Fix memory handling in slot refresh

On refreshing slots, there were two issues:
- When reusing a PKCS11_SLOT_PRIVATE structure instance, the instance to
  be reused was accidentally freed
- Looking for an instance in the list of slots had bugs in pointer
  usage.

src/libp11-int.h

@@ -220,8 +220,9 @@ extern unsigned long pkcs11_get_slotid_from_slot(PKCS11_SLOT_private *);
 /* Increment slot reference count */
 extern PKCS11_SLOT_private *pkcs11_slot_ref(PKCS11_SLOT_private *slot);
 
-/* Decrement slot reference count, free if it becomes zero */
-extern void pkcs11_slot_unref(PKCS11_SLOT_private *slot);
+/* Decrement slot reference count, free if it becomes zero.
+ * Returns 1 if it was freed. */
+extern int pkcs11_slot_unref(PKCS11_SLOT_private *slot);
 
 /* Free the list of slots allocated by PKCS11_enumerate_slots() */
 extern void pkcs11_release_all_slots(PKCS11_SLOT *slots, unsigned int nslots);

src/p11_slot.c

@@ -76,9 +76,14 @@ int pkcs11_enumerate_slots(PKCS11_CTX_private *ctx, PKCS11_SLOT **slotp,
 	for (n = 0; n < nslots; n++) {
 		PKCS11_SLOT_private *slot = NULL;
 		for (i = 0; i < *countp; i++) {
-			if (PRIVSLOT(slotp[i])->id != slotid[n])
+			PKCS11_SLOT_private *slot_old_private =
+				PRIVSLOT(&((*slotp)[i]));
+			if (slot_old_private->id != slotid[n])
 				continue;
-			slot = pkcs11_slot_ref(PRIVSLOT(slotp[i]));
+			/* Increase ref count so it doesn't get freed when ref
+			 * count is decremented in pkcs11_release_all_slots
+			 * at the end of this function. */
+			slot = pkcs11_slot_ref(slot_old_private);
 			break;
 		}
 		if (!slot)
@@ -447,10 +452,10 @@ PKCS11_SLOT_private *pkcs11_slot_ref(PKCS11_SLOT_private *slot)
 	return slot;
 }
 
-void pkcs11_slot_unref(PKCS11_SLOT_private *slot)
+int pkcs11_slot_unref(PKCS11_SLOT_private *slot)
 {
 	if (pkcs11_atomic_add(&slot->refcnt, -1, &slot->lock) != 0)
-		return;
+		return 0;
 
 	pkcs11_wipe_cache(slot);
 	if (slot->prev_pin) {
@@ -461,6 +466,8 @@ void pkcs11_slot_unref(PKCS11_SLOT_private *slot)
 	OPENSSL_free(slot->session_pool);
 	pthread_mutex_destroy(&slot->lock);
 	pthread_cond_destroy(&slot->cond);
+
+	return 1;
 }
 
 static int pkcs11_init_slot(PKCS11_CTX_private *ctx, PKCS11_SLOT *slot, PKCS11_SLOT_private *spriv)
@@ -500,11 +507,13 @@ static void pkcs11_release_slot(PKCS11_SLOT *slot)
 		pkcs11_destroy_token(slot->token);
 		OPENSSL_free(slot->token);
 	}
-	if (spriv)
-		pkcs11_slot_unref(spriv);
+	if (spriv) {
+		if (pkcs11_slot_unref(spriv) != 0) {
+			OPENSSL_free(slot->_private);
+		}
+	}
 	OPENSSL_free(slot->description);
 	OPENSSL_free(slot->manufacturer);
-	OPENSSL_free(slot->_private);
 
 	memset(slot, 0, sizeof(*slot));
 }