Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Version-Release number of selected component (if applicable):
nss-3.12.10-17.el6_2
How reproducible:
100%
Steps to Reproduce:
1. run the attached test-case
Actual results:
43,008 bytes in 256 blocks are definitely lost in loss record 75 of 75
at 0x4A04A28: calloc (vg_replace_malloc.c:467)
by 0x331A4236CC: PR_NewLock (ptsynch.c:174)
by 0x4C36D24: nssCKFWMutex_Create (mutex.c:137)
by 0x4C36989: nssCKFWInstance_Create (instance.c:245)
by 0x4C40FAF: NSSCKFWC_Initialize (wrap.c:205)
by 0x4E98F06: secmod_ModuleInit (pk11load.c:252)
by 0x4E99886: secmod_LoadPKCS11Module (pk11load.c:492)
by 0x4EAE354: SECMOD_LoadModule (pk11pars.c:1121)
by 0x4EAE5C7: SECMOD_LoadUserModule (pk11pars.c:1209)
by 0x40080F: main (ckfw-leak.c:19)
LEAK SUMMARY:
definitely lost: 43,008 bytes in 256 blocks
indirectly lost: 0 bytes in 0 blocks
possibly lost: 0 bytes in 0 blocks
still reachable: 11,137 bytes in 88 blocks
suppressed: 0 bytes in 0 blocks
Expected results (I get this after downgrade to nss-3.12.10-11.el6):
LEAK SUMMARY:
definitely lost: 0 bytes in 0 blocks
indirectly lost: 0 bytes in 0 blocks
possibly lost: 0 bytes in 0 blocks
still reachable: 11,137 bytes in 88 blocks
suppressed: 0 bytes in 0 blocks
Additional info:
The CKFW code has been broken since RHEL-6.0, but it did not take any effect until nss-3.12.10-13.el6, where the following patch was applied:
--- ./mozilla/security/nss/lib/ckfw/pem/pinst.c.735047
+++ ./mozilla/security/nss/lib/ckfw/pem/pinst.c
@@ -377,7 +377,6 @@ AddCertificate(char *certfile, char *key
CK_SLOT_ID slotID)
{
pemInternalObject *o;
- SECItem certDER;
CK_RV error = 0;
int objid, i;
int nobjs = 0;
@@ -385,7 +384,6 @@ AddCertificate(char *certfile, char *key
char *ivstring = NULL;
int cipher;
- certDER.data = NULL;
nobjs = ReadDERFromFile(&objs, certfile, PR_TRUE, &cipher, &ivstring, PR_TRUE /* certs only */);
if (nobjs <= 0) {
nss_ZFreeIf(objs);
@@ -469,32 +467,36 @@ pem_Initialize
)
{
CK_RV rv;
- /* parse the initialization string and initialize CRLInstances */
+ /* parse the initialization string */
char **certstrings = NULL;
+ char *modparms = NULL;
PRInt32 numcerts = 0;
PRBool status, error = PR_FALSE;
int i;
+ CK_C_INITIALIZE_ARGS_PTR modArgs = NULL;
+
+ if (!fwInstance) return CKR_ARGUMENTS_BAD;
+
+ modArgs = NSSCKFWInstance_GetInitArgs(fwInstance);
+ if (modArgs &&
+ ((modArgs->flags & CKF_OS_LOCKING_OK) || (modArgs->CreateMutex != 0))) {
+ return CKR_CANT_LOCK;
+ }
Comment on attachment 549053[details]
proposed fix
r+
So the mutex is an instance variable, do we do the mutex destroy in the finalize as well? (Sometimes the framework depends too much on arenas to do cleanup).
bob
(In reply to comment #4)
> So the mutex is an instance variable, do we do the mutex destroy in the
> finalize as well?
If finalize means NSSCKFWC_Finalize(), it seems we do. It calls nssCKFWInstance_Destroy(), which calls nssCKFWMutex_Destroy(fwInstance->mutex).
Cool, then it was just the error path that was wrong.
