nvme_init() allocates prp_pool after configuring the admin queue, but some later error paths return without freeing it.
Free prp_pool before freeing the queue array in the failure paths after nvme_setup_io_queues() and namespace ID buffer allocation. This fixes a memory leak during NVMe initialization failures. Signed-off-by: Prashant Kamble <[email protected]> --- drivers/nvme/nvme.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/nvme/nvme.c b/drivers/nvme/nvme.c index da7dad9f52b..9df7824b1c5 100644 --- a/drivers/nvme/nvme.c +++ b/drivers/nvme/nvme.c @@ -886,14 +886,14 @@ int nvme_init(struct udevice *udev) if (!ndev->prp_pool) { ret = -ENOMEM; printf("Error: %s: Out of memory!\n", udev->name); - goto free_nvme; + goto free_queue; } ndev->prp_entry_num = MAX_PRP_POOL >> 3; ret = nvme_setup_io_queues(ndev); if (ret) { log_debug("Unable to setup I/O queues(err=%dE)\n", ret); - goto free_queue; + goto free_prp_pool; } nvme_get_info_from_identify(ndev); @@ -903,7 +903,7 @@ int nvme_init(struct udevice *udev) id = memalign(ndev->page_size, sizeof(struct nvme_id_ns)); if (!id) { ret = -ENOMEM; - goto free_queue; + goto free_prp_pool; } for (int i = 1; i <= ndev->nn; i++) { @@ -948,6 +948,8 @@ int nvme_init(struct udevice *udev) free_id: free(id); +free_prp_pool: + free((void *)ndev->prp_pool); free_queue: free((void *)ndev->queues); free_nvme: -- 2.43.0
