When converting a remote (gssproxy-side) context to a local one,
gpp_remote_to_local_ctx() called xdr_free() on *remote_ctx to release the
members of the gssx_ctx, but never free()'d the gssx_ctx struct itself
before clearing the pointer. The struct is allocated by the XDR layer
(gssrpc_xdr_reference) when decoding the init_sec_context reply, so this
orphaned one gssx_ctx allocation on every conversion.
This is hit on every successful sec=krb5 mount: gssd serializes the
context for the kernel via gss_export_lucid_sec_context(), which the
mechglue dispatches into gssi_inquire_sec_context_by_oid() ->
gpp_remote_to_local_ctx(), leaking the remote context each time.
Add the missing free(*remote_ctx), matching the xdr_free()+free() pattern
already used in gpm_delete_sec_context().
This fixes the following leak:
==1043== 576 bytes in 2 blocks are definitely lost in loss record 815 of 926
==1043== at 0x4877826: malloc (vg_replace_malloc.c:447)
==1043== by 0x5774BC1: gssrpc_xdr_reference (in /usr/lib64/libgssrpc.so.4.2)
==1043== by 0x5725E27: xdr_gssx_res_init_sec_context (gss_proxy_xdr.c:577)
==1043== by 0x5728512: gpm_make_call (gpm_common.c:768)
==1043== by 0x572BC83: gpm_init_sec_context (gpm_init_sec_context.c:94)
==1043== by 0x5731B83: gssi_init_sec_context (gpp_init_sec_context.c:158)
==1043== by 0x48F1C62: gss_init_sec_context (in /usr/lib64/libgssapi_krb5.so.2.2)
==1043== by 0x4A43DED: _rpc_gss_refresh (auth_gss.c:484)
==1043== by 0x4A44A79: rpc_gss_seccreate (auth_gss.c:861)
==1043== by 0x4010674: create_auth_rpc_client.constprop.0 (gssd_proc.c:439)
==1043== by 0x4012C03: krb5_use_machine_creds (gssd_proc.c:660)
==1043== by 0x4012C03: process_krb5_upcall (gssd_proc.c:789)
==1043== by 0x4012C03: gssd_work_thread_fn (gssd_proc.c:932)
==1043== by 0x4B649E1: start_thread (in /usr/lib64/libc.so.6)
==1043==
Assisted-by: Claude Opus 4.8 <noreply(a)anthropic.com>
Signed-off-by: Scott Mayhew <smayhew(a)redhat.com>
---
src/mechglue/gss_plugin.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/mechglue/gss_plugin.c b/src/mechglue/gss_plugin.c
index 0e423dd..4e2bc8f 100644
--- a/src/mechglue/gss_plugin.c
+++ b/src/mechglue/gss_plugin.c
@@ -525,6 +525,7 @@ uint32_t gpp_remote_to_local_ctx(uint32_t *minor, gssx_ctx **remote_ctx,
free(mech.elements);
(void)gss_release_buffer(&min, &wrap_token);
xdr_free((xdrproc_t)xdr_gssx_ctx, (char *)(*remote_ctx));
+ free(*remote_ctx);
*remote_ctx = NULL;
return maj;
}
--
2.55.0
