[openssl/openssl] 8b2632: Revert "Free connections before listeners in the r...

[Neil Horman]

Branch: refs/heads/master
Home: https://github.com/openssl/openssl
Commit: 8b2632d90fac3b0e0a9e6f0ade41ca03c43edeed
https://github.com/openssl/openssl/commit/8b2632d90fac3b0e0a9e6f0ade41ca03c43edeed
Author: Neil Horman <nho...@openssl.org>
Date: 2026-09-11 (Fri, 11 Sep 2026)

Changed paths:
M test/radix/quic_bindings.c

Log Message:
-----------
Revert "Free connections before listeners in the radix test cleanup"

This reverts commit 31c32ca387a01b1134b459941d5111ab977b8197.

Reviewed-by: Jakub Zelenka <jakub....@openssl.foundation>
Reviewed-by: Andrew Dinh <and...@openssl.org>
MergeDate: Fri Sep 11 20:50:56 2026
(Merged from https://github.com/openssl/openssl/pull/32498)


Commit: f99bbcd5afff69840f2bfed92458cd5ac092cf91
https://github.com/openssl/openssl/commit/f99bbcd5afff69840f2bfed92458cd5ac092cf91
Author: Neil Horman <nho...@openssl.org>
Date: 2026-09-11 (Fri, 11 Sep 2026)

Changed paths:
M crypto/bio/bss_dgram_pair.c
M include/internal/threads_common.h

Log Message:
-----------
Dont have dgram_pairs track bios, track bio_dgram_pair_st instead

@ifanzki reported an asan issue with the quic_radix_test in:
https://github.com/openssl/openssl/issues/32420

And we've tried fixing it a few different ways, with varying amounts of
success

This commit represents an alternative approach which I think is more
general to the bio_dgram_pair bio type.

The problem:
We have a race condition as reported above in which freeing one side of
a BIO dgram pair results in a use after free

The root cause:
BIO_new_bio_dgram_pair creates 2 dgram BIOS, each with a reference count
of one (which is sensible, as each bio has a single owner). However,
after creating the bios, it calls BIO_make_bio_pair(), which links the
two together. Under the covers in the bio_dgram_pair implementation,
each bio stores the pointer of its peer bio _without_ taking an
additional reference on the bio. This means that, once the first bio is
freed, the second bio may be doing subsequent io, which requires
dereferencing of the peer bio , which is already release,
leading to the use after free case observed.

Nominally this isn't an issue, as most code that uses BIO_dgram_pairs
are single threaded, and freeing of the component bios only occurs after
any i/o is already terminated, avoiding the observed UAF. However, the
QUIC radix test exercises the thread assisted mode of the quic stack,
and in so doing passes each half of a bio dgram pair to a separate
thread.

The fix:

Nominally we could resolve this by increasing the reference count on
each of the peer bios, and dropping that ref count when each is freed,
so that only the last to free actually deallocates both instances, but
this creates a chicken and egg issue. Since the the stored reference to
each bio lives in the dgram pair implementation, upping the refcount of
the bios prevents either bio from ever reaching the implementation free
code (dgram_pair_free)

So instead I'm proposing the following in this commit:
1) Instead of having the internal bio data track the peer bio, instead
have the internal data track a shared bio_dgram_peer_st structure
which is reference counted

2) When creating a pair, the pair only uses the data (ring buffers,
locks, etc), from the shared data, as its guaranteed to live until
the last owner of the pair either frees itself BIO_free, or destroys
the pair vi BIO_dgram_destroy_pair

3) If either side of the pair disconnects via the calls in (3), the
shared data state is updated to reflect that, and the remaining peer
triggers on that to get BROKEN_PIPE return codes

Also added tests from @bukka, as they provide more coverage than the
test I had in mind.

Fixes #32420

Reviewed-by: Jakub Zelenka <jakub....@openssl.foundation>
Reviewed-by: Andrew Dinh <and...@openssl.org>
MergeDate: Fri Sep 11 20:50:58 2026
(Merged from https://github.com/openssl/openssl/pull/32498)


Commit: 862853b97484857b7d94865fcc3b862a5ed765df
https://github.com/openssl/openssl/commit/862853b97484857b7d94865fcc3b862a5ed765df
Author: Jakub Zelenka <jakub....@openssl.foundation>
Date: 2026-09-11 (Fri, 11 Sep 2026)

Changed paths:
M test/bio_dgram_test.c

Log Message:
-----------
Add tests for bio_dgram_pair

Add tests to ensure various race conditions are closed in bio_dgram_pair
usage

Co-authored-by: Neil Horman <nho...@openssl.org>
Assisted-by: Claude:claude-fable-5-1

Reviewed-by: Andrew Dinh <and...@openssl.org>
Reviewed-by: Neil Horman <nho...@openssl.org>
MergeDate: Fri Sep 11 20:50:59 2026
(Merged from https://github.com/openssl/openssl/pull/32498)


Commit: e66f91b34b53d4e301d5bade83a441d74a6a7ad5
https://github.com/openssl/openssl/commit/e66f91b34b53d4e301d5bade83a441d74a6a7ad5
Author: Neil Horman <nho...@openssl.org>
Date: 2026-09-11 (Fri, 11 Sep 2026)

Changed paths:
M doc/man3/BIO_s_dgram_pair.pod

Log Message:
-----------
Augment docs for BIO_s_dgram_pair

Reviewed-by: Jakub Zelenka <jakub....@openssl.foundation>
Reviewed-by: Andrew Dinh <and...@openssl.org>
MergeDate: Fri Sep 11 20:51:01 2026
(Merged from https://github.com/openssl/openssl/pull/32498)


Compare: https://github.com/openssl/openssl/compare/668dc66f6637...e66f91b34b53

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications