iommufd/device: Fix hwpt at err_unresv in iommufd_device_do_replace()

commit 950aeefb34923fe3c28ade35fe05f24e2c5b1d55 upstream.

The rewind routine should remove the reserved iovas added to the new hwpt.

Fixes: 89db31635c87 ("iommufd: Derive iommufd_hwpt_paging from iommufd_hw_pagetable")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/r/20240718050130.1956804-1-nicolinc@nvidia.com
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/iommu/iommufd/device.c b/drivers/iommu/iommufd/device.c
index 873630c111c1fc70a5297f101a67a83090f7f9ff..e333793e88eb7e93dcad6ff67d5e3672bcb02b05 100644 (file)
--- a/drivers/iommu/iommufd/device.c
+++ b/drivers/iommu/iommufd/device.c
@@ -525,7 +525,7 @@ iommufd_device_do_replace(struct iommufd_device *idev,
 err_unresv:
        if (hwpt_is_paging(hwpt))
                iommufd_group_remove_reserved_iova(igroup,
-                                                  to_hwpt_paging(old_hwpt));
+                                                  to_hwpt_paging(hwpt));
 err_unlock:
        mutex_unlock(&idev->igroup->lock);
        return ERR_PTR(rc);