tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

selftests/landlock: Fix socket file descriptor leaks in audit helpers

audit_init() opens a netlink socket and configures it, but leaks the
file descriptor if audit_set_status() or setsockopt() fails. Fix this
by jumping to an error path that closes the socket before returning.

Apply the same fix to audit_init_with_exe_filter(), which leaks the file
descriptor from audit_init() if audit_init_filter_exe() or
audit_filter_exe() fails, and to audit_cleanup(), which leaks it if
audit_init_filter_exe() fails in FIXTURE_TEARDOWN_PARENT().

Cc: Günther Noack <gnoack@google.com>
Cc: stable@vger.kernel.org
Fixes: 6a500b22971c ("selftests/landlock: Add tests for audit flags and domain IDs")
Reviewed-by: Günther Noack <gnoack3000@gmail.com>
Link: https://lore.kernel.org/r/20260402192608.1458252-3-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>

Mickaël Salaün 9143d790 b566f7a4

+19 -7
+19 -7
tools/testing/selftests/landlock/audit.h
··· 379 379 380 380 err = audit_set_status(fd, AUDIT_STATUS_ENABLED, 1); 381 381 if (err) 382 - return err; 382 + goto err_close; 383 383 384 384 err = audit_set_status(fd, AUDIT_STATUS_PID, getpid()); 385 385 if (err) 386 - return err; 386 + goto err_close; 387 387 388 388 /* Sets a timeout for negative tests. */ 389 389 err = setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &audit_tv_default, 390 390 sizeof(audit_tv_default)); 391 - if (err) 392 - return -errno; 391 + if (err) { 392 + err = -errno; 393 + goto err_close; 394 + } 393 395 394 396 return fd; 397 + 398 + err_close: 399 + close(fd); 400 + return err; 395 401 } 396 402 397 403 static int audit_init_filter_exe(struct audit_filter *filter, const char *path) ··· 447 441 448 442 filter = &new_filter; 449 443 err = audit_init_filter_exe(filter, NULL); 450 - if (err) 444 + if (err) { 445 + close(audit_fd); 451 446 return err; 447 + } 452 448 } 453 449 454 450 /* Filters might not be in place. */ ··· 476 468 477 469 err = audit_init_filter_exe(filter, NULL); 478 470 if (err) 479 - return err; 471 + goto err_close; 480 472 481 473 err = audit_filter_exe(fd, filter, AUDIT_ADD_RULE); 482 474 if (err) 483 - return err; 475 + goto err_close; 484 476 485 477 return fd; 478 + 479 + err_close: 480 + close(fd); 481 + return err; 486 482 }