Commit 53990ac497 for openssl.org

commit 53990ac497823b22bff9a400714dc68cde77e0f6
Author: Matt Caswell <matt@openssl.foundation>
Date:   Mon Nov 2 17:31:57 2026 +0000

    ssl/quic/quic_impl.c: lock the QUIC connection in SSL_get_conn_close_info()

    ossl_quic_get_conn_close_info() reads the channel state and terminate
    cause without taking the domain mutex. With thread assist, the assist
    thread ticks the channel under that mutex and can change both at the
    same time, so an application calling SSL_get_conn_close_info() from
    another thread races with it.

    The threads_sanitizer CI job hits this in quic_radix_test: after the
    check_thread_assisted_idle script re-enables ticking on a
    thread-assisted client, the harness calls SSL_get_conn_close_info()
    on it from the main thread to print the final object state while the
    assist thread is ticking. TSan reports a race in
    ossl_quic_channel_is_term_any() only when the two overlap, so the job
    fails intermittently.

    Take the lock, as the other getters in quic_impl.c do.

    Fixes: c3a04ea2fdd0 "QUIC DISPATCH/APL: Add SSL_stream_reset and status query APIs"
    References: 3a9cedc20fe6 "QUIC APL: Rework QCTX to support listener calls"
    Assisted-by: Claude Code:claude-opus-5-5
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Reviewed-by: Saša Nedvědický <sashan@openssl.org>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Merge-date: Fri Nov  6 11:38:05 2026
    Merged-from: https://github.com/openssl/openssl/pull/33505

diff --git a/ssl/quic/quic_impl.c b/ssl/quic/quic_impl.c
index a858a8c04a..92f85f0106 100644
--- a/ssl/quic/quic_impl.c
+++ b/ssl/quic/quic_impl.c
@@ -4618,13 +4618,16 @@ int ossl_quic_get_conn_close_info(SSL *ssl,
 {
     QCTX ctx;
     const QUIC_TERMINATE_CAUSE *tc;
+    int ret = 0;

     if (!expect_quic_conn_only(ssl, &ctx))
         return -1;

+    qctx_lock(&ctx);
+
     tc = ossl_quic_channel_get_terminate_cause(ctx.qc->ch);
     if (tc == NULL)
-        return 0;
+        goto out;

     info->error_code = tc->error_code;
     info->frame_type = tc->frame_type;
@@ -4635,7 +4638,11 @@ int ossl_quic_get_conn_close_info(SSL *ssl,
         info->flags |= SSL_CONN_CLOSE_FLAG_LOCAL;
     if (!tc->app)
         info->flags |= SSL_CONN_CLOSE_FLAG_TRANSPORT;
-    return 1;
+    ret = 1;
+
+out:
+    qctx_unlock(&ctx);
+    return ret;
 }

 /*