Re: [PATCH] APC: Segmentation fault in sma_allocate

Christian Seiler wrote:

I recompiled everything Apache related with debugging symbols activated and made sure, Apache could dump a core in order to debug the problem. I then used GDB to have a look at the core dump:

Wow, users like these are what makes hacking this seem worthwhile!

Program terminated with signal 11, Segmentation fault. #0 sma_allocate (shmaddr=0x2ba1ac905000, size=<value optimized out>) at /var/tmp/portage/dev-php5/pecl-apc-3.0.15/work/APC-3.0.15/apc_sma.c:164

164             if (cur->size >= realsize) {

...

Ok, so nfoffset is not zero, so I'll just access the block at header->nfoffset: ...

BUT the code does NOT check this at the very beginning, i.e. if header->nfoffset is nonzero and the FIRST block already has ->next set to zero.

Basically what you're saying is that when header->nfoffset points to the very last block of space left, so that the ->next wraps around, it SEGVS? That makes so much sense, that I'm in forehead-slapping mode.

Here's the patch for the problem (I also attached it, but just in case attachments are filtered out by this list): ...

I tested the patch for a whole week on a production system and it didn't crash anymore so I assume it's the correct fix for the problem.

I always knew *something* was going wrong when the shm space fills up and the allocator overlapping space, but never managed to get any sense out of any of the bug reports I got. I've been digging at this problem for over a year now, dealing with people complaining about random segvs with APC. I'll ensure this patch ends up in HEAD, even though I'm heavily into the APC 3.1 skunkworks rewrite/branch. Thanks for your testing, patch & support! Cheers, Gopal -- The makers may make and the users may use, but the fixers must fix with but minimal clues.