[LinuxJedi]

WP11_Object_Find walked the object list under the token lock, released it, and then read obj->handle and obj->opFlag (for the CKA_PRIVATE check). A concurrent C_DestroyObject of the same token object from another session can unlink and free the object in that window. The sanitizer job hit this once on #247 (asan, PKCS#11 V3.2 PQC Build, run 38708225449): an 8-byte read in WP11_Object_Find called from C_DestroyObject in concurrent_destroy_object_test, on memory just freed by the other destroyer thread. It is pre-existing; #247 does not touch this code.

• One token-lock section now covers the session list walk, the NSS cross-session walk and the token list walk, and the CKA_PRIVATE bit is captured while the lock is held. obj is never dereferenced after the unlock.
• The redundant post-unlock obj->handle == objHandle re-check is gone; ret == 0 already means the walk matched.
• The slot lock for loginState is still only taken after the token lock is released, so the slot-then-token lock order is unchanged.

Testing:

• Reproduced on macOS with ASAN (PQC config). Unaided the race is rare: one hit in the first stress pass (roughly 15,000 rounds over 8 parallel runs), with the same stack as CI. With a DYLD_INSERT_LIBRARIES shim that sleeps briefly after some mutex unlocks on worker threads, the unfixed library failed 3 of 3 times within 9-17 s.
• With the fix: 126,400 rounds with the shim and 144,000 without, no failures.
• Pre-commit hook make test passes (debug and default configs).

[Copilot]

🟢 Approval recommended

The focused fix protects lookup-time reads without changing lock ordering or introducing identified regressions.

0 open findings

What changed in this PR

Fixes a lookup-time use-after-free in WP11_Object_Find when another session concurrently destroys the object.

Changes:

• Keeps object traversal and private-flag reads under the token lock.
• Removes post-unlock object dereferences while preserving lock ordering.

File	Description
src/​internal.c	Extends lookup locking and captures the private flag before unlocking.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[LinuxJedi]

Superseded by #254, which now carries this fix as its own commit ("Fix use-after-free in WP11_Object_Find") together with the WP11_Lock fix and the TSAN changes it depends on.