[openssl/openssl] ed510d: Fix remove_session_cb called while holding ctx->lock

  Branch: refs/heads/openssl-3.6
  Home:   https://github.com/openssl/openssl
  Commit: ed510d4b88ea8e4b427289bca7d774cdb67f1d9f
      https://github.com/openssl/openssl/commit/ed510d4b88ea8e4b427289bca7d774cdb67f1d9f
  Author: Matt Caswell <[email protected]>
  Date:   2026-07-08 (Wed, 08 Jul 2026)

  Changed paths:
    M ssl/ssl_sess.c

  Log Message:
  -----------
  Fix remove_session_cb called while holding ctx->lock

SSL_CTX_add_session() held ctx->lock while calling remove_session_lock()
with lck = 0, which still fired the remove_session_cb callback.
SSL_CTX_flush_sessions_ex() had the same problem: it called
remove_session_cb for each expired session while holding the lock.
Any callback that re-entered an OpenSSL API requiring the same lock
would deadlock.

Refactor remove_session_lock() into remove_session_locked() (caller
holds the lock) which returns the removed SSL_SESSION * instead of
calling the callback and freeing it internally.

SSL_CTX_remove_session() manages its own locking and invokes the
callback unconditionally after releasing the lock (preserving the
existing behaviour where the callback fires even when the session is
not in the internal cache, to allow external caches to be notified).

SSL_CTX_add_session() collects evicted sessions in a temporary
singly-linked list (via the now-NULL next pointer) and processes them
after CRYPTO_THREAD_unlock().

SSL_CTX_flush_sessions_ex() already deferred SSL_SESSION_free() to
after the lock via a STACK_OF(SSL_SESSION). The callback is now also
deferred: sessions are collected on the stack under the lock, then
the lock is released before iterating the stack to fire callbacks
and free each session.

Assisted-by: Claude:claude-sonnet-4-6

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
MergeDate: Wed Jul  8 17:58:47 2026
(Merged from https://github.com/openssl/openssl/pull/31540)

(cherry picked from commit 4be956b9cdeec99bd34f968ac4b595989d73abf7)


  Commit: 59ec9b5e8d39af94437745d66b2fc0661444900c
      https://github.com/openssl/openssl/commit/59ec9b5e8d39af94437745d66b2fc0661444900c
  Author: Matt Caswell <[email protected]>
  Date:   2026-07-08 (Wed, 08 Jul 2026)

  Changed paths:
    M test/sslapitest.c

  Log Message:
  -----------
  Add regression test for remove_session_cb under lock

Install a remove_session_cb that calls SSL_CTX_flush_sessions_ex().
If the callback is invoked while ctx->lock is held, the nested
flush call deadlocks immediately.

The test covers the SSL_CTX_add_session() eviction path (adding a
second session to a size == 1 cache evicts the first, firing the
callback) and the SSL_CTX_flush_sessions_ex() path (SSL_CTX_free()
flushes the remaining session via flush_sessions_ex()).

Assisted-by: Claude:claude-sonnet-4-6

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
MergeDate: Wed Jul  8 17:58:48 2026
(Merged from https://github.com/openssl/openssl/pull/31540)

(cherry picked from commit b24c43f9b8806f9fa7af89816db500f4dba7051b)


Compare: https://github.com/openssl/openssl/compare/dc219a04088d...59ec9b5e8d39

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.6/dc219a-59ec9b%40github.com.