Update to NSS 3.16.2 Beta 3.

nss/lib/pk11wrap/pk11load.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 /*
  * The following handles the loading, unloading and management of
  * various PCKS #11 modules
  */
 #define FORCE_PR_LOG 1
 #include "seccomon.h"
 #include "pkcs11.h"
@@ skipping 37 matching lines @@
     return CKR_OK;
 }
 
 static SECMODModuleID  nextModuleID = 1;
 static const CK_C_INITIALIZE_ARGS secmodLockFunctions = {
     secmodCreateMutext, secmodDestroyMutext, secmodLockMutext, 
     secmodUnlockMutext, CKF_LIBRARY_CANT_CREATE_OS_THREADS|
         CKF_OS_LOCKING_OK
     ,NULL
 };
+static const CK_C_INITIALIZE_ARGS secmodNoLockArgs = {
+    NULL, NULL, NULL, NULL,
+    CKF_LIBRARY_CANT_CREATE_OS_THREADS
+    ,NULL
+};
 
 static PRBool loadSingleThreadedModules = PR_TRUE;
 static PRBool enforceAlreadyInitializedError = PR_TRUE;
 static PRBool finalizeModules = PR_TRUE;
 
 /* set global options for NSS PKCS#11 module loader */
 SECStatus pk11_setGlobalOptions(PRBool noSingleThreadedModules,
                                 PRBool allowAlreadyInitializedModules,
                                 PRBool dontFinalizeModules)
 {
@@ skipping 134 matching lines @@
 
     if (reload) {
         *reload = NULL;
     }
 
     if (!mod || !alreadyLoaded) {
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return SECFailure;
     }
 
-    if (mod->isThreadSafe == PR_FALSE) {
-        pInitArgs = NULL;
-    } else if (mod->libraryParams == NULL) {
-        pInitArgs = (void *) &secmodLockFunctions;
+    if (mod->libraryParams == NULL) {
+        if (mod->isThreadSafe) {
+            pInitArgs = (void *) &secmodLockFunctions;
+        } else {
+            pInitArgs = NULL;
+        }
     } else {
-        moduleArgs = secmodLockFunctions;
+        if (mod->isThreadSafe) {
+            moduleArgs = secmodLockFunctions;
+        } else {
+            moduleArgs = secmodNoLockArgs;
+        }
         moduleArgs.LibraryParameters = (void *) mod->libraryParams;
         pInitArgs = &moduleArgs;
     }
     crv = PK11_GETTAB(mod)->C_Initialize(pInitArgs);
     if (CKR_CRYPTOKI_ALREADY_INITIALIZED == crv) {
         SECMODModule *oldModule = NULL;
 
         /* Library has already been loaded once, if caller expects it, and it
          * has additional configuration, try reloading it as well. */
         if (reload != NULL && mod->libraryParams) {
@@ skipping 16 matching lines @@
             }
             SECMOD_DestroyModule(oldModule);
         }
         /* reload not possible, fall back to old semantics */
         if (!enforceAlreadyInitializedError) {
             *alreadyLoaded = PR_TRUE;
             return SECSuccess;
         }
     }
     if (crv != CKR_OK) {
-        if (pInitArgs == NULL ||
+        if (!mod->isThreadSafe ||
                 crv == CKR_NETSCAPE_CERTDB_FAILED ||
                 crv == CKR_NETSCAPE_KEYDB_FAILED) {
             PORT_SetError(PK11_MapError(crv));
             return SECFailure;
         }
+        /* If we had attempted to init a single threaded module "with"
+         * parameters and it failed, should we retry "without" parameters?
+         * (currently we don't retry in this scenario) */
+
         if (!loadSingleThreadedModules) {
             PORT_SetError(SEC_ERROR_INCOMPATIBLE_PKCS11);
             return SECFailure;
         }
+        /* If we arrive here, the module failed a ThreadSafe init. */
         mod->isThreadSafe = PR_FALSE;
-        crv = PK11_GETTAB(mod)->C_Initialize(NULL);
+        if (!mod->libraryParams) {
+            pInitArgs = NULL;
+        } else {
+            moduleArgs = secmodNoLockArgs;
+            moduleArgs.LibraryParameters = (void *) mod->libraryParams;
+            pInitArgs = &moduleArgs;
+        }
+        crv = PK11_GETTAB(mod)->C_Initialize(pInitArgs);
         if ((CKR_CRYPTOKI_ALREADY_INITIALIZED == crv) &&
             (!enforceAlreadyInitializedError)) {
             *alreadyLoaded = PR_TRUE;
             return SECSuccess;
         }
         if (crv != CKR_OK)  {
             PORT_SetError(PK11_MapError(crv));
             return SECFailure;
         }
     }
@@ skipping 354 matching lines @@
 
 void
 nss_DumpModuleLog(void)
 {
 #ifdef DEBUG_MODULE
     if (modToDBG) {
         print_final_statistics();
     }
 #endif
 }