From 11e056e3207d3b4eabebb1a7630b0195ee9eb5ee Mon Sep 17 00:00:00 2001 From: Prashant Kamble Date: Sun, 24 May 2026 20:27:16 +0530 Subject: nvme: free prp_pool on nvme_init() failure paths nvme_init() allocates prp_pool after configuring the admin queue, but some later error paths return without freeing it. Free prp_pool before freeing the queue array in the failure paths after nvme_setup_io_queues() and namespace ID buffer allocation. This fixes a memory leak during NVMe initialization failures. Signed-off-by: Prashant Kamble Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20260524145721.9206-1-prashant.kamble223@gmail.com Signed-off-by: Neil Armstrong --- drivers/nvme/nvme.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/nvme/nvme.c b/drivers/nvme/nvme.c index 30eba0bf7c7..980ca919632 100644 --- a/drivers/nvme/nvme.c +++ b/drivers/nvme/nvme.c @@ -880,14 +880,14 @@ int nvme_init(struct udevice *udev) if (!ndev->prp_pool) { ret = -ENOMEM; printf("Error: %s: Out of memory!\n", udev->name); - goto free_nvme; + goto free_queue; } ndev->prp_entry_num = MAX_PRP_POOL >> 3; ret = nvme_setup_io_queues(ndev); if (ret) { log_debug("Unable to setup I/O queues(err=%dE)\n", ret); - goto free_queue; + goto free_prp_pool; } nvme_get_info_from_identify(ndev); @@ -897,7 +897,7 @@ int nvme_init(struct udevice *udev) id = memalign(ndev->page_size, sizeof(struct nvme_id_ns)); if (!id) { ret = -ENOMEM; - goto free_queue; + goto free_prp_pool; } for (int i = 1; i <= ndev->nn; i++) { @@ -942,6 +942,8 @@ int nvme_init(struct udevice *udev) free_id: free(id); +free_prp_pool: + free((void *)ndev->prp_pool); free_queue: free((void *)ndev->queues); free_nvme: -- cgit v1.3.1