Valgrind issues in SoftHSM

Start by reading the linked Valgrind log and the CI configuration that runs the tests; the report names OSSLRNG.cpp, OSSLRSA.cpp, and calls through OpenSSL’s DRBG and AES routines. Check whether the warnings reproduce with the upstream SoftHSM version and identify which reports originate in SoftHSM versus its dependencies. Done means the warnings are understood and any upstream issue has a reproducible resolution.

In our CI pipeline, we are receiving a lot of problems from valgrinds memory checker in SoftHSM (softhsm2=2.6.1-2.2ubuntu3). However, I'm unsure if they apply to the upstream version of SoftHSM

https://productionresultssa4.blob.core.windows.net/actions-results/6dd3583a-6042-48bb-98f1-b587f65bbd27/workflow-job-run-70f75f5e-8692-5c2b-5974-34c6ae62b7d6/logs/job/job-logs.txt?rsct=text%2Fplain&se=2025-03-04T11%3A41%3A07Z&sig=EcT4%2BUU2qxvalbYJwIprfjd%2FK9LsfXjsjWREaT%2Fq0IY%3D&ske=2025-03-04T21%3A08%3A50Z&skoid=ca7593d4-ee42-46cd-af88-8b886a2f84eb&sks=b&skt=2025-03-04T09%3A08%3A50Z&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skv=2025-01-05&sp=r&spr=https&sr=b&st=2025-03-04T11%3A31%3A02Z&sv=2025-01-05

The full log can be found here log.txt (search for "insert_a_suppression_name_here")

Here are some examples from the log (the full log is too long to be displayed here):

