core: make sure to close connection fd when we fail to activate a per-connection service

Fixes: #2993 #2691

3 files changed, 7 insertions, 2 deletions

diff --git a/src/core/service.c b/src/core/service.c
index 3c4328c584..88f8cc5795 100644
--- a/src/core/service.c
+++ b/src/core/service.c
@@ -180,7 +180,7 @@ static int service_set_main_pid(Service *s, pid_t pid) {
         return 0;
 }
 
-static void service_close_socket_fd(Service *s) {
+void service_close_socket_fd(Service *s) {
         assert(s);
 
         s->socket_fd = asynchronous_close(s->socket_fd);
diff --git a/src/core/service.h b/src/core/service.h
index cd9e41646e..c7f1e81bdb 100644
--- a/src/core/service.h
+++ b/src/core/service.h
@@ -198,6 +198,7 @@ struct Service {
 extern const UnitVTable service_vtable;
 
 int service_set_socket_fd(Service *s, int fd, struct Socket *socket, bool selinux_context_net);
+void service_close_socket_fd(Service *s);
 
 const char* service_restart_to_string(ServiceRestart i) _const_;
 ServiceRestart service_restart_from_string(const char *s) _pure_;
diff --git a/src/core/socket.c b/src/core/socket.c
index 42260d8729..a897a11a29 100644
--- a/src/core/socket.c
+++ b/src/core/socket.c
@@ -2010,8 +2010,12 @@ static void socket_enter_running(Socket *s, int cfd) {
                 s->n_connections++;
 
                 r = manager_add_job(UNIT(s)->manager, JOB_START, UNIT(service), JOB_REPLACE, &error, NULL);
-                if (r < 0)
+                if (r < 0) {
+                        /* We failed to activate the new service, but it still exists. Let's make sure the service
+                         * closes and forgets the connection fd again, immediately. */
+                        service_close_socket_fd(service);
                         goto fail;
+                }
 
                 /* Notify clients about changed counters */
                 unit_add_to_dbus_queue(UNIT(s));