> From: Liu, Yi L <yi.l.liu@xxxxxxxxx> > Sent: Tuesday, February 21, 2023 11:48 AM > > + > +void vfio_device_cdev_close(struct vfio_device_file *df) > +{ > + struct vfio_device *device = df->device; > + > + mutex_lock(&device->dev_set->lock); > + if (!smp_load_acquire(&df->access_granted)) { there is no contention with another one changing this flag at this point so directly accessing it is fine. but actually should check device->open_count as v3 does. Otherwise the last error on copy_to_user() in ioctl_bind_iommufd() simply returns here given df->access_granted hasn't been set but .open_device() has been completed.