From: Prashant Kamble <prashant.kamble223@gmail.com>
Date: Sun, 24 May 2026 14:57:16 +0000 (+0530)
Subject: nvme: free prp_pool on nvme_init() failure paths
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=11e056e3207d3b4eabebb1a7630b0195ee9eb5ee;p=thirdparty%2Fu-boot.git

nvme: free prp_pool on nvme_init() failure paths

nvme_init() allocates prp_pool after configuring the admin queue,
but some later error paths return without freeing it.

Free prp_pool before freeing the queue array in the failure paths
after nvme_setup_io_queues() and namespace ID buffer allocation.

This fixes a memory leak during NVMe initialization failures.

Signed-off-by: Prashant Kamble <prashant.kamble223@gmail.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260524145721.9206-1-prashant.kamble223@gmail.com
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
---

diff --git a/drivers/nvme/nvme.c b/drivers/nvme/nvme.c
index 30eba0bf7c7..980ca919632 100644
--- a/drivers/nvme/nvme.c
+++ b/drivers/nvme/nvme.c
@@ -880,14 +880,14 @@ int nvme_init(struct udevice *udev)
 	if (!ndev->prp_pool) {
 		ret = -ENOMEM;
 		printf("Error: %s: Out of memory!\n", udev->name);
-		goto free_nvme;
+		goto free_queue;
 	}
 	ndev->prp_entry_num = MAX_PRP_POOL >> 3;
 
 	ret = nvme_setup_io_queues(ndev);
 	if (ret) {
 		log_debug("Unable to setup I/O queues(err=%dE)\n", ret);
-		goto free_queue;
+		goto free_prp_pool;
 	}
 
 	nvme_get_info_from_identify(ndev);
@@ -897,7 +897,7 @@ int nvme_init(struct udevice *udev)
 	id = memalign(ndev->page_size, sizeof(struct nvme_id_ns));
 	if (!id) {
 		ret = -ENOMEM;
-		goto free_queue;
+		goto free_prp_pool;
 	}
 
 	for (int i = 1; i <= ndev->nn; i++) {
@@ -942,6 +942,8 @@ int nvme_init(struct udevice *udev)
 
 free_id:
 	free(id);
+free_prp_pool:
+	free((void *)ndev->prp_pool);
 free_queue:
 	free((void *)ndev->queues);
 free_nvme: