From 0fb19adc8b0fa4b6ba0b17298b85ccd9b456e474 Mon Sep 17 00:00:00 2001 From: Denis Rechkunov Date: Mon, 12 Feb 2024 13:06:05 +0100 Subject: [PATCH 1/3] Fix file handle leak when handling errors in filestream Files were not closed properly in some rare error cases. --- filebeat/input/filestream/input.go | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/filebeat/input/filestream/input.go b/filebeat/input/filestream/input.go index 6cedd1bd9d1..e7fd6678c4c 100644 --- a/filebeat/input/filestream/input.go +++ b/filebeat/input/filestream/input.go @@ -179,6 +179,9 @@ func (inp *filestream) open(log *logp.Logger, canceler input.Canceler, fs fileSo return nil, err } + ok := false // used for cleanup + defer cleanup.IfNot(&ok, cleanup.IgnoreError(f.Close)) + log.Debug("newLogFileReader with config.MaxBytes:", inp.readerConfig.MaxBytes) // if the file is archived, it means that it is not going to be updated in the future @@ -203,7 +206,6 @@ func (inp *filestream) open(log *logp.Logger, canceler input.Canceler, fs fileSo dbgReader, err := debug.AppendReaders(logReader) if err != nil { - f.Close() return nil, err } @@ -221,7 +223,6 @@ func (inp *filestream) open(log *logp.Logger, canceler input.Canceler, fs fileSo MaxBytes: encReaderMaxBytes, }) if err != nil { - f.Close() return nil, err } @@ -233,6 +234,7 @@ func (inp *filestream) open(log *logp.Logger, canceler input.Canceler, fs fileSo r = readfile.NewLimitReader(r, inp.readerConfig.MaxBytes) + ok = true // no need to close the file return r, nil } @@ -252,11 +254,11 @@ func (inp *filestream) openFile(log *logp.Logger, path string, offset int64) (*o return nil, nil, fmt.Errorf("failed to open file %s, named pipes are not supported", fi.Name()) } - ok := false f, err := file.ReadOpen(path) if err != nil { return nil, nil, fmt.Errorf("failed opening %s: %w", path, err) } + ok := false defer cleanup.IfNot(&ok, cleanup.IgnoreError(f.Close)) fi, err = f.Stat() @@ -286,8 +288,8 @@ func (inp *filestream) openFile(log *logp.Logger, path string, offset int64) (*o } return nil, nil, fmt.Errorf("initialising encoding for '%v' failed: %w", f, err) } - ok = true + ok = true // no need to close the file return f, encoding, nil } From eedae74abf84ee46dbee508a6c5f8d7dd139d876 Mon Sep 17 00:00:00 2001 From: Denis Rechkunov Date: Mon, 12 Feb 2024 13:11:24 +0100 Subject: [PATCH 2/3] Add changelog entry --- CHANGELOG.next.asciidoc | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 48497df4957..a793bf3bdaa 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -90,6 +90,7 @@ fields added to events containing the Beats version. {pull}37553[37553] - Fix TCP/UDP metric queue length parsing base. {pull}37714[37714] - Update github.com/lestrrat-go/jwx dependency. {pull}37799[37799] - [threatintel] MISP pagination fixes {pull}37898[37898] +- Fix file handle leak when handling errors in filestream {pull}37973[37973] *Heartbeat* From 48b8db99fc3463ac46df772baf69559d5bc80d76 Mon Sep 17 00:00:00 2001 From: Denis Rechkunov Date: Mon, 12 Feb 2024 17:07:45 +0100 Subject: [PATCH 3/3] Remove redundant f.Close() --- filebeat/input/filestream/input.go | 1 - 1 file changed, 1 deletion(-) diff --git a/filebeat/input/filestream/input.go b/filebeat/input/filestream/input.go index e7fd6678c4c..43c6ddcb19f 100644 --- a/filebeat/input/filestream/input.go +++ b/filebeat/input/filestream/input.go @@ -282,7 +282,6 @@ func (inp *filestream) openFile(log *logp.Logger, path string, offset int64) (*o encoding, err := inp.encodingFactory(f) if err != nil { - f.Close() if errors.Is(err, transform.ErrShortSrc) { return nil, nil, fmt.Errorf("initialising encoding for '%v' failed due to file being too short", f) }