2025-03-04T11:13:23.3229416Z ==33651== Conditional jump or move depends on uninitialised value(s)
2025-03-04T11:13:23.3229546Z ==33651==    at 0x4C37053: drbg_ctr_generate (drbg_ctr.c:427)
2025-03-04T11:13:23.3229673Z ==33651==    by 0x4C43C7C: ossl_prov_drbg_generate (drbg.c:683)
2025-03-04T11:13:23.3229781Z ==33651==    by 0x4C43F7C: ossl_drbg_get_seed (drbg.c:176)
2025-03-04T11:13:23.3229881Z ==33651==    by 0x4C42EF0: get_entropy (drbg.c:241)
2025-03-04T11:13:23.3229999Z ==33651==    by 0x4C43899: ossl_prov_drbg_reseed (drbg.c:579)
2025-03-04T11:13:23.3230120Z ==33651==    by 0x4C43C54: ossl_prov_drbg_generate (drbg.c:674)
2025-03-04T11:13:23.3230253Z ==33651==    by 0x4A62FD8: evp_rand_generate_locked (evp_rand.c:558)
2025-03-04T11:13:23.3230375Z ==33651==    by 0x4A63FE1: EVP_RAND_generate (evp_rand.c:580)
2025-03-04T11:13:23.3230482Z ==33651==    by 0x4B6E8D9: RAND_bytes_ex (rand_lib.c:371)
2025-03-04T11:13:23.3230594Z ==33651==    by 0x56F65E9: generateRandom (OSSLRNG.cpp:44)
2025-03-04T11:13:23.3230831Z ==33651==    by 0x56F65E9: OSSLRNG::generateRandom(ByteString&, unsigned long) (OSSLRNG.cpp:38)
2025-03-04T11:13:23.3231220Z ==33651==    by 0x56B9777: SoftHSM::C_GenerateRandom(unsigned long, unsigned char*, unsigned long) (SoftHSM.cpp:7201)
2025-03-04T11:13:23.3231341Z ==33651==    by 0x5694A8F: C_GenerateRandom (main.cpp:1133)
2025-03-04T11:13:23.3231579Z ==33651==    by 0x130193: test_random (in /home/runner/work/OpenSC/OpenSC/src/tools/.libs/pkcs11-tool)
2025-03-04T11:13:23.3231808Z ==33651==    by 0x1304FD: p11_test (in /home/runner/work/OpenSC/OpenSC/src/tools/.libs/pkcs11-tool)
2025-03-04T11:13:23.3232014Z ==33651==    by 0x115F0A: main (in /home/runner/work/OpenSC/OpenSC/src/tools/.libs/pkcs11-tool)
2025-03-04T11:13:23.3232081Z ==33651== 
2025-03-04T11:13:23.3232148Z {
2025-03-04T11:13:23.3232236Z    <insert_a_suppression_name_here>
2025-03-04T11:13:23.3232307Z    Memcheck:Cond
2025-03-04T11:13:23.3232382Z    fun:drbg_ctr_generate
2025-03-04T11:13:23.3232468Z    fun:ossl_prov_drbg_generate
2025-03-04T11:13:23.3232542Z    fun:ossl_drbg_get_seed
2025-03-04T11:13:23.3232610Z    fun:get_entropy
2025-03-04T11:13:23.3232761Z    fun:ossl_prov_drbg_reseed
2025-03-04T11:13:23.3232839Z    fun:ossl_prov_drbg_generate
2025-03-04T11:13:23.3232922Z    fun:evp_rand_generate_locked
2025-03-04T11:13:23.3232994Z    fun:EVP_RAND_generate
2025-03-04T11:13:23.3233064Z    fun:RAND_bytes_ex
2025-03-04T11:13:23.3233141Z    fun:generateRandom
2025-03-04T11:13:23.3233258Z    fun:_ZN7OSSLRNG14generateRandomER10ByteStringm
2025-03-04T11:13:23.3233360Z    fun:_ZN7SoftHSM16C_GenerateRandomEmPhm
2025-03-04T11:13:23.3233441Z    fun:C_GenerateRandom
2025-03-04T11:13:23.3233509Z    fun:test_random
2025-03-04T11:13:23.3233583Z    fun:p11_test
2025-03-04T11:13:23.3233705Z    fun:main
2025-03-04T11:13:23.3233769Z }
...
2025-03-04T11:13:23.3973528Z ==33651== Conditional jump or move depends on uninitialised value(s)
2025-03-04T11:13:23.3973801Z ==33651==    at 0x4925CC8: aesni_ctr32_encrypt_blocks (aesni-x86_64.s:1036)
2025-03-04T11:13:23.3974056Z ==33651==    by 0x4B432C4: CRYPTO_ctr128_encrypt_ctr32 (ctr128.c:187)
2025-03-04T11:13:23.3974491Z ==33651==    by 0x4C49561: ossl_cipher_hw_generic_ctr (ciphercommon_hw.c:117)
2025-03-04T11:13:23.3974818Z ==33651==    by 0x4C46036: ossl_cipher_generic_stream_update (ciphercommon.c:488)
2025-03-04T11:13:23.3975049Z ==33651==    by 0x4A5A656: EVP_EncryptUpdate (evp_enc.c:684)
