nvdimm/btt: Free arenas on btt_init() error paths

The arenas allocated by discover_arenas() or create_arenas() are not
freed on some error paths in btt_init(). This leaks memory when BTT
initialization fails.

Call free_arenas() from the affected error paths to release the
allocations.

[ as: commit message and log edits ]

Fixes: 5212e11fde4d ("nd_btt: atomic sector updates")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Link: https://patch.msgid.link/20260519-nvdimmleaks-v1-2-592300fb7a43@cse.iitm.ac.in
Signed-off-by: Alison Schofield <alison.schofield@intel.com>

diff --git a/drivers/nvdimm/btt.c b/drivers/nvdimm/btt.c
index e0b6a85a8124001cc7638ccb7cd080712ee7326b..7e1112960d7f8852aeb10e7215f966d1a0d78379 100644 (file)
--- a/drivers/nvdimm/btt.c
+++ b/drivers/nvdimm/btt.c
@@ -1592,7 +1592,7 @@ static struct btt *btt_init(struct nd_btt *nd_btt, unsigned long long rawsize,
        if (btt->init_state != INIT_READY && nd_region->ro) {
                dev_warn(dev, "%s is read-only, unable to init btt metadata\n",
                                dev_name(&nd_region->dev));
-               return NULL;
+               goto err;
        } else if (btt->init_state != INIT_READY) {
                btt->num_arenas = (rawsize / ARENA_MAX_SIZE) +
                        ((rawsize % ARENA_MAX_SIZE) ? 1 : 0);
@@ -1602,25 +1602,28 @@ static struct btt *btt_init(struct nd_btt *nd_btt, unsigned long long rawsize,
                ret = create_arenas(btt);
                if (ret) {
                        dev_info(dev, "init: create_arenas: %d\n", ret);
-                       return NULL;
+                       goto err;
                }
 
                ret = btt_meta_init(btt);
                if (ret) {
                        dev_err(dev, "init: error in meta_init: %d\n", ret);
-                       return NULL;
+                       goto err;
                }
        }
 
        ret = btt_blk_init(btt);
        if (ret) {
                dev_err(dev, "init: error in blk_init: %d\n", ret);
-               return NULL;
+               goto err;
        }
 
        btt_debugfs_init(btt);
 
        return btt;
+err:
+       free_arenas(btt);
+       return NULL;
 }
 
 /**