Files
linuxkit/alpine/kernel/patches/0009-VSOCK-Only-allow-host-network-namespace-to-use-AF_VS.patch
Ian Campbell f2171c7beb Update vsock patches
Upstream commit 598881800825 ("vsock: Fix blocking ops call in
prepare_to_wait") was subsequently reverted in 6f57e56a1527, which said:

    The commit reverted with this patch caused us to potentially miss wakeups.
    Since the condition is not checked between the prepare_to_wait and the
    schedule(), if a wakeup happens after the condition is checked but before
    the sleep happens, we will miss it. ( A description of the problem can be
    found here: http://www.makelinux.net/ldd3/chp-6-sect-2 ).

The underlying issue has been fixed instead with f7f9b5e7f8ec ("AF_VSOCK:
Shrink the area influenced by prepare_to_wait").

Signed-off-by: Ian Campbell <ian.campbell@docker.com>
2016-04-12 14:33:32 +01:00

31 lines
919 B
Diff

From 550ec4c8f90f2bf99c1bcb13b2f8476780f42418 Mon Sep 17 00:00:00 2001
From: Ian Campbell <ian.campbell@docker.com>
Date: Mon, 4 Apr 2016 14:50:10 +0100
Subject: [PATCH 9/9] VSOCK: Only allow host network namespace to use AF_VSOCK.
The VSOCK addressing schema does not really lend itself to simply creating an
alternative end point address within a namespace.
Signed-off-by: Ian Campbell <ian.campbell@docker.com>
---
net/vmw_vsock/af_vsock.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 112fa8b..ead5127 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -1859,6 +1859,9 @@ static const struct proto_ops vsock_stream_ops = {
static int vsock_create(struct net *net, struct socket *sock,
int protocol, int kern)
{
+ if (!net_eq(net, &init_net))
+ return -EAFNOSUPPORT;
+
if (!sock)
return -EINVAL;
--
2.8.0.rc3