In ida_alloc_range(), if the XArray operation encounters an error (e.g., -ENOSPC) during allocation, the function exits early via return xas_error(&xas). However, if an intermediate `alloc` bitmap was allocated via kzalloc() earlier in the function but the XArray insertion failed, the error path returns without freeing `alloc`. Reorder the error handling to ensure `alloc` is properly freed when an XArray error occurs. Also add a test case in idr-test to ensure coverage of the error path in the IDA allocation logic. Signed-off-by: Josh Law --- tools/testing/radix-tree/idr-test.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/tools/testing/radix-tree/idr-test.c b/tools/testing/radix-tree/idr-test.c index bf6a0da6a50a..f4c3a5ed4ce1 100644 --- a/tools/testing/radix-tree/idr-test.c +++ b/tools/testing/radix-tree/idr-test.c @@ -543,6 +543,7 @@ void user_ida_checks(void) ida_check_nomem(); ida_check_conv_user(); ida_check_random(); + ida_check_leak(); ida_alloc_free_test(); radix_tree_cpu_dead(1); @@ -556,6 +557,22 @@ static void *ida_random_fn(void *arg) return NULL; } +/* + * Check that an XArray error does not leak the allocated bitmap. + */ +static void ida_check_leak(void) +{ + DEFINE_IDA(ida); + + /* Allocate up to 128 to ensure we need a new bitmap */ + ida_alloc_range(&ida, 0, 128, GFP_KERNEL); + + /* Force a failure by providing an invalid range */ + ida_alloc_range(&ida, 0, 0, GFP_KERNEL); + + ida_destroy(&ida); +} + static void *ida_leak_fn(void *arg) { struct ida *ida = arg; -- 2.34.1