Elio, could you make sure we get an upstream bug for this. The issue affects all ckfw modules, not just libpem... most particularly the builtins module (but also libcapi on windows and libmkey on mac).
bob
Comment 7Elio Maldonado Batiz
2012-01-03 22:29:05 UTC
Comment 12Kai Engert (:kaie) (inactive account)
2012-03-05 18:11:41 UTC
Kamil, as I understand it, your patch was added upstream and will be contained in NSS 3.13.2 and newer.
I understand Elio already works on including the newer 3.13.3 into RHEL-6.3
I conclude this bug can be closed?
Comment 21Elio Maldonado Batiz
2012-04-26 18:27:29 UTC
Technical note added. If any revisions are required, please edit the "Technical Notes" field
accordingly. All revisions will be proofread by the Engineering Content Services team.
New Contents:
No documentation needed
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
http://rhn.redhat.com/errata/RHSA-2012-0973.html
Version-Release number of selected component (if applicable): nss-3.12.10-17.el6_2 How reproducible: 100% Steps to Reproduce: 1. run the attached test-case Actual results: 43,008 bytes in 256 blocks are definitely lost in loss record 75 of 75 at 0x4A04A28: calloc (vg_replace_malloc.c:467) by 0x331A4236CC: PR_NewLock (ptsynch.c:174) by 0x4C36D24: nssCKFWMutex_Create (mutex.c:137) by 0x4C36989: nssCKFWInstance_Create (instance.c:245) by 0x4C40FAF: NSSCKFWC_Initialize (wrap.c:205) by 0x4E98F06: secmod_ModuleInit (pk11load.c:252) by 0x4E99886: secmod_LoadPKCS11Module (pk11load.c:492) by 0x4EAE354: SECMOD_LoadModule (pk11pars.c:1121) by 0x4EAE5C7: SECMOD_LoadUserModule (pk11pars.c:1209) by 0x40080F: main (ckfw-leak.c:19) LEAK SUMMARY: definitely lost: 43,008 bytes in 256 blocks indirectly lost: 0 bytes in 0 blocks possibly lost: 0 bytes in 0 blocks still reachable: 11,137 bytes in 88 blocks suppressed: 0 bytes in 0 blocks Expected results (I get this after downgrade to nss-3.12.10-11.el6): LEAK SUMMARY: definitely lost: 0 bytes in 0 blocks indirectly lost: 0 bytes in 0 blocks possibly lost: 0 bytes in 0 blocks still reachable: 11,137 bytes in 88 blocks suppressed: 0 bytes in 0 blocks Additional info: The CKFW code has been broken since RHEL-6.0, but it did not take any effect until nss-3.12.10-13.el6, where the following patch was applied: --- ./mozilla/security/nss/lib/ckfw/pem/pinst.c.735047 +++ ./mozilla/security/nss/lib/ckfw/pem/pinst.c @@ -377,7 +377,6 @@ AddCertificate(char *certfile, char *key CK_SLOT_ID slotID) { pemInternalObject *o; - SECItem certDER; CK_RV error = 0; int objid, i; int nobjs = 0; @@ -385,7 +384,6 @@ AddCertificate(char *certfile, char *key char *ivstring = NULL; int cipher; - certDER.data = NULL; nobjs = ReadDERFromFile(&objs, certfile, PR_TRUE, &cipher, &ivstring, PR_TRUE /* certs only */); if (nobjs <= 0) { nss_ZFreeIf(objs); @@ -469,32 +467,36 @@ pem_Initialize ) { CK_RV rv; - /* parse the initialization string and initialize CRLInstances */ + /* parse the initialization string */ char **certstrings = NULL; + char *modparms = NULL; PRInt32 numcerts = 0; PRBool status, error = PR_FALSE; int i; + CK_C_INITIALIZE_ARGS_PTR modArgs = NULL; + + if (!fwInstance) return CKR_ARGUMENTS_BAD; + + modArgs = NSSCKFWInstance_GetInitArgs(fwInstance); + if (modArgs && + ((modArgs->flags & CKF_OS_LOCKING_OK) || (modArgs->CreateMutex != 0))) { + return CKR_CANT_LOCK; + }