[PATCH] nvme: free prp_pool on nvme_init() failure paths

[Neil Armstrong]

On 5/24/26 16:57, Prashant Kamble wrote:
> nvme_init() allocates prp_pool after configuring the admin queue,
> but some later error paths return without freeing it.
> 
> Free prp_pool before freeing the queue array in the failure paths
> after nvme_setup_io_queues() and namespace ID buffer allocation.
> 
> This fixes a memory leak during NVMe initialization failures.
> 
> Signed-off-by: Prashant Kamble <prashant.kamble223 at gmail.com>
> ---
>   drivers/nvme/nvme.c | 8 +++++---
>   1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/nvme/nvme.c b/drivers/nvme/nvme.c
> index da7dad9f52b..9df7824b1c5 100644
> --- a/drivers/nvme/nvme.c
> +++ b/drivers/nvme/nvme.c
> @@ -886,14 +886,14 @@ int nvme_init(struct udevice *udev)
>   	if (!ndev->prp_pool) {
>   		ret = -ENOMEM;
>   		printf("Error: %s: Out of memory!\n", udev->name);
> -		goto free_nvme;
> +		goto free_queue;
>   	}
>   	ndev->prp_entry_num = MAX_PRP_POOL >> 3;
>   
>   	ret = nvme_setup_io_queues(ndev);
>   	if (ret) {
>   		log_debug("Unable to setup I/O queues(err=%dE)\n", ret);
> -		goto free_queue;
> +		goto free_prp_pool;
>   	}
>   
>   	nvme_get_info_from_identify(ndev);
> @@ -903,7 +903,7 @@ int nvme_init(struct udevice *udev)
>   	id = memalign(ndev->page_size, sizeof(struct nvme_id_ns));
>   	if (!id) {
>   		ret = -ENOMEM;
> -		goto free_queue;
> +		goto free_prp_pool;
>   	}
>   
>   	for (int i = 1; i <= ndev->nn; i++) {
> @@ -948,6 +948,8 @@ int nvme_init(struct udevice *udev)
>   
>   free_id:
>   	free(id);
> +free_prp_pool:
> +	free((void *)ndev->prp_pool);
>   free_queue:
>   	free((void *)ndev->queues);
>   free_nvme:

Reviewed-by: Neil Armstrong <neil.armstrong at linaro.org>

Thanks,
Neil