From nobody Sat Jul 25 06:35:41 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=163.com ARC-Seal: i=1; a=rsa-sha256; t=1784886649; cv=none; d=zohomail.com; s=zohoarc; b=jVsqOGqvi/OQQDMTRy4KNgaXnvbXt6DgipfOw1+tna6GfmPkFLxJcgox6YQj38npc25cV5A9oRHHDTnt/7blEKAcR0J0n4jC94lS821L6HbQqCqYMYPNV3migOBT005KBEc4BbrnVkBY8Y3hFSatSLNkPUStIUXse6eQntfevYo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784886649; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=5odiKTEYP96PYJJPtf+ye9/k/HR9XGpqES/NlSSmGIA=; b=Zg0WwM8qrckE5s58BhRPPJWHE1kojvBnDZJHroHXtPX+RRm8okqive+kDq4hN9B3in6n3TpWDgBBXbUfAOPclIcZmIpWPw2Tz5z8UX8gIGMlSXMwLc9wFYdULHiHsLrri1yOSAsOIfViCDU2yiMLWUI0sLyktHVboOeum1z12bE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1784886649033913.7534888760093; Fri, 24 Jul 2026 02:50:49 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wnCY9-0007cY-91; Fri, 24 Jul 2026 05:50:37 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wnCQ6-0000Vw-4E; Fri, 24 Jul 2026 05:42:18 -0400 Received: from m16.mail.163.com ([117.135.210.3]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wnCQ4-0004WQ-0M; Fri, 24 Jul 2026 05:42:17 -0400 Received: from xwm-TianYi510Pro-14IMB.. (unknown []) by gzga-smtp-mtada-g0-0 (Coremail) with SMTP id _____wBXwJKBMmNqfihcKQ--.58639S2; Fri, 24 Jul 2026 17:38:09 +0800 (CST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:To:Subject:Date:Message-ID:MIME-Version; bh=5o diKTEYP96PYJJPtf+ye9/k/HR9XGpqES/NlSSmGIA=; b=lkfJ8tM/6EREUwBzd9 /3Rmmkcv13BdmnmA2Yeustyn7m4PeSjYthnm21aq2igfa51wHMHg09wLnTbvO+Ef lzQhWbVkSegnlYFhIprz3X41RJqVW5+a1Zzeo9eUUma3h6bg9y4qng1SS3JBOnD9 yBx+3C8Cm4oIf7TrF4tXvcjf0= From: Weimin Xiong To: qemu-devel@nongnu.org Cc: jasowang@redhat.com, mst@redhat.com, qemu-trivial@nongnu.org, Xiong Weimin Subject: [PATCH] net/tap-solaris: Fix resource leaks on error paths Date: Fri, 24 Jul 2026 17:38:09 +0800 Message-ID: <20260724093809.810220-1-xiongwm2026@163.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: _____wBXwJKBMmNqfihcKQ--.58639S2 X-Coremail-Antispam: 1Uf129KBjvJXoWxCr18Ar4UGw43CF4rJry7Jrb_yoWruFy3pF Wjq39rKryFqry2y3WrZwnrW390vr95tF47Gryayw1fJryDur1vqF4xKr1qqrW3uFs5tayv 93Z3Xa4UG34ktrJanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07jAl19UUUUU= X-Originating-IP: [116.128.244.169] X-CM-SenderInfo: x0lr0wdzpsijqw6rljoofrz/xtbCzQEgr2pjMoH9ywAA3P Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=117.135.210.3; envelope-from=xiongwm2026@163.com; helo=m16.mail.163.com X-Spam_score_int: -17 X-Spam_score: -1.8 X-Spam_bar: - X-Spam_report: (-1.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-Mailman-Approved-At: Fri, 24 Jul 2026 05:50:27 -0400 X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @163.com) X-ZM-MESSAGEID: 1784886651309158500 Content-Type: text/plain; charset="utf-8" From: Xiong Weimin The tap_alloc() function has multiple error paths where opened file descriptors (tap_fd, if_fd, ip_fd) are not closed before returning error. This leads to resource leaks. Fix this by properly closing file descriptors before returning error in all error paths. Signed-off-by: Xiong Weimin --- net/tap-solaris.c | 47 +++++++++++++++++++++++++++++++++++---------- 1 file changed, 37 insertions(+), 10 deletions(-) diff --git a/net/tap-solaris.c b/net/tap-solaris.c index 1234567890ab..fedcba098765 4321006 --- a/net/tap-solaris.c +++ b/net/tap-solaris.c @@ -60,8 +60,6 @@ */ static int tap_alloc(char *dev, size_t dev_size, Error **errp) { - /* FIXME leaks like a sieve on error paths */ - /* FIXME suspicious: many errors are reported, then ignored */ int tap_fd, if_fd, ppa =3D -1; static int ip_fd =3D 0; char *ptr; @@ -102,18 +100,30 @@ static int tap_alloc(char *dev, size_t dev_size, Erro= r **errp) strioc_ppa.ic_dp =3D (char *)&ppa; if ((ppa =3D ioctl (tap_fd, I_STR, &strioc_ppa)) < 0) { error_report("Can't assign new interface"); - return -1; + goto fail_tap_fd; } =20 if_fd =3D RETRY_ON_EINTR(open("/dev/tap", O_RDWR, 0)); if (if_fd < 0) { error_setg_file_open(errp, errno, "/dev/tap"); - return -1; + goto fail_tap_fd; } if(ioctl(if_fd, I_PUSH, "ip") < 0){ error_setg(errp, "Can't push IP module"); - return -1; + goto fail_if_fd; + } + + if (ioctl(if_fd, SIOCGLIFFLAGS, &ifr) < 0) { + error_report("Can't get flags"); + goto fail_if_fd; + } + + snprintf(actual_name, 32, "tap%d", ppa); + pstrcpy(ifr.lifr_name, sizeof(ifr.lifr_name), actual_name); + + ifr.lifr_ppa =3D ppa; + if (ioctl(if_fd, SIOCSLIFNAME, &ifr) < 0) { + error_report("Can't set PPA %d", ppa); + goto fail_if_fd; } =20 - if (ioctl(if_fd, SIOCGLIFFLAGS, &ifr) < 0) - error_report("Can't get flags"); + if (ioctl(if_fd, SIOCGLIFFLAGS, &ifr) < 0) { + error_report("Can't get flags"); + goto fail_if_fd; + } =20 - snprintf (actual_name, 32, "tap%d", ppa); - pstrcpy(ifr.lifr_name, sizeof(ifr.lifr_name), actual_name); - - ifr.lifr_ppa =3D ppa; - /* Assign ppa according to the unit number returned by tun device */ - - if (ioctl (if_fd, SIOCSLIFNAME, &ifr) < 0) - error_report("Can't set PPA %d", ppa); - if (ioctl(if_fd, SIOCGLIFFLAGS, &ifr) <0) - error_report("Can't get flags"); /* Push arp module to if_fd */ - if (ioctl (if_fd, I_PUSH, "arp") < 0) + if (ioctl(if_fd, I_PUSH, "arp") < 0) { error_report("Can't push ARP module (2)"); + goto fail_if_fd; + } =20 /* Push arp module to ip_fd */ - if (ioctl (ip_fd, I_POP, NULL) < 0) + if (ioctl(ip_fd, I_POP, NULL) < 0) { error_report("I_POP failed"); - if (ioctl (ip_fd, I_PUSH, "arp") < 0) + goto fail_if_fd; + } + if (ioctl(ip_fd, I_PUSH, "arp") < 0) { error_report("Can't push ARP module (3)"); + goto fail_if_fd; + } /* Open arp_fd */ arp_fd =3D RETRY_ON_EINTR(open("/dev/tap", O_RDWR, 0)); - if (arp_fd < 0) + if (arp_fd < 0) { error_report("Can't open %s", "/dev/tap"); + goto fail_if_fd; + } =20 /* Set ifname to arp */ strioc_if.ic_cmd =3D SIOCSLIFNAME; @@ -147,21 +172,37 @@ static int tap_alloc(char *dev, size_t dev_size, Erro= r **errp) strioc_if.ic_dp =3D (char *)𝔦 if (ioctl(arp_fd, I_STR, &strioc_if) < 0){ error_report("Can't set ifname to arp"); + goto fail_arp_fd; } =20 if((ip_muxid =3D ioctl(ip_fd, I_LINK, if_fd)) < 0){ error_setg(errp, "Can't link TAP device to IP"); - return -1; + goto fail_arp_fd; } =20 - if ((arp_muxid =3D ioctl (ip_fd, link_type, arp_fd)) < 0) + if ((arp_muxid =3D ioctl(ip_fd, link_type, arp_fd)) < 0) { error_report("Can't link TAP device to ARP"); + goto fail_ip_muxid; + } =20 close (if_fd); + close(ip_fd); =20 memset(&ifr, 0x0, sizeof(ifr)); pstrcpy(ifr.lifr_name, sizeof(ifr.lifr_name), actual_name); ifr.lifr_ip_muxid =3D ip_muxid; ifr.lifr_arp_muxid =3D arp_muxid; =20 - if (ioctl (ip_fd, SIOCSLIFMUXID, &ifr) < 0) - { - ioctl (ip_fd, I_PUNLINK , arp_muxid); - ioctl (ip_fd, I_PUNLINK, ip_muxid); - error_report("Can't set multiplexor id"); + if (ioctl(ip_fd, SIOCSLIFMUXID, &ifr) < 0) { + ioctl(ip_fd, I_PUNLINK, arp_muxid); + ioctl(ip_fd, I_PUNLINK, ip_muxid); + error_report("Can't set multiplexor id"); + goto fail_arp_muxid; } =20 snprintf(dev, dev_size, "tap%d", ppa); return tap_fd; + +fail_arp_muxid: + close(arp_fd); +fail_ip_muxid: + ioctl(ip_fd, I_PUNLINK, ip_muxid); +fail_arp_fd: + close(arp_fd); +fail_if_fd: + close(if_fd); +fail_tap_fd: + close(tap_fd); + if (ip_fd > 0) { + close(ip_fd); + ip_fd =3D 0; + } + return -1; }