diff -up nss/lib/pk11wrap/pk11util.c.race nss/lib/pk11wrap/pk11util.c

--- nss/lib/pk11wrap/pk11util.c.race	2017-01-13 17:43:25.829686952 +0100

+++ nss/lib/pk11wrap/pk11util.c	2017-01-13 17:47:56.374041802 +0100

@@ -1297,7 +1297,7 @@ SECMOD_HasRemovableSlots(SECMODModule *m

  */

 static SECStatus

 secmod_UserDBOp(PK11SlotInfo *slot, CK_OBJECT_CLASS objClass,

-                const char *sendSpec)

+                const char *sendSpec, PRBool needlock)

 {

     CK_OBJECT_HANDLE dummy;

     CK_ATTRIBUTE template[2];

@@ -1312,16 +1312,16 @@ secmod_UserDBOp(PK11SlotInfo *slot, CK_O

     PORT_Assert(attrs - template <= 2);

-    PK11_EnterSlotMonitor(slot);

+    if (needlock) PK11_EnterSlotMonitor(slot);

     crv = PK11_CreateNewObject(slot, slot->session,

                                template, attrs - template, PR_FALSE, &dummy);

-    PK11_ExitSlotMonitor(slot);

+    if (needlock) PK11_ExitSlotMonitor(slot);

     if (crv != CKR_OK) {

         PORT_SetError(PK11_MapError(crv));

         return SECFailure;

     }

-    return SECMOD_UpdateSlotList(slot->module);

+    return SECSuccess;

 }

 /*

@@ -1330,11 +1330,20 @@ secmod_UserDBOp(PK11SlotInfo *slot, CK_O

 static PRBool

 secmod_SlotIsEmpty(SECMODModule *mod, CK_SLOT_ID slotID)

 {

-    PK11SlotInfo *slot = SECMOD_LookupSlot(mod->moduleID, slotID);

+    PK11SlotInfo *slot = SECMOD_FindSlotByID(mod, slotID);

     if (slot) {

-        PRBool present = PK11_IsPresent(slot);

+	CK_SLOT_INFO slotInfo;

+	CK_RV crv;

+	/* check if the slot is present, skip any slot reinit stuff,

+	 * or cached present values, or locking. (we don't need to lock 

+	 * even if the module is not thread safe because we are already 

+	 * holding the module refLock, which is the same as the slot 

+	 * sessionLock if the module isn't thread safe. */

+	crv = PK11_GETTAB(slot)->C_GetSlotInfo(slot->slotID,&slotInfo);

         PK11_FreeSlot(slot);

-        if (present) {

+	if ((crv == CKR_OK) && 

+		((slotInfo.flags & CKF_TOKEN_PRESENT) == CKF_TOKEN_PRESENT)) {

+	    /* slot is present, so it's not empty */

             return PR_FALSE;

         }

     }

@@ -1390,24 +1399,29 @@ SECMOD_OpenNewSlot(SECMODModule *mod, co

     char *sendSpec;

     SECStatus rv;

+    PZ_Lock(mod->refLock);   /* don't reuse a slot on the fly */

     slotID = secmod_FindFreeSlot(mod);

     if (slotID == (CK_SLOT_ID)-1) {

+	PZ_Unlock(mod->refLock);

         return NULL;

     }

     if (mod->slotCount == 0) {

+	PZ_Unlock(mod->refLock);

         return NULL;

     }

     /* just grab the first slot in the module, any present slot should work */

     slot = PK11_ReferenceSlot(mod->slots[0]);

     if (slot == NULL) {

+	PZ_Unlock(mod->refLock);

         return NULL;

     }

     /* we've found the slot, now build the moduleSpec */

     escSpec = NSSUTIL_DoubleEscape(moduleSpec, '>', ']');

     if (escSpec == NULL) {

+	PZ_Unlock(mod->refLock);

         PK11_FreeSlot(slot);

         return NULL;

     }

@@ -1416,16 +1430,26 @@ SECMOD_OpenNewSlot(SECMODModule *mod, co

     if (sendSpec == NULL) {

         /* PR_smprintf does not set SEC_ERROR_NO_MEMORY on failure. */

+	PZ_Unlock(mod->refLock);

         PK11_FreeSlot(slot);

         PORT_SetError(SEC_ERROR_NO_MEMORY);

         return NULL;

     }

-    rv = secmod_UserDBOp(slot, CKO_NETSCAPE_NEWSLOT, sendSpec);

+    rv = secmod_UserDBOp(slot, CKO_NETSCAPE_NEWSLOT, sendSpec, 

+    /* If the module isn't thread safe, the slot sessionLock == mod->refLock

+     * since we already hold the refLock we don't need to lock the sessionLock

+     */

+							mod->isThreadSafe);

+    PZ_Unlock(mod->refLock);

     PR_smprintf_free(sendSpec);

     PK11_FreeSlot(slot);

     if (rv != SECSuccess) {

         return NULL;

     }

+    rv = SECMOD_UpdateSlotList(mod); /* don't call holding the mod->reflock */

+    if (rv != SECSuccess) {

+	return NULL;

+    }

     slot = SECMOD_FindSlotByID(mod, slotID);

     if (slot) {

@@ -1558,7 +1582,7 @@ SECMOD_CloseUserDB(PK11SlotInfo *slot)

         PORT_SetError(SEC_ERROR_NO_MEMORY);

         return SECFailure;

     }

-    rv = secmod_UserDBOp(slot, CKO_NETSCAPE_DELSLOT, sendSpec);

+    rv = secmod_UserDBOp(slot, CKO_NETSCAPE_DELSLOT, sendSpec, PR_TRUE);

     PR_smprintf_free(sendSpec);

     /* if we are in the delay period for the "isPresent" call, reset

      * the delay since we know things have probably changed... */