Bug 1400922

Summary:	OpenSSL 1.0.2j deadlock in FIPS mode
Product:	[Fedora] Fedora	Reporter:	Christian Heimes <cheimes>
Component:	openssl	Assignee:	Tomas Mraz <tmraz>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	high
Version:	24	CC:	cfu, edewata, nkinder, tmraz
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openssl-1.0.2j-3.fc25 openssl-1.0.2j-3.fc24	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-12-22 16:49:54 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Christian Heimes 2016-12-02 10:15:07 UTC

Description of problem:
OpenSSL 1.0.2j deadlocks in FIPS mode. The deadlock occurs in multithreaded applicaiton with an OpenSSL thread lock callback, e.g. Python's ssl module. It's triggered by reseed of the RNG during SSL handshake

Version-Release number of selected component (if applicable):
OpenSSL 1.0.2j

How reproducible:
always

Steps to Reproduce:
1. touch /etc/system-fips
2. OPENSSL_FORCE_FIPS_MODE=1 pip download somepackage

Actual results:
program deadlocks

Expected results:
pip works

Additional info:
https://bugs.python.org/issue28854
https://github.com/openssl/openssl/issues/2019

The bug is caused by a double lock acquire of CRYPTO_LOCK_RAND lock. My Python upstream bug contains more detailed information and gdb stack dumps.

Comment 1 Tomas Mraz 2016-12-02 10:30:08 UTC

You can close the upstream report as the FIPS mode support we have in Fedora is different from upstream.

I'll investigate and fix it.

Comment 4 Tomas Mraz 2016-12-02 17:09:16 UTC

Can you please test openssl-1.0.2j-3.fc24 from koji? According to my tests it should be fixed. I've dropped the read lock in drbg_status which is unnecessary.

Comment 5 Christian Heimes 2016-12-02 17:29:28 UTC

openssl-1.0.2j-3.fc24 from http://koji.fedoraproject.org/koji/taskinfo?taskID=16708277 fixes the bug and no longer causes deadlocks. Thanks a lot for the fast fix!

Comment 6 Fedora Update System 2016-12-21 08:16:23 UTC

openssl-1.0.2j-3.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-f5c57e05b6

Comment 7 Fedora Update System 2016-12-21 08:16:32 UTC

openssl-1.0.2j-3.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2016-5ccc141b9c

Comment 8 Fedora Update System 2016-12-21 15:49:17 UTC

openssl-1.0.2j-3.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-f5c57e05b6

Comment 9 Fedora Update System 2016-12-21 15:51:22 UTC

openssl-1.0.2j-3.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-5ccc141b9c

Comment 10 Fedora Update System 2016-12-22 16:49:54 UTC

openssl-1.0.2j-3.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2016-12-27 10:49:03 UTC

openssl-1.0.2j-3.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.