lkml.org 
[lkml]   [2019]   [Apr]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 104/107] KVM: Reject device ioctls from processes other than the VMs creator
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Sean Christopherson <sean.j.christopherson@intel.com>

    commit ddba91801aeb5c160b660caed1800eb3aef403f8 upstream.

    KVM's API requires thats ioctls must be issued from the same process
    that created the VM. In other words, userspace can play games with a
    VM's file descriptors, e.g. fork(), SCM_RIGHTS, etc..., but only the
    creator can do anything useful. Explicitly reject device ioctls that
    are issued by a process other than the VM's creator, and update KVM's
    API documentation to extend its requirements to device ioctls.

    Fixes: 852b6d57dc7f ("kvm: add device control API")
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    Documentation/virtual/kvm/api.txt | 16 +++++++++++-----
    virt/kvm/kvm_main.c | 3 +++
    2 files changed, 14 insertions(+), 5 deletions(-)

    --- a/Documentation/virtual/kvm/api.txt
    +++ b/Documentation/virtual/kvm/api.txt
    @@ -13,7 +13,7 @@ of a virtual machine. The ioctls belong

    - VM ioctls: These query and set attributes that affect an entire virtual
    machine, for example memory layout. In addition a VM ioctl is used to
    - create virtual cpus (vcpus).
    + create virtual cpus (vcpus) and devices.

    Only run VM ioctls from the same process (address space) that was used
    to create the VM.
    @@ -24,6 +24,11 @@ of a virtual machine. The ioctls belong
    Only run vcpu ioctls from the same thread that was used to create the
    vcpu.

    + - device ioctls: These query and set attributes that control the operation
    + of a single device.
    +
    + device ioctls must be issued from the same process (address space) that
    + was used to create the VM.

    2. File descriptors
    -------------------
    @@ -32,10 +37,11 @@ The kvm API is centered around file desc
    open("/dev/kvm") obtains a handle to the kvm subsystem; this handle
    can be used to issue system ioctls. A KVM_CREATE_VM ioctl on this
    handle will create a VM file descriptor which can be used to issue VM
    -ioctls. A KVM_CREATE_VCPU ioctl on a VM fd will create a virtual cpu
    -and return a file descriptor pointing to it. Finally, ioctls on a vcpu
    -fd can be used to control the vcpu, including the important task of
    -actually running guest code.
    +ioctls. A KVM_CREATE_VCPU or KVM_CREATE_DEVICE ioctl on a VM fd will
    +create a virtual cpu or device and return a file descriptor pointing to
    +the new resource. Finally, ioctls on a vcpu or device fd can be used
    +to control the vcpu or device. For vcpus, this includes the important
    +task of actually running guest code.

    In general file descriptors can be migrated among processes by means
    of fork() and the SCM_RIGHTS facility of unix domain socket. These
    --- a/virt/kvm/kvm_main.c
    +++ b/virt/kvm/kvm_main.c
    @@ -2812,6 +2812,9 @@ static long kvm_device_ioctl(struct file
    {
    struct kvm_device *dev = filp->private_data;

    + if (dev->kvm->mm != current->mm)
    + return -EIO;
    +
    switch (ioctl) {
    case KVM_SET_DEVICE_ATTR:
    return kvm_device_ioctl_attr(dev, dev->ops->set_attr, arg);

    \
     
     \ /
      Last update: 2019-04-01 19:26    [W:4.778 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site