283658 - PK11_DestroyContext destroys session then destroys key

Status: RESOLVED INVALID

(NSS :: Libraries, defect)

Description

[Nelson Bolyard (seldom reads bugmail)]

While investigating bug 283654, I noticed that PK11_DestroyContext first calls 

pk11_CloseSession(context->slot,context->session,context->ownSession);

then calls

PK11_FreeSymKey(context->key);

It appears to me that the first of these operations will invalidate the
session key handle for that key by destroying the session via C_CloseSession,
and the second will (er, may) then pass that invalidated handle to the PKCS11
module's C_DestroyObject function.  

We really don't want to be attempting to destroy objects that have 
already been destroyed, explicitly or implicitly (via C_CloseSession).
It's wrong, wastes time, and may destroy an object handle that has been 
reissued by the module to another thread.

Comment 1

[Robert Relyea]

The code is correct.

Keys do not have the same session as contexts for historical reasons. 
(They are created before the contexts, and they may be used by more than one
context).

If we do have some case where the context session is inherited from the key, the
contest session should not be 'owned' by the context (that would be a bug in the
code that created the context).

bob