Segmentation fault in C_CloseSession

[sandevins]

Hello everyone,

This sounds like an issue, but as I modified the code and probably is due to my provider or to any change on the code, I think it's better to put it here.

I'm trying to perform a MLDSA signature using the following command.

openssl pkeyutl -sign -inkey "pkcs11:token=PKCS11 Token;object=MLDSA_2_key;type=private" -in data.txt -out test.csr

I had to modify some of the source code (last version of main as of today) because of some logic on the backend HSM simulator. The specific change I had to made was the following.

In src/sig/mldsa.c

static CK_RV p11prov_mldsa_set_mechanism(P11PROV_SIG_CTX *sigctx)
{
    unsigned char *p_mech;
    if (sigctx->mechanism.pParameter) {
        OPENSSL_free(sigctx->mechanism.pParameter);
        sigctx->mechanism.pParameter = NULL;
        sigctx->mechanism.ulParameterLen = 0;
    }
    p_mech = OPENSSL_malloc(8);
    if (!p_mech) {
        return CKR_HOST_MEMORY;
    }
    store_int4(0, p_mech); // flags. used?
    store_int4(CKP_ML_DSA_44, p_mech + 4);
    sigctx->mechanism.mechanism = CKM_MECH_MLDSA_SIGN;
    sigctx->mechanism.pParameter = p_mech;
    sigctx->mechanism.ulParameterLen = 8;
    return CKR_OK;
}

Then I modified the p11prov_sig_freectx in `/src/sig/signature.c' adding the following line.

OPENSSL_free(sigctx->mechanism.pParameter);

I have also multiple changes on other parts of the code due to different types and definitions on the provider, but those don't allocate memory so cannot be the issue (I suppose).

The thing is that now after performing the signature, when calling C_CloseSession, a segmentation fault happens on the precise call. It's exactly this line.

ret = intf->CloseSession(hSession);

Other issue I experienced is the following.

As I have mutiple slots, the provider performs a login in all the slots. Those sessions opened at the beginning (when calling C_GenerateRandom) don't close until the end of the signature process. Sometimes the session 11 causes a segfault, sometimes it doesn't (I swear to god that sometimes I have to hate C). I notices that if I wait a little bit the error won't happen, so maybe is some dangling memory managed by the OS. Also if I introduce the PIN on the session 11, it always causes a segmentation fault.

The session where I perform the signature and always causes a segmentation fault is session 13.

A summary of when the sessions are opened.

• sessions 1-10:

• session 11-13:

There are only 2 slots and only two sessions that ask for login on the terminal.

Enter PIN for PKCS#11 Token (Slot 0 - PORT@IP- CLUSTER_0000 - SLOT_0000):
Enter PIN for PKCS#11 Token (Slot 1 - PORT@IP- CLUSTER_0000 - SLOT_0001):

Do you have any clue why this would happen? Maybe something related with how the PIN is managed.

By the way, the issue only happen with MLDSA Keys, the RSA keys work perfectly fine.

[simo5]

Looks like this has been effectively answered in #615