Re: [PATCH v6 07/18] KVM: selftests: Add VFIO device support to eventfd IRQ test

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] `probe_iommu_type()` incorrectly checks for the existence of the `/dev/vfio` directory instead of the `/dev/vfio/vfio` character device, causing the test to fail instead of gracefully skipping on systems without VFIO.
--

commit f5addd74013c3a4a3fb4fedd4bad238886d29e95
Author: David Matlack <dmatlack@google.com>

KVM: selftests: Add VFIO device support to eventfd IRQ test

Extends the eventfd IRQ test to support triggering interrupts via a VFIO
device instead of manually signaling the eventfd. It also introduces logic
to auto-probe between IOMMUFD and legacy VFIO.

Link: https://lore.kernel.org/all/20260602222941.3133236-1-jrhilke%40google.com [1]

> diff --git a/tools/testing/selftests/kvm/irq_test.c b/tools/testing/selftests/kvm/irq_test.c
> index 9f8895b898214..6888be54ee4a9 100644
> --- a/tools/testing/selftests/kvm/irq_test.c
> +++ b/tools/testing/selftests/kvm/irq_test.c

[ ... ]

> @@ -74,11 +107,29 @@ static void kvm_route_msi(struct kvm_vm *vm, u32 gsi, struct kvm_vcpu *vcpu,
>  	vm_ioctl(vm, KVM_SET_GSI_ROUTING, &routing.header);
>  }
>  
> +static const char *probe_iommu_type(void)
> +{
> +	int io_fd;
> +
> +	io_fd = open("/dev/iommu", O_RDONLY);
> +	if (io_fd >= 0) {
> +		close(io_fd);
> +		return MODE_IOMMUFD;
> +	}
> +
> +	io_fd = __open_path_or_exit("/dev/vfio", O_RDONLY,
> +				    "Is VFIO (or IOMMUFD) loaded and enabled?");
> +	close(io_fd);

[Severity: Medium]
The commit message states that the test will auto-probe IOMMUFD vs legacy
VFIO and skip the test if neither is available. However, probe_iommu_type()
calls __open_path_or_exit() on /dev/vfio.

Because /dev/vfio is a directory, open() with O_RDONLY will succeed if the
directory exists (e.g., created by udev or left over after a module unload),
even if the VFIO module is not loaded and the character device is absent.
Opening a directory does not trigger the kernel's character device module
autoloading.

If this occurs, probe_iommu_type() incorrectly assumes VFIO is available and
returns MODE_VFIO_TYPE1_IOMMU. The test then calls iommu_init(), which attempts
to open /dev/vfio/vfio and will fatally abort, resulting in a test crash rather
than a clean skip.

Additionally, using __open_path_or_exit() will cause the test to exit rather
than skip if the path does not exist.

Should this probe instead check for the /dev/vfio/vfio character device and
use open() instead of __open_path_or_exit() to allow the test to gracefully
skip and trigger module autoloading?

> +	return MODE_VFIO_TYPE1_IOMMU;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260610005338.2967132-1-seanjc@google.com?part=7