[PATCH] iommu/vt-d: Fix iopf_refcount leak in nested RID replacement

[PATCH] iommu/vt-d: Fix iopf_refcount leak in nested RID replacement

[Jiale Yao]

intel_nested_attach_dev() enables IOPF for the new nested domain without
releasing the reference held by the old domain.  Replacing a domain with
an IOPF-enabled domain therefore leaves an extra reference in
info->iopf_refcount.

Commit 236dd58fabd2 ("iommu/vt-d: Fix iopf_refcount leak on RID
domain replacement") fixed the same IOPF reference leak in the regular
RID attach paths.  The nested RID attach path has the same old-domain
handling bug.

Use iopf_for_domain_replace() for the attach and restore the old domain
reference if nested PASID setup fails, matching the existing PASID path.

Signed-off-by: Jiale Yao <yaojiale02@163.com>
Link: https://lore.kernel.org/all/20260731054329.2948252-4-baolu.lu@linux.intel.com/
---
 drivers/iommu/intel/nested.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/iommu/intel/nested.c b/drivers/iommu/intel/nested.c
index 2b979bec56ce..dbcec6093d50 100644
--- a/drivers/iommu/intel/nested.c
+++ b/drivers/iommu/intel/nested.c
@@ -50,7 +50,7 @@ static int intel_nested_attach_dev(struct iommu_domain *domain,
 	if (ret)
 		goto detach_iommu;
 
-	ret = iopf_for_domain_set(domain, dev);
+	ret = iopf_for_domain_replace(domain, old, dev);
 	if (ret)
 		goto unassign_tag;
 
@@ -67,7 +67,7 @@ static int intel_nested_attach_dev(struct iommu_domain *domain,
 
 	return 0;
 disable_iopf:
-	iopf_for_domain_remove(domain, dev);
+	iopf_for_domain_replace(old, domain, dev);
 unassign_tag:
 	cache_tag_unassign_domain(dmar_domain, dev, IOMMU_NO_PASID);
 detach_iommu:
-- 
2.34.1

Re: [PATCH] iommu/vt-d: Fix iopf_refcount leak in nested RID replacement

[Baolu Lu]

On 9/24/2026 7:50 PM, Jiale Yao wrote:
> intel_nested_attach_dev() enables IOPF for the new nested domain without
> releasing the reference held by the old domain.  Replacing a domain with
> an IOPF-enabled domain therefore leaves an extra reference in
> info->iopf_refcount.
> 
> Commit 236dd58fabd2 ("iommu/vt-d: Fix iopf_refcount leak on RID
> domain replacement") fixed the same IOPF reference leak in the regular
> RID attach paths.  The nested RID attach path has the same old-domain
> handling bug.
> 
> Use iopf_for_domain_replace() for the attach and restore the old domain
> reference if nested PASID setup fails, matching the existing PASID path.
> 
> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> Link: https://lore.kernel.org/all/20260731054329.2948252-4-baolu.lu@linux.intel.com/
> ---
>   drivers/iommu/intel/nested.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/iommu/intel/nested.c b/drivers/iommu/intel/nested.c
> index 2b979bec56ce..dbcec6093d50 100644
> --- a/drivers/iommu/intel/nested.c
> +++ b/drivers/iommu/intel/nested.c
> @@ -50,7 +50,7 @@ static int intel_nested_attach_dev(struct iommu_domain *domain,
>   	if (ret)
>   		goto detach_iommu;
>   
> -	ret = iopf_for_domain_set(domain, dev);
> +	ret = iopf_for_domain_replace(domain, old, dev);
>   	if (ret)
>   		goto unassign_tag;
>   
> @@ -67,7 +67,7 @@ static int intel_nested_attach_dev(struct iommu_domain *domain,
>   
>   	return 0;
>   disable_iopf:
> -	iopf_for_domain_remove(domain, dev);
> +	iopf_for_domain_replace(old, domain, dev);
>   unassign_tag:
>   	cache_tag_unassign_domain(dmar_domain, dev, IOMMU_NO_PASID);
>   detach_iommu:

Thanks for the patch, but we already have a fix in the iommu tree:

83871c3ae10e ("iommu/vt-d: Fix iopf refcount leak in nested attach")

Thanks,
baolu