[LinuxJedi]

WP11_Session_RemoveObjectByHandle found the object to unlink by pointer identity only, despite its name. C_DestroyObject resolves the handle with WP11_Object_Find, drops the lock, then removes by that pointer. If another thread destroyed the object in between and a third thread created an object that landed at the same address, the first caller would unlink and free the new object and return CKR_OK for the old handle.

• WP11_Session_RemoveObjectByHandle now takes the handle instead of onToken, derives onToken from it, and only matches a list node when both the pointer and the handle are equal. The handle of a linked node is safe to read under the token lock, and published handles come from a counter that is never reused, so a recycled address no longer matches.
• C_DestroyObject passes hObject; the cleanup wrapper WP11_Session_RemoveObject passes the object's own handle.
• NSS builds: the cross-session fallback still reads object->session before it knows the object is linked. The pointer-and-handle match stops a stale or reused object being removed, but the read itself can touch freed memory. Avoiding it needs the slot lock, which this function cannot take because wp11_Session_Final calls it with the slot lock already held. This is noted in the code.

Address reuse cannot be forced through the PKCS#11 API (and ASAN quarantines freed memory), so this adds a DEBUG_WOLFPKCS11-only hook, WP11_Test_RemoveObjectStale, following the existing WP11_Slot_TokenKeyIsZero pattern, and tests/destroy_stale_handle_test.c. The test pairs a live object's pointer with the handle of an already destroyed object, for both token and session objects, and checks that the removal is refused and the object survives. A control call with matching handles checks the hook does remove. It runs in --enable-debug builds (the unit-test.yml debug job) and skips otherwise.

Testing:

• destroy_stale_handle_test passes all 18 checks. With the handle comparison removed (pointer-only, as on master) 2 checks fail and the live object is freed.
• Pre-commit hook make test passes (debug and default configs); also make check with --enable-nss --enable-debug under ASAN.

[Copilot]

🔵 Needs a closer look

The concurrency-sensitive removal path retains an acknowledged NSS lifetime hazard that warrants human review.

1 open finding

• Return 77 when debug support or AES is unavailable · New

What changed in this PR

Protects object destruction from address reuse by requiring both pointer and handle identity before unlinking an object.

Changes:

• Passes the original handle through removal paths.
• Adds a debug-only hook and regression tests for stale token and session handles.
• Documents the existing NSS lifetime limitation.

File	Description
wolfpkcs11/​internal.h	Updates removal signature and declares the debug hook.
tests/​include.am	Registers and links the regression test.
tests/​destroy_stale_handle_test.c	Tests stale-handle rejection and matching-handle removal.
src/​internal.c	Checks pointer and handle identity; implements the hook.
src/​crypto.c	Passes the original handle from C_DestroyObject.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.