_ssl.c has thread-usafe code in implementation of read, write and other methods. E.g. 'write' method:

2099        PySSL_BEGIN_ALLOW_THREADS
2100        len = SSL_write(self->ssl, b->buf, (int)b->len);
2101        _PySSL_UPDATE_ERRNO_IF(len <= 0, self, len);
2102        PySSL_END_ALLOW_THREADS
2103        err = self->ssl_errno;

_PySSL_UPDATE_ERRNO_IF updates self->ssl_errno without lock. Similar code used in 'read' method. Later self->ssl_errno is used for decision on retrying the operation. As result, SSL_write can be incorrectly repeated because ssl_errno was updated by 'read' method to SSL_ERROR_WANT_READ from another thread.

Looks like commit e6eb48c10dc389d1d70657593de6a6cb3087d3d1 is the cause.

Almost seems like an unwinnable race here. We need to collect the error numbers before reacquiring the GIL (which could change some of them), but then if we update the object after getting the lock back we could still have raced with another thread.

Perhaps we need to make more dramatic changes to not store error codes against the object?

I'd gather errno and win error into local variables (or struct) just after SSL call and then pass them to PySSL_SetError.

Is there anything on the roadmap to fix this? This is a pretty severe bug given that this breaks multi-threaded OpenSSL while the documentation says it's thread-safe.

We don't have a roadmap, just volunteers. When someone is sufficiently motivated to work on it, it will happen. (You're welcome to try and motivate people with reason, pleading, money and/or abuse, though I don't recommend the last one :) Money doesn't work either on many of us who are really just time-poor.)

New changeset c6fd1c1c3a65217958b68df3a4991e4f306e9b7d by Steve Dower in branch 'master':
bpo-32533: Fixed thread-safety of error handling in _ssl. (GH-7158)
https://github.com/python/cpython/commit/c6fd1c1c3a65217958b68df3a4991e4f306e9b7d

New changeset 1229664f30dd5fd4da32174a19258f8312464d45 by Miss Islington (bot) in branch '3.7':
bpo-32533: Fixed thread-safety of error handling in _ssl. (GH-7158)
https://github.com/python/cpython/commit/1229664f30dd5fd4da32174a19258f8312464d45

New changeset 1a107eea8e91e50c5c9025e945c78eb1aa9b874d by Steve Dower in branch '3.6':
bpo-32533: Fixed thread-safety of error handling in _ssl. (GH-7158)
https://github.com/python/cpython/commit/1a107eea8e91e50c5c9025e945c78eb1aa9b874d

Fixed, with a fix for the regression coming in issue34759