[PATCH] nvme: free prp_pool on nvme_init() failure paths

Prashant Kamble prashant.kamble223 at gmail.com
Sun May 24 16:57:16 CEST 2026


nvme_init() allocates prp_pool after configuring the admin queue,
but some later error paths return without freeing it.

Free prp_pool before freeing the queue array in the failure paths
after nvme_setup_io_queues() and namespace ID buffer allocation.

This fixes a memory leak during NVMe initialization failures.

Signed-off-by: Prashant Kamble <prashant.kamble223 at gmail.com>
---
 drivers/nvme/nvme.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/nvme/nvme.c b/drivers/nvme/nvme.c
index da7dad9f52b..9df7824b1c5 100644
--- a/drivers/nvme/nvme.c
+++ b/drivers/nvme/nvme.c
@@ -886,14 +886,14 @@ int nvme_init(struct udevice *udev)
 	if (!ndev->prp_pool) {
 		ret = -ENOMEM;
 		printf("Error: %s: Out of memory!\n", udev->name);
-		goto free_nvme;
+		goto free_queue;
 	}
 	ndev->prp_entry_num = MAX_PRP_POOL >> 3;
 
 	ret = nvme_setup_io_queues(ndev);
 	if (ret) {
 		log_debug("Unable to setup I/O queues(err=%dE)\n", ret);
-		goto free_queue;
+		goto free_prp_pool;
 	}
 
 	nvme_get_info_from_identify(ndev);
@@ -903,7 +903,7 @@ int nvme_init(struct udevice *udev)
 	id = memalign(ndev->page_size, sizeof(struct nvme_id_ns));
 	if (!id) {
 		ret = -ENOMEM;
-		goto free_queue;
+		goto free_prp_pool;
 	}
 
 	for (int i = 1; i <= ndev->nn; i++) {
@@ -948,6 +948,8 @@ int nvme_init(struct udevice *udev)
 
 free_id:
 	free(id);
+free_prp_pool:
+	free((void *)ndev->prp_pool);
 free_queue:
 	free((void *)ndev->queues);
 free_nvme:
-- 
2.43.0



More information about the U-Boot mailing list