Make CRYPTO_cleanup_all_ex_data() a compatibility no-op

The ex_data callback registry is process-wide, but this API could free
it while other threads were still using libcrypto, resulting in a
use-after-free.

Retain the public symbol as a compatibility no-op and mark it
deprecated. Move the actual cleanup to an internal function called by
OPENSSL_cleanup(). Replace the in-tree callers with OPENSSL_cleanup()
at final shutdown to preserve cleanup behavior and coverage.

Document both APIs and the requirement that OPENSSL_cleanup() only be
called after all threads and components have stopped using libcrypto.

ok tb

1 files changed, 2 insertions, 2 deletions

diff --git a/src/lib/libcrypto/crypto_init.c b/src/lib/libcrypto/crypto_init.c
index ae4914e358..5b7ce3d4fa 100644
--- a/src/lib/libcrypto/crypto_init.c
+++ b/src/lib/libcrypto/crypto_init.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: crypto_init.c,v 1.26 2025/06/11 07:41:12 tb Exp $ */
+/*      $OpenBSD: crypto_init.c,v 1.27 2026/08/30 12:19:37 kenjiro Exp $ */
 /*
  * Copyright (c) 2018 Bob Beck <beck@openbsd.org>
  *
@@ -107,7 +107,7 @@ OPENSSL_cleanup(void)
         /* This currently calls init... */
         ERR_free_strings();
 
-        CRYPTO_cleanup_all_ex_data();
+        crypto_ex_data_cleanup();
         EVP_cleanup();
 
         X509_VERIFY_PARAM_table_cleanup();