From 0af85cbca84afbd603c703e8366c78ba98c6079d Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Wed, 12 Nov 2025 13:28:57 -0800 Subject: [PATCH] [1.4] libct: newProcessComm: close fds on error Reported in issue 5008. Reported-by: Arina Cherednik Signed-off-by: Kir Kolyshkin (cherry picked from commit c24965b742468a5307fd268ef484b173a3e52f2b) Signed-off-by: Aleksa Sarai --- libcontainer/process_linux.go | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/libcontainer/process_linux.go b/libcontainer/process_linux.go index fddb03408..d9c441ec5 100644 --- a/libcontainer/process_linux.go +++ b/libcontainer/process_linux.go @@ -70,7 +70,7 @@ type processComm struct { logPipeChild *os.File } -func newProcessComm() (*processComm, error) { +func newProcessComm() (_ *processComm, retErr error) { var ( comm processComm err error @@ -79,10 +79,24 @@ func newProcessComm() (*processComm, error) { if err != nil { return nil, fmt.Errorf("unable to create init pipe: %w", err) } + defer func() { + if retErr != nil { + comm.initSockParent.Close() + comm.initSockChild.Close() + } + }() + comm.syncSockParent, comm.syncSockChild, err = newSyncSockpair("sync") if err != nil { return nil, fmt.Errorf("unable to create sync pipe: %w", err) } + defer func() { + if retErr != nil { + comm.syncSockParent.Close() + comm.syncSockChild.Close() + } + }() + comm.logPipeParent, comm.logPipeChild, err = os.Pipe() if err != nil { return nil, fmt.Errorf("unable to create log pipe: %w", err)