tree 9b22345e6485bab60e576c0f279d86975d349fcc
parent 5e124900c6ebf5dfbe31b7b67073a64b2da14967
author Sean Christopherson <sean.j.christopherson@intel.com> 1550263719 -0800
committer Paolo Bonzini <pbonzini@redhat.com> 1553790426 +0100

KVM: Reject device ioctls from processes other than the VM's creator

KVM's API requires thats ioctls must be issued from the same process
that created the VM.  In other words, userspace can play games with a
VM's file descriptors, e.g. fork(), SCM_RIGHTS, etc..., but only the
creator can do anything useful.  Explicitly reject device ioctls that
are issued by a process other than the VM's creator, and update KVM's
API documentation to extend its requirements to device ioctls.

Fixes: 852b6d57dc7f ("kvm: add device control API")
Cc: <stable@vger.kernel.org>
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>