Re: [PATCH v2 1/2] vfio: Prevent open_count decrement to negative

[Jason Gunthorpe <jgg@nvidia.com>]

On Fri, Jun 13, 2025 at 04:31:00PM -0600, Alex Williamson wrote:
> Hi Jacob,
> 
> On Tue,  3 Jun 2025 08:23:42 -0700
> Jacob Pan <jacob.pan@linux.microsoft.com> wrote:
> 
> > When vfio_df_close() is called with open_count=0, it triggers a warning in
> > vfio_assert_device_open() but still decrements open_count to -1. This
> > allows a subsequent open to incorrectly pass the open_count == 0 check,
> > leading to unintended behavior, such as setting df->access_granted = true.
> > 
> > For example, running an IOMMUFD compat no-IOMMU device with VFIO tests
> > (https://github.com/awilliam/tests/blob/master/vfio-noiommu-pci-device-open.c)
> > results in a warning and a failed VFIO_GROUP_GET_DEVICE_FD ioctl on the
> > first run, but the second run succeeds incorrectly.
> > 
> > Add checks to avoid decrementing open_count below zero.
> 
> The example above suggests to me that this is a means by which we could
> see this, but in reality it seems it is the only means by which we can
> create this scenario, right?

I understood this as an assertion hit because of the bug fixed in
patch 2 and thus the missed assertion error handling flow was noticed.

Obviously the assertion should never happen, but if it does we should
try to recover better than we currently do.

Jason