Skip to content

JSSE: protect from calling freeSSL() while I/O operations in progress#278

Merged
rlm2002 merged 1 commit intowolfSSL:masterfrom
cconlon:sslSocketFreeFix
Aug 18, 2025
Merged

JSSE: protect from calling freeSSL() while I/O operations in progress#278
rlm2002 merged 1 commit intowolfSSL:masterfrom
cconlon:sslSocketFreeFix

Conversation

@cconlon
Copy link
Copy Markdown
Member

@cconlon cconlon commented Jul 2, 2025

This PR adds an atomic counter of active I/O operations (read/write) to WolfSSLSocket.java to protect against calling freeSSL() while I/O ops are still in progress.

This fixes an issue where AddressSanitizer detected heap-use-after-free errors when multiple threads performed concurrent I/O operations while another thread called close() on the same WolfSSLSocket. The race condition occurred when wolfSSL_get_app_data() was called on a freed WOLFSSL object during active read/write operations.

I did try to get a unit test put together for regression on this item, but was unsuccessful in a reliable consistent test yet. Separate reproducer confirmed this fixed the issue locally.

@cconlon cconlon self-assigned this Jul 2, 2025
@cconlon cconlon requested a review from Copilot July 2, 2025 18:18
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

The PR introduces an atomic counter to track active I/O operations in WolfSSLSocket and prevent freeSSL() from being called while reads or writes are in flight.

  • Added activeOperations counter with enterIOOperation()/exitIOOperation() helpers.
  • Wrapped read/write streams to increment/decrement the counter.
  • Updated close() to defer freeing SSL until no active operations remain.
Comments suppressed due to low confidence (1)

src/java/com/wolfssl/provider/jsse/WolfSSLSocket.java:2735

  • No tests were added to verify that activeOperations prevents freeSSL() under concurrent I/O, or that the counter remains accurate under failure paths. Consider adding multithreaded unit tests or integration tests that simulate concurrent read/write and close calls.
            /* Enter I/O operation to prevent use-after-free */

Comment thread src/java/com/wolfssl/provider/jsse/WolfSSLSocket.java
Comment thread src/java/com/wolfssl/provider/jsse/WolfSSLSocket.java Outdated
@cconlon cconlon force-pushed the sslSocketFreeFix branch from 33d4e7c to e022448 Compare July 2, 2025 18:29
@cconlon cconlon force-pushed the sslSocketFreeFix branch from e022448 to 17fe8ad Compare July 2, 2025 20:20
@cconlon cconlon assigned rlm2002 and unassigned cconlon Aug 15, 2025
@rlm2002 rlm2002 merged commit e23ff98 into wolfSSL:master Aug 18, 2025
52 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants