[RFC PATCH v6 02/11] vfio: cdev: Reject duplicate bind before updating KVM file

[Aneesh Kumar K.V (Arm)]

The cdev path only supports one bound/open device fd, but
VFIO_DEVICE_BIND_IOMMUFD only checked the per-file access_granted flag
before capturing the KVM file reference. A second fd for the same device
could therefore replace device->kvm_file, fail later in vfio_df_open()
because open_count is already nonzero, and then clear the active KVM
association during error cleanup.

Reject the bind while holding dev_set->lock if the device is already
open, matching the existing cdev single-open rule before touching the
device-wide KVM state.

Signed-off-by: Aneesh Kumar K.V (Arm) <aneesh.kumar@xxxxxxxxxx>
---
 drivers/vfio/device_cdev.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/vfio/device_cdev.c b/drivers/vfio/device_cdev.c
index ca75ab8eb7bd..67e48f7ebfc3 100644
--- a/drivers/vfio/device_cdev.c
+++ b/drivers/vfio/device_cdev.c
@@ -115,8 +115,8 @@ long vfio_df_ioctl_bind_iommufd(struct vfio_device_file *df,
 		return ret;
 
 	mutex_lock(&device->dev_set->lock);
-	/* one device cannot be bound twice */
-	if (df->access_granted) {
+	/* The cdev path only supports one bound/open device fd. */
+	if (df->access_granted || device->open_count) {
 		ret = -EINVAL;
 		goto out_unlock;
 	}
-- 
2.43.0