From 70b4b1c418099094e25c2f3014fb07799d13f0c4 Mon Sep 17 00:00:00 2001 From: Khashayar Fereidani Date: Mon, 22 Jun 2026 13:14:13 +0000 Subject: [PATCH 1/4] ipc: close unix socket used for liveness probe UAPIOpen dials the socket only to check whether it is in use, but it left the established connection open, leaking a file descriptor on every attempt that found the socket busy. Signed-off-by: Khashayar Fereidani --- ipc/uapi_unix.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ipc/uapi_unix.go b/ipc/uapi_unix.go index dcce1671a..51da605a7 100644 --- a/ipc/uapi_unix.go +++ b/ipc/uapi_unix.go @@ -52,7 +52,8 @@ func UAPIOpen(name string) (*os.File, error) { } // Test socket, if not in use cleanup and try again. - if _, err := net.Dial("unix", socketPath); err == nil { + if conn, err := net.Dial("unix", socketPath); err == nil { + conn.Close() return nil, errors.New("unix socket in use") } if err := os.Remove(socketPath); err != nil { From c94502d3e96ec447b4b29569a001ac53b4e64bca Mon Sep 17 00:00:00 2001 From: Khashayar Fereidani Date: Mon, 22 Jun 2026 13:14:50 +0000 Subject: [PATCH 2/4] ipc: close listener when duplicating its file descriptor fails If listener.File() returns an error, the underlying unix listener is left open, leaking its file descriptor. Close it on the failure path. Signed-off-by: Khashayar Fereidani --- ipc/uapi_unix.go | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/ipc/uapi_unix.go b/ipc/uapi_unix.go index 51da605a7..12bb08bfc 100644 --- a/ipc/uapi_unix.go +++ b/ipc/uapi_unix.go @@ -48,7 +48,12 @@ func UAPIOpen(name string) (*os.File, error) { listener, err := net.ListenUnix("unix", addr) if err == nil { - return listener.File() + file, err := listener.File() + if err != nil { + listener.Close() + return nil, err + } + return file, nil } // Test socket, if not in use cleanup and try again. @@ -63,5 +68,10 @@ func UAPIOpen(name string) (*os.File, error) { if err != nil { return nil, err } - return listener.File() + file, err := listener.File() + if err != nil { + listener.Close() + return nil, err + } + return file, nil } From e25bbbbf25d612e8c5497f911de72de8360ed033 Mon Sep 17 00:00:00 2001 From: Khashayar Fereidani Date: Mon, 22 Jun 2026 13:15:34 +0000 Subject: [PATCH 3/4] ipc: close listener on UAPIListen error paths UAPIListen creates a listener from the file descriptor before setting up inotify. If inotify initialization, watch addition, or the rwcancel helper fails, the listener is returned to the caller neither closed nor handed off, leaking its file descriptor. The inotify file descriptor is likewise leaked when watch addition fails. Close them on each path. Signed-off-by: Khashayar Fereidani --- ipc/uapi_linux.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ipc/uapi_linux.go b/ipc/uapi_linux.go index fddded0c9..b8cd40690 100644 --- a/ipc/uapi_linux.go +++ b/ipc/uapi_linux.go @@ -74,6 +74,7 @@ func UAPIListen(name string, file *os.File) (net.Listener, error) { uapi.inotifyFd, err = unix.InotifyInit() if err != nil { + listener.Close() return nil, err } @@ -86,11 +87,14 @@ func UAPIListen(name string, file *os.File) (net.Listener, error) { ) if err != nil { + listener.Close() + unix.Close(uapi.inotifyFd) return nil, err } uapi.inotifyRWCancel, err = rwcancel.NewRWCancel(uapi.inotifyFd) if err != nil { + listener.Close() unix.Close(uapi.inotifyFd) return nil, err } From 7fb3b43ce61f6d074961777dfdc3ff2d35330f5b Mon Sep 17 00:00:00 2001 From: Khashayar Fereidani Date: Mon, 22 Jun 2026 13:15:50 +0000 Subject: [PATCH 4/4] conn: close socket when address resolution fails listenNet resolves the local address after opening the socket. If resolution fails, the socket is returned neither closed nor handed off, leaking its file descriptor. Signed-off-by: Khashayar Fereidani --- conn/bind_std.go | 1 + 1 file changed, 1 insertion(+) diff --git a/conn/bind_std.go b/conn/bind_std.go index f5c88160e..2a1dd7fac 100644 --- a/conn/bind_std.go +++ b/conn/bind_std.go @@ -132,6 +132,7 @@ func listenNet(network string, port int) (*net.UDPConn, int, error) { laddr.String(), ) if err != nil { + conn.Close() return nil, 0, err } return conn.(*net.UDPConn), uaddr.Port, nil