QUIC APL: Fix refcounting for listeners

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)

diff --git a/ssl/quic/quic_impl.c b/ssl/quic/quic_impl.c
index 6562a70492d4472e54b8e958179d92a2879e439d..cba2d2463b55d82ec7023d88b301eaf14a75ad53 100644 (file)
--- a/ssl/quic/quic_impl.c
+++ b/ssl/quic/quic_impl.c
@@ -546,17 +546,18 @@ static void qc_cleanup(QUIC_CONNECTION *qc, int have_lock)
         quic_unref_port_bios(qc->port);
         ossl_quic_port_free(qc->port);
         qc->port = NULL;
-    }
 
-    ossl_quic_engine_free(qc->engine);
-    qc->engine = NULL;
+        ossl_quic_engine_free(qc->engine);
+        qc->engine = NULL;
+    }
 
     if (have_lock)
         /* tsan doesn't like freeing locked mutexes */
         ossl_crypto_mutex_unlock(qc->mutex);
 
 #if defined(OPENSSL_THREADS)
-    ossl_crypto_mutex_free(&qc->mutex);
+    if (qc->listener == NULL)
+        ossl_crypto_mutex_free(&qc->mutex);
 #endif
 }
 
@@ -662,6 +663,10 @@ void ossl_quic_free(SSL *s)
      * us
      */
     qc_cleanup(ctx.qc, /*have_lock=*/1);
+    /* Note: SSL_free calls OPENSSL_free(qc) for us */
+
+    if (ctx.qc->listener != NULL)
+        SSL_free(&ctx.qc->listener->obj.ssl);
 }
 
 /* SSL method init */
@@ -4198,8 +4203,14 @@ static QUIC_CONNECTION *create_qc_from_incoming_conn(QUIC_LISTENER *ql, QUIC_CHA
 {
     QUIC_CONNECTION *qc = NULL;
 
+    if (!SSL_up_ref(&ql->obj.ssl)) {
+        QUIC_RAISE_NON_NORMAL_ERROR(NULL, ERR_R_INTERNAL_ERROR, NULL);
+        goto err;
+    }
+
     if ((qc = OPENSSL_zalloc(sizeof(*qc))) == NULL) {
         QUIC_RAISE_NON_NORMAL_ERROR(NULL, ERR_R_CRYPTO_LIB, NULL);
+        SSL_free(&ql->obj.ssl);
         goto err;
     }
 
@@ -4207,6 +4218,7 @@ static QUIC_CONNECTION *create_qc_from_incoming_conn(QUIC_LISTENER *ql, QUIC_CHA
                             SSL_TYPE_QUIC_CONNECTION,
                             &ql->obj.ssl, NULL, NULL)) {
         QUIC_RAISE_NON_NORMAL_ERROR(NULL, ERR_R_INTERNAL_ERROR, NULL);
+        SSL_free(&ql->obj.ssl);
         goto err;
     }