iommufd/fault: Destroy response and mutex in iommufd_fault_destroy()

commit 3f4818ec139030f425476bf8a10b616bab53a7b5 upstream.

Both were missing in the initial patch.

Fixes: 07838f7fd529 ("iommufd: Add iommufd fault object")
Link: https://patch.msgid.link/r/bc8bb13e215af27e62ee51bdba3648dd4ed2dce3.1736923732.git.nicolinc@nvidia.com
Cc: stable@vger.kernel.org
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/iommu/iommufd/fault.c b/drivers/iommu/iommufd/fault.c
index 119b95f14917153d4989b19872d43cca518eec54..6f283966f4deb7cf526caa5e640e0c463c3f061c 100644 (file)
--- a/drivers/iommu/iommufd/fault.c
+++ b/drivers/iommu/iommufd/fault.c
@@ -208,6 +208,7 @@ void iommufd_fault_destroy(struct iommufd_object *obj)
 {
        struct iommufd_fault *fault = container_of(obj, struct iommufd_fault, obj);
        struct iopf_group *group, *next;
+       unsigned long index;
 
        /*
         * The iommufd object's reference count is zero at this point.
@@ -220,6 +221,13 @@ void iommufd_fault_destroy(struct iommufd_object *obj)
                iopf_group_response(group, IOMMU_PAGE_RESP_INVALID);
                iopf_free_group(group);
        }
+       xa_for_each(&fault->response, index, group) {
+               xa_erase(&fault->response, index);
+               iopf_group_response(group, IOMMU_PAGE_RESP_INVALID);
+               iopf_free_group(group);
+       }
+       xa_destroy(&fault->response);
+       mutex_destroy(&fault->mutex);
 }
 
 static void iommufd_compose_fault_message(struct iommu_fault *fault,