kvm: use anon_inode_getfd() with O_CLOEXEC flag