Commit 021b8c18ad for openssl.org

commit 021b8c18ad1217fe938f96f098e1105a53d6ee12
Author: Neil Horman <nhorman@openssl.org>
Date:   Wed Nov 11 13:22:14 2026 -0500

    Update docs regarding the freeing of providers from libctx objects

    The docs were unclear on how providers should be handled in relation
    to the freeing of a libctx objects.  Providers loaded via configuration
    are automatically deactivated and freed on a call
    to OSSL_LIB_CTX_free(), but providers explicitly loaded
    via a OSSL_PROVIDER_[try]_load_[ex]() call need an explicit unload call
    to balance their reference counts.

    Clarify the distinction in the OSSL_PROVIDER.pod and OSSL_LIB_CTX.pod
    files.

    Resolves: https://github.com/openssl/openssl/issues/33488
    Fixes: ce101e19abed "doc: document provider/library context cleanup order requirement"
    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    Reviewed-by: Bob Beck <beck@openssl.org>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Merge-date: Sat Nov 14 04:58:11 2026
    Merged-from: https://github.com/openssl/openssl/pull/33670

diff --git a/doc/man3/OSSL_LIB_CTX.pod b/doc/man3/OSSL_LIB_CTX.pod
index 013c047339..cf7eb3ac70 100644
--- a/doc/man3/OSSL_LIB_CTX.pod
+++ b/doc/man3/OSSL_LIB_CTX.pod
@@ -92,8 +92,13 @@ multiple threads on a single I<ctx>.

 OSSL_LIB_CTX_free() frees the given I<ctx>, unless it happens to be the
 default OpenSSL library context. If the argument is NULL, nothing is done.
-Any providers loaded into I<ctx> are automatically deactivated and freed
-as part of the library context cleanup.
+Any providers loaded into I<ctx> from the configuration file are automatically
+deactivated and freed as part of the library context cleanup.
+Every B<OSSL_PROVIDER> obtained via L<OSSL_PROVIDER_load(3)>,
+L<OSSL_PROVIDER_try_load(3)>, L<OSSL_PROVIDER_load_ex(3)>,
+or L<OSSL_PROVIDER_try_load_ex(3)> must be explicitly released via a call
+to L<OSSL_PROVIDER_unload(3)> prior to freeing the associated library context
+to prevent leaks.
 Any B<OSSL_PROVIDER> pointers obtained from I<ctx> must not be used after
 this call.

diff --git a/doc/man3/OSSL_PROVIDER.pod b/doc/man3/OSSL_PROVIDER.pod
index 82c0a85a06..a3e1f57637 100644
--- a/doc/man3/OSSL_PROVIDER.pod
+++ b/doc/man3/OSSL_PROVIDER.pod
@@ -124,9 +124,11 @@ configuration file.
 OSSL_PROVIDER_unload() unloads the given provider.
 For a provider added with OSSL_PROVIDER_add_builtin(), this simply
 runs its teardown function.
-It is not necessary to explicitly unload providers before calling
-L<OSSL_LIB_CTX_free(3)>, as freeing a library context automatically
-deactivates and frees all providers associated with it.
+Every B<OSSL_PROVIDER> obtained via OSSL_PROVIDER_load(),
+OSSL_PROVIDER_try_load(), OSSL_PROVIDER_load_ex(),
+or OSSL_PROVIDER_try_load_ex() must be explicitly released via a call
+to OSSL_PROVIDER_unload() prior to freeing the associated library context
+to prevent leaks.
 OSSL_PROVIDER_unload() must not be called after L<OSSL_LIB_CTX_free(3)>
 has been called on the associated library context.