Bug #71482 [Asn]: Lost zend_string after "reached pm.max_children setting" with segfault

Edit report at https://bugs.php.net/bug.php?id=71482&edit=1 ID: 71482 User updated by: alex dot schneider at sevenval dot com Reported by: alex dot schneider at sevenval dot com Summary: Lost zend_string after "reached pm.max_children setting" with segfault Status: Assigned Type: Bug Package: PCRE related Operating System: Linux Mint 17.3 PHP Version: 7.0.2 Assigned To: laruence Block user comment: N Private report: N New Comment: I agree. I could not find out which module was responsible, too. I made debug outputs while destructoring of the "module_registry" and saw that it crashes right here, in the "pcre" module. But i don't know, who is the trigger. Previous Comments: ------------------------------------------------------------------------ [2016-02-01 08:36:17] laruence@php.net in generally, your patch is right. we need a persistent alloc memory for the key but I am prefer to find out which extension(case) break this.. the only reason I can think out is, that some interned string in a extension used as a pcre pattern.. I just don't know which extension and how does it do this.. ------------------------------------------------------------------------ [2016-01-31 05:54:26] alex dot schneider at sevenval dot com Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00000000007a140d in gc_check_possible_root (z=0x7f523c5311e0) at ~/test/build/src/external/php-7.0.2/Zend/zend_gc.h:136 136 gc_possible_root(Z_COUNTED_P(z)); (gdb) bt #0 0x00000000007a140d in gc_check_possible_root (z=0x7f523c5311e0) at ~/test/build/src/external/php-7.0.2/Zend/zend_gc.h:136 #1 0x00000000007a549d in zend_hash_clean (ht=0xdf9320) at ~/test/build/src/external/php-7.0.2/Zend/zend_hash.c:1355 #2 0x00000000004773a7 in make_subpats_table (num_subpats=0, pce=0x7fff9e3591c0) at ~/test/build/src/external/php-7.0.2/ext/pcre/php_pcre.c:226 #3 0x000000000079ad42 in do_register_internal_class (orig_class_entry=0x79ad42 <do_register_internal_class+6>, ce_flags=32767) at ~/test/build/src/external/php-7.0.2/Zend/zend_API.c:2641 #4 0x000000000078ef00 in zend_startup (utility_functions=0x27df3e0, extensions=0x7fff9e359380) at ~/test/build/src/external/php-7.0.2/Zend/zend.c:708 #5 0x00000000007a4a8a in zend_hash_del_ind (ht=0x27df3e0, key=0x7fff9e359380) at ~/test/build/src/external/php-7.0.2/Zend/zend_hash.c:1106 #6 0x00000000007a4b55 in zend_hash_str_del_ind (ht=0x7a4b55 <zend_hash_str_del_ind+12>, str=0x7fff9e3592d0 "", len=4294967313) at ~/test/build/src/external/php-7.0.2/Zend/zend_hash.c:1128 #7 0x00000000007a5e16 in zend_hash_apply_with_arguments (ht=0x78ef00 <zend_startup+670>, apply_func=0x7fff9e359230, num_args=0) at ~/test/build/src/external/php-7.0.2/Zend/zend_hash.c:1571 #8 0x0000000000798a7e in zend_check_magic_method_implementation (ce=0x7a5e16 <zend_hash_apply_with_arguments+192>, fptr=0x7fff9e359300, error_type=0) at ~/test/build/src/external/php-7.0.2/Zend/zend_API.c:2062 #9 0x000000000078f582 in zend_call_destructors () at ~/test/build/src/external/php-7.0.2/Zend/zend.c:953 #10 0x00000000006fe1ba in php_execute_script (primary_file=0x0) at ~/test/build/src/external/php-7.0.2/main/main.c:2473 #11 0x00000000008610e1 in ?? () #12 0x0000000000000000 in ?? () (gdb) bt full #0 0x00000000007a140d in gc_check_possible_root (z=0x7f523c5311e0) at ~/test/build/src/external/php-7.0.2/Zend/zend_gc.h:136 No locals. #1 0x00000000007a549d in zend_hash_clean (ht=0xdf9320) at ~/test/build/src/external/php-7.0.2/Zend/zend_hash.c:1355 p = 0x29b8180 end = 0x29b8240 #2 0x00000000004773a7 in make_subpats_table (num_subpats=0, pce=0x7fff9e3591c0) at ~/test/build/src/external/php-7.0.2/ext/pcre/php_pcre.c:226 extra = 0xc name_cnt = 43745856 name_size = 43745664 ni = 0 rc = 32767 name_table = 0x4773a7 <make_subpats_table+76> "E\334H\213E\260H\213" name_idx = 0 subpat_names = 0xdf9320 rc1 = 0 rc2 = -1640656416 #3 0x000000000079ad42 in do_register_internal_class (orig_class_entry=0x79ad42 <do_register_internal_class+6>, ce_flags=32767) at ~/test/build/src/external/php-7.0.2/Zend/zend_API.c:2641 class_entry = 0x7fff9e359230 lowercase_name = 0x27df3e0 #4 0x000000000078ef00 in zend_startup (utility_functions=0x27df3e0, extensions=0x7fff9e359380) at ~/test/build/src/external/php-7.0.2/Zend/zend.c:708 No locals. #5 0x00000000007a4a8a in zend_hash_del_ind (ht=0x27df3e0, key=0x7fff9e359380) at ~/test/build/src/external/php-7.0.2/Zend/zend_hash.c:1106 ---Type <return> to continue, or q <return> to quit--- data = 0x119e3594f0 h = 15539213552 nIndex = 0 idx = 0 p = 0xdfe080 prev = 0x27c3000 #6 