commit e9ec1cf8715d72195a94d748777a19b8e2ba4db5
author Ildar Kamaletdinov <i.kamaletdinov@omp.ru> Sat May 07 20:35:04 2022 +0300
committer Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Mon May 09 13:05:38 2022 -0700
tree d32d343cd9c3f3824c91c78eb563500ac050b222
parent a4741ef4bf6c6fb262b38a897312e929c2161cf9

tools: Fix handle leak in rfcomm

Some branches of execution can make handle (socket) leakage.

Found by Linux Verification Center (linuxtesting.org) with the SVACE
static analysis tool.

tools/rfcomm.c

diff --git a/tools/rfcomm.c b/tools/rfcomm.c
index cd520aa..e013ff5 100644
--- a/tools/rfcomm.c
+++ b/tools/rfcomm.c
@@ -298,6 +298,7 @@
 
 		if (setsockopt(sk, SOL_SOCKET, SO_LINGER, &l, sizeof(l)) < 0) {
 			perror("Can't set linger option");
+			close(sk);
 			return;
 		}
 	}
@@ -466,6 +467,7 @@
 	if (getsockname(nsk, (struct sockaddr *)&laddr, &alen) < 0) {
 		perror("Can't get RFCOMM socket name");
 		close(nsk);
+		close(sk);
 		return;
 	}
 
@@ -475,6 +477,7 @@
 		if (setsockopt(nsk, SOL_SOCKET, SO_LINGER, &l, sizeof(l)) < 0) {
 			perror("Can't set linger option");
 			close(nsk);
+			close(sk);
 			return;
 		}
 	}
@@ -490,6 +493,7 @@
 	dev = ioctl(nsk, RFCOMMCREATEDEV, &req);
 	if (dev < 0) {
 		perror("Can't create RFCOMM TTY");
+		close(nsk);
 		close(sk);
 		return;
 	}