#3 Fix crash in PKCS11 engine when used via p11-kit
Merged a year ago by nmav. Opened a year ago by abbra.
rpms/ abbra/softhsm master  into  master

@@ -0,0 +1,72 @@ 

+ From 16f994e7944a917fa81c8db11c56c594f4e78b40 Mon Sep 17 00:00:00 2001

+ From: Alexander Bokovoy <abokovoy@redhat.com>

+ Date: Tue, 31 Jul 2018 14:59:03 +0300

+ Subject: [PATCH] Reset mutex callbacks to the default version when finished

+ 

+ If a PKCS11 API caller provided own mutex handling callbacks,

+ we need to ensure they aren't used after C_Finalize is called

+ and SoftHSM instance is recycled.

+ 

+ Inability to do so may lead to a situation where callbacks might

+ be provided by a different dynamically loaded object which is removed

+ after C_Finalize() call. Thus, callback pointers become invalid and

+ calling them leads to crashes.

+ 

+ Fixes: https://github.com/opendnssec/SoftHSMv2/issues/408

+ 

+ Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>

+ ---

+  src/lib/SoftHSM.cpp | 16 ++++++++++++----

+  1 file changed, 12 insertions(+), 4 deletions(-)

+ 

+ diff --git a/src/lib/SoftHSM.cpp b/src/lib/SoftHSM.cpp

+ index ee94d3f..e4cc044 100644

+ --- a/src/lib/SoftHSM.cpp

+ +++ b/src/lib/SoftHSM.cpp

+ @@ -314,6 +314,15 @@ static CK_ATTRIBUTE bsAttribute(CK_ATTRIBUTE_TYPE type, const ByteString &value)

+  /*****************************************************************************

+   Implementation of SoftHSM class specific functions

+   *****************************************************************************/

+ +static void resetMutexFactoryCallbacks()

+ +{

+ +	// Reset MutexFactory callbacks to our versions

+ +	MutexFactory::i()->setCreateMutex(OSCreateMutex);

+ +	MutexFactory::i()->setDestroyMutex(OSDestroyMutex);

+ +	MutexFactory::i()->setLockMutex(OSLockMutex);

+ +	MutexFactory::i()->setUnlockMutex(OSUnlockMutex);

+ +}

+ +

+  

+  // Return the one-and-only instance

+  SoftHSM* SoftHSM::i()

+ @@ -342,6 +351,7 @@ SoftHSM::SoftHSM()

+  	slotManager = NULL;

+  	sessionManager = NULL;

+  	handleManager = NULL;

+ +	resetMutexFactoryCallbacks();

+  }

+  

+  // Destructor

+ @@ -352,6 +362,7 @@ SoftHSM::~SoftHSM()

+  	if (slotManager != NULL) delete slotManager;

+  	if (objectStore != NULL) delete objectStore;

+  	if (sessionObjectStore != NULL) delete sessionObjectStore;

+ +	resetMutexFactoryCallbacks();

+  }

+  

+  /*****************************************************************************

+ @@ -402,10 +413,7 @@ CK_RV SoftHSM::C_Initialize(CK_VOID_PTR pInitArgs)

+  			if (args->flags & CKF_OS_LOCKING_OK)

+  			{

+  				// Use our own mutex functions.

+ -				MutexFactory::i()->setCreateMutex(OSCreateMutex);

+ -				MutexFactory::i()->setDestroyMutex(OSDestroyMutex);

+ -				MutexFactory::i()->setLockMutex(OSLockMutex);

+ -				MutexFactory::i()->setUnlockMutex(OSUnlockMutex);

+ +				resetMutexFactoryCallbacks();

+  				MutexFactory::i()->enable();

+  			}

+  			else

+ -- 

+ 2.17.1

+ 

file modified
+6 -1

@@ -3,13 +3,14 @@ 

  Summary: Software version of a PKCS#11 Hardware Security Module

  Name: softhsm

  Version: 2.3.0

- Release: %{?prever:0.}3%{?prever:.%{prever}}%{?dist}.2

+ Release: %{?prever:0.}4%{?prever:.%{prever}}%{?dist}

  License: BSD

  Url: http://www.opendnssec.org/

  Source: http://dist.opendnssec.org/source/%{?prever:testing/}%{name}-%{version}.tar.gz

  Source1: http://dist.opendnssec.org/source/%{?prever:testing/}%{name}-%{version}.tar.gz.sig

  

  Patch0: softhsm-2.3.0-rsa-pss.patch

+ Patch1: 0001-Reset-mutex-callbacks-to-the-default-version-when-fi.patch

  

  Group: Applications/System

  BuildRequires: openssl-devel >= 1.0.1k-6, sqlite-devel >= 3.4.2, cppunit-devel

@@ -44,6 +45,7 @@ 

  %setup -q -n %{name}-%{version}%{?prever}

  

  %patch0 -p1

+ %patch1 -p1

  

  %if 0%{?prever:1}

  autoreconf -fiv

@@ -116,6 +118,9 @@ 

  fi

  

  %changelog

+ * Tue Jul 31 2018 Alexander Bokovoy <abokovoy@redhat.com> - 2.3.0-4

+ - Fix crash when used via p11-kit (#1607635)

+ 

  * Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.3.0-3.2

  - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild

  

This is a backport of https://github.com/opendnssec/SoftHSMv2/pull/409

It is required to allow FreeIPA deployment in Rawhide as otherwise ipa-server-install crashes when running ns-slapd LDIF import.

Resolves: rhbz#1607635

Pull-Request has been merged by nmav

a year ago