[PATCH] iommu/vt-d: Fix iopf_refcount leak in nested RID replacement

[Jiale Yao]

intel_nested_attach_dev() enables IOPF for the new nested domain without
releasing the reference held by the old domain.  Replacing a domain with
an IOPF-enabled domain therefore leaves an extra reference in
info->iopf_refcount.

Commit 236dd58fabd2 ("iommu/vt-d: Fix iopf_refcount leak on RID
domain replacement") fixed the same IOPF reference leak in the regular
RID attach paths.  The nested RID attach path has the same old-domain
handling bug.

Use iopf_for_domain_replace() for the attach and restore the old domain
reference if nested PASID setup fails, matching the existing PASID path.

Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
Link: https://lore.kernel.org/all/20260731054329.2948252-4-baolu.lu@xxxxxxxxxxxxxxx/
---
 drivers/iommu/intel/nested.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/iommu/intel/nested.c b/drivers/iommu/intel/nested.c
index 2b979bec56ce..dbcec6093d50 100644
--- a/drivers/iommu/intel/nested.c
+++ b/drivers/iommu/intel/nested.c
@@ -50,7 +50,7 @@ static int intel_nested_attach_dev(struct iommu_domain *domain,
 	if (ret)
 		goto detach_iommu;
 
-	ret = iopf_for_domain_set(domain, dev);
+	ret = iopf_for_domain_replace(domain, old, dev);
 	if (ret)
 		goto unassign_tag;
 
@@ -67,7 +67,7 @@ static int intel_nested_attach_dev(struct iommu_domain *domain,
 
 	return 0;
 disable_iopf:
-	iopf_for_domain_remove(domain, dev);
+	iopf_for_domain_replace(old, domain, dev);
 unassign_tag:
 	cache_tag_unassign_domain(dmar_domain, dev, IOMMU_NO_PASID);
 detach_iommu:
-- 
2.34.1