Re: [PATCH 2/2] iommupt: Drop pagealloc references during domain deinit

[Jason Gunthorpe]

On Thu, Aug 27, 2026 at 10:58:55PM +0800, Yuanhe Shu wrote:
> Since commit b948a8722848 ("iommu: Fix up map/unmap debugging for
> iommupt domains") iommu_map() takes an IOMMU_DEBUG_PAGEALLOC reference
> for every page it maps into a generic_pt domain, and those references
> are only dropped by the IOVA based unmap path.  When a domain is freed
> while mappings are still installed, pt_iommu_deinit() releases the page
> table memory without dropping them, so every mapped page stays counted
> as IOMMU-mapped after it returns to the buddy allocator and each later
> allocation or free of it reports:
> 
>     WARNING: drivers/iommu/iommu-debug-pagealloc.c:91 at __iommu_debug_check_unmapped+0x4e/0x70, CPU#0: init/1
>     iommu: Detected page leak!
> 
> Freeing a domain with mappings still installed is not driver misuse:
> the deinit contract in include/linux/generic_pt/iommu.h only requires
> the table to be removed from HW access and caches, with no requirement
> to unmap first, and the kunit suite itself frees domains with live
> mappings in pt_kunit_iommu_exit().

It is not misusing iommupt, but it is definitely misusing any iommu
API built on top of it. How did you trigger this?

> Verified with the generic_pt kunit suite as an in-tree reproducer:
> running the x86_64 format's test_pgsize_boundary() with

If this is the only trigger, then it is different testing things
interacting badly and I don't think it should be fixed like this.

Probably have the kunits directly unmap as they were being lazy

Jason