opencryptoki/opencryptoki-3.14.0-early-error-in-c-initialize.patch

86 lines
4.3 KiB
Diff

commit 2585fc1a52afdfc6ec119e6a27d7c5d52c06d4e2
Author: Alexander Scheel <ascheel@redhat.com>
Date: Wed Jul 1 08:23:42 2020 -0400
Handle early error cases in C_Initialize
When C_Initialize errors prior to the bt_init call, bt_destroy will be
called on garbage memory because Anchor hasn't yet been zeroed. This
gives a stack trace such as:
Stack trace of thread 27740:
#0 0x00007fce91552b05 raise (libc.so.6 + 0x3cb05)
#1 0x00007fce9153b8a4 abort (libc.so.6 + 0x258a4)
#2 0x00007fce908db2e1 _ZN2os5abortEb.cold (libjvm.so + 0x20f2e1)
#3 0x00007fce911f76c2 _ZN7VMError14report_and_dieEv (libjvm.so + 0xb2b6c2)
#4 0x00007fce90fe7a24 JVM_handle_linux_signal (libjvm.so + 0x91ba24)
#5 0x00007fce90fdaa9c _Z13signalHandleriP9siginfo_tPv (libjvm.so + 0x90ea9c)
#6 0x00007fce91552b90 __restore_rt (libc.so.6 + 0x3cb90)
#7 0x00007fce7a262550 bt_destroy (libopencryptoki.so + 0x11550)
#8 0x00007fce7a2600d6 C_Initialize (libopencryptoki.so + 0xf0d6)
#9 0x00007fce7a6c8234 initialize_module_inlock_reentrant (p11-kit-proxy.so + 0x2d234)
#10 0x00007fce7a6c8383 managed_C_Initialize (p11-kit-proxy.so + 0x2d383)
#11 0x00007fce7a6cabe0 p11_kit_modules_initialize (p11-kit-proxy.so + 0x2fbe0)
#12 0x00007fce7a6cea97 proxy_C_Initialize (p11-kit-proxy.so + 0x33a97)
#13 0x00007fce7aaaa6f2 secmod_ModuleInit (libnss3.so + 0x486f2)
#14 0x00007fce7aaaae4a secmod_LoadPKCS11Module (libnss3.so + 0x48e4a)
#15 0x00007fce7aab800d SECMOD_LoadModule (libnss3.so + 0x5600d)
#16 0x00007fce7aab8148 SECMOD_LoadModule (libnss3.so + 0x56148)
#17 0x00007fce7aa80dc1 nss_Init (libnss3.so + 0x1edc1)
#18 0x00007fce7aa8124d NSS_InitReadWrite (libnss3.so + 0x1f24d)
#19 0x00007fce7ac47a29 Java_org_mozilla_jss_CryptoManager_initializeAllNative2 (libjss4.so + 0x15a29)
#20 0x00007fce7c8133c7 n/a (n/a + 0x0)
#21 0x00007fce7c802ffd n/a (n/a + 0x0)
#22 0x00007fce7c802ffd n/a (n/a + 0x0)
#23 0x00007fce7c802ffd n/a (n/a + 0x0)
#24 0x00007fce7c802ffd n/a (n/a + 0x0)
#25 0x00007fce7c802ffd n/a (n/a + 0x0)
#26 0x00007fce7c802ffd n/a (n/a + 0x0)
#27 0x00007fce7c802ffd n/a (n/a + 0x0)
#28 0x00007fce7c802ffd n/a (n/a + 0x0)
#29 0x00007fce7c802ffd n/a (n/a + 0x0)
#30 0x00007fce7c7fb4e7 n/a (n/a + 0x0)
#31 0x00007fce90d60e45 _ZN9JavaCalls11call_helperEP9JavaValueP12methodHandleP17JavaCallArgumentsP6Thread (libjvm.so + 0x694e45)
#32 0x00007fce90d8488d _ZL17jni_invoke_staticP7JNIEnv_P9JavaValueP8_jobject11JNICallTypeP10_jmethodIDP18JNI_ArgumentPusherP6Thread.constprop.1 (libjvm.so + 0x6b888d)
#33 0x00007fce90d87996 jni_CallStaticVoidMethod (libjvm.so + 0x6bb996)
#34 0x00007fce916ee877 JavaMain (libjli.so + 0x4877)
#35 0x00007fce914dc3f9 start_thread (libpthread.so.0 + 0x93f9)
#36 0x00007fce916183b3 __clone (libc.so.6 + 0x1023b3)
Fixing this requires zeroing Anchor earlier, making t->size 0 and
allowing bt_destroy to exit with accessing uninitialized memory.
Resolves: #304
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
diff --git a/usr/lib/api/api_interface.c b/usr/lib/api/api_interface.c
index 51ab30fe..f61f2368 100644
--- a/usr/lib/api/api_interface.c
+++ b/usr/lib/api/api_interface.c
@@ -2557,6 +2557,11 @@ CK_RV C_Initialize(CK_VOID_PTR pVoid)
// Clear out the load list
memset(slot_loaded, 0, sizeof(int) * NUMBER_SLOTS_MANAGED);
+ // Zero out API_Proc_Struct
+ // This must be done prior to all goto error calls, else bt_destroy()
+ // will fail because it accesses uninitialized memory when t->size > 0.
+ memset(Anchor, 0, sizeof(API_Proc_Struct_t));
+
TRACE_DEBUG("Anchor allocated at %s\n", (char *) Anchor);
// Validation of the parameters passed
@@ -2653,12 +2658,10 @@ CK_RV C_Initialize(CK_VOID_PTR pVoid)
rc = CKR_FUNCTION_FAILED;
goto error;
}
- //Zero out API_Proc_Struct
//Map Shared Memory Region
//if ( Shared Memory Mapped not Successful )
// Free allocated Memory
// Return CKR_HOST_MEMORY
- memset((char *) Anchor, 0, sizeof(API_Proc_Struct_t));
bt_init(&Anchor->sess_btree, free);
Anchor->Pid = getpid();