iommufd/device: Fix hwpt at err_unresv in iommufd_device_do_replace()

The rewind routine should remove the reserved iovas added to the new hwpt.

Fixes: 89db31635c87 ("iommufd: Derive iommufd_hwpt_paging from iommufd_hw_pagetable")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/r/20240718050130.1956804-1-nicolinc@nvidia.com
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

diff --git a/drivers/iommu/iommufd/device.c b/drivers/iommu/iommufd/device.c
index 9a7ec5997c61c5f862a03b3b5fd8cd637e35e14a..3214a4c17c6b3b0883742be3f30e081e6c7f7d32 100644 (file)
--- a/drivers/iommu/iommufd/device.c
+++ b/drivers/iommu/iommufd/device.c
@@ -526,7 +526,7 @@ iommufd_device_do_replace(struct iommufd_device *idev,
 err_unresv:
        if (hwpt_is_paging(hwpt))
                iommufd_group_remove_reserved_iova(igroup,
-                                                  to_hwpt_paging(old_hwpt));
+                                                  to_hwpt_paging(hwpt));
 err_unlock:
        mutex_unlock(&idev->igroup->lock);
        return ERR_PTR(rc);