virtio-blk: fix memory leak on vring page allocation failure

Bug: If pmm_alloc_page() failed in the middle of the vring page
allocation loop, previously allocated physical pages and the VA range
were not freed, causing a memory leak.

Fix: Add rollback loop on allocation failure to:
1. Unmap and free previously allocated physical pages
2. Free the VA range via kva_free_pages()

This is a pre-existing bug that was exposed during H6 regression
analysis, not a regression introduced by H6.

Test: make test-battery PASS (157/157), make analyzer PASS

diff --git a/src/drivers/virtio_blk.c b/src/drivers/virtio_blk.c
index 52bf1aaff452213b19b8f2ed852f7d64e8df1895..9c78578f9eba37e3d2fb3956bf050f5ce01bfc1f 100644 (file)
--- a/src/drivers/virtio_blk.c
+++ b/src/drivers/virtio_blk.c
@@ -184,6 +184,14 @@ int virtio_blk_init(void) {
         if (!frame) {
             kprintf("[VIRTIO-BLK] Failed to alloc vring page.\n");
             outb(vblk_iobase + VIRTIO_PCI_STATUS, VIRTIO_STATUS_FAILED);
+            /* Rollback: free previously allocated pages and VA range */
+            for (uint32_t j = 0; j < i; j++) {
+                uintptr_t page_va = vring_va + j * 4096U;
+                uintptr_t p = vmm_virt_to_phys(page_va);
+                vmm_unmap_page(page_va);
+                if (p) pmm_free_page((void*)p);
+            }
+            kva_free_pages(vring_va, pages);
             return -1;
         }
         vmm_map_page((uint64_t)(uintptr_t)frame,