From 4e262509b8bc584bf4a57afbb6c21e2e74cdd5e0 Mon Sep 17 00:00:00 2001
From: Kir Kolyshkin <kolyshkin@gmail.com>
Date: Mon, 13 Oct 2025 15:54:45 -0700
Subject: [PATCH] libct: close child fds on prepareCgroupFD error

The (*setns).start is supposed to close child fds once the child has
started, or upon an error. Commit 5af4dd4e6 added a bug -- child fds
are not closed if prepareCgroupFD fails.

Fix by adding a missing call to closeChild.

I'm not sure how to write a good test case for it. Found when working
on PR 4928 (and tested in there).

Fixes: 5af4dd4e6
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
---
 libcontainer/process_linux.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libcontainer/process_linux.go b/libcontainer/process_linux.go
index c91bf5515..7d0a6b5dd 100644
--- a/libcontainer/process_linux.go
+++ b/libcontainer/process_linux.go
@@ -357,6 +357,7 @@ func (p *setnsProcess) start() (retErr error) {
 
 	fd, err := p.prepareCgroupFD()
 	if err != nil {
+		p.comm.closeChild()
 		return err
 	}