239827 - NSS has race condition in unwrap key code.

Status: VERIFIED FIXED

(NSS :: Libraries, defect)

Description

[Robert Relyea]

Bug reported byt [e-mail]:

This bug is triggered when the application is under stress by multiple threads. 
I think the stack trace that we captured supports the fact that the problem is 
originated from PK11_UnwrapPrivKey where we forgot to enter a monitor that 
protects the C_UnwrapKey function.

Comment 1

[Robert Relyea]

The problem is in multiple creations of non-permanant keys. For permanent keys, 
the appropriate locks or threadsafe session handle is acquired.

bob

Comment 2

[Robert Relyea]

Attachment: Add the appropriate locks. - Version NSS 3.7

Comment 3

[Robert Relyea]

Attachment: Add locks, patch for nss 3.9

Comment 4

[Robert Relyea]

This patch has been verified on NSS 3.7 by thomask.

Comment 5

[Wan-Teh Chang]

Comment on attachment 145559 [details] [diff] [review]
Add the appropriate locks. - Version NSS 3.7

r=wtc.

Comment 6

[Wan-Teh Chang]

This fix should go into 3.9.1.  Fortunately the code
path is not executed by the NISCC tests so the fix
does not invalidate the NISCC testing Bishakha has
done.

Comment 7

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 145559 [details] [diff] [review]
Add the appropriate locks. - Version NSS 3.7

This patch appears to be correct.  However, it seems odd that all such
operations will now be single threaded for session objects, but not for token
objects.  
But this operation is thought to be very rare, so maybe this detail doesn't
matter.  r=MisterSSL

Comment 8

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 145560 [details] [diff] [review]
Add locks, patch for nss 3.9

Both of these patches are effectively identical.  So my comments apply to both.

Comment 9

[Nelson Bolyard (seldom reads bugmail)]

Bob,  This bug has several patches all r+ and sr+
Are these patchces checked in now?  If not, why not?
Can this bug be closed?

Comment 10

[Wan-Teh Chang]

Marked the bug fixed and verified.  The fix is
in the tip (3.10), NSS_3_9_BRANCH (3.9.1), and
NSS_3_7_BRANCH (3.7.11).  The fix was verified
by the original bug reporter (Thomas Kwan).

Comment 11

[Robert Relyea]

For future reference:

3.7 patch was pk11skey.c rev 1.57.2.9
3.9 patch was pk11skey.c rev 1.84.2.1
Trunk patch was pk11skey.c rev 1.86

bob