Skip to content

gh-137583: Only lock the SSL context, not the SSL socket #137588

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 16 commits into from
Aug 10, 2025
Merged

gh-137583: Only lock the SSL context, not the SSL socket #137588

Show file tree
Hide file tree
Changes from 12 commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
0a070e2
Only lock the SSL context, not the SSL socket.
ZeroIntensity Aug 9, 2025
42a0351
Fix the test.
ZeroIntensity Aug 9, 2025
c776679
Fix race conditions in the test case.
ZeroIntensity Aug 9, 2025
90d93c3
I now realize that approach was bad.
ZeroIntensity Aug 9, 2025
7ea2613
Some other fixups.
ZeroIntensity Aug 9, 2025
5ff4efc
I give up.
ZeroIntensity Aug 9, 2025
cf630d7
Stupid workaround.
ZeroIntensity Aug 9, 2025
f3ec86c
Add blurb.
ZeroIntensity Aug 9, 2025
12a68a5
Fix blurb.
ZeroIntensity Aug 9, 2025
d45f6a8
Supposedly this *actually* fixes the blurb.
ZeroIntensity Aug 9, 2025
6799b03
Avoid Sphinx references for the blurb.
ZeroIntensity Aug 9, 2025
38e29f9
Fix race condition in the test case (for real this time).
ZeroIntensity Aug 9, 2025
64f7480
Fix the blurb (hopefully for the last time).
ZeroIntensity Aug 9, 2025
6da074e
Fix the Windows buildbots.
ZeroIntensity Aug 9, 2025
bb99322
Blurb fixup.
ZeroIntensity Aug 10, 2025
36a4d66
Ugh.
ZeroIntensity Aug 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 35 additions & 0 deletions Lib/test/test_ssl.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4620,6 +4620,41 @@ def server_callback(identity):
with client_context.wrap_socket(socket.socket()) as s:
s.connect((HOST, server.port))

def test_thread_recv_while_main_thread_sends(self):
# GH-137583: Locking was added to calls to send() and recv() on SSL
# socket objects. This seemed fine at the surface level because those
# calls weren't re-entrant, but recv() calls would implicitly mimick
# holding a lock by blocking until it received data. This means that
# if a thread started to infinitely block until data was received, calls
# to send() would deadlock, because it would wait forever on the lock
# that the recv() call held.
data = b"1" * 1024
event = threading.Event()
def background(sock):
event.set()
received = sock.recv(len(data))
self.assertEqual(received, data)

client_context, server_context, hostname = testing_context()
server = ThreadedEchoServer(context=server_context)
with server:
with client_context.wrap_socket(socket.socket(),
server_hostname=hostname) as sock:
sock.connect((HOST, server.port))
sock.settimeout(1)
# Ensure that the server is ready to accept requests
sock.sendall(b"123")
self.assertEqual(sock.recv(3), b"123")
with threading_helper.catch_threading_exception() as cm:
thread = threading.Thread(target=background,
args=(sock,), daemon=True)
thread.start()
event.wait()
sock.sendall(data)
thread.join()
if cm.exc_value is not None:
raise cm.exc_value


@unittest.skipUnless(has_tls_version('TLSv1_3') and ssl.HAS_PHA,
"Test needs TLS 1.3 PHA")
Expand Down
4 changes: 4 additions & 0 deletions Misc/NEWS.d/next/Library/2025-08-09-08-53-32.gh-issue-137583.s6OZud.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
Fix a deadlock introduced in the :mod:`ssl` module when a call to
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

mention the specific Python 3.13 version the deadlock was introduced in.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(and 3.14.0rc1)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The backport didn't make it to 3.14, so it's fine there. Only 3.13.6 is affected.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

``recv()`` was blocked in one thread, while another
attempted to call ``send()`` to unblock it in another
thread.
Copy link

@aaugustin aaugustin Aug 10, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd simplify this as follows:

Fix a regression in 3.13.6 when a call to
:meth:`ssl.SSLSocket.recv <socket.socket.recv>` in a thread would block calling
:meth:`ssl.SSLSocket.send <socket.socket.send>` in another thread.

Indeed, the problem happens even without a dependency between recv and send.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we even need to mention send at all. If recv was blocked, it's not possible to access most methods on an SSLSocket, because they'll also try to acquire that same lock.

38 changes: 20 additions & 18 deletions Modules/_ssl.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -366,9 +366,6 @@ typedef struct {
* and shutdown methods check for chained exceptions.
*/
PyObject *exc;
/* Lock to synchronize calls when the thread state is detached.
See also gh-134698. */
PyMutex tstate_mutex;
} PySSLSocket;

#define PySSLSocket_CAST(op) ((PySSLSocket *)(op))
Expand Down Expand Up @@ -918,7 +915,6 @@ newPySSLSocket(PySSLContext *sslctx, PySocketSockObject *sock,
self->server_hostname = NULL;
self->err = err;
self->exc = NULL;
self->tstate_mutex = (PyMutex){0};

/* Make sure the SSL error state is initialized */
ERR_clear_error();
Expand Down Expand Up @@ -994,12 +990,12 @@ newPySSLSocket(PySSLContext *sslctx, PySocketSockObject *sock,
BIO_set_nbio(SSL_get_wbio(self->ssl), 1);
}