0x00000000007a4b55 in zend_hash_str_del_ind (ht=0x7a4b55 <zend_hash_str_del_ind+12>, str=0x7fff9e3592d0 "", len=4294967313) at ~/test/build/src/external/php-7.0.2/Zend/zend_hash.c:1128 h = 14672000 nIndex = 0 idx = 41693184 p = 0x3ffffffef prev = 0x300abc580 #7 0x00000000007a5e16 in zend_hash_apply_with_arguments (ht=0x78ef00 <zend_startup+670>, apply_func=0x7fff9e359230, num_args=0) at ~/test/build/src/external/php-7.0.2/Zend/zend_hash.c:1571 idx = 0 p = 0x7fff9e359280 args = {{gp_offset = 8014474, fp_offset = 0, overflow_arg_area = 0x0, reg_save_area = 0x27c3000}} hash_key = {h = 140735847699328, key = 0x27df3e0} result = 0 #8 0x0000000000798a7e in zend_check_magic_method_implementation (ce=0x7a5e16 <zend_hash_apply_with_arguments+192>, fptr=0x7fff9e359300, error_type=0) at ~/test/build/src/external/php-7.0.2/Zend/zend_API.c:2062 lcname = "p\227\065\236\003\000\000\000\000\060|\002\000\000\000" ---Type <return> to continue, or q <return> to quit--- name_len = 14672000 #9 0x000000000078f582 in zend_call_destructors () at ~/test/build/src/external/php-7.0.2/Zend/zend.c:953 __orig_bailout = 0x100000011 __bailout = {{__jmpbuf = {140735847699152, 8014677, 140735847700336, 41693184, 12896159104, 14672000, 17179869167, 0}, __mask_was_saved = -1640656128, __saved_mask = {__val = { 8019478, 140735847699216, 14672000, 15539214192, 41693184, 140735847699216, 7965310, 140735847699296, 7927170, 140735847699312, 4356944, 140735847700336, 0, 0, 0, 140735847699296}}}} #10 0x00000000006fe1ba in php_execute_script (primary_file=0x0) at ~/test/build/src/external/php-7.0.2/main/main.c:2473 realfile = "@ \222VR\177\000\000\000 \222VR\177\000\000Ѓ5\236\377\177\000\000\356\252u\000\000\000\000\000\020l\215VR\177", '\000' <repeats 14 times>, "D\005\000\000\200ū\000\000\000\000\000\000 \222VR\177\000\000@\000\200VR\177\000\000\020\204\065\236\"\001\000\000\t\000\000\200\000\000\000\000\000 \022\000\000\000\000\000\000\000\200VR\177\000\000\000\204\065\236\377\177\000\000,\324u", '\000' <repeats 17 times>, "D\005\000\000\200ū\000\000\000\000\000\000 \222VR\177\000\000@\204\065\236\377\177\000\000\033Xz\000\000\000\000\000@\204\065\236\377\177\000\000\000 \222VR\177\000\000\000\000\000\000\000\000\000\000(\342\220"... __orig_bailout = 0x0 __bailout = {{__jmpbuf = {140735847695040, 34367460396, 139991616154112, 139991615275072, 139991616154160, 139991616154112, 140735847695136, 7711470}, __mask_was_saved = 1452420832, __saved_mask = {__val = {0, 1129576398848, 11249520, 139991616154112, 139991615275072, 919123001344, 2147483656, 879104, 139991615275008, 140735847695184, 7722028, 0, 1129576398848, 11249520, 40106813952, 139991616462848}}}} prepend_file_p = 0x0 append_file_p = 0x0 prepend_file = {handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = 0, mmap = {len = 0, pos = 0, map = 0x0, buf = 0x0, old_handle = 0x0, old_closer = 0x0}, reader = 0x0, fsizer = 0x0, closer = 0x31ba}}, filename = 0x800000001 <error: Cannot access memory at address 0x800000001>, opened_path = 0x7f52568d6910, type = 1451229248, free_filename = 82 'R'} append_file = {handle = {fd = 1452108096, fp = 0x7f52568d6940, stream = {handle = 0x7f52568d6940, isatty = 1452108048, mmap = {len = 140735847694992, pos = 7711470, map = 0x13880, buf = 0x0, old_handle = 0x10700000000, old_closer = 0xaba770}, reader = 0x7f52568d6910, fsizer = 0x7f5256800040, closer = 0xd600000000}}, filename = 0x80000008 <error: Cannot access memory at address 0x80000008>, opened_path = 0xd6910, type = 1451229184, free_filename = 82 'R'} ---Type <return> to continue, or q <return> to quit--- old_cwd = 0x0 use_heap = 0 '\000' retval = 0 #11 0x00000000008610e1 in ?? () No symbol table info available. #12 0x0000000000000000 in ?? () No symbol table info available. ------------------------------------------------------------------------ [2016-01-30 16:54:39] laruence@php.net could you please show me the real backtrace? it may be helpful ------------------------------------------------------------------------ [2016-01-30 05:34:27] alex dot schneider at sevenval dot com Yes, we use, but i'a almost sure that the error comes from module "pcre" self. Is also interesting that there is no longer segfaults, once we disable the "opcache". Is here a big intern difference between the both functions (original and patched)? ------------------------------------------------------------------------ [2016-01-30 04:25:09] laruence@php.net hmm, do you use any other extensions which is not bundled with php ? ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=71482 -- Edit this bug report at https://bugs.php.net/bug.php?id=71482&edit=1