From 8a9b4dcda6de12549bdc7d0824ed9eea0fcea693 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Wed, 12 Nov 2025 13:35:24 -0800 Subject: [PATCH] libct: mountFd: close mountFile on error Reported in issue 5008. Reported-by: Arina Cherednik Signed-off-by: Kir Kolyshkin --- libcontainer/mount_linux.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/libcontainer/mount_linux.go b/libcontainer/mount_linux.go index 9d4b5dcef..06df6cbbf 100644 --- a/libcontainer/mount_linux.go +++ b/libcontainer/mount_linux.go @@ -250,7 +250,7 @@ func syscallMode(i fs.FileMode) (o uint32) { // process will need to do an old-fashioned mount(2) themselves. // // This helper is only intended to be used by goCreateMountSources. -func mountFd(nsHandles *userns.Handles, m *configs.Mount) (*mountSource, error) { +func mountFd(nsHandles *userns.Handles, m *configs.Mount) (_ *mountSource, retErr error) { if !m.IsBind() { return nil, errors.New("new mount api: only bind-mounts are supported") } @@ -261,6 +261,11 @@ func mountFd(nsHandles *userns.Handles, m *configs.Mount) (*mountSource, error) var mountFile *os.File var sourceType mountSourceType + defer func() { + if retErr != nil && mountFile != nil { + mountFile.Close() + } + }() // Ideally, we would use OPEN_TREE_CLONE for everything, because we can // be sure that the file descriptor cannot be used to escape outside of