2025-03-04T11:13:23.3975271Z ==33651==    by 0x4C36FFD: drbg_ctr_generate (drbg_ctr.c:438)
2025-03-04T11:13:23.3975498Z ==33651==    by 0x4C43C7C: ossl_prov_drbg_generate (drbg.c:683)
2025-03-04T11:13:23.3975750Z ==33651==    by 0x4A62FD8: evp_rand_generate_locked (evp_rand.c:558)
2025-03-04T11:13:23.3975967Z ==33651==    by 0x4A63FE1: EVP_RAND_generate (evp_rand.c:580)
2025-03-04T11:13:23.3976274Z ==33651==    by 0x4B6EB09: RAND_priv_bytes_ex (rand_lib.c:342)
2025-03-04T11:13:23.3976435Z ==33651==    by 0x496DF88: bnrand (bn_rand.c:51)
2025-03-04T11:13:23.3976629Z ==33651==    by 0x496E1D7: bnrand_range (bn_rand.c:189)
2025-03-04T11:13:23.3976880Z ==33651==    by 0x495E550: BN_BLINDING_create_param (bn_blind.c:274)
2025-03-04T11:13:23.3977124Z ==33651==    by 0x4B77C61: RSA_setup_blinding (rsa_crpt.c:155)
2025-03-04T11:13:23.3977343Z ==33651==    by 0x4B77EFA: RSA_blinding_on (rsa_crpt.c:77)
2025-03-04T11:13:23.3978108Z ==33651==    by 0x56F6D44: OSSLRSA::sign(PrivateKey*, ByteString const&, ByteString&, AsymMech::Type, void const*, unsigned long) (OSSLRSA.cpp:257)
2025-03-04T11:13:23.3978321Z ==33651==    by 0x56B8399: AsymSign (SoftHSM.cpp:4557)
2025-03-04T11:13:23.3978861Z ==33651==    by 0x56B8399: SoftHSM::C_Sign(unsigned long, unsigned char*, unsigned long, unsigned char*, unsigned long*) (SoftHSM.cpp:4597)
2025-03-04T11:13:23.3978972Z ==33651==    by 0x56942FF: C_Sign (main.cpp:782)
2025-03-04T11:13:23.3979226Z ==33651==    by 0x12ED4F: sign_verify (in /home/runner/work/OpenSC/OpenSC/src/tools/.libs/pkcs11-tool)
2025-03-04T11:13:23.3979577Z ==33651==    by 0x12F220: test_verify (in /home/runner/work/OpenSC/OpenSC/src/tools/.libs/pkcs11-tool)
2025-03-04T11:13:23.3979811Z ==33651==    by 0x130539: p11_test (in /home/runner/work/OpenSC/OpenSC/src/tools/.libs/pkcs11-tool)
2025-03-04T11:13:23.3980035Z ==33651==    by 0x115F0A: main (in /home/runner/work/OpenSC/OpenSC/src/tools/.libs/pkcs11-tool)
2025-03-04T11:13:23.3980101Z ==33651== 
2025-03-04T11:13:23.3980165Z {
2025-03-04T11:13:23.3980263Z    <insert_a_suppression_name_here>
2025-03-04T11:13:23.3980336Z    Memcheck:Cond
2025-03-04T11:13:23.3980426Z    fun:aesni_ctr32_encrypt_blocks
2025-03-04T11:13:23.3980547Z    fun:CRYPTO_ctr128_encrypt_ctr32
2025-03-04T11:13:23.3980814Z    fun:ossl_cipher_hw_generic_ctr
2025-03-04T11:13:23.3981181Z    fun:ossl_cipher_generic_stream_update
2025-03-04T11:13:23.3981354Z    fun:EVP_EncryptUpdate
2025-03-04T11:13:23.3981467Z    fun:drbg_ctr_generate
2025-03-04T11:13:23.3981555Z    fun:ossl_prov_drbg_generate
2025-03-04T11:13:23.3981649Z    fun:evp_rand_generate_locked
2025-03-04T11:13:23.3981726Z    fun:EVP_RAND_generate
2025-03-04T11:13:23.3981804Z    fun:RAND_priv_bytes_ex
2025-03-04T11:13:23.3981877Z    fun:bnrand
2025-03-04T11:13:23.3981952Z    fun:bnrand_range
2025-03-04T11:13:23.3982039Z    fun:BN_BLINDING_create_param
2025-03-04T11:13:23.3982117Z    fun:RSA_setup_blinding
2025-03-04T11:13:23.3982191Z    fun:RSA_blinding_on
2025-03-04T11:13:23.3982423Z    fun:_ZN7OSSLRSA4signEP10PrivateKeyRK10ByteStringRS2_N8AsymMech4TypeEPKvm
2025-03-04T11:13:23.3982493Z    fun:AsymSign
2025-03-04T11:13:23.3982590Z    fun:_ZN7SoftHSM6C_SignEmPhmS0_Pm
2025-03-04T11:13:23.3982655Z    fun:C_Sign
2025-03-04T11:13:23.3982733Z    fun:sign_verify
2025-03-04T11:13:23.3982806Z    fun:test_verify
2025-03-04T11:13:23.3982878Z    fun:p11_test
2025-03-04T11:13:23.3982948Z    fun:main
2025-03-04T11:13:23.3983011Z }
...