Commit ddba9180 authored by Sean Christopherson's avatar Sean Christopherson Committed by Paolo Bonzini

KVM: Reject device ioctls from processes other than the VM's creator

KVM's API requires thats ioctls must be issued from the same process
that created the VM.  In other words, userspace can play games with a
VM's file descriptors, e.g. fork(), SCM_RIGHTS, etc..., but only the
creator can do anything useful.  Explicitly reject device ioctls that
are issued by a process other than the VM's creator, and update KVM's
API documentation to extend its requirements to device ioctls.

Fixes: 852b6d57 ("kvm: add device control API")
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarSean Christopherson <sean.j.christopherson@intel.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent 5e124900
...@@ -13,7 +13,7 @@ of a virtual machine. The ioctls belong to three classes: ...@@ -13,7 +13,7 @@ of a virtual machine. The ioctls belong to three classes:
- VM ioctls: These query and set attributes that affect an entire virtual - VM ioctls: These query and set attributes that affect an entire virtual
machine, for example memory layout. In addition a VM ioctl is used to machine, for example memory layout. In addition a VM ioctl is used to
create virtual cpus (vcpus). create virtual cpus (vcpus) and devices.
VM ioctls must be issued from the same process (address space) that was VM ioctls must be issued from the same process (address space) that was
used to create the VM. used to create the VM.
...@@ -26,6 +26,11 @@ of a virtual machine. The ioctls belong to three classes: ...@@ -26,6 +26,11 @@ of a virtual machine. The ioctls belong to three classes:
the documentation. Otherwise, the first ioctl after switching threads the documentation. Otherwise, the first ioctl after switching threads
could see a performance impact. could see a performance impact.
- device ioctls: These query and set attributes that control the operation
of a single device.
device ioctls must be issued from the same process (address space) that
was used to create the VM.
2. File descriptors 2. File descriptors
------------------- -------------------
...@@ -34,10 +39,11 @@ The kvm API is centered around file descriptors. An initial ...@@ -34,10 +39,11 @@ The kvm API is centered around file descriptors. An initial
open("/dev/kvm") obtains a handle to the kvm subsystem; this handle open("/dev/kvm") obtains a handle to the kvm subsystem; this handle
can be used to issue system ioctls. A KVM_CREATE_VM ioctl on this can be used to issue system ioctls. A KVM_CREATE_VM ioctl on this
handle will create a VM file descriptor which can be used to issue VM handle will create a VM file descriptor which can be used to issue VM
ioctls. A KVM_CREATE_VCPU ioctl on a VM fd will create a virtual cpu ioctls. A KVM_CREATE_VCPU or KVM_CREATE_DEVICE ioctl on a VM fd will
and return a file descriptor pointing to it. Finally, ioctls on a vcpu create a virtual cpu or device and return a file descriptor pointing to
fd can be used to control the vcpu, including the important task of the new resource. Finally, ioctls on a vcpu or device fd can be used
actually running guest code. to control the vcpu or device. For vcpus, this includes the important
task of actually running guest code.
In general file descriptors can be migrated among processes by means In general file descriptors can be migrated among processes by means
of fork() and the SCM_RIGHTS facility of unix domain socket. These of fork() and the SCM_RIGHTS facility of unix domain socket. These
......
...@@ -2905,6 +2905,9 @@ static long kvm_device_ioctl(struct file *filp, unsigned int ioctl, ...@@ -2905,6 +2905,9 @@ static long kvm_device_ioctl(struct file *filp, unsigned int ioctl,
{ {
struct kvm_device *dev = filp->private_data; struct kvm_device *dev = filp->private_data;
if (dev->kvm->mm != current->mm)
return -EIO;
switch (ioctl) { switch (ioctl) {
case KVM_SET_DEVICE_ATTR: case KVM_SET_DEVICE_ATTR:
return kvm_device_ioctl_attr(dev, dev->ops->set_attr, arg); return kvm_device_ioctl_attr(dev, dev->ops->set_attr, arg);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment