(trafficserver) branch master updated: Fix data race in SSLCertContext copy & assignment (#13227)

[bc...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

bryancall pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/trafficserver.git


The following commit(s) were added to refs/heads/master by this push:
     new 6106f6b57f Fix data race in SSLCertContext copy & assignment (#13227)
6106f6b57f is described below

commit 6106f6b57f466df2cc00fbb71d1621b0ce2ff615
Author: Sasank P <14...@users.noreply.github.com>
AuthorDate: Tue Sep 1 04:28:28 2026 +0530

    Fix data race in SSLCertContext copy & assignment (#13227)
    
    Resolve concurrent read/write data races by using std::scoped_lock in operator= and locking other.ctx_mutex at the start of the copy constructor.
---
 src/iocore/net/SSLCertLookup.cc | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/iocore/net/SSLCertLookup.cc b/src/iocore/net/SSLCertLookup.cc
index c53bf07b68..84ea4641ab 100644
--- a/src/iocore/net/SSLCertLookup.cc
+++ b/src/iocore/net/SSLCertLookup.cc
@@ -34,6 +34,7 @@
 #include "P_SSLUtils.h"
 
 #include <mutex>
+#include <shared_mutex>
 #include <unordered_map>
 #include <utility>
 #include <vector>
@@ -234,24 +235,24 @@ fail:
 
 SSLCertContext::SSLCertContext(SSLCertContext const &other)
 {
+  std::shared_lock lock(other.ctx_mutex);
   opt        = other.opt;
   userconfig = other.userconfig;
   keyblock   = other.keyblock;
   ctx_type   = other.ctx_type;
-  std::shared_lock lock(other.ctx_mutex);
-  ctx = other.ctx;
+  ctx        = other.ctx;
 }
 
 SSLCertContext &
 SSLCertContext::operator=(SSLCertContext const &other)
 {
   if (&other != this) {
+    std::scoped_lock lock(this->ctx_mutex, other.ctx_mutex);
     this->opt        = other.opt;
     this->userconfig = other.userconfig;
     this->keyblock   = other.keyblock;
     this->ctx_type   = other.ctx_type;
-    std::shared_lock lock(other.ctx_mutex);
-    this->ctx = other.ctx;
+    this->ctx        = other.ctx;
   }
   return *this;
 }