Files
linuxkit/kernel/patches-4.9/0001-VSOCK-Only-allow-host-network-namespace-to-use-AF_VS.patch
Ian Campbell 31cf45bfc3 Revert "sched/cpuacct: Show all possible CPUs in cpuacct output" in 4.9 kernel
This change (5ca3726 added in v4.7-rc1) exposed issues described in
https://github.com/docker/docker/issues/28941, since we don't support CPU
hotplug anyway revert the change while we decide on a proper fix.

Signed-off-by: Ian Campbell <ian.campbell@docker.com>
2017-02-17 13:19:18 +00:00

31 lines
926 B
Diff

From 3d6fce5663241a06b78e10c2b5ae298abd7a72ba Mon Sep 17 00:00:00 2001
From: Ian Campbell <ian.campbell@docker.com>
Date: Mon, 4 Apr 2016 14:50:10 +0100
Subject: [PATCH 1/9] VSOCK: Only allow host network namespace to use AF_VSOCK.
The VSOCK addressing schema does not really lend itself to simply creating an
alternative end point address within a namespace.
Signed-off-by: Ian Campbell <ian.campbell@docker.com>
---
net/vmw_vsock/af_vsock.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 8a398b3fb532..0edc54c5e6ed 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -1852,6 +1852,9 @@ static const struct proto_ops vsock_stream_ops = {
static int vsock_create(struct net *net, struct socket *sock,
int protocol, int kern)
{
+ if (!net_eq(net, &init_net))
+ return -EAFNOSUPPORT;
+
if (!sock)
return -EINVAL;
--
2.11.0