[PATCH] uio: uio_pci_generic_sva: reject multiple opens

[PATCH] uio: uio_pci_generic_sva: reject multiple opens

[Avi Weiss]

uio_pci_sva_open() stores an SVA binding handle in device-wide state.
A second open from another address space overwrites that handle. Closing
the two descriptors then unbinds the second handle twice and leaves the
first binding active.

Reject another open while a binding is active and clear the handle on
release. UIO core already serializes the callbacks under info_lock.

Fixes: 3397c3cd859a ("uio: Add SVA support for PCI devices via uio_pci_generic_sva.c")
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
---
 drivers/uio/uio_pci_generic_sva.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/uio/uio_pci_generic_sva.c b/drivers/uio/uio_pci_generic_sva.c
index d05ef77f7e322..fedf54e82f270 100644
--- a/drivers/uio/uio_pci_generic_sva.c
+++ b/drivers/uio/uio_pci_generic_sva.c
@@ -32,6 +32,9 @@ static int uio_pci_sva_open(struct uio_info *info, struct inode *inode)
 	if (!udev || !udev->pdev)
 		return -ENODEV;
 
+	if (udev->sva_handle)
+		return -EBUSY;
+
 	domain = iommu_get_domain_for_dev(&udev->pdev->dev);
 	if (domain)
 		iommu_detach_device(domain, &udev->pdev->dev);
@@ -55,6 +58,7 @@ static int uio_pci_sva_release(struct uio_info *info, struct inode *inode)
 		return -ENODEV;
 
 	iommu_sva_unbind_device(udev->sva_handle);
+	udev->sva_handle = NULL;
 
 	return 0;
 }

base-commit: 65ba8f34ec886ec72b2c07ddc8cf3d815c32869d
-- 
2.43.0

Re: [PATCH] uio: uio_pci_generic_sva: reject multiple opens

[Greg Kroah-Hartman]

On Wed, Oct 28, 2026 at 09:27:26AM +0200, Avi Weiss wrote:
> uio_pci_sva_open() stores an SVA binding handle in device-wide state.
> A second open from another address space overwrites that handle. Closing
> the two descriptors then unbinds the second handle twice and leaves the
> first binding active.
> 
> Reject another open while a binding is active and clear the handle on
> release. UIO core already serializes the callbacks under info_lock.

That's up to userspace to protect, as it can pass around file
descriptors to other processes just fine, and the kernel can't do
anything about that, so this type of change doesn't make much sense.

In other words, if you open the device multiple times, that's your
problem, you get to keep both pieces :)

thanks,

greg k-h