Avoid races by caching exported ciphers in the init function

TSAN was reporting a race of the exported ciphers cache that we create in
the default and fips providers. This was because we cached it in the query
function rather than the init function, so this would cause a race if multiple
threads queried at the same time. In practice it probably wouldn't make much
difference since different threads should come up with the same answer.

Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13987)

diff --git a/providers/defltprov.c b/providers/defltprov.c
index 2a1ebb6218c5e80ebc06acd1a51d75bdd1fdf62f..c246ed42be315de647e4cc08892227f26302e767 100644 (file)
--- a/providers/defltprov.c
+++ b/providers/defltprov.c
@@ -472,7 +472,6 @@ static const OSSL_ALGORITHM *deflt_query(void *provctx, int operation_id,
     case OSSL_OP_DIGEST:
         return deflt_digests;
     case OSSL_OP_CIPHER:
-        ossl_prov_cache_exported_algorithms(deflt_ciphers, exported_ciphers);
         return exported_ciphers;
     case OSSL_OP_MAC:
         return deflt_macs;
@@ -570,6 +569,7 @@ int ossl_default_provider_init(const OSSL_CORE_HANDLE *handle,
     ossl_prov_ctx_set0_core_bio_method(*provctx, corebiometh);
 
     *out = deflt_dispatch_table;
+    ossl_prov_cache_exported_algorithms(deflt_ciphers, exported_ciphers);
 
     return 1;
 }

diff --git a/providers/fips/fipsprov.c b/providers/fips/fipsprov.c
index deffb88ba6bb9b6b7c17b9c810cdcea9eb07700a..dc1bd7b4726b42d08ade418bf589d57f6790f2e6 100644 (file)
--- a/providers/fips/fipsprov.c
+++ b/providers/fips/fipsprov.c
@@ -434,8 +434,6 @@ static const OSSL_ALGORITHM *fips_query(void *provctx, int operation_id,
     case OSSL_OP_DIGEST:
         return fips_digests;
     case OSSL_OP_CIPHER:
-        ossl_prov_cache_exported_algorithms(fips_ciphers,
-                                            exported_fips_ciphers);
         return exported_fips_ciphers;
     case OSSL_OP_MAC:
         return fips_macs;
@@ -626,6 +624,8 @@ int OSSL_provider_init(const OSSL_CORE_HANDLE *handle,
 
     fgbl->handle = handle;
 
+    ossl_prov_cache_exported_algorithms(fips_ciphers, exported_fips_ciphers);
+
     selftest_params.libctx = libctx;
     if (!SELF_TEST_post(&selftest_params, 0)) {
         ERR_raise(ERR_LIB_PROV, PROV_R_SELF_TEST_POST_FAILURE);