iommu: Fix potential memory leak in iopf_queue_remove_device()

The iopf_queue_remove_device() helper removes a device from the per-iommu
iopf queue when PRI is disabled on the device. It responds to all
outstanding iopf's with an IOMMU_PAGE_RESP_INVALID code and detaches the
device from the queue.

However, it fails to release the group structure that represents a group
of iopf's awaiting for a response after responding to the hardware. This
can cause a memory leak if iopf_queue_remove_device() is called with
pending iopf's.

Fix it by calling iopf_free_group() after the iopf group is responded.

Fixes: 199112327135 ("iommu: Track iopf group instead of last fault")
Cc: [e-mail]
Suggested-by: Kevin Tian <[e-mail]>
Signed-off-by: Lu Baolu <[e-mail]>
Reviewed-by: Kevin Tian <[e-mail]>
Reviewed-by: Jason Gunthorpe <[e-mail]>
Link: https://lore.kernel.org/r/[e-mail]
Signed-off-by: Joerg Roedel <[e-mail]>

drivers/iommu/io-pgfault.c

···
 
 		ops->page_response(dev, iopf, &resp);
 		list_del_init(&group->pending_node);
+		iopf_free_group(group);
 	}
 	mutex_unlock(&fault_param->lock);