This is the same issue as the report on 4/6: with the device removed, viommu_sync_req() returns without draining, and the requests left on viommu->requests are not freed anywhere either.
Batching does not change its size: once the device is gone nothing can be queued anymore, and a request only enters the list together with a free descriptor in the request virtqueue, so what can be left behind is bounded by that queue's depth. It is a leak all the same. Please see my reply to 4/6 for the cleanup and the reasoning: - the objects cannot be freed before the queues are torn down: the virtqueue owns them (it holds them as the buffer data and has their scatterlists mapped) and the device may still use them until it is reset; - after the reset, virtqueue_detach_unused_buf() releases both the object and its mapping, which is where the loop belongs; - the baseline did not clean up either, and would use-after-free the deleted virtqueues instead. That cleanup is in the v2 I just sent. Thanks, Anlai
