[PATCH] RDMA/uverbs: Fix radix tree node leak in uapi_add_elm()

[PATCH] RDMA/uverbs: Fix radix tree node leak in uapi_add_elm()

[Deepanshu Kartikey]

syzbot reported a memory leak of radix_tree_node objects allocated
while registering a siw device:

  unreferenced object 0xffff88810d78f488 (size 576):
    radix_tree_node_alloc+0x81/0x1a0 lib/radix-tree.c:276
    radix_tree_insert+0x140/0x390 lib/radix-tree.c:712
    uapi_add_elm+0x61/0x140 drivers/infiniband/core/uverbs_uapi.c:41
    uverbs_alloc_api+0x85/0xc50 drivers/infiniband/core/uverbs_uapi.c:659
    ib_uverbs_add_one+0x1b1/0x350 drivers/infiniband/core/uverbs_main.c:1196
    ib_register_device+0x4fe/0x7f0 drivers/infiniband/core/device.c:1503
    siw_newlink+0x36a/0x3f0 drivers/infiniband/sw/siw/siw_main.c:433

radix_tree_insert() can fail with -ENOMEM after __radix_tree_create()
has already linked intermediate nodes into the tree, leaving them with
no entries. uapi_add_elm() frees the element on failure, but nothing
frees these empty nodes: uverbs_destroy_api() only removes populated
slots, and radix tree nodes are freed only as a side effect of
deleting an entry. The nodes are therefore leaked when the uapi is
destroyed.

On -ENOMEM, populate the same key with a dummy entry and delete it
again so that radix_tree_delete() reclaims the empty node chain.

Reported-by: syzbot+d60be66dd00b4490fa96@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d60be66dd00b4490fa96
Tested-by: syzbot+d60be66dd00b4490fa96@syzkaller.appspotmail.com
Fixes: 9ed3e5f44772 ("IB/uverbs: Build the specs into a radix tree at runtime")
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/infiniband/core/uverbs_uapi.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/infiniband/core/uverbs_uapi.c b/drivers/infiniband/core/uverbs_uapi.c
index b67db3790f03..6b2eb392b076 100644
--- a/drivers/infiniband/core/uverbs_uapi.c
+++ b/drivers/infiniband/core/uverbs_uapi.c
@@ -15,6 +15,7 @@ static int ib_uverbs_notsupp(struct uverbs_attr_bundle *attrs)
 
 static void *uapi_add_elm(struct uverbs_api *uapi, u32 key, size_t alloc_size)
 {
+	static void *dummy;
 	void *elm;
 	int rc;
 
@@ -27,6 +28,16 @@ static void *uapi_add_elm(struct uverbs_api *uapi, u32 key, size_t alloc_size)
 	rc = radix_tree_insert(&uapi->radix, key, elm);
 	if (rc) {
 		kfree(elm);
+
+		/*
+		 * A failed radix_tree_insert() can leave empty intermediate
+		 * nodes linked in the tree. They are only freed when an entry
+		 * under them is deleted, so populate and delete the slot to
+		 * reclaim them.
+		 */
+		if (rc == -ENOMEM &&
+		    !radix_tree_insert(&uapi->radix, key, &dummy))
+		    radix_tree_delete(&uapi->radix, key);
 		return ERR_PTR(rc);
 	}
 
-- 
2.43.0

Re: [PATCH] RDMA/uverbs: Fix radix tree node leak in uapi_add_elm()

[Jason Gunthorpe]

On Fri, Nov 06, 2026 at 07:09:08AM +0530, Deepanshu Kartikey wrote:
> syzbot reported a memory leak of radix_tree_node objects allocated
> while registering a siw device:
> 
>   unreferenced object 0xffff88810d78f488 (size 576):
>     radix_tree_node_alloc+0x81/0x1a0 lib/radix-tree.c:276
>     radix_tree_insert+0x140/0x390 lib/radix-tree.c:712
>     uapi_add_elm+0x61/0x140 drivers/infiniband/core/uverbs_uapi.c:41
>     uverbs_alloc_api+0x85/0xc50 drivers/infiniband/core/uverbs_uapi.c:659
>     ib_uverbs_add_one+0x1b1/0x350 drivers/infiniband/core/uverbs_main.c:1196
>     ib_register_device+0x4fe/0x7f0 drivers/infiniband/core/device.c:1503
>     siw_newlink+0x36a/0x3f0 drivers/infiniband/sw/siw/siw_main.c:433
> 
> radix_tree_insert() can fail with -ENOMEM after __radix_tree_create()
> has already linked intermediate nodes into the tree, leaving them with
> no entries. uapi_add_elm() frees the element on failure, but nothing
> frees these empty nodes: uverbs_destroy_api() only removes populated
> slots, and radix tree nodes are freed only as a side effect of
> deleting an entry. The nodes are therefore leaked when the uapi is
> destroyed.
> 
> On -ENOMEM, populate the same key with a dummy entry and delete it
> again so that radix_tree_delete() reclaims the empty node chain.

