Skip to content

Socket leak in neu_conn_eth_check_interface() on ioctl() failure #2904

Description

@K-ANOY

There is a socket fd leak in neu_conn_eth_check_interface() when the interface hardware-address lookup fails.

File: src/connection/connection_eth.c

Function: neu_conn_eth_check_interface

Relevant code:

int neu_conn_eth_check_interface(const char *interface)
{
    struct ifreq ifr = { 0 };
    int          fd  = socket(PF_PACKET, SOCK_RAW, ETH_P_IPV6);
    int          ret = -1;

    if (fd <= 0) {
        return -1;
    }

    snprintf(ifr.ifr_name, IFNAMSIZ, "%s", interface);
    ret = ioctl(fd, SIOCGIFHWADDR, &ifr);
    if (ret != 0) {
        return -1;
    }

    close(fd);
    return ret;
}

The success path closes fd before returning:

close(fd);
return ret;

But if ioctl(fd, SIOCGIFHWADDR, &ifr) fails, the function returns -1
without closing the socket. This leaks one socket fd per failed interface check.

Suggested fix: close fd before returning from the ioctl() error path.

Also, socket() can legally return fd 0, so the check should probably be
fd < 0 instead of fd <= 0.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions