[nfs-utils PATCH] gssd: fix upcall_* leak when re-reading service info

[nfs-utils PATCH] gssd: fix upcall_* leak when re-reading service info

[Scott Mayhew]

gssd_scan_clnt() calls gssd_read_service_info() whenever clp->prog == 0,
and the function's fail path leaves clp->prog == 0. If an initial read
fails (e.g. the "info" file is not fully populated when inotify fires),
the fail path strdup()s the parsed values into clp->upcall_address,
upcall_port, upcall_protoname and upcall_service. A subsequent re-scan
then calls gssd_read_service_info() again and overwrites those fields
without freeing them first: the success path sets them to NULL and the
fail path strdup()s fresh copies, leaking the previous allocations.

Free the upcall_* fields at the top of the function before repopulating.
clp is calloc()'d so the fields are NULL on the first call, making the
free() calls safe.

This fixes the following leak:

==1300== 5 bytes in 1 blocks are definitely lost in loss record 13 of 929
==1300==    at 0x4877826: malloc (vg_replace_malloc.c:447)
==1300==    by 0x4B7B9FE: strdup (strdup.c:42)
==1300==    by 0x400D08D: gssd_read_service_info (gssd.c:373)
==1300==    by 0x400D08D: gssd_scan_clnt (gssd.c:734)
==1300==    by 0x400D7C6: gssd_inotify_clnt (gssd.c:922)
==1300==    by 0x400D7C6: gssd_inotify_cb (gssd.c:988)
==1300==    by 0x48B9D9B: event_persist_closure (event.c:1623)
==1300==    by 0x48B9D9B: event_process_active_single_queue (event.c:1682)
==1300==    by 0x48BA5BE: event_process_active (event.c:1783)
==1300==    by 0x48BA5BE: event_base_loop (event.c:2006)
==1300==    by 0x400A431: main (gssd.c:1292)
==1300==

Assisted-by: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Scott Mayhew <smayhew@redhat.com>
---
 utils/gssd/gssd.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/utils/gssd/gssd.c b/utils/gssd/gssd.c
index e381c0f2..223d5dfe 100644
--- a/utils/gssd/gssd.c
+++ b/utils/gssd/gssd.c
@@ -276,6 +276,21 @@ gssd_read_service_info(int dirfd, struct clnt_info *clp)
 	char *port = NULL;
 	char *servername = NULL;
 
+	/*
+	 * This may be a re-scan of a client whose previous read failed
+	 * (gssd_scan_clnt only calls us while clp->prog == 0, which the fail
+	 * path below leaves set).  Free any upcall_* values left over from that
+	 * attempt so we don't leak them when we repopulate the fields below.
+	 */
+	free(clp->upcall_address);
+	free(clp->upcall_port);
+	free(clp->upcall_protoname);
+	free(clp->upcall_service);
+	clp->upcall_address = NULL;
+	clp->upcall_port = NULL;
+	clp->upcall_protoname = NULL;
+	clp->upcall_service = NULL;
+
 	fd = openat(dirfd, "info", O_RDONLY);
 	if (fd < 0) {
 		printerr(0, "ERROR: can't open %s/info: %s\n",
-- 
2.55.0