Kevin Tian

A NULL pointer dereference or refcount corruption exists in the iommu/vt-d component. When `dev pasid` is not found in the `dev pasids` list and remains NULL, teardown operations are executed unconditionally. If the domain was never attached to the IOMMU, the `info` variable will be NULL, leading to an immediate dereference when checking `info->refcnt`. Additionally, decrementing the refcount without removing a valid PASID can unbalance the count, potentially causing the refcount to drop to 0 prematurely and resulting in a use-after-free for other active devices sharing the domain.

A memory leak issue has been identified in the Linux kernel, specifically in the iopf queue remove device() function. This function is responsible for removing a device from the per-iommu iopf queue when PRI is disabled on the device. However, it fails to release the group structure that represents a group of iopf's awaiting a response after responding to the hardware, potentially causing a memory leak if iopf queue remove device() is called with pending iopf's.