diff options
| author | Amit Shah <amit.shah@qumranet.com> | 2008-08-13 16:22:37 +0300 |
|---|---|---|
| committer | Avi Kivity <avi@qumranet.com> | 2008-10-15 10:15:20 +0200 |
| commit | 6762b7299aa115e11815decd1fd982d015f09615 (patch) | |
| tree | 3973aab788f7f1d75377aa2aa78dc0014354c6f5 | |
| parent | dc7404cea34ef997dfe89ca94d16358e9d29c8d8 (diff) | |
| download | kernel_samsung_tuna-6762b7299aa115e11815decd1fd982d015f09615.zip kernel_samsung_tuna-6762b7299aa115e11815decd1fd982d015f09615.tar.gz kernel_samsung_tuna-6762b7299aa115e11815decd1fd982d015f09615.tar.bz2 | |
KVM: Device assignment: Check for privileges before assigning irq
Even though we don't share irqs at the moment, we should ensure
regular user processes don't try to allocate system resources.
We check for capability to access IO devices (CAP_SYS_RAWIO) before
we request_irq on behalf of the guest.
Noticed by Avi.
Signed-off-by: Amit Shah <amit.shah@qumranet.com>
Signed-off-by: Avi Kivity <avi@qumranet.com>
| -rw-r--r-- | arch/x86/kvm/x86.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 4a03375..fffdf4f 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -191,6 +191,11 @@ static int kvm_vm_ioctl_assign_irq(struct kvm *kvm, kvm_assigned_dev_interrupt_work_handler); if (irqchip_in_kernel(kvm)) { + if (!capable(CAP_SYS_RAWIO)) { + return -EPERM; + goto out; + } + if (assigned_irq->host_irq) match->host_irq = assigned_irq->host_irq; else |