Handle_LEAK in /deps/hiredis/net.c:124 ( v. 8.0.3 )

[guschin058]

Handle 's' is created at net.c:124 by calling function 'socket' and lost at net.c:131.
The redisCreateSocket() function creates a socket descriptor, but does not close it in the error handling path when redisSetReuseAddr() returns REDIS_ERR. This creates a resource leak in which socket descriptors remain open indefinitely, potentially leading to EMFILE errors (too many open files) and system instability.
Line 124 https://github.com/redis/redis/blob/8.0.3/deps/hiredis/net.c#L124

static int redisCreateSocket(redisContext *c, int type) {
    redisFD s;
    if ((s = socket(type, SOCK_STREAM, 0)) == REDIS_INVALID_FD) {
        __redisSetErrorFromErrno(c,REDIS_ERR_IO,NULL);
        return REDIS_ERR;
    }
    c->fd = s;
    if (type == AF_INET) {
        if (redisSetReuseAddr(c) == REDIS_ERR) {
            return REDIS_ERR;
        }
    }
    return REDIS_OK;
}

Found Linux Verification Center ( linuxtesting.org ) with SVACE
Reporter: Gushchin Egor ( guschin058@yandex.ru )

[michael-grunder]

I'm not sure this is correct.

If you follow into redisSetReuseAddr:

hiredis/net.c

Lines 113 to 120 in 2947820

	static int redisSetReuseAddr(redisContext *c) {
	int on = 1;
	if (setsockopt(c->fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on)) == -1) {
	__redisSetErrorFromErrno(c,REDIS_ERR_IO,NULL);
	redisNetClose(c);
	return REDIS_ERR;
	}
	return REDIS_OK;

You will see that in the error condition we then call redisNetClose, which closes the socket:

hiredis/net.c

Lines 56 to 61 in 2947820

	void redisNetClose(redisContext *c) {
	if (c && c->fd != REDIS_INVALID_FD) {
	close(c->fd);
	c->fd = REDIS_INVALID_FD;
	}
	}