make --device works at privileged mode

Signed-off-by: wenlxie <wenlxie@ebay.com>

daemon/container.go

@@ -275,6 +275,22 @@ func validateHostConfig(hostConfig *containertypes.HostConfig, platform string)
 	if hostConfig == nil {
 		return nil
 	}
+
+	if hostConfig.Privileged {
+		for _, deviceMapping := range hostConfig.Devices {
+			if deviceMapping.PathOnHost == deviceMapping.PathInContainer {
+				continue
+			}
+			if _, err := os.Stat(deviceMapping.PathInContainer); err != nil {
+				if os.IsNotExist(err) {
+					continue
+				}
+				return errors.Wrap(err, "error stating device path in container")
+			}
+			return errors.Errorf("container device path: %s must be different from any host device path for privileged mode containers", deviceMapping.PathInContainer)
+		}
+	}
+
 	if hostConfig.AutoRemove && !hostConfig.RestartPolicy.IsNone() {
 		return errors.Errorf("can't create 'AutoRemove' container with restart policy")
 	}

daemon/oci_linux.go

@@ -16,6 +16,7 @@ import (
 	containertypes "github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/container"
 	daemonconfig "github.com/docker/docker/daemon/config"
+	"github.com/docker/docker/errdefs"
 	"github.com/docker/docker/oci"
 	"github.com/docker/docker/oci/caps"
 	"github.com/docker/docker/pkg/idtools"