Re: [PATCH] vfio: cdev: Reject duplicate bind before updating KVM file

[Alex Williamson]

On Thu,  1 Oct 2026 15:01:52 +0530
"Aneesh Kumar K.V (Arm)" <aneesh.kumar@xxxxxxxxxx> wrote:

> The cdev path only supports one bound/open device fd, but
> VFIO_DEVICE_BIND_IOMMUFD only checked the per-file access_granted flag
> before capturing the KVM file reference. A second fd for the same device
> could therefore replace device->kvm, fail later in vfio_df_open()
> because open_count is already nonzero, and then clear the active KVM
> association during error cleanup.
> 
> Reject the bind while holding dev_set->lock if the device is already
> open, matching the existing cdev single-open rule before touching the
> device-wide KVM state.
> 
> Cc: Alex Williamson <alex@xxxxxxxxxxx>
> Cc: kvm@xxxxxxxxxxxxxxx
> Cc: linux-kernel@xxxxxxxxxxxxxxx
> Signed-off-by: Aneesh Kumar K.V (Arm) <aneesh.kumar@xxxxxxxxxx>
> ---
>  drivers/vfio/device_cdev.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/vfio/device_cdev.c b/drivers/vfio/device_cdev.c
> index 1d9515c967b0..ab46563604ac 100644
> --- a/drivers/vfio/device_cdev.c
> +++ b/drivers/vfio/device_cdev.c
> @@ -124,8 +124,8 @@ long vfio_df_ioctl_bind_iommufd(struct vfio_device_file *df,
>  		return ret;
>  
>  	mutex_lock(&device->dev_set->lock);
> -	/* one device cannot be bound twice */
> -	if (df->access_granted) {
> +	/* The cdev path only supports one bound/open device fd. */
> +	if (df->access_granted || device->open_count) {
>  		ret = -EINVAL;
>  		goto out_unlock;
>  	}

This is already addressed by [1], committed as [2].

[1]https://lore.kernel.org/all/20260911170429.1642480-2-alex.williamson@xxxxxxxxxx/
[2]https://github.com/awilliam/linux-vfio/commit/258ba46543abdd36844f04bba8b4022a5731d873

Thanks,
Alex