On Mon, Feb 27, 2023 at 10:59:41AM +0100, Stefano Brivio wrote:
> If tcp_timer_ctl() gets a socket number greater than SOCKET_MAX
> (2 ^ 24), we return error but we don't close the socket. This is a
> rather formal issue given that, at least on Linux, socket numbers are
> monotonic and we're in general not allowed to open so many sockets.
> 
> Signed-off-by: Stefano Brivio <sbrivio@redhat.com>

Reviewed-by: David Gibson <david@gibson.dropbear.id.au>

> ---
>  tcp.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/tcp.c b/tcp.c
> index 561064e..b674311 100644
> --- a/tcp.c
> +++ b/tcp.c
> @@ -702,6 +702,9 @@ static void tcp_timer_ctl(const struct ctx *c, struct tcp_tap_conn *conn)
>  		fd = timerfd_create(CLOCK_MONOTONIC, 0);
>  		if (fd == -1 || fd > SOCKET_MAX) {
>  			debug("TCP: failed to get timer: %s", strerror(errno));
> +			if (fd > -1)
> +				close(fd);
> +			conn->timer = -1;
>  			return;
>  		}
>  		conn->timer = fd;

-- 
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson