nvme: free prp_pool on nvme_init() failure paths

nvme_init() allocates prp_pool after configuring the admin queue,
but some later error paths return without freeing it.

Free prp_pool before freeing the queue array in the failure paths
after nvme_setup_io_queues() and namespace ID buffer allocation.

This fixes a memory leak during NVMe initialization failures.

Signed-off-by: Prashant Kamble <prashant.kamble223@gmail.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260524145721.9206-1-prashant.kamble223@gmail.com
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>

diff --git a/drivers/nvme/nvme.c b/drivers/nvme/nvme.c
index 30eba0bf7c735536859a5b478bc0a0bad23a8ea0..980ca91963252b2e3abab123f1c49efa06e4a686 100644 (file)
--- a/drivers/nvme/nvme.c
+++ b/drivers/nvme/nvme.c
@@ -880,14 +880,14 @@ int nvme_init(struct udevice *udev)
        if (!ndev->prp_pool) {
                ret = -ENOMEM;
                printf("Error: %s: Out of memory!\n", udev->name);
-               goto free_nvme;
+               goto free_queue;
        }
        ndev->prp_entry_num = MAX_PRP_POOL >> 3;
 
        ret = nvme_setup_io_queues(ndev);
        if (ret) {
                log_debug("Unable to setup I/O queues(err=%dE)\n", ret);
-               goto free_queue;
+               goto free_prp_pool;
        }
 
        nvme_get_info_from_identify(ndev);
@@ -897,7 +897,7 @@ int nvme_init(struct udevice *udev)
        id = memalign(ndev->page_size, sizeof(struct nvme_id_ns));
        if (!id) {
                ret = -ENOMEM;
-               goto free_queue;
+               goto free_prp_pool;
        }
 
        for (int i = 1; i <= ndev->nn; i++) {
@@ -942,6 +942,8 @@ int nvme_init(struct udevice *udev)
 
 free_id:
        free(id);
+free_prp_pool:
+       free((void *)ndev->prp_pool);
 free_queue:
        free((void *)ndev->queues);
 free_nvme: