From c24965b742468a5307fd268ef484b173a3e52f2b Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Wed, 12 Nov 2025 13:28:57 -0800 Subject: [PATCH] libct: newProcessComm: close fds on error Reported in issue 5008. Reported-by: Arina Cherednik Signed-off-by: Kir Kolyshkin --- libcontainer/process_linux.go | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/libcontainer/process_linux.go b/libcontainer/process_linux.go index c1c27494f..51c7b0d87 100644 --- a/libcontainer/process_linux.go +++ b/libcontainer/process_linux.go @@ -66,7 +66,7 @@ type processComm struct { logPipeChild *os.File } -func newProcessComm() (*processComm, error) { +func newProcessComm() (_ *processComm, retErr error) { var ( comm processComm err error @@ -75,10 +75,24 @@ func newProcessComm() (*processComm, error) { if err != nil { return nil, fmt.Errorf("unable to create init pipe: %w", err) } + defer func() { + if retErr != nil { + comm.initSockParent.Close() + comm.initSockChild.Close() + } + }() + comm.syncSockParent, comm.syncSockChild, err = newSyncSockpair("sync") if err != nil { return nil, fmt.Errorf("unable to create sync pipe: %w", err) } + defer func() { + if retErr != nil { + comm.syncSockParent.Close() + comm.syncSockChild.Close() + } + }() + comm.logPipeParent, comm.logPipeChild, err = os.Pipe() if err != nil { return nil, fmt.Errorf("unable to create log pipe: %w", err)