[rpms/kryoptic] f44: Avoid deadlock in tests due to wrong order of lock acquiring in finalize

[Jakub Jelen <jjelen@redhat.com>]

A new commit has been pushed.

Repo   : rpms/kryoptic
Branch : f44
Commit : 5cd02c3f7296d9f9d509feef73665d9e9be46d9e
Author : Jakub Jelen <jjelen@redhat.com>
Date   : 2026-06-05T20:47:23+02:00
Stats  : +41/-0 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/kryoptic/c/5cd02c3f7296d9f9d509feef73665d9e9be46d9e?branch=f44

Log:
Avoid deadlock in tests due to wrong order of lock acquiring in finalize

---
diff --git a/kryoptic-deadlock.patch b/kryoptic-deadlock.patch
new file mode 100644
index 0000000..08604a1
--- /dev/null
+++ b/kryoptic-deadlock.patch
@@ -0,0 +1,38 @@
+From 5494395faecdd07b4473e6c2ef74a9f858c7c1f4 Mon Sep 17 00:00:00 2001
+From: Simo Sorce <simo@redhat.com>
+Date: Fri, 5 Jun 2026 11:55:15 -0400
+Subject: [PATCH] Fix potential deadlock by resetting config before finalizing
+ state
+
+This commit swaps the order of operations in the finalize function
+to ensure the global configuration is reset before the state is
+finalized. Although the write lock on STATE is supposed to be released
+before the CONFIG lock is acquired, we have observed deadlocks in some
+builds, likely because STATE does not immediately go out of scope.
+
+By ensuring the CONFIG lock is always acquired prior to the STATE lock,
+we align with the locking order used throughout the rest of the codebase
+and eliminate this potential deadlock.
+
+Assisted-by: Gemini <gemini@google.com>
+Signed-off-by: Simo Sorce <simo@redhat.com>
+---
+ src/fns/general.rs | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/fns/general.rs b/src/fns/general.rs
+index 419bacf9..54c61059 100644
+--- a/src/fns/general.rs
++++ b/src/fns/general.rs
+@@ -97,9 +97,9 @@ pub extern "C" fn fn_initialize(init_args: CK_VOID_PTR) -> CK_RV {
+ 
+ #[inline(always)]
+ fn finalize(_reserved: CK_VOID_PTR) -> Result<()> {
+-    let ret = STATE.wlock()?.finalize();
+     let mut conf = crate::CONFIG.wlock()?;
+     *conf = Config::new();
++    let ret = STATE.wlock()?.finalize();
+     if ret != CKR_OK {
+         return Err(ret)?;
+     }
+

diff --git a/kryoptic.spec b/kryoptic.spec
index 4161625..4aec254 100644
--- a/kryoptic.spec
+++ b/kryoptic.spec
@@ -33,6 +33,9 @@ Source0:        https://github.com/latchset/kryoptic/releases/download/v%{versio
 Source1:        https://github.com/latchset/kryoptic/releases/download/v%{version}/%{name}-%{version}.tar.gz.asc
 Source2:        https://people.redhat.com/~ssorce/simo_redhat.asc
 %endif
+# https://github.com/latchset/kryoptic/pull/459
+Patch:          kryoptic-deadlock.patch
+
 
 BuildRequires:  cargo-rpm-macros >= 26
 BuildRequires:  openssl-devel