diff mbox series

[Openvpn-devel,v2] dns: close first pipe if creating the second one fails

Message ID 20261102170525.112032-1-frank@lichtenheld.com
State New
Headers
Series [Openvpn-devel,v2] dns: close first pipe if creating the second one fails |

Commit Message

Frank Lichtenheld Nov. 2, 2026, 5:05 p.m. UTC 
  From: Razvan Cojocaru <razvanc@mailbox.org>

run_updown_runner() leaked dns_pipe_fd when pipe(ack_pipe_fd) failed.

Broken since 1dfe8729 ("dns: support running up/down command with
privsep").

Change-Id: I73efe00fddbd919897489c975ec65ed4b4628cc8
Signed-off-by: Razvan Cojocaru <razvanc@mailbox.org>
Acked-by: Frank Lichtenheld <frank@lichtenheld.com>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2091
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2091
This mail reflects revision 2 of this Change.

Acked-by according to Gerrit (reflected above):
Frank Lichtenheld <frank@lichtenheld.com>

Comments

Gert Doering Nov. 2, 2026, 9:36 p.m. UTC | #1 
This should be unlikely to happen, but then, resource exhaustion does
happen... and then we shouldn't leak.

Just stared at the code & did a test compile & BB all green :-)

Your patch has been applied to the master and release/2.7 branch (bugfix).

commit 4a6c1db218c71a4c7a8346f7508242a315fb587d (master)
commit 685c12392fa8fa107657066a4077233e1f7206ff (release/2.7)
Author: Razvan Cojocaru
Date:   Mon Nov 2 18:05:25 2026 +0100

     dns: close first pipe if creating the second one fails

     Signed-off-by: Razvan Cojocaru <razvanc@mailbox.org>
     Acked-by: Frank Lichtenheld <frank@lichtenheld.com>
     Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2091
     Message-Id: <20261102170525.112032-1-frank@lichtenheld.com>
     URL: https://lore.kernel.org/openvpn-devel/20261102170525.112032-1-frank@lichtenheld.com
     Signed-off-by: Gert Doering <gert@greenie.muc.de>


--
kind regards,

Gert Doering
diff mbox series

Patch

diff --git a/src/openvpn/dns.c b/src/openvpn/dns.c
index e5ed1bc..abe30ed 100644
--- a/src/openvpn/dns.c
+++ b/src/openvpn/dns.c
@@ -608,11 +608,18 @@ 
 {
     int dns_pipe_fd[2];
     int ack_pipe_fd[2];
-    if (pipe(dns_pipe_fd) != 0 || pipe(ack_pipe_fd) != 0)
+    if (pipe(dns_pipe_fd) != 0)
     {
         msg(M_WARN | M_ERRNO, "run_dns_up_down: unable to create pipes");
         return false;
     }
+    if (pipe(ack_pipe_fd) != 0)
+    {
+        msg(M_WARN | M_ERRNO, "run_dns_up_down: unable to create pipes");
+        close(dns_pipe_fd[0]);
+        close(dns_pipe_fd[1]);
+        return false;
+    }
     updown_runner->pid = fork();
     if (updown_runner->pid == -1)
     {