[PATCH] Fix memory leak of remote context in gpp_remote_to_local_ctx

[Scott Mayhew]

When converting a remote (gssproxy-side) context to a local one,
gpp_remote_to_local_ctx() called xdr_free() on *remote_ctx to release the
members of the gssx_ctx, but never free()'d the gssx_ctx struct itself
before clearing the pointer. The struct is allocated by the XDR layer
(gssrpc_xdr_reference) when decoding the init_sec_context reply, so this
orphaned one gssx_ctx allocation on every conversion.

This is hit on every successful sec=krb5 mount: gssd serializes the
context for the kernel via gss_export_lucid_sec_context(), which the
mechglue dispatches into gssi_inquire_sec_context_by_oid() ->
gpp_remote_to_local_ctx(), leaking the remote context each time.

Add the missing free(*remote_ctx), matching the xdr_free()+free() pattern
already used in gpm_delete_sec_context().

This fixes the following leak:

==1043== 576 bytes in 2 blocks are definitely lost in loss record 815 of 926
==1043==    at 0x4877826: malloc (vg_replace_malloc.c:447)
==1043==    by 0x5774BC1: gssrpc_xdr_reference (in /usr/lib64/libgssrpc.so.4.2)
==1043==    by 0x5725E27: xdr_gssx_res_init_sec_context (gss_proxy_xdr.c:577)
==1043==    by 0x5728512: gpm_make_call (gpm_common.c:768)
==1043==    by 0x572BC83: gpm_init_sec_context (gpm_init_sec_context.c:94)
==1043==    by 0x5731B83: gssi_init_sec_context (gpp_init_sec_context.c:158)
==1043==    by 0x48F1C62: gss_init_sec_context (in /usr/lib64/libgssapi_krb5.so.2.2)
==1043==    by 0x4A43DED: _rpc_gss_refresh (auth_gss.c:484)
==1043==    by 0x4A44A79: rpc_gss_seccreate (auth_gss.c:861)
==1043==    by 0x4010674: create_auth_rpc_client.constprop.0 (gssd_proc.c:439)
==1043==    by 0x4012C03: krb5_use_machine_creds (gssd_proc.c:660)
==1043==    by 0x4012C03: process_krb5_upcall (gssd_proc.c:789)
==1043==    by 0x4012C03: gssd_work_thread_fn (gssd_proc.c:932)
==1043==    by 0x4B649E1: start_thread (in /usr/lib64/libc.so.6)
==1043==

Assisted-by: Claude Opus 4.8 
Signed-off-by: Scott Mayhew 
---
 src/mechglue/gss_plugin.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/mechglue/gss_plugin.c b/src/mechglue/gss_plugin.c
index 0e423dd..4e2bc8f 100644
--- a/src/mechglue/gss_plugin.c
+++ b/src/mechglue/gss_plugin.c
@@ -525,6 +525,7 @@ uint32_t gpp_remote_to_local_ctx(uint32_t *minor, gssx_ctx **remote_ctx,
     free(mech.elements);
     (void)gss_release_buffer(&min, &wrap_token);
     xdr_free((xdrproc_t)xdr_gssx_ctx, (char *)(*remote_ctx));
+    free(*remote_ctx);
     *remote_ctx = NULL;
     return maj;
 }

[Simo Sorce]

Hi Scott,
would you mind opening a PR here: https://github.com/gssapi/gssproxy ?

Best,
Simo.

On Mon, 2026-08-31 at 18:32 -0400, Scott Mayhew wrote:
> When converting a remote (gssproxy-side) context to a local one,
> gpp_remote_to_local_ctx() called xdr_free() on *remote_ctx to release the
> members of the gssx_ctx, but never free()'d the gssx_ctx struct itself
> before clearing the pointer. The struct is allocated by the XDR layer
> (gssrpc_xdr_reference) when decoding the init_sec_context reply, so this
> orphaned one gssx_ctx allocation on every conversion.
>
> This is hit on every successful sec=krb5 mount: gssd serializes the
> context for the kernel via gss_export_lucid_sec_context(), which the
> mechglue dispatches into gssi_inquire_sec_context_by_oid() ->
> gpp_remote_to_local_ctx(), leaking the remote context each time.
>
> Add the missing free(*remote_ctx), matching the xdr_free()+free() pattern
> already used in gpm_delete_sec_context().
>
> This fixes the following leak:
>
> ==1043== 576 bytes in 2 blocks are definitely lost in loss record 815 of 926
> ==1043==    at 0x4877826: malloc (vg_replace_malloc.c:447)
> ==1043==    by 0x5774BC1: gssrpc_xdr_reference (in /usr/lib64/libgssrpc.so.4.2)
> ==1043==    by 0x5725E27: xdr_gssx_res_init_sec_context (gss_proxy_xdr.c:577)
> ==1043==    by 0x5728512: gpm_make_call (gpm_common.c:768)
> ==1043==    by 0x572BC83: gpm_init_sec_context (gpm_init_sec_context.c:94)
> ==1043==    by 0x5731B83: gssi_init_sec_context (gpp_init_sec_context.c:158)
> ==1043==    by 0x48F1C62: gss_init_sec_context (in /usr/lib64/libgssapi_krb5.so.2.2)
> ==1043==    by 0x4A43DED: _rpc_gss_refresh (auth_gss.c:484)
> ==1043==    by 0x4A44A79: rpc_gss_seccreate (auth_gss.c:861)
> ==1043==    by 0x4010674: create_auth_rpc_client.constprop.0 (gssd_proc.c:439)
> ==1043==    by 0x4012C03: krb5_use_machine_creds (gssd_proc.c:660)
> ==1043==    by 0x4012C03: process_krb5_upcall (gssd_proc.c:789)
> ==1043==    by 0x4012C03: gssd_work_thread_fn (gssd_proc.c:932)
> ==1043==    by 0x4B649E1: start_thread (in /usr/lib64/libc.so.6)
> ==1043==
>
> Assisted-by: Claude Opus 4.8 
> Signed-off-by: Scott Mayhew
>
> src/mechglue/gss_plugin.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/src/mechglue/gss_plugin.c b/src/mechglue/gss_plugin.c
> index 0e423dd..4e2bc8f 100644
> --- a/src/mechglue/gss_plugin.c
> +++ b/src/mechglue/gss_plugin.c
> @@ -525,6 +525,7 @@ uint32_t gpp_remote_to_local_ctx(uint32_t *minor, gssx_ctx **remote_ctx,
>      free(mech.elements);
>      (void)gss_release_buffer(&min, &wrap_token);
>      xdr_free((xdrproc_t)xdr_gssx_ctx, (char *)(*remote_ctx));
> free(*remote_ctx);
> *remote_ctx = NULL;
> return maj;
>
> }