Re: [PATCH] iommu/vt-d: Fix iopf_refcount leak in nested RID replacement

[Baolu Lu <baolu.lu@linux.intel.com>]

On 9/24/2026 7:50 PM, Jiale Yao wrote:
> intel_nested_attach_dev() enables IOPF for the new nested domain without
> releasing the reference held by the old domain.  Replacing a domain with
> an IOPF-enabled domain therefore leaves an extra reference in
> info->iopf_refcount.
> 
> Commit 236dd58fabd2 ("iommu/vt-d: Fix iopf_refcount leak on RID
> domain replacement") fixed the same IOPF reference leak in the regular
> RID attach paths.  The nested RID attach path has the same old-domain
> handling bug.
> 
> Use iopf_for_domain_replace() for the attach and restore the old domain
> reference if nested PASID setup fails, matching the existing PASID path.
> 
> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> Link: https://lore.kernel.org/all/20260731054329.2948252-4-baolu.lu@linux.intel.com/
> ---
>   drivers/iommu/intel/nested.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/iommu/intel/nested.c b/drivers/iommu/intel/nested.c
> index 2b979bec56ce..dbcec6093d50 100644
> --- a/drivers/iommu/intel/nested.c
> +++ b/drivers/iommu/intel/nested.c
> @@ -50,7 +50,7 @@ static int intel_nested_attach_dev(struct iommu_domain *domain,
>   	if (ret)
>   		goto detach_iommu;
>   
> -	ret = iopf_for_domain_set(domain, dev);
> +	ret = iopf_for_domain_replace(domain, old, dev);
>   	if (ret)
>   		goto unassign_tag;
>   
> @@ -67,7 +67,7 @@ static int intel_nested_attach_dev(struct iommu_domain *domain,
>   
>   	return 0;
>   disable_iopf:
> -	iopf_for_domain_remove(domain, dev);
> +	iopf_for_domain_replace(old, domain, dev);
>   unassign_tag:
>   	cache_tag_unassign_domain(dmar_domain, dev, IOMMU_NO_PASID);
>   detach_iommu:

Thanks for the patch, but we already have a fix in the iommu tree:

83871c3ae10e ("iommu/vt-d: Fix iopf refcount leak in nested attach")

Thanks,
baolu