From d9d58d44c27105b9dceb987da6c60b31331abfe9 Mon Sep 17 00:00:00 2001 From: Scott Mayhew Date: Mon, 31 Aug 2026 15:09:48 -0400 Subject: [PATCH] Fix memory leak of remote context in gpp_remote_to_local_ctx When converting a remote (gssproxy-side) context to a local one, gpp_remote_to_local_ctx() called xdr_free() on *remote_ctx to release the members of the gssx_ctx, but never free()'d the gssx_ctx struct itself before clearing the pointer. The struct is allocated by the XDR layer (gssrpc_xdr_reference) when decoding the init_sec_context reply, so this orphaned one gssx_ctx allocation on every conversion. This is hit on every successful sec=krb5 mount: gssd serializes the context for the kernel via gss_export_lucid_sec_context(), which the mechglue dispatches into gssi_inquire_sec_context_by_oid() -> gpp_remote_to_local_ctx(), leaking the remote context each time. Add the missing free(*remote_ctx), matching the xdr_free()+free() pattern already used in gpm_delete_sec_context(). This fixes the following leak: ==1043== 576 bytes in 2 blocks are definitely lost in loss record 815 of 926 ==1043== at 0x4877826: malloc (vg_replace_malloc.c:447) ==1043== by 0x5774BC1: gssrpc_xdr_reference (in /usr/lib64/libgssrpc.so.4.2) ==1043== by 0x5725E27: xdr_gssx_res_init_sec_context (gss_proxy_xdr.c:577) ==1043== by 0x5728512: gpm_make_call (gpm_common.c:768) ==1043== by 0x572BC83: gpm_init_sec_context (gpm_init_sec_context.c:94) ==1043== by 0x5731B83: gssi_init_sec_context (gpp_init_sec_context.c:158) ==1043== by 0x48F1C62: gss_init_sec_context (in /usr/lib64/libgssapi_krb5.so.2.2) ==1043== by 0x4A43DED: _rpc_gss_refresh (auth_gss.c:484) ==1043== by 0x4A44A79: rpc_gss_seccreate (auth_gss.c:861) ==1043== by 0x4010674: create_auth_rpc_client.constprop.0 (gssd_proc.c:439) ==1043== by 0x4012C03: krb5_use_machine_creds (gssd_proc.c:660) ==1043== by 0x4012C03: process_krb5_upcall (gssd_proc.c:789) ==1043== by 0x4012C03: gssd_work_thread_fn (gssd_proc.c:932) ==1043== by 0x4B649E1: start_thread (in /usr/lib64/libc.so.6) ==1043== Assisted-by: Claude Opus 4.8 Signed-off-by: Scott Mayhew --- src/mechglue/gss_plugin.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/mechglue/gss_plugin.c b/src/mechglue/gss_plugin.c index 0e423dd44..4e2bc8fb7 100644 --- a/src/mechglue/gss_plugin.c +++ b/src/mechglue/gss_plugin.c @@ -525,6 +525,7 @@ uint32_t gpp_remote_to_local_ctx(uint32_t *minor, gssx_ctx **remote_ctx, free(mech.elements); (void)gss_release_buffer(&min, &wrap_token); xdr_free((xdrproc_t)xdr_gssx_ctx, (char *)(*remote_ctx)); + free(*remote_ctx); *remote_ctx = NULL; return maj; }