[PATCH v3 2/2] lib/idr: fix memory leak in ida_alloc_range() error path

Josh Law
2026-03-12T18:19:59Z

In ida_alloc_range(), if the XArray operation encounters an error
(e.g., -ENOSPC) during allocation, the function exits early via
return xas_error(&xas). However, if an intermediate `alloc` bitmap
was allocated via kzalloc() earlier in the function but the XArray
insertion failed, the error path returns without freeing `alloc`.

Reorder the error handling to ensure `alloc` is properly freed when
an XArray error occurs.

Also add a test case in idr-test to ensure coverage of the error
path in the IDA allocation logic.

Signed-off-by: Josh Law <objecting@objecting.org>
---
tools/testing/radix-tree/idr-test.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)

diff --git a/tools/testing/radix-tree/idr-test.c b/tools/testing/radix-tree/idr-test.c
index bf6a0da6a50a..f4c3a5ed4ce1 100644
--- a/tools/testing/radix-tree/idr-test.c
+++ b/tools/testing/radix-tree/idr-test.c
@@ -543,6 +543,7 @@ void user_ida_checks(void)
ida_check_nomem();
ida_check_conv_user();
ida_check_random();
+ ida_check_leak();
ida_alloc_free_test();

radix_tree_cpu_dead(1);
@@ -556,6 +557,22 @@ static void *ida_random_fn(void *arg)
return NULL;
}

+/*
+ * Check that an XArray error does not leak the allocated bitmap.
+ */
+static void ida_check_leak(void)
+{
+ DEFINE_IDA(ida);
+
+ /* Allocate up to 128 to ensure we need a new bitmap */
+ ida_alloc_range(&ida, 0, 128, GFP_KERNEL);
+
+ /* Force a failure by providing an invalid range */
+ ida_alloc_range(&ida, 0, 0, GFP_KERNEL);
+
+ ida_destroy(&ida);
+}
+
static void *ida_leak_fn(void *arg)
{
struct ida *ida = arg;
--
2.34.1