From 435e37b3141afbccd6d1907c58ae32f3d10f5fa2 Mon Sep 17 00:00:00 2001 From: Tulio A M Mendes Date: Wed, 10 Jun 2026 22:45:05 -0300 Subject: [PATCH] virtio-blk: fix memory leak on vring page allocation failure Bug: If pmm_alloc_page() failed in the middle of the vring page allocation loop, previously allocated physical pages and the VA range were not freed, causing a memory leak. Fix: Add rollback loop on allocation failure to: 1. Unmap and free previously allocated physical pages 2. Free the VA range via kva_free_pages() This is a pre-existing bug that was exposed during H6 regression analysis, not a regression introduced by H6. Test: make test-battery PASS (157/157), make analyzer PASS --- src/drivers/virtio_blk.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/drivers/virtio_blk.c b/src/drivers/virtio_blk.c index 52bf1aaf..9c78578f 100644 --- a/src/drivers/virtio_blk.c +++ b/src/drivers/virtio_blk.c @@ -184,6 +184,14 @@ int virtio_blk_init(void) { if (!frame) { kprintf("[VIRTIO-BLK] Failed to alloc vring page.\n"); outb(vblk_iobase + VIRTIO_PCI_STATUS, VIRTIO_STATUS_FAILED); + /* Rollback: free previously allocated pages and VA range */ + for (uint32_t j = 0; j < i; j++) { + uintptr_t page_va = vring_va + j * 4096U; + uintptr_t p = vmm_virt_to_phys(page_va); + vmm_unmap_page(page_va); + if (p) pmm_free_page((void*)p); + } + kva_free_pages(vring_va, pages); return -1; } vmm_map_page((uint64_t)(uintptr_t)frame, -- 2.43.0