From f4798de88cb5d24e3dea5b996c6bed2dc0cb41c0 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 9 Jul 2026 07:31:24 +0200 Subject: [PATCH] pkcs11: Avoid race condition in token hot-plug handling If a token is removed during initialization, where `token_event_cb()` is called manually, the callback could be triggered after the credential set was added to the list but before it was registered with the manager. This could then cause a use-after-free if the manager accesses it after the other thread destroyed it. Note that there is still a race if the removal runs before the other thread even acquires the mutex. We'd end up with a registered but defunct credential set that is not backed by a valid token. But that shouldn't cause any crashes. Fixes: a6d2ec331ba8 ("Implemented a credential set on top of a PKCS#11 token") --- src/libstrongswan/plugins/pkcs11/pkcs11_plugin.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/libstrongswan/plugins/pkcs11/pkcs11_plugin.c b/src/libstrongswan/plugins/pkcs11/pkcs11_plugin.c index aa27f1e38..3314d2f85 100644 --- a/src/libstrongswan/plugins/pkcs11/pkcs11_plugin.c +++ b/src/libstrongswan/plugins/pkcs11/pkcs11_plugin.c @@ -90,8 +90,8 @@ static void token_event_cb(private_pkcs11_plugin_t *this, pkcs11_library_t *p11, { this->mutex->lock(this->mutex); this->creds->insert_last(this->creds, creds); - this->mutex->unlock(this->mutex); lib->credmgr->add_set(lib->credmgr, &creds->set); + this->mutex->unlock(this->mutex); } } }