From ec93edc4ca5aaf54369023f9a24400e819cf1ab5 Mon Sep 17 00:00:00 2001 From: Mike Yuan Date: Sat, 28 Feb 2026 22:48:14 +0100 Subject: [PATCH] core/exec-invoke: fix potential double close of socket/bpffs fds on failure The owned fds should be closed before close_all_fds() along the lines of exec_params/runtime_close(), otherwise they would be left dangling afterwards. --- src/core/exec-invoke.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/core/exec-invoke.c b/src/core/exec-invoke.c index 25c12ece25..39b087a3d9 100644 --- a/src/core/exec-invoke.c +++ b/src/core/exec-invoke.c @@ -6191,6 +6191,8 @@ int exec_invoke( /* Kill unnecessary process, for the case that e.g. when the bpffs mount point is hidden. */ pidref_done_sigkill_wait(&bpffs_pidref); + bpffs_socket_fd = safe_close(bpffs_socket_fd); + bpffs_errno_pipe = safe_close(bpffs_errno_pipe); if (needs_sandboxing && exec_needs_cgroup_namespace(context) && params->cgroup_path) { /* Move ourselves into the subcgroup now *after* we've unshared the cgroup namespace, which @@ -6267,6 +6269,7 @@ int exec_invoke( * them open until the final execve(). But first, close the remaining sockets in the context * objects. */ + socket_fd = safe_close(socket_fd); exec_runtime_close(runtime); exec_params_close(params);