Bug 1680963

Description of problem:
Since NSS automatically load the p11-kit library, if an application is linked
to the p11-kit library (eg. using gnutls pkg-config like QEMU) and it uses NSS,
there is a strange behaviour when it calls two times or more
NSS_Init()/NSS_Shutdown().

NSS_Init() loads the p11-kit module and than calls C_GetFunctionList().
This function, among other things, calls init_globals_unlocked() that initializes
some global variables that are freed by free_modules_when_no_refs_unlocked()
usually called when the module is unloaded.

If p11-kit is not linked, the p11_proxy_module_cleanup() is called at every
NSS_Shutdown() (during the dlclose()), but if p11-kit is linked, it is called
only when the application exit and the free_modules_when_no_refs_unlocked()
is called multiple times at the end of the application, because in the
C_GetFunctionList() is created a list of State, causing the segfault.

I discovered this behaviour while debugging a QEMU BZ (https://bugzilla.redhat.com/show_bug.cgi?id=1654696.)
and I wrote a simple application to replicate the issue.

Version-Release number of selected component (if applicable):
nss (3.41.0-5.el8)
p11-kit (0.23.14-4.el8)

How reproducible:
100%

Steps to Reproduce:
1. vim nss_test.c

#include<stdlib.h>
#include<stdio.h>
#include<seccomon.h>
#include<nss.h>

int main() {
    SECStatus rv;

    for (int i = 0; i < 2; i++) {
        rv = NSS_NoDB_Init("/tmp");
        if (rv != SECSuccess) {
            fprintf(stderr, "NSS_Init failed");
            exit(-1);
        }

        rv = NSS_Shutdown();
        if (rv != SECSuccess) {
            fprintf(stderr, "NSS_Shutdown failed");
            exit(-1);
        }
    }

    return 0;
}

2. gcc -o nss_test nss_test.c `pkg-config --cflags nss` `pkg-config --libs nss` -lp11-kit

3. ./nss_test && echo "OK"

Actual results:
[1]    182629 segmentation fault (core dumped)  ./nss_test

Core was generated by `./nss_test'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007f65406b0fc3 in next_entry (iter=0x7fff6bf7dc20) at common/dict.c:70
(gdb) bt
#0  0x00007f65406b0fc3 in next_entry (iter=0x7fff6bf7dc20) at common/dict.c:70
#1  p11_dict_next (iter=0x7fff6bf7dc20, key=0x7fff6bf7dc18, value=0x0) at common/dict.c:84
#2  0x00007f6540632994 in free_modules_when_no_refs_unlocked () at p11-kit/modules.c:806
#3  0x00007f6540634989 in p11_modules_release_inlock_reentrant (
    modules=modules@entry=0x23b4080) at p11-kit/modules.c:1900
#4  0x00007f6540634f9d in p11_kit_modules_release (modules=0x23b4080)
    at p11-kit/modules.c:2295
#5  0x00007f654061dffb in p11_proxy_module_cleanup () at p11-kit/proxy.c:1733
#6  0x00007f654061b0ad in _p11_kit_fini () at ./common/init.h:61
#7  0x00007f65409bd1e6 in _dl_fini () at dl-fini.c:138
#8  0x00007f6540463ccc in __run_exit_handlers (status=0, listp=0x7f65405e9738 <__exit_funcs>,
    run_list_atexit=run_list_atexit@entry=true, run_dtors=run_dtors@entry=true) at exit.c:108
#9  0x00007f6540463e00 in __GI_exit (status=<optimized out>) at exit.c:139
#10 0x00007f654044d41a in __libc_start_main (main=0x401156 <main>, argc=1,
    argv=0x7fff6bf7df08, init=<optimized out>, fini=<optimized out>,
    rtld_fini=<optimized out>, stack_end=0x7fff6bf7def8) at ../csu/libc-start.c:342
#11 0x000000000040109e in _start ()

Expected results:
OK

Additional info:
The following patch fix the issue, but I'm not sure if it is a correct approach:

diff --git a/p11-kit/modules.c b/p11-kit/modules.c
index 0299eda..35e9137 100644
--- a/p11-kit/modules.c
+++ b/p11-kit/modules.c
@@ -800,11 +800,13 @@ free_modules_when_no_refs_unlocked (void)
        Module *mod;
        p11_dictiter iter;
 
-       /* Check if any modules have a ref count */
-       p11_dict_iterate (gl.modules, &iter);
-       while (p11_dict_next (&iter, (void **)&mod, NULL)) {
-               if (mod->ref_count)
-                       return;
+       if (gl.modules) {
+               /* Check if any modules have a ref count */
+               p11_dict_iterate (gl.modules, &iter);
+               while (p11_dict_next (&iter, (void **)&mod, NULL)) {
+                       if (mod->ref_count)
+                               return;
+               }
        }
 
        p11_dict_free (gl.unmanaged_by_funcs);