PySSL_BEGIN_ALLOW_THREADS(self)
Py_BEGIN_ALLOW_THREADS;
if (socket_type == PY_SSL_CLIENT)
SSL_set_connect_state(self->ssl);
else
SSL_set_accept_state(self->ssl);
PySSL_END_ALLOW_THREADS(self)
Py_END_ALLOW_THREADS;

self->socket_type = socket_type;
if (sock != NULL) {
Expand Down Expand Up @@ -1068,10 +1064,11 @@ _ssl__SSLSocket_do_handshake_impl(PySSLSocket *self)
/* Actually negotiate SSL connection */
/* XXX If SSL_do_handshake() returns 0, it's also a failure. */
do {
PySSL_BEGIN_ALLOW_THREADS(self)
Py_BEGIN_ALLOW_THREADS
ret = SSL_do_handshake(self->ssl);
err = _PySSL_errno(ret < 1, self->ssl, ret);
PySSL_END_ALLOW_THREADS(self)
Py_END_ALLOW_THREADS;
_PySSL_FIX_ERRNO;
self->err = err;

if (PyErr_CheckSignals())
Expand Down Expand Up @@ -2615,10 +2612,11 @@ _ssl__SSLSocket_sendfile_impl(PySSLSocket *self, int fd, Py_off_t offset,
}

do {
PySSL_BEGIN_ALLOW_THREADS(self)
Py_BEGIN_ALLOW_THREADS
retval = SSL_sendfile(self->ssl, fd, (off_t)offset, size, flags);
err = _PySSL_errno(retval < 0, self->ssl, (int)retval);
PySSL_END_ALLOW_THREADS(self)
Py_END_ALLOW_THREADS;
_PySSL_FIX_ERRNO;
self->err = err;

if (PyErr_CheckSignals()) {
Expand Down Expand Up @@ -2746,10 +2744,11 @@ _ssl__SSLSocket_write_impl(PySSLSocket *self, Py_buffer *b)
}

do {
PySSL_BEGIN_ALLOW_THREADS(self)
Py_BEGIN_ALLOW_THREADS;
retval = SSL_write_ex(self->ssl, b->buf, (size_t)b->len, &count);
err = _PySSL_errno(retval == 0, self->ssl, retval);
PySSL_END_ALLOW_THREADS(self)
Py_END_ALLOW_THREADS;
_PySSL_FIX_ERRNO;
self->err = err;

if (PyErr_CheckSignals())
Expand Down Expand Up @@ -2807,10 +2806,11 @@ _ssl__SSLSocket_pending_impl(PySSLSocket *self)
int count = 0;
_PySSLError err;

PySSL_BEGIN_ALLOW_THREADS(self)
Py_BEGIN_ALLOW_THREADS;
count = SSL_pending(self->ssl);
err = _PySSL_errno(count < 0, self->ssl, count);
PySSL_END_ALLOW_THREADS(self)
Py_END_ALLOW_THREADS;
_PySSL_FIX_ERRNO;
self->err = err;

if (count < 0)
Expand Down Expand Up @@ -2901,10 +2901,11 @@ _ssl__SSLSocket_read_impl(PySSLSocket *self, Py_ssize_t len,
deadline = _PyDeadline_Init(timeout);

do {
PySSL_BEGIN_ALLOW_THREADS(self)
Py_BEGIN_ALLOW_THREADS;
retval = SSL_read_ex(self->ssl, mem, (size_t)len, &count);
err = _PySSL_errno(retval == 0, self->ssl, retval);
PySSL_END_ALLOW_THREADS(self)
Py_END_ALLOW_THREADS;
_PySSL_FIX_ERRNO;
self->err = err;

if (PyErr_CheckSignals())
Expand Down Expand Up @@ -3003,7 +3004,7 @@ _ssl__SSLSocket_shutdown_impl(PySSLSocket *self)
}

while (1) {
PySSL_BEGIN_ALLOW_THREADS(self)
Py_BEGIN_ALLOW_THREADS;
/* Disable read-ahead so that unwrap can work correctly.
* Otherwise OpenSSL might read in too much data,
* eating clear text data that happens to be
Expand All @@ -3016,7 +3017,8 @@ _ssl__SSLSocket_shutdown_impl(PySSLSocket *self)
SSL_set_read_ahead(self->ssl, 0);
ret = SSL_shutdown(self->ssl);
err = _PySSL_errno(ret < 0, self->ssl, ret);
PySSL_END_ALLOW_THREADS(self)
Py_END_ALLOW_THREADS;
_PySSL_FIX_ERRNO;
self->err = err;

/* If err == 1, a secure shutdown with SSL_shutdown() is complete */
Expand Down
1 change: 0 additions & 1 deletion Modules/_ssl/debughelpers.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,7 +140,6 @@ _PySSL_keylog_callback(const SSL *ssl, const char *line)
* critical debug helper.
*/

assert(PyMutex_IsLocked(&ssl_obj->tstate_mutex));
Py_BEGIN_ALLOW_THREADS
PyThread_acquire_lock(lock, 1);
res = BIO_printf(ssl_obj->ctx->keylog_bio, "%s\n", line);
Expand Down
Loading