[PATCH v3] vfio: selftests: Verify a failed second open preserves the vf_token

[Alex Williamson]

The cdev path enforces a single open per device and rejects a second
bind of an already open device.  That rejection must happen before the
bind can mutate state shared across opens, notably the PF vf_token, so
that a bind which cannot complete leaves the current opener's state
untouched.  Before the fix in commit 258ba46543ab ("vfio: Reject a
second cdev open before mutating shared device state"), the second bind
mutated the vf_token and only then failed with -EINVAL.  It is now
rejected early with -EBUSY.

Add a regression test that binds a PF with one token, attempts a second
bind of the same PF with a different token, then initializes a VF with
the original token.  The VF init succeeds only if the rejected second
bind left the PF vf_token intact; a regression that clobbered it to the
second token would make the VF init fail.  The -EBUSY errno is checked
with EXPECT_EQ() so the clobber assertion still runs if the rejection
returns a different error.

This hazard is specific to the cdev/iommufd single-open path, so the
test runs only in iommufd mode.

Suggested-by: David Matlack <dmatlack@xxxxxxxxxx>
Assisted-by: LLM
Signed-off-by: Alex Williamson <alex.williamson@xxxxxxxxxx>
---

v3 following v2 from [1], incorporating David's suggestions to combine
the tests using EXPECT_EQ() rather than ASSERT_EQ() so that we still
test both aspects without duplicating code.  -EINVAL reference moved to
commit log.  Remaining patches from [1] applied to vfio next branch.

[1] https://lore.kernel.org/all/20260911170429.1642480-3-alex.williamson@xxxxxxxxxx/

 .../selftests/vfio/vfio_pci_sriov_uapi_test.c | 35 +++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/tools/testing/selftests/vfio/vfio_pci_sriov_uapi_test.c b/tools/testing/selftests/vfio/vfio_pci_sriov_uapi_test.c
index 19d657d00b75..87f42aae340c 100644
--- a/tools/testing/selftests/vfio/vfio_pci_sriov_uapi_test.c
+++ b/tools/testing/selftests/vfio/vfio_pci_sriov_uapi_test.c
@@ -157,6 +157,41 @@ TEST_F(vfio_pci_sriov_uapi_test, override_token)
 	ASSERT_COND_VF_CREATION(ret);
 }
 
+TEST(failed_second_open_does_not_clobber_token)
+{
+	struct vfio_pci_device *pf = NULL, *pf_second_fd = NULL, *vf = NULL;
+	struct iommu *iommu;
+	int ret;
+
+	iommu = iommu_init("iommufd");
+
+	/* Create and bind PF using UUID_1 */
+	ret = device_init(pf_bdf, iommu, UUID_1, &pf);
+	ASSERT_EQ(ret, 0);
+
+	/*
+	 * Attempt to open the same PF again and bind it with a *different*
+	 * token (UUID_2).  This must fail with -EBUSY because the cdev path
+	 * only supports a single open per device.  Enforce it with EXPECT_EQ()
+	 * so the clobber assertion below still runs if the errno differs.
+	 */
+	ret = device_init(pf_bdf, iommu, UUID_2, &pf_second_fd);
+	EXPECT_EQ(ret, -EBUSY);
+
+	/*
+	 * Attempt to initialize a VF using the original PF token (UUID_1).
+	 * If the failed open above clobbered the PF's token (i.e. updated it to
+	 * UUID_2), this VF initialization will fail.
+	 */
+	ret = device_init(vf_bdf, iommu, UUID_1, &vf);
+	ASSERT_EQ(ret, 0);
+
+	device_cleanup(vf);
+	device_cleanup(pf_second_fd);
+	device_cleanup(pf);
+	iommu_cleanup(iommu);
+}
+
 static void vf_teardown(void)
 {
 	/*

base-commit: bc78c90728cd74d1c7335fef786fa51968bdebad
-- 
2.53.0