On 5/24/26 16:57, Prashant Kamble wrote:
nvme_init() allocates prp_pool after configuring the admin queue,
but some later error paths return without freeing it.
Free prp_pool before freeing the queue array in the failure paths
after nvme_setup_io_queues() and namespace ID buffer allocation.
This fixes a memory leak during NVMe initialization failures.
Signed-off-by: Prashant Kamble <[email protected]>
---
drivers/nvme/nvme.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/nvme/nvme.c b/drivers/nvme/nvme.c
index da7dad9f52b..9df7824b1c5 100644
--- a/drivers/nvme/nvme.c
+++ b/drivers/nvme/nvme.c
@@ -886,14 +886,14 @@ int nvme_init(struct udevice *udev)
if (!ndev->prp_pool) {
ret = -ENOMEM;
printf("Error: %s: Out of memory!\n", udev->name);
- goto free_nvme;
+ goto free_queue;
}
ndev->prp_entry_num = MAX_PRP_POOL >> 3;
ret = nvme_setup_io_queues(ndev);
if (ret) {
log_debug("Unable to setup I/O queues(err=%dE)\n", ret);
- goto free_queue;
+ goto free_prp_pool;
}
nvme_get_info_from_identify(ndev);
@@ -903,7 +903,7 @@ int nvme_init(struct udevice *udev)
id = memalign(ndev->page_size, sizeof(struct nvme_id_ns));
if (!id) {
ret = -ENOMEM;
- goto free_queue;
+ goto free_prp_pool;
}
for (int i = 1; i <= ndev->nn; i++) {
@@ -948,6 +948,8 @@ int nvme_init(struct udevice *udev)
free_id:
free(id);
+free_prp_pool:
+ free((void *)ndev->prp_pool);
free_queue:
free((void *)ndev->queues);
free_nvme:
Reviewed-by: Neil Armstrong <[email protected]>
Thanks,
Neil
