Bug #69547 [Opn]: php-fpm segfault (reproducible)

Edit report at https://bugs.php.net/bug.php?id=69547&edit=1 ID: 69547 User updated by: waldner at katamail dot com Reported by: waldner at katamail dot com Summary: php-fpm segfault (reproducible) Status: Open Type: Bug Package: FPM related Operating System: Debian wheezy PHP Version: 5.6.8 Block user comment: N Private report: N New Comment: Happens also via TCP socket (127.0.0.1:9000). Previous Comments: ------------------------------------------------------------------------ [2015-04-29 15:45:21] waldner at katamail dot com php -m: [PHP Modules] apc apcu bcmath bz2 calendar Core ctype curl date dba dom ereg exif fileinfo filter ftp gd gettext gmp hash iconv imagick intl json libxml mbstring mcrypt mhash mysql mysqli mysqlnd openssl pcntl pcre PDO pdo_mysql Phar posix readline Reflection session shmop SimpleXML soap sockets SPL standard sysvmsg sysvsem sysvshm tidy tokenizer wddx xml xmlreader xmlrpc xmlwriter xsl Zend OPcache zip zlib [Zend Modules] Zend OPcache ------------------------------------------------------------------------ [2015-04-29 15:44:30] waldner at katamail dot com /etc/php5/fpm/php-fpm.conf: [global] pid = /run/php5-fpm.pid error_log = /var/log/php5-fpm.log include=/etc/php5/fpm/pool.d/*.conf /etc/php5/fpm/pool.d/www.conf: [www] user = www-data group = www-data listen = /var/run/php5-fpm.sock listen.owner = www-data listen.group = www-data pm = static pm.max_children = 1 pm.start_servers = 1 pm.min_spare_servers = 1 pm.max_spare_servers = 1 chdir = / ------------------------------------------------------------------------ [2015-04-29 15:42:22] waldner at katamail dot com /etc/php5/fpm/php.ini: [PHP] engine = On zend.ze1_compatibility_mode = Off zend.enable_gc = On short_open_tag = On asp_tags = Off precision = 14 y2k_compliance = On output_buffering = 4096 zlib.output_compression = Off implicit_flush = Off unserialize_callback_func= serialize_precision = 17 allow_call_time_pass_reference = Off safe_mode = Off safe_mode_gid = Off safe_mode_include_dir = safe_mode_exec_dir = safe_mode_allowed_env_vars = PHP_ safe_mode_protected_env_vars = LD_LIBRARY_PATH disable_functions = disable_classes = expose_php = Off max_execution_time = 90 max_input_time = 90 ; workaround for HOT extranet monster-input max_input_vars = 4000 ; workaround end ; Another workaround for session encryption ; memory_limit = 128M error_reporting = E_ALL ;& ~E_NOTICE display_errors = On display_startup_errors = Off log_errors = On log_errors_max_len = 1024 ignore_repeated_errors = Off ignore_repeated_source = Off report_memleaks = On track_errors = Off error_log = "/dev/null" ;error_log = "/tmp/eee" variables_order = "GPCS" register_globals = Off register_argc_argv = Off auto_globals_jit = On post_max_size = 10M magic_quotes_runtime = Off magic_quotes_sybase = Off auto_prepend_file = "" auto_append_file = default_mimetype = "text/html" default_charset = "iso-8859-1" include_path = ".:/usr/share/php" doc_root = user_dir = enable_dl = On file_uploads = On upload_max_filesize = 2M allow_url_fopen = On allow_url_include = Off default_socket_timeout = 90 browscap = /etc/browscap.ini [mail function] SMTP = localhost smtp_port = 25 [Date] date.timezone = "Europe/Madrid" [Syslog] define_syslog_variables = Off [SQL] sql.safe_mode = Off [MySQL] mysql.allow_persistent = On mysql.max_persistent = -1 mysql.max_links = -1 mysql.default_port = mysql.default_socket = mysql.default_host = mysql.default_user = mysql.default_password = mysql.connect_timeout = 60 mysql.trace_mode = Off [MySQLi] mysqli.max_links = -1 mysqli.default_port = 3306 mysqli.default_socket = mysqli.default_host = mysqli.default_user = mysqli.default_pw = mysqli.reconnect = Off [bcmath] bcmath.scale = 0 [Session] session.save_handler = files session.use_cookies = 1 session.use_only_cookies = 1 session.name = PHPSESSID session.auto_start = 0 session.cookie_lifetime = 0 session.cookie_path = / session.cookie_domain = session.cookie_httponly = 1 session.serialize_handler = php session.gc_probability = 1 session.gc_divisor = 10000 session.gc_maxlifetime = 1800 session.bug_compat_42 = 0 session.bug_compat_warn = 1 session.referer_check = session.entropy_length = 0 session.entropy_file = session.cache_limiter = nocache session.cache_expire = 180 session.use_trans_sid = 0 session.hash_function = 0 session.hash_bits_per_character = 4 url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=fakeentry" [Tidy] tidy.clean_output = Off [soap] soap.wsdl_cache_enabled=1 soap.wsdl_cache_dir="/tmp/" soap.wsdl_cache_ttl=86400 [opcache] opcache.enable=1 opcache.enable_cli=0 opcache.memory_consumption=256 opcache.interned_strings_buffer=8 opcache.max_accelerated_files=7963 opcache.max_wasted_percentage=5 opcache.use_cwd=1 opcache.validate_timestamps=0 opcache.revalidate_freq=2 opcache.revalidate_path=0 opcache.save_comments=1 opcache.load_comments=1 opcache.fast_shutdown=1 opcache.enable_file_override=0 opcache.optimization_level=0xffffffff opcache.inherited_hack=1 opcache.dups_fix=0 opcache.blacklist_filename= opcache.max_file_size=0 opcache.consistency_checks=0 opcache.force_restart_timeout=180 opcache.error_log= opcache.log_verbosity_level=1 opcache.preferred_memory_model= opcache.protect_memory=None opcache.mmap_base= ------------------------------------------------------------------------ [2015-04-29 15:27:49] waldner at katamail dot com Description: ------------ The following request crashes a php-fpm process almost 100% reliably for me. This is nginx + fpm via unix socket from the dotdeb repository. Crucially a request with less headers works (and after that, requests like the one below start working too - though not always). Test script: --------------- curl -X POST -d '{}' -H 'Connection: close' -H 'X-FORWARDED-FOR: 127.0.0.1' -H 'X-REAL-IP: 127.0.0.1' -H 'X-FORWARDED-HOST: 1.2.3.4' -H 'X-FORWARDED-PROTO: https' -H 'Content-Length: 2' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:37.0) Gecko/20100101 Firefox/37.0' -H 'Accept: application/json' -H 'Accept-Language: ca,en-US;q=0.7,en;q=0.3' -H 'Accept-Encoding: gzip, deflate' -H 'Content-Type: application/json; charset=UTF-8' -H 'apikey: YmRhZjQ3MGRlYTczYTllZmFjMTNjNTRhYTgxZDg5YTgyODU0OTVhOQ==' -H 'Referer: https://xxxxxxxxxx.xxxxx.xxx/documentation/' -H 'Cookie: PHPSESSID=9be03814eea0ef3e3a7fbc9a1f69c062' -H 'Pragma: no-cache' -H 'Cache-Control: no-cache' http://127.0.0.1/api/clients Expected result: ---------------- The pool process should process the request without segfaulting. Actual result: -------------- Backtrace: (gdb) bt full #0 0x00000000006e88ea in zend_hash_find (ht=ht@entry=0x7ff11fa6f9b0, arKey=arKey@entry=0x238a820 "Europe/Madrid", nKeyLength=14, pData=pData@entry=0x7ffe4538fac0) at /usr/src/php5.6/nonzts/source/dotdeb-php5/Zend/zend_hash.c:849 h = 1394799404352781269 nIndex = 15313 p = <optimized