shpedoikal/opencryptoki — comment on commit 5ec4ac1b86e96085d7d64c432c57777f5ab7cd12
File:  line 0
By joylatten:

How testcase found this issue:

The spinlock test create a bunch of children that go off and run several loops of obj_mgmt_lock_tests. obj_mgmt_lock_tests does object management stuff that requires the spinlocks. Stuff like Creating, Copying, Destroying, Finding objects and getting, setting attribute values.

I noticed that on the cca token each time I ran the test, some of the children segfault. And the segfault was always in
template_unflatten_withSize() although the api call was sometimes different. (See core below.)

My first thought was that objects were moving around faster than they could be accounted for... for example, one child
might be accessing objects that another childs had just removed. I thought it might be another lock problem, but it did not
happen on the other tokens.

I noticed that cca had its own loadsave.c where reload_token_object() resides. The other tokens used the one in
common.c. So, I took a look at common/loadsave.c and saw some differences in the routines.

My analysis (its foggy) was that in reload_token_object() we were trying to fread an object that perhaps been removed.
The fread() parameters seem backwards to me and it also was not checking to see if we successfully read anything.

I also wondered about load_public_token_objects() since cca's was different from what was in common.
I thought this might be where we first read index and load/create object list and if we did not check for 0 from fread() in this routine,
we may include objects that had been removed or we should be ignoring. And this would get passed to reload_token_object().

Core was generated by `./obj_mgmt_lock_tests -slot 1\'.
Program terminated with signal 11, Segmentation fault.
#0 0x000003fffcf7deca in template_unflatten_withSize (new_tmpl=0x3ffffc39770,
buf=, count=,
buf_size=) at ../common/template.c:1066
1066 memcpy( pb2, pb, a1->ulValueLen );
Missing separate debuginfos, use: debuginfo-install csulcca-4.1.0-06.s390x glibc-2.12-1.47.el6.s390x libica-2.1.0-2.el6.s390x openssl-1.0.0-20.el6.s390x zlib-1.2.3-27.el6.s390x
(gdb) where
#0 0x000003fffcf7deca in template_unflatten_withSize (new_tmpl=0x3ffffc39770,
buf=, count=,
buf_size=) at ../common/template.c:1066
#1 0x000003fffcf84a4e in object_restore_withSize (data=0x3fff8001c50 \"\",
new_obj=0x3ffffc39820, replace=,
data_size=) at ../common/object.c:931
#2 0x000003fffcf7b83c in object_mgr_restore_obj_withSize (
data=, oldObj=,
data_size=) at ../common/obj_mgr.c:1844
#3 0x000003fffcf86854 in reload_token_object (obj=0x3fff80020b0)
at loadsave.c:1087
#4 0x000003fffcf7a976 in object_mgr_update_priv_tok_obj_from_shm ()
at ../common/obj_mgr.c:2410
#5 0x000003fffcf7aaec in object_mgr_update_from_shm ()
at ../common/obj_mgr.c:2290
#6 0x000003fffcf7b538 in object_mgr_find_init (sess=0x3fff8002bf0,
pTemplate=0x3ffffc3afd0, ulCount=1) at ../common/obj_mgr.c:1532
#7 0x000003fffd0bb570 in C_FindObjectsInit (hSession=,
pTemplate=0x3ffffc3afd0, ulCount=1) at api_interface.c:1911
#8 0x0000000080002c80 in do_CreateTokenObjects () at obj_mgmt_lock.c:863
#9 0x000000008000530c in obj_mgmt_functions () at obj_mgmt_lock.c:1231
#10 0x0000000080005414 in main (argc=,
argv=) at obj_mgmt_lock.c:1278
(gdb)