From: Timo Sirainen <timo.sirainen@open-xchange.com>
Date: Fri, 27 Jun 2025 21:23:14 +0000 (+0300)
Subject: login-common: Fix potential crash when login proxy is destroyed
X-Git-Tag: 2.4.2~694
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ca5d54707e8ef2561fbb2770625d783c969ae862;p=thirdparty%2Fdovecot%2Fcore.git

login-common: Fix potential crash when login proxy is destroyed

iostream-proxy may have closed the proxy with istream first, which closed
the fd, followed by closing the ostream, which attempted to remove IO for
the already closed fd.

Use iostream_fd refcounting to make sure the fd isn't closed too early.

Fixes:
Panic: epoll_ctl(del, 22) failed: Bad file descriptor
---

diff --git a/src/login-common/client-common.c b/src/login-common/client-common.c
index 6e1dad13bd..bb5b948c7f 100644
--- a/src/login-common/client-common.c
+++ b/src/login-common/client-common.c
@@ -923,9 +923,10 @@ int client_get_plaintext_fd(struct client *client, int *fd_r, bool *close_fd_r)
 	fd_set_nonblock(fds[0], TRUE);
 	fd_set_nonblock(fds[1], TRUE);
 
-	struct ostream *output = o_stream_create_fd(fds[0], IO_BLOCK_SIZE);
-	struct istream *input =
-		i_stream_create_fd_autoclose(&fds[0], IO_BLOCK_SIZE);
+	struct ostream *output;
+	struct istream *input;
+	io_stream_create_fd_autoclose(&fds[0], IO_BLOCK_SIZE, IO_BLOCK_SIZE,
+				      &input, &output);
 	o_stream_set_no_error_handling(output, TRUE);
 
 	i_assert(client->io == NULL);