Segmentation fault during database upgrade 7 -> 8

[alitofresko]

Tested with 1.9.0, trying to use a DB created with 1.8.0.

Running a simple command with the pkcs11-tool we receive a segmentation fault with a specific database created with 1.8.0 lib.

Steps used to get the error: Run export TPM2_PKCS11_LOG_LEVEL=2 to get verbose logs Run pkcs11-tool --verbose --test --module /usr/lib/pkcs11/libtpm2_pkcs11.so to perform a test This is the output INFO on line: "393" in file: "/usr/src/debug/tpm2-pkcs11/1.9.0-r0/src/pkcs11.c": enter "C_GetFunctionList" INFO on line: "393" in file: "/usr/src/debug/tpm2-pkcs11/1.9.0-r0/src/pkcs11.c": return "C_GetFunctionList" value: 0 INFO on line: "381" in file: "/usr/src/debug/tpm2-pkcs11/1.9.0-r0/src/pkcs11.c": enter "C_Initialize" INFO on line: "41" in file: "/usr/src/debug/tpm2-pkcs11/1.9.0-r0/src/lib/backend.c": Initializing backends INFO on line: "2626" in file: "/usr/src/debug/tpm2-pkcs11/1.9.0-r0/src/lib/db.c": Using sqlite3 DB: "/etc/tpm2_pkcs11/tpm2_pkcs11.sqlite3" INFO on line: "2216" in file: "/usr/src/debug/tpm2-pkcs11/1.9.0-r0/src/lib/db.c": Performing DB backup at: "/etc/tpm2_pkcs11/tpm2_pkcs11.sqlite3.bak" Segmentation fault

After some investigation, I see that my database /etc/tpm2_pkcs11/tpm2_pkcs11.sqlite3 created with 1.8.0 has 3 rows on tobjects table, the last one has no attribute of type CKA_ALLOWED_MECHANISMS. So, the function attr_get_attribute_by_type returns null and the next instruction type_from_ptr cause a segmentation fault.

by placing an "if not null" before the function that caused the segmentation fault, the db upgrade seems to complete with success. Attached my patch used to add more logs and the "if not null" check. This is the relevant output of pkcs11-tool --verbose --test --module /usr/lib/pkcs11/libtpm2_pkcs11.so after patch applied:

INFO on line: "2639" in file: "/usr/src/debug/tpm2-pkcs11/1.9.0-r0/src/lib/db.c": Using sqlite3 DB: "/etc/tpm2_pkcs11/tpm2_pkcs11.sqlite3" INFO on line: "2229" in file: "/usr/src/debug/tpm2-pkcs11/1.9.0-r0/src/lib/db.c": Performing DB backup at: "/etc/tpm2_pkcs11/tpm2_pkcs11.sqlite3.bak" INFO on line: "2145" in file: "/usr/src/debug/tpm2-pkcs11/1.9.0-r0/src/lib/db.c": Upgrading DB from 7 to 8 ERROR on line: "2157" in file: "/usr/src/debug/tpm2-pkcs11/1.9.0-r0/src/lib/db.c": Upgrading DB from 7 to 8 - step INFO on line: "2168" in file: "/usr/src/debug/tpm2-pkcs11/1.9.0-r0/src/lib/db.c": begin process tobjects row INFO on line: "2177" in file: "/usr/src/debug/tpm2-pkcs11/1.9.0-r0/src/lib/db.c": Attribute by type ptr: 0xe980f0 INFO on line: "2179" in file: "/usr/src/debug/tpm2-pkcs11/1.9.0-r0/src/lib/db.c": Attribute ptr and length: 0xe97f70 48 INFO on line: "2182" in file: "/usr/src/debug/tpm2-pkcs11/1.9.0-r0/src/lib/db.c": Upgrading tobject attrs INFO on line: "2184" in file: "/usr/src/debug/tpm2-pkcs11/1.9.0-r0/src/lib/db.c": Done INFO on line: "2168" in file: "/usr/src/debug/tpm2-pkcs11/1.9.0-r0/src/lib/db.c": begin process tobjects row INFO on line: "2177" in file: "/usr/src/debug/tpm2-pkcs11/1.9.0-r0/src/lib/db.c": Attribute by type ptr: 0xe86798 INFO on line: "2179" in file: "/usr/src/debug/tpm2-pkcs11/1.9.0-r0/src/lib/db.c": Attribute ptr and length: 0xe98130 48 INFO on line: "2182" in file: "/usr/src/debug/tpm2-pkcs11/1.9.0-r0/src/lib/db.c": Upgrading tobject attrs INFO on line: "2184" in file: "/usr/src/debug/tpm2-pkcs11/1.9.0-r0/src/lib/db.c": Done INFO on line: "2168" in file: "/usr/src/debug/tpm2-pkcs11/1.9.0-r0/src/lib/db.c": begin process tobjects row INFO on line: "2177" in file: "/usr/src/debug/tpm2-pkcs11/1.9.0-r0/src/lib/db.c": Attribute by type ptr: (nil) INFO on line: "2187" in file: "/usr/src/debug/tpm2-pkcs11/1.9.0-r0/src/lib/db.c": Skip attribute upgrading cause of null attrs: (nil)

db-upgrade-7-8-segmentation-fault.patch db-upgrade-7-8-segmentation-fault.log

[sem-hub]

Thank you! It works for me.

[tracefinder]

Confirm the issue on Manjaro with tpm2-pkcs11 1.9.0-1

[tazjin]

Confirm that @tracefinder's PR fixes this for me. Maybe if the project is (temporarily?) unmaintained, we should adopt patches into a fork until the maintainer is either back or something else happens?

[tracefinder]

BTW, there is the second PR aimed to solve the problem - https://github.com/tpm2-software/tpm2-pkcs11/pull/858

I believe a fork is the last resort option in case the project is dead. @williamcroberts could you clarify the state of the project?

[williamcroberts]

BTW, there is the second PR aimed to solve the problem - #858

I believe a fork is the last resort option in case the project is dead. @williamcroberts could you clarify the state of the project?

The project is alive, I just don't have as much time as I used to. We are looking for folks that want to be active in the tpm2-software space, so if anyone wants to sign up :-p