Bug 1273678 - Own PK11SlotInfos in NSSSlot/NSSToken r=franziskus (thx=keeler)

Differential Revision: https://nss-review.dev.mozaws.net/D332

2 files changed, 19 insertions, 6 deletions

diff --git a/lib/dev/devslot.c b/lib/dev/devslot.c
index c3c05be9a..7e8bfcd64 100644
--- a/lib/dev/devslot.c
+++ b/lib/dev/devslot.c
@@ -31,6 +31,7 @@ nssSlot_Destroy(
 {
     if (slot) {
         if (PR_ATOMIC_DECREMENT(&slot->base.refCount) == 0) {
+            PK11_FreeSlot(slot->pk11slot);
             PZ_DestroyLock(slot->base.lock);
             return nssArena_Destroy(slot->base.arena);
         }
@@ -224,10 +225,17 @@ NSS_IMPLEMENT NSSToken *
 nssSlot_GetToken(
     NSSSlot *slot)
 {
-    if (nssSlot_IsTokenPresent(slot)) {
-        return nssToken_AddRef(slot->token);
+    NSSToken *rvToken = NULL;
+    nssSlot_EnterMonitor(slot);
+
+    /* Even if a token should be present, check `slot->token` too as it
+     * might be gone already. This would happen mostly on shutdown. */
+    if (nssSlot_IsTokenPresent(slot) && slot->token) {
+        rvToken = nssToken_AddRef(slot->token);
     }
-    return (NSSToken *)NULL;
+
+    nssSlot_ExitMonitor(slot);
+    return rvToken;
 }
 
 NSS_IMPLEMENT PRStatus
diff --git a/lib/dev/devtoken.c b/lib/dev/devtoken.c
index 40f2acaae..0d4c3b5a7 100644
--- a/lib/dev/devtoken.c
+++ b/lib/dev/devtoken.c
@@ -29,11 +29,16 @@ nssToken_Destroy(
 {
     if (tok) {
         if (PR_ATOMIC_DECREMENT(&tok->base.refCount) == 0) {
+            PK11_FreeSlot(tok->pk11slot);
             PZ_DestroyLock(tok->base.lock);
             nssTokenObjectCache_Destroy(tok->cache);
-            /* The token holds the first/last reference to the slot.
-             * When the token is actually destroyed, that ref must go too.
-             */
+
+            /* We're going away, let the nssSlot know in case it's held
+             * alive by someone else. Usually we should hold the last ref. */
+            nssSlot_EnterMonitor(tok->slot);
+            tok->slot->token = NULL;
+            nssSlot_ExitMonitor(tok->slot);
+
             (void)nssSlot_Destroy(tok->slot);
             return nssArena_Destroy(tok->base.arena);
         }