RE: [RFC PATCH v6 02/11] vfio: cdev: Reject duplicate bind before updating KVM file

[Tian, Kevin]

> From: Aneesh Kumar K.V (Arm) <aneesh.kumar@xxxxxxxxxx>
> Sent: Thursday, September 17, 2026 10:02 PM
> 
> The cdev path only supports one bound/open device fd, but
> VFIO_DEVICE_BIND_IOMMUFD only checked the per-file access_granted flag
> before capturing the KVM file reference. A second fd for the same device
> could therefore replace device->kvm_file, fail later in vfio_df_open()
> because open_count is already nonzero, and then clear the active KVM
> association during error cleanup.
> 
> Reject the bind while holding dev_set->lock if the device is already
> open, matching the existing cdev single-open rule before touching the
> device-wide KVM state.
> 
> Signed-off-by: Aneesh Kumar K.V (Arm) <aneesh.kumar@xxxxxxxxxx>

could you send it out as a separate fix?

> ---
>  drivers/vfio/device_cdev.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/vfio/device_cdev.c b/drivers/vfio/device_cdev.c
> index ca75ab8eb7bd..67e48f7ebfc3 100644
> --- a/drivers/vfio/device_cdev.c
> +++ b/drivers/vfio/device_cdev.c
> @@ -115,8 +115,8 @@ long vfio_df_ioctl_bind_iommufd(struct
> vfio_device_file *df,
>  		return ret;
> 
>  	mutex_lock(&device->dev_set->lock);
> -	/* one device cannot be bound twice */
> -	if (df->access_granted) {
> +	/* The cdev path only supports one bound/open device fd. */
> +	if (df->access_granted || device->open_count) {
>  		ret = -EINVAL;
>  		goto out_unlock;
>  	}
> --
> 2.43.0