From patchwork Mon Nov 2 17:05:25 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Frank Lichtenheld X-Patchwork-Id: 5568 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:6022:3119:b0:118:2077:975e with SMTP id e25csp5702673laa; Mon, 2 Nov 2026 09:05:39 -0800 (PST) X-Forwarded-Encrypted: i=2; AKwUvBxqETJrMco9LWXckPNr9ey3Sf5W6QU94omuYM0x3LKF2C6MdJCURi3Vmsv/3fgQRCCy6S+0He/sgb8=@openvpn.net X-Received: by 2002:a05:693c:88c8:20b0:369:f2d6:4108 with SMTP id 5a478bee46e88-36a42401233mr15996282eec.10.1793639139354; Mon, 02 Nov 2026 09:05:39 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793639139; cv=none; d=google.com; s=arc-20260327; b=FPcvKF1gtbMyDtP4LfReEJEzZ/taCMhBuvVykPuSnq/5ZKVvt/PLk0RHaO/EMW4NGd X6f//CfAku/+ZUPJdcqC5yQtD8TOjR5GvjwGnmiJmUv6muLm02KWK0mqauf3WTZ3mzhE IVKpU44kYn0daIxOeu+KxinUz5tEu+N2fxddr4trOfLIHqYH0X8SdXVGzj9u0HYxVSRv kYO98N//NM72da0yywollzY+HXrdwvMiOcYH2RNdUH1w45QhiAoP58Kk1GjjiB4uu9Mk fLffUhRzm4apLEcbOOQmUmFgwFt57R6J5MdCXlB2ocZZ9lJWYERZJpM/jqFv1A6vIFAj J2Dw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=13D7nJbKGpsykU8Lm3aEqdXrsSHZfzSAqZ5c+ucaceg=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=lGkCHHG9/9DNSh/OugANBAdwRYIddUYce9h4dzfeXuuYnCUvcnSuBXErHE0gxRRHT0 tqyovJ7sxGlChzBDsoHan6Bv4jN9WX+xT8JW3XW5D2RaK+T1uZyq48lWlfxUVrAZuroE 0izCRM5XWvZs3dEtcyAYe8dtKrv3c42FW5IHiXnykbdlviviYzyAA0cJM0xTauZjtPfw 3GuvERc6pXCBS8S+7l5eVlDGB1ZnrtAlELzubunItUANHOSBirpai9SlTlpOHi87xKag lImCUH+chErDilXcuIx0rTRQzH82xjtdCmxWPGrjnhPsinZFt3JT7AiybLffPdBe8mIO ONFw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b="i/w/ueNM"; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=OUmUqVqh; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=kxmEJ2ja; dkim=neutral (body hash did not verify) header.i=@lichtenheld.com header.s=MBO0001 header.b=j5RTW8Uh; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 5a478bee46e88-36a42b1892fsi30950987eec.54.2026.11.02.09.05.39 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 02 Nov 2026 09:05:39 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b="i/w/ueNM"; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=OUmUqVqh; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=kxmEJ2ja; dkim=neutral (body hash did not verify) header.i=@lichtenheld.com header.s=MBO0001 header.b=j5RTW8Uh; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=13D7nJbKGpsykU8Lm3aEqdXrsSHZfzSAqZ5c+ucaceg=; b=i/w/ueNMYGV+8f w/5+H+20xGf15OJsYgT5PoCsq8gjsbR2FodHbD2dEs537UNsAE0/KmnCG2ViUrDJKLNXLWrW6TxTF 1K2oq0xoKEzV0FTXaVxj7k4I1PkdgkzjW8Go6kwrOV3goSi/gSwXzVocK2qBCqd2tm0A2nrWeKEAh vWU=; Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xNvTW-000000001R5-0MLm; Mon, 02 Nov 2026 17:05:38 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xNvTU-000000001Qw-1hkc for openvpn-devel@lists.sourceforge.net; Mon, 02 Nov 2026 17:05:36 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=BT7iEXWv6nDbhnTO2OfKSw/a7OBHZm1jFk/V8w9mFmc=; b=OUmUqVqhVz2GvWM951xE/5Iw6h iL4J2EyIcmdWrxtBOKElV4dCFIBxixTPpcl+HPwx038YEZ87zqdHn2sn+ZaxdWdu/IYIV9pGX+BgP S9X73rrDzbNECWkVq2tfMBvmsyHp55Fw9iYf/+PVp0Q0a3UWpGCXa1k5VyfUlovgE+rU=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=BT7iEXWv6nDbhnTO2OfKSw/a7OBHZm1jFk/V8w9mFmc=; b=kxmEJ2jaKIiYUF3aAhESXztJS4 