linux-kernel - [PATCH] pps: Fix IDR memory leak in module exit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250704125536.1091187-1-anders.roxell@linaro.org>
Date: Fri,  4 Jul 2025 14:55:36 +0200
From: Anders Roxell <anders.roxell@...aro.org>
To: lduncan@...e.com,
	cleech@...hat.com,
	michael.christie@...cle.com,
	James.Bottomley@...senPartnership.com,
	martin.petersen@...cle.com
Cc: open-iscsi@...glegroups.com,
	linux-scsi@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	arnd@...db.de,
	Anders Roxell <anders.roxell@...aro.org>
Subject: [PATCH] pps: Fix IDR memory leak in module exit

Add missing idr_destroy() call in pps_exit() to properly free the pps_idr
radix tree nodes. Without this, module load/unload cycles leak 576-byte
radix tree node allocations, detectable by kmemleak as:

unreferenced object (size 576):
  backtrace:
    [<ffffffff81234567>] radix_tree_node_alloc+0xa0/0xf0
    [<ffffffff81234568>] idr_get_free+0x128/0x280

The pps_idr is initialized via DEFINE_IDR() at line 32 and used throughout
the PPS subsystem for device ID management. The fix follows the documented
pattern in lib/idr.c and matches the cleanup approach used by other drivers
such as drivers/uio/uio.c.

This leak was discovered through comprehensive module testing with cumulative
kmemleak detection across 10 load/unload iterations per module.

Fixes: eae9d2ba0cfc ("LinuxPPS: core support")
Signed-off-by: Anders Roxell <anders.roxell@...aro.org>
---
 drivers/scsi/scsi_transport_iscsi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index c75a806496d6..adbedb58930d 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -5024,6 +5024,7 @@ static void __exit iscsi_transport_exit(void)
 	class_unregister(&iscsi_endpoint_class);
 	class_unregister(&iscsi_iface_class);
 	class_unregister(&iscsi_transport_class);
+	idr_destroy(&iscsi_ep_idr);
 }

 module_init(iscsi_transport_init);
-- 
2.47.2