[prev in list] [next in list] [prev in thread] [next in thread] 

List:       openbsd-tech
Subject:    [patch] network daemons may lose file descriptors while accepting connections
From:       Igor Zinovik <zinovik () cs ! karelia ! ru>
Date:       2008-01-31 10:12:06
Message-ID: 20080131101206.GA15338 () kappa ! cs ! prv
[Download RAW message or body]

	Hello, tech@ readers.

Network daemons (bgpd, snmpd, relayd, hoststated, dvmrpd, ripd, ospfd)
may lose file descriptor `connfd', while accepting network connection.
If memory allocation fails daemon is still working, but it does not
close socket, so eventually it may exhaust all descriptors.  relayd(8)
is already fixed by reyk@.  Here is a diff for other daemons.

--- bgpd-control.c.orig	Thu Jan 31 01:54:20 2008
+++ bgpd-control.c	Thu Jan 31 01:54:50 2008
@@ -130,6 +130,7 @@ control_accept(int listenfd, int restric
 	session_socket_blockmode(connfd, BM_NONBLOCK);
 
 	if ((ctl_conn = malloc(sizeof(struct ctl_conn))) == NULL) {
+		close(connfd);
 		log_warn("session_control_accept");
 		return (0);
 	}

--- dvmrpd-control.c.orig	Thu Jan 31 02:05:03 2008
+++ dvmrpd-control.c	Thu Jan 31 02:05:14 2008
@@ -128,6 +128,7 @@ control_accept(int listenfd, short event
 	session_socket_blockmode(connfd, BM_NONBLOCK);
 
 	if ((c = malloc(sizeof(struct ctl_conn))) == NULL) {
+		close(connfd);
 		log_warn("control_accept");
 		return;
 	}

--- hoststated-control.c.orig	Thu Jan 31 02:00:05 2008
+++ hoststated-control.c	Thu Jan 31 02:00:09 2008
@@ -138,6 +138,7 @@ control_accept(int listenfd, short event
 	session_socket_blockmode(connfd, BM_NONBLOCK);
 
 	if ((c = malloc(sizeof(struct ctl_conn))) == NULL) {
+		close(connfd);
 		log_warn("control_accept");
 		return;
 	}

--- ospf6d-control.c.orig	Thu Jan 31 02:03:19 2008
+++ ospf6d-control.c	Thu Jan 31 02:03:29 2008
@@ -126,6 +126,7 @@ control_accept(int listenfd, short event
 	session_socket_blockmode(connfd, BM_NONBLOCK);
 
 	if ((c = malloc(sizeof(struct ctl_conn))) == NULL) {
+		close(connfd);
 		log_warn("control_accept");
 		return;
 	}

--- ospfd-control.c.orig	Thu Jan 31 02:02:35 2008
+++ ospfd-control.c	Thu Jan 31 02:02:47 2008
@@ -128,6 +128,7 @@ control_accept(int listenfd, short event
 	session_socket_blockmode(connfd, BM_NONBLOCK);
 
 	if ((c = malloc(sizeof(struct ctl_conn))) == NULL) {
+		close(connfd);
 		log_warn("control_accept");
 		return;
 	}

--- ripd-control.c.orig	Thu Jan 31 01:53:15 2008
+++ ripd-control.c	Thu Jan 31 01:53:24 2008
@@ -127,6 +127,7 @@ control_accept(int listenfd, short event
 	session_socket_blockmode(connfd, BM_NONBLOCK);
 
 	if ((c = malloc(sizeof(struct ctl_conn))) == NULL) {
+		close(connfd);
 		log_warn("control_accept");
 		return;
 	}

--- snmpd-control.c.orig	Thu Jan 31 02:01:53 2008
+++ snmpd-control.c	Thu Jan 31 02:01:58 2008
@@ -138,6 +138,7 @@ control_accept(int listenfd, short event
 	session_socket_blockmode(connfd, BM_NONBLOCK);
 
 	if ((c = malloc(sizeof(struct ctl_conn))) == NULL) {
+		close(connfd);
 		log_warn("control_accept");
 		return;
 	}

[prev in list] [next in list] [prev in thread] [next in thread]