Bug 2333301 - SSL_CTX_new() hangs in CRYPTO_THREAD_read_lock()
Summary: SSL_CTX_new() hangs in CRYPTO_THREAD_read_lock()
Keywords:
Status: CLOSED EOL
Alias: None
Product: Fedora
Classification: Fedora
Component: mingw-openssl
Version: 41
Hardware: x86_64
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Richard W.M. Jones
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-12-19 10:25 UTC by Jan Wielemaker
Modified: 2025-12-16 18:13 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2025-12-16 18:13:52 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Jan Wielemaker 2024-12-19 10:25:23 UTC
I use a Fedora 41 Docker to build the Windows release for SWI-Prolog.  After upgrading from Fedora 39, my executable can no longer establish connections using SSL.  The application deadlocks while creating the SSL context.  Running under Windows 11 home, using MSYS2 gdb, I get the stack trace below.   Note that the DLLs for ssl are copied from the Fedora locations into the package.   When I replace the ssl and crypto dlls with dlls from https://slproweb.com/products/Win32OpenSSL.html, everything works fine.

Fedora version: mingw-openssl-3.2.2-2.fc41, Downloaded version: `Win64OpenSSL_Light-3_2_3.exe`

```
#0  0x00007ff903467864 in ntdll!ZwWaitForAlertByThreadId () from C:\Windows\SYSTEM32\ntdll.dll
#1  0x00007ff9033fab2d in ntdll!RtlAcquireSRWLockShared () from C:\Windows\SYSTEM32\ntdll.dll
#2  0x00007ff8b5e8b939 in CRYPTO_THREAD_read_lock ()
   from \\?\p:\build.win64\src\libcrypto-3-x64.dll
#3  0x00007ff8b5f63ff0 in ossl_rand_get0_seed_noncreating ()
   from \\?\p:\build.win64\src\libcrypto-3-x64.dll
#4  0x00007ff8b5f6309f in ossl_rand_get_user_nonce ()
   from \\?\p:\build.win64\src\libcrypto-3-x64.dll
#5  0x00007ff8b6025d02 in ossl_prov_drbg_instantiate ()
   from \\?\p:\build.win64\src\libcrypto-3-x64.dll
#6  0x00007ff8b60278c1 in drbg_ctr_instantiate_wrapper ()
   from \\?\p:\build.win64\src\libcrypto-3-x64.dll
#7  0x00007ff8b5e50a6b in EVP_RAND_instantiate () from \\?\p:\build.win64\src\libcrypto-3-x64.dll
#8  0x00007ff8b5f6358a in rand_new_drbg () from \\?\p:\build.win64\src\libcrypto-3-x64.dll
#9  0x00007ff8b5f640be in RAND_get0_primary () from \\?\p:\build.win64\src\libcrypto-3-x64.dll
#10 0x00007ff8b5f64450 in RAND_get0_public () from \\?\p:\build.win64\src\libcrypto-3-x64.dll
#11 0x00007ff8b5f64508 in RAND_bytes_ex () from \\?\p:\build.win64\src\libcrypto-3-x64.dll
#12 0x00007ff8b7c49bb7 in SSL_CTX_new_ex () from \\?\p:\build.win64\src\libssl-3-x64.dll
#13 0x00007ff8b5ae3830 in ssl_init (role=role@entry=PL_SSL_CLIENT,
    ssl_method=ssl_method@entry=0x7ff8b7cc4e80)
    at /home/swipl/src/swipl-devel/packages/ssl/ssl4pl.c:2537
#14 0x00007ff8b5ae7a88 in pl_ssl_context (role=role@entry=310, config=config@entry=311,
    options=options@entry=312, method=method@entry=313)
    at /home/swipl/src/swipl-devel/packages/ssl/ssl4pl.c:3819
#15 0x00007ff88def067d in PL_next_solution___LD (__PL_ld=<optimized out>,
    __PL_ld@entry=0x7ff88e018e20 <PL_local_data>, qid=<optimized out>, qid@entry=0x2dd3190)
--Type <RET> for more, q to quit, c to continue without paging--
    at /home/swipl/src/swipl-devel/src/pl-vmi.c:4524
#16 0x00007ff88debdf4e in query_loop (goal=goal@entry=33285, loop=true)
    at /home/swipl/src/swipl-devel/src/pl-pro.c:171
#17 0x00007ff88debddfb in prologToplevel (goal=goal@entry=33285)
    at /home/swipl/src/swipl-devel/src/pl-pro.c:654
#18 0x00007ff88ded1fdd in PL_toplevel () at /home/swipl/src/swipl-devel/src/pl-fli.c:4979
#19 0x00007ff6437514a0 in wmain (argc=2, argv=0x851ac0)
    at /home/swipl/src/swipl-devel/src/pl-main.c:143
#20 0x00007ff6437512ef in __tmainCRTStartup () at ../crt/crtexe.c:267
#21 0x00007ff643751406 in mainCRTStartup () at ../crt/crtexe.c:188
```

Reproducible: Always

Steps to Reproduce:
I do not expect you to download the SWI-Prolog installer.   If you do, download swipl-9.3.17-1.x64.exe from https://www.swi-prolog.org/download/devel, install, run `swipl.exe` and then

```
?- use_module(library(http/http_open)).
?- http_open('https://www.swi-prolog.org', In, []).
<hangs>
```

This reproduces with any https server, both on Windows 11 and when running the executable under Wine (on Fedora 41).

Comment 1 Richard W.M. Jones 2025-01-02 15:30:04 UTC
I would suggest asking about this upstream, and we're only packaging openssl here.

Comment 2 Jan Wielemaker 2025-01-02 16:55:55 UTC
(In reply to Richard W.M. Jones from comment #1)
> I would suggest asking about this upstream, and we're only packaging openssl
> here.

Thanks.  Considering that the OpenSSL versions from slproweb are not affected by this bug I suspect an issue in MinGW or the configuration of OpenSSL for MinGW.  What would be the best place to report this?

Comment 3 Richard W.M. Jones 2025-01-02 17:00:03 UTC
I don't know/care what slproweb or how their versions are different, but you can see how
Fedora's mingw-openssl is packaged here:

https://src.fedoraproject.org/rpms/mingw-openssl/blob/rawhide/f/mingw-openssl.spec

As you can see we patch openssl a fair bit (all of these patches coming from the
main Fedora openssl package).  What exactly causes this bug or if it is related,
I do not know.

Comment 4 Adam Williamson 2025-12-02 02:00:19 UTC
This message is a reminder that Fedora Linux 41 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 41 on 2025-12-15.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '41'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, change the 'version' 
to a later Fedora Linux version. Note that the version field may be hidden.
Click the "Show advanced fields" button if you do not see it.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora Linux 41 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora Linux, you are encouraged to change the 'version' to a later version
prior to this bug being closed.

Comment 5 Samyak Jain (RedHat) 2025-12-16 18:13:52 UTC
Fedora Linux 41 entered end-of-life (EOL) status on 2025-12-15.

Fedora Linux 41 is no longer maintained, which means that it
will not receive any further security or bug fix updates. As a result we
are closing this bug.

If you can reproduce this bug against a currently maintained version of Fedora Linux
please feel free to reopen this bug against that version. Note that the version
field may be hidden. Click the "Show advanced fields" button if you do not see
the version field.

If you are unable to reopen this bug, please file a new report against an
active release.

Thank you for reporting this bug and we are sorry it could not be fixed.


Note You need to log in before you can comment on or make changes to this bug.