From 8f9211abca9c0564c8c1b1f81d6b28c469b4aba9 Mon Sep 17 00:00:00 2001
From: Ayush Ranjan <ayushranjan@google.com>
Date: Wed, 1 Nov 2023 14:14:55 -0700
Subject: [PATCH] Close gofer filestore FDs in failure cases.

This is consistent with how other FDs are closed. This is so we don't leak FDs
if they are not consumed.

PiperOrigin-RevId: 578638281
---
 runsc/boot/controller.go     | 5 +++++
 runsc/boot/loader.go         | 9 ++++++---
 runsc/container/container.go | 3 +++
 3 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/runsc/boot/controller.go b/runsc/boot/controller.go
index 23642d968..9ddb7d7f3 100644
--- a/runsc/boot/controller.go
+++ b/runsc/boot/controller.go
@@ -346,6 +346,11 @@ func (cm *containerManager) StartSubcontainer(args *StartArgs, _ *struct{}) erro
 		goferFilestoreFDs = append(goferFilestoreFDs, goferFilestoreFD)
 	}
 	goferFiles = goferFiles[args.NumGoferFilestoreFDs:]
+	defer func() {
+		for _, fd := range goferFilestoreFDs {
+			_ = fd.Close()
+		}
+	}()
 
 	goferFDs, err := fd.NewFromFiles(goferFiles)
 	if err != nil {
diff --git a/runsc/boot/loader.go b/runsc/boot/loader.go
index f26550985..47a9282e8 100644
--- a/runsc/boot/loader.go
+++ b/runsc/boot/loader.go
@@ -598,9 +598,9 @@ func (l *Loader) Destroy() {
 	// Release any dangling tcp connections.
 	tcpip.ReleaseDanglingEndpoints()
 
-	// In the success case, stdioFDs and goferFDs will only contain
-	// released/closed FDs that ownership has been passed over to host FDs and
-	// gofer sessions. Close them here in case of failure.
+	// In the success case, all FDs in l.root will only contain released/closed
+	// FDs whose ownership has been passed over to host FDs and gofer sessions.
+	// Close them here in case of failure.
 	for _, f := range l.root.stdioFDs {
 		_ = f.Close()
 	}
@@ -610,6 +610,9 @@ func (l *Loader) Destroy() {
 	for _, f := range l.root.goferFDs {
 		_ = f.Close()
 	}
+	for _, f := range l.root.goferFilestoreFDs {
+		_ = f.Close()
+	}
 
 	l.stopProfiling()
 }
diff --git a/runsc/container/container.go b/runsc/container/container.go
index 62a875ed9..4025ef9d0 100644
--- a/runsc/container/container.go
+++ b/runsc/container/container.go
@@ -467,6 +467,9 @@ func (c *Container) Start(conf *config.Config) error {
 				for _, f := range goferFiles {
 					_ = f.Close()
 				}
+				for _, f := range goferFilestores {
+					_ = f.Close()
+				}
 			}()
 
 			cleanMounts, err := specutils.ReadMounts(mountsFile)