XtkcuOFqGYzw1dWkJxdgfGul8zCMv6bOoz0OoMWPktwXWmB+a/r09FwYvml5iPjKpBq54ulZtxm0g 5AZ4xzzjlrxYv2f7AKgQTHU7rAkMyrH2MJwnKce6AMzto/fBhf+N1qlMt5W5wrA10gbs=; Received: from mout-p-201.mailbox.org ([80.241.56.171]) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xNvTS-0000000065H-2yua for openvpn-devel@lists.sourceforge.net; Mon, 02 Nov 2026 17:05:36 +0000 Received: from smtp1.mailbox.org (smtp1.mailbox.org [IPv6:2001:67c:2050:b231:465::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519MLKEM768 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-p-201.mailbox.org (Postfix) with ESMTPS id 4jJJ462bB3zMlPN for ; Mon, 02 Nov 2026 18:05:26 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lichtenheld.com; s=MBO0001; t=1793639126; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=BT7iEXWv6nDbhnTO2OfKSw/a7OBHZm1jFk/V8w9mFmc=; b=j5RTW8UhBGkec7z3dSF96LWENBLuEHeuP4Oi7eRvzi4qSJdzRVscVd7HNE22eTmNl9jhTQ IofbaXbJRMfYxbK0qCg4f0LUq1WPO//X885IRNQDmlZUMJ5+YLmE40lgaB74Mwrj9VodEN aQGMGi+Jk8xIe55wF9ctXIxkB3PMvwZXQaSPG+pkqWQBdNvoCxCdwzBlx9yJ3+SWiqm+4u auqOeL08mECpVUeodKJsjS8uSeC4wjv7yOy1K6U8C2V04pxEHoOiFR9FTgno8Ee2Ed6ESP gBahE6EYN2DhOfMXMx1O/epFmE924oglrtqxaujfWXlEzwM0xJlV1ngjqMaPVQ== Authentication-Results: outgoing_mbo_mout; dkim=none; spf=pass (outgoing_mbo_mout: domain of frank@lichtenheld.com designates 2001:67c:2050:b231:465::1 as permitted sender) smtp.mailfrom=frank@lichtenheld.com From: Frank Lichtenheld To: openvpn-devel@lists.sourceforge.net Date: Mon, 2 Nov 2026 18:05:25 +0100 Message-ID: <20261102170525.112032-1-frank@lichtenheld.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 X-Rspamd-Queue-Id: 4jJJ462bB3zMlPN X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Razvan Cojocaru run_updown_runner() leaked dns_pipe_fd when pipe(ack_pipe_fd) failed. Broken since 1dfe8729 ("dns: support running up/down command with privsep"). Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain X-Headers-End: 1xNvTS-0000000065H-2yua Subject: [Openvpn-devel] [PATCH v2] dns: close first pipe if creating the second one fails X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1880766954650383172 X-GMAIL-MSGID: 1880766954650383172 From: Razvan Cojocaru run_updown_runner() leaked dns_pipe_fd when pipe(ack_pipe_fd) failed. Broken since 1dfe8729 ("dns: support running up/down command with privsep"). Change-Id: I73efe00fddbd919897489c975ec65ed4b4628cc8 Signed-off-by: Razvan Cojocaru Acked-by: Frank Lichtenheld Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2091 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2091 This mail reflects revision 2 of this Change. Acked-by according to Gerrit (reflected above): Frank Lichtenheld diff --git a/src/openvpn/dns.c b/src/openvpn/dns.c index e5ed1bc..abe30ed 100644 --- a/src/openvpn/dns.c +++ b/src/openvpn/dns.c @@ -608,11 +608,18 @@ { int dns_pipe_fd[2]; int ack_pipe_fd[2]; - if (pipe(dns_pipe_fd) != 0 || pipe(ack_pipe_fd) != 0) + if (pipe(dns_pipe_fd) != 0) { msg(M_WARN | M_ERRNO, "run_dns_up_down: unable to create pipes"); return false; } + if (pipe(ack_pipe_fd) != 0) + { + msg(M_WARN | M_ERRNO, "run_dns_up_down: unable to create pipes"); + close(dns_pipe_fd[0]); + close(dns_pipe_fd[1]); + return false; + } updown_runner->pid = fork(); if (updown_runner->pid == -1) {