out> #1 0x000000000043aad4 in php_date_parse_tzfile (formal_tzname=0x238a820 "Europe/Madrid", tzdb=0xea4e00) at /usr/src/php5.6/nonzts/source/dotdeb-php5/ext/date/php_date.c:918 ptzi = <optimized out> #2 0x000000000043c4ca in get_timezone_info () at /usr/src/php5.6/nonzts/source/dotdeb-php5/ext/date/php_date.c:997 tz = 0x238a820 "Europe/Madrid" tzi = <optimized out> #3 0x000000000043e6c5 in php_format_date (format=format@entry=0xb88939 "d-M-Y H:i:s e", format_len=format_len@entry=13, ts=1430320522, localtime=localtime@entry=1) at /usr/src/php5.6/nonzts/source/dotdeb-php5/ext/date/php_date.c:1250 t = 0x271b050 tzi = <optimized out> string = <optimized out> #4 0x0000000000673c92 in php_log_err ( log_message=0x7ff11faa0170 "PHP Deprecated: Automatically populating $HTTP_RAW_POST_DATA is deprecated and will be removed in a future version. To avoid this warning set 'always_populate_raw_post_data' to '-1' in php.ini and us"...) at /usr/src/php5.6/nonzts/source/dotdeb-php5/main/main.c:713 tmp = <optimized out> len = <optimized out> error_time_str = <optimized out> fd = <optimized out> error_time = 1430320522 #5 0x00000000006740a7 in php_error_cb (type=8192, error_filename=0xb6e9d1 "Unknown", error_lineno=0, format=<optimized out>, args=<optimized out>) at /usr/src/php5.6/nonzts/source/dotdeb-php5/main/main.c:1144 log_buffer = 0x7ff11faa0170 "PHP Deprecated: Automatically populating $HTTP_RAW_POST_DATA is deprecated and will be removed in a future version. To avoid this warning set 'always_populate_raw_post_data' to '-1' in php.ini and us"... error_type_str = 0xb6bf0a "Deprecated" buffer = 0x7ff11faa0010 "Automatically populating $HTTP_RAW_POST_DATA is deprecated and will be removed in a future version. To avoid this warning set 'always_populate_raw_post_data' to '-1' in php.ini and use the php://input"... buffer_len = 216 display = <optimized out> #6 0x00000000005887c0 in soap_error_handler (error_num=8192, error_filename=0xb6e9d1 "Unknown", error_lineno=0, format=0xb95098 "Automatically populating $HTTP_RAW_POST_DATA is deprecated and will be removed in a future version. To avoid this warning set 'always_populate_raw_post_data' to '-1' in php.ini and use the php://input"..., args=0x7ffe453902e0) at /usr/src/php5.6/nonzts/source/dotdeb-php5/ext/soap/soap.c:2216 copy = {{gp_offset = 16, fp_offset = 48, overflow_arg_area = 0x7ffe45390400, reg_save_area = 0x7ffe45390310}} tmp = 0x553787cb use_exceptions = <optimized out> _old_in_compilation = 0 '\000' _old_in_execution = 0 '\000' _old_current_execute_data = 0x0 _old_http_response_code = 200 _old_http_status_line = 0x0 #7 0x00000000006da92c in zend_error (type=8192, format=0xb95098 "Automatically populating $HTTP_RAW_POST_DATA is deprecated and will be removed in a future version. To avoid this warning set 'always_populate_raw_post_data' to '-1' in php.ini and use the php://input"...) at /usr/src/php5.6/nonzts/source/dotdeb-php5/Zend/zend.c:1142 args = {{gp_offset = 16, fp_offset = 48, overflow_arg_area = 0x7ffe45390400, reg_save_area = 0x7ffe45390310}} usr_copy = {{gp_offset = 2, fp_offset = 0, overflow_arg_area = 0x2002, reg_save_area = 0x7ff11fa9fa18}} params = <optimized out> retval = <optimized out> z_error_type = <optimized out> z_error_message = <optimized out> z_error_filename = <optimized out> z_error_lineno = <optimized out> z_context = <optimized out> error_filename = 0xb6e9d1 "Unknown" error_lineno = <optimized out> orig_user_error_handler = <optimized out> in_compilation = <optimized out> saved_class_entry = <optimized out> bp_stack = <optimized out> function_call_stack = <optimized out> switch_cond_stack = <optimized out> foreach_copy_stack = <optimized out> object_stack = <optimized out> declare_stack = <optimized out> list_stack = <optimized out> context_stack = <optimized out> #8 0x0000000000681c97 in php_default_post_reader () at /usr/src/php5.6/nonzts/source/dotdeb-php5/main/php_content_types.c:75 length = <optimized out> data = 0x7ff11fa9fd40 "{}" #9 php_default_post_reader () at /usr/src/php5.6/nonzts/source/dotdeb-php5/main/php_content_types.c:51 No locals. #10 0x000000000067e4c7 in sapi_read_post_data () at /usr/src/php5.6/nonzts/source/dotdeb-php5/main/SAPI.c:247 content_type_length = <optimized out> content_type = 0x7ff11fa9f9b0 "application/json; charset=UTF-8" oldchar = <optimized out> post_entry = 0x705846 p = 0x7ff11fa9f9c1 " charset=UTF-8" post_reader_func = <optimized out> #11 sapi_activate () at /usr/src/php5.6/nonzts/source/dotdeb-php5/main/SAPI.c:482 No locals. #12 0x00000000006754cc in php_request_startup () at /usr/src/php5.6/nonzts/source/dotdeb-php5/main/main.c:1632 __orig_bailout = <optimized out> __bailout = {{__jmpbuf = {15610304, -798298996382607278, 140673594877200, 0, 140673594879856, 15501569, 799201161399785554, -798298749005047726}, __mask_was_saved = 0, __saved_mask = { __val = {140673568943750, 140730059785568, 140673594877488, 0, 7876671, 81739, 15610304, 140673594877488, 7912927, 15501628, 2, 81739, 856902, 0, 15610304, 0}}}} retval = 0 #13 0x0000000000433e97 in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/php5.6/nonzts/source/dotdeb-php5/sapi/fpm/fpm/fpm_main.c:1902 primary_script = 0x0 __orig_bailout = 0x0 __bailout = {{__jmpbuf = {0, -798298996382082990, 70, 4294967295, 140730059802835, 15501628, 799201161435437138, -798298438956328878}, __mask_was_saved = 0, __saved_mask = {__val = { 140673540653051, 0, 140673593026626, 0, 0, 0, 0, 0, 0, 0, 0, 4294967296, 0, 0, 0, 0}}}} exit_status = 0 c = <optimized out> use_extended_info = 0 file_handle = {type = ZEND_HANDLE_FILENAME, filename = 0x0, opened_path = 0x0, handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = 0, mmap = {len = 0, pos = 0, map = 0x0, buf = 0x0, old_handle = 0x0, old_closer = 0}, reader = 0, fsizer = 0, closer = 0}}, free_filename = 0 '\000'} orig_optind = 1 orig_optarg = 0x0 ini_entries_len = 0 max_requests = 0 requests = 0 fcgi_fd = 15610304 request = {listen_socket = 0, fd = 4, id = 1, keep = 0, closed = 0, in_len = 0, in_pad = 6, out_hdr = 0x0, out_pos = 0x7ffe45390900 "", out_buf = '\000' <repeats 8191 times>, reserved = '\000' <repeats 15 times>, env = 0x7ff11fa6e310} fpm_config = 0x7ffe453948d3 "" fpm_prefix = 0x0 fpm_pid = 0x0 test_conf = 0 force_daemon = 1 force_stderr = 0 php_information = 0 php_allow_to_run_as_root = 0 __func__ = "main" The offending code line is: p = ht->arBuckets[nIndex]; ht here is date_globals.tzcache: date_globals.tzcache->arBuckets = (Bucket **) 0x0 It seems to have a valid value until SG(request_info).request_body = php_stream_temp_create_ex(TEMP_STREAM_DEFAULT, SAPI_POST_BLOCK_SIZE, PG(upload_tmp_dir)); (main/SAPI.c, line 282). When php_stream_temp_create_ex returns, it's 0x0. It looks like memory of date_globals.tzcache->arBuckets gets overwritten by emalloc() or similar at some point. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=69547&edit=1