Fix a fd leak in socketpair():

- Close the new file objects created during socketpair() if the copyout of
  the new file descriptors fails.
- Add a test to the socketpair regression test for this edge case.

1 files changed, 7 insertions, 2 deletions

diff --git a/sys/kern/uipc_syscalls.c b/sys/kern/uipc_syscalls.c
index 5f6479c..fd2a208 100644
--- a/sys/kern/uipc_syscalls.c
+++ b/sys/kern/uipc_syscalls.c
@@ -664,7 +664,10 @@ socketpair(td, uap)
 	fp2->f_ops = &socketops;
 	fp2->f_type = DTYPE_SOCKET;
 	FILE_UNLOCK(fp2);
+	so1 = so2 = NULL;
 	error = copyout(sv, uap->rsv, 2 * sizeof (int));
+	if (error)
+		goto free4;
 	fdrop(fp1, td);
 	fdrop(fp2, td);
 	goto done2;
@@ -675,9 +678,11 @@ free3:
 	fdclose(fdp, fp1, sv[0], td);
 	fdrop(fp1, td);
 free2:
-	(void)soclose(so2);
+	if (so2 != NULL)
+		(void)soclose(so2);
 free1:
-	(void)soclose(so1);
+	if (so1 != NULL)
+		(void)soclose(so1);
 done2:
 	NET_UNLOCK_GIANT();
 	return (error);