That seems like an absurd thing to do, can we fix
uverbs_destroy_api() to free the entire tree rather just populated
slots somehow?

Jason

Re: [PATCH] RDMA/uverbs: Fix radix tree node leak in uapi_add_elm()

[Deepanshu Kartikey]

On Tue, Nov 10, 2026 at 6:15 AM Jason Gunthorpe <jgg@ziepe.ca> wrote:
>
> On Fri, Nov 06, 2026 at 07:09:08AM +0530, Deepanshu Kartikey wrote:
> > syzbot reported a memory leak of radix_tree_node objects allocated
> > while registering a siw device:
> >
> >   unreferenced object 0xffff88810d78f488 (size 576):
> >     radix_tree_node_alloc+0x81/0x1a0 lib/radix-tree.c:276
> >     radix_tree_insert+0x140/0x390 lib/radix-tree.c:712
> >     uapi_add_elm+0x61/0x140 drivers/infiniband/core/uverbs_uapi.c:41
> >     uverbs_alloc_api+0x85/0xc50 drivers/infiniband/core/uverbs_uapi.c:659
> >     ib_uverbs_add_one+0x1b1/0x350 drivers/infiniband/core/uverbs_main.c:1196
> >     ib_register_device+0x4fe/0x7f0 drivers/infiniband/core/device.c:1503
> >     siw_newlink+0x36a/0x3f0 drivers/infiniband/sw/siw/siw_main.c:433
> >
> > radix_tree_insert() can fail with -ENOMEM after __radix_tree_create()
> > has already linked intermediate nodes into the tree, leaving them with
> > no entries. uapi_add_elm() frees the element on failure, but nothing
> > frees these empty nodes: uverbs_destroy_api() only removes populated
> > slots, and radix tree nodes are freed only as a side effect of
> > deleting an entry. The nodes are therefore leaked when the uapi is
> > destroyed.
> >
> > On -ENOMEM, populate the same key with a dummy entry and delete it
> > again so that radix_tree_delete() reclaims the empty node chain.
>
> That seems like an absurd thing to do, can we fix
> uverbs_destroy_api() to free the entire tree rather just populated
> slots somehow?
>
> Jason

Hi Jason,

Agreed. Since radix_tree_root is now an alias for struct xarray,
uverbs_destroy_api() can call xa_destroy() after removing the
populated slots, which frees all remaining nodes. I'll send a v2
with that and drop the dummy insert/delete.

Thanks,
Deepanshu

Re: [PATCH] RDMA/uverbs: Fix radix tree node leak in uapi_add_elm()

[Leon Romanovsky]

On Sun, Nov 15, 2026 at 08:00:25PM +0530, Deepanshu Kartikey wrote:
> On Tue, Nov 10, 2026 at 6:15 AM Jason Gunthorpe <jgg@ziepe.ca> wrote:
> >
> > On Fri, Nov 06, 2026 at 07:09:08AM +0530, Deepanshu Kartikey wrote:
> > > syzbot reported a memory leak of radix_tree_node objects allocated
> > > while registering a siw device:
> > >
> > >   unreferenced object 0xffff88810d78f488 (size 576):
> > >     radix_tree_node_alloc+0x81/0x1a0 lib/radix-tree.c:276
> > >     radix_tree_insert+0x140/0x390 lib/radix-tree.c:712
> > >     uapi_add_elm+0x61/0x140 drivers/infiniband/core/uverbs_uapi.c:41
> > >     uverbs_alloc_api+0x85/0xc50 drivers/infiniband/core/uverbs_uapi.c:659
> > >     ib_uverbs_add_one+0x1b1/0x350 drivers/infiniband/core/uverbs_main.c:1196
> > >     ib_register_device+0x4fe/0x7f0 drivers/infiniband/core/device.c:1503
> > >     siw_newlink+0x36a/0x3f0 drivers/infiniband/sw/siw/siw_main.c:433
> > >
> > > radix_tree_insert() can fail with -ENOMEM after __radix_tree_create()
> > > has already linked intermediate nodes into the tree, leaving them with
> > > no entries. uapi_add_elm() frees the element on failure, but nothing
> > > frees these empty nodes: uverbs_destroy_api() only removes populated
> > > slots, and radix tree nodes are freed only as a side effect of
> > > deleting an entry. The nodes are therefore leaked when the uapi is
> > > destroyed.
> > >
> > > On -ENOMEM, populate the same key with a dummy entry and delete it
> > > again so that radix_tree_delete() reclaims the empty node chain.
> >
> > That seems like an absurd thing to do, can we fix
> > uverbs_destroy_api() to free the entire tree rather just populated
> > slots somehow?
> >
> > Jason
> 
> Hi Jason,
> 
> Agreed. Since radix_tree_root is now an alias for struct xarray,
> uverbs_destroy_api() can call xa_destroy() after removing the
> populated slots, which frees all remaining nodes. I'll send a v2
> with that and drop the dummy insert/delete.

Can you please elaborate more about this sentence "which frees all
remaining nodes"?

Thanks

> 
> Thanks,
> Deepanshu