Commit 6cfad0a948 for openssl.org

commit 6cfad0a94827754048ac9647b9ba1031ad8fcf36
Author: Jakub Zelenka <jakub.zelenka@openssl.foundation>
Date:   Wed Aug 5 15:04:30 2026 +0200

    ssl: add missing SSLfatal on session ID lock failure

    The first CRYPTO_THREAD_read_lock() failure in
    ssl_generate_session_id() returned failure without calling SSLfatal()
    while the second lock right below does, and callers such as
    tls_construct_new_session_ticket() assume the fatal state was
    already set. This should currently not happen as the read lock does
    not realistically fail, so this is just future proofing of the error
    handling.

    Assisted-by: Claude:claude-fable-5

    Reviewed-by: Matt Caswell <matt@openssl.foundation>
    Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
    MergeDate: Tue Aug 11 07:31:08 2026
    (Merged from https://github.com/openssl/openssl/pull/32200)

diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index 094ab1a74e..68f3b04db2 100644
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -394,8 +394,10 @@ int ssl_generate_session_id(SSL_CONNECTION *s, SSL_SESSION *ss)
     }

     /* Choose which callback will set the session ID */
-    if (!CRYPTO_THREAD_read_lock(SSL_CONNECTION_GET_SSL(s)->lock))
+    if (!CRYPTO_THREAD_read_lock(SSL_CONNECTION_GET_SSL(s)->lock)) {
+        SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
         return 0;
+    }
     if (!CRYPTO_THREAD_read_lock(s->session_ctx->lock)) {
         CRYPTO_THREAD_unlock(ssl->lock);
         SSLfatal(s, SSL_AD_INTERNAL_ERROR,