Bug #71135 [Com]: Random memory corruption with strings

Edit report at https://bugs.php.net/bug.php?id=71135&edit=1 ID: 71135 Comment by: vojtech dot kurka at gmail dot com Reported by: iquito at gmx dot net Summary: Random memory corruption with strings Status: Assigned Type: Bug Package: opcache Operating System: Debian Jessie PHP Version: 7.0.0 Assigned To: laruence Block user comment: N Private report: N New Comment: Dmitry, are all these fixes included in 7.0.4? Thank you Previous Comments: ------------------------------------------------------------------------ [2016-02-24 21:03:36] dmitry@php.net The problem was caused by incorrect synchronization of processes during opcache reload. Some processes might crash or might not crash because of race-conditions. The commit mentioned above and a couple of following fixes, should solve the problem. ------------------------------------------------------------------------ [2016-02-22 22:36:15] iquito at gmx dot net Would be great if this problem was fixed, but the linked changes do not seem related to the bug here (as far as I can tell) - in my configuration it sometimes occured after a opcache_reset(), but those were not the majority cases, usually it just happened at seemingly random times when the opcache was warmed up and in full swing for many hours. I do use opcache_invalidate quite regularly on some files, but the error occured so infrequently that I do not know if that is linked to this bug - the errors occured once a day, but within that timeframe I used opcache_reset and opcache_invalidate many times without problems. I also never had a crash, only one "flipped" character in a string, which seems an odd and hard-to-pinpoint bug anyway - almost all strings were still correct, only 1-2 strings were one character off. This makes this bug so intimidating - if strings can change a bit seemingly random, than that can be a real problem for an application and can also stay unnoticed for some time. ------------------------------------------------------------------------ [2016-02-22 22:12:45] matej21 at matej21 dot cz this issue is probably fixed by https://github.com/php/php-src/commit/d2287529396539fd2cba6f449ae9679cac64c3b9 ------------------------------------------------------------------------ [2016-02-08 17:59:02] matej21 at matej21 dot cz Hi, I'm experiencing similar issue. It sometimes happens to me after opcache_reset (not only manual but also automatic cache reset when opcache is out of a memory). I was able to reproduce it on my dev machine using "ab" requesting the site and running opcache_reset few times (it happens in about 10% of opcache_reset calls) I tried it with both enabled and disabled protected_memory. And here are some errors and traces: with opcache.protected_memory=1 Program terminated with signal SIGSEGV, Segmentation fault. #0 0x0000000000a5e9dd in zend_string_release (s=0x7f5937855d80) at /home/matej21/tmp/php-7.0.3/Zend/zend_string.h:270 270 if (--GC_REFCOUNT(s) == 0) { (gdb) bt #0 0x0000000000a5e9dd in zend_string_release (s=0x7f5937855d80) at /home/matej21/tmp/php-7.0.3/Zend/zend_string.h:270 #1 0x0000000000a629f1 in zend_hash_destroy (ht=0x7f593599ef60) at /home/matej21/tmp/php-7.0.3/Zend/zend_hash.c:1265 #2 0x0000000000a81e45 in zend_gc_collect_cycles () at /home/matej21/tmp/php-7.0.3/Zend/zend_gc.c:1117 #3 0x0000000000a3517f in shutdown_executor () at /home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:352 #4 0x0000000000a4cf98 in zend_deactivate () at /home/matej21/tmp/php-7.0.3/Zend/zend.c:967 #5 0x00000000009ba30d in php_request_shutdown (dummy=0x0) at /home/matej21/tmp/php-7.0.3/main/main.c:1823 #6 0x0000000000b1d4ae in main (argc=4, argv=0x7ffe1f4434a8) at /home/matej21/tmp/php-7.0.3/sapi/fpm/fpm/fpm_main.c:1972 Program terminated with signal SIGSEGV, Segmentation fault. #0 0x0000000000a5e9dd in zend_string_release (s=0x7f593779d6b0) at /home/matej21/tmp/php-7.0.3/Zend/zend_string.h:270 270 if (--GC_REFCOUNT(s) == 0) { (gdb) bt #0 0x0000000000a5e9dd in zend_string_release (s=0x7f593779d6b0) at /home/matej21/tmp/php-7.0.3/Zend/zend_string.h:270 #1 0x0000000000a629f1 in zend_hash_destroy (ht=0x7f59360751c0) at /home/matej21/tmp/php-7.0.3/Zend/zend_hash.c:1265 #2 0x0000000000a3b042 in destroy_zend_class (zv=0x7ffe1f442c40) at /home/matej21/tmp/php-7.0.3/Zend/zend_opcode.c:289 #3 0x0000000000a6203f in _zend_hash_del_el_ex (ht=0x30df4a0, idx=700, p=0x34138c0, prev=0x0) at /home/matej21/tmp/php-7.0.3/Zend/zend_hash.c:1013 #4 0x0000000000a6210a in _zend_hash_del_el (ht=0x30df4a0, idx=700, p=0x34138c0) at /home/matej21/tmp/php-7.0.3/Zend/zend_hash.c:1037 #5 0x0000000000a639a6 in zend_hash_reverse_apply (ht=0x30df4a0, apply_func=0xa3454a <clean_non_persistent_class>) at /home/matej21/tmp/php-7.0.3/Zend/zend_hash.c:1615 #6 0x0000000000a35269 in shutdown_executor () at /home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:367 #7 0x0000000000a4cf98 in zend_deactivate () at /home/matej21/tmp/php-7.0.3/Zend/zend.c:967 #8 0x00000000009ba30d in php_request_shutdown (dummy=0x0) at /home/matej21/tmp/php-7.0.3/main/main.c:1823 #9 0x0000000000b1d4ae in main (argc=4, argv=0x7ffe1f4434a8) at /home/matej21/tmp/php-7.0.3/sapi/fpm/fpm/fpm_main.c:1972 --------------------------------------- with opcache.protected_memory=0 first some error messages showing corrupted memory: require(): Failed opening required '/var/www/foo-project/vendor/composer/autoload_namespaces.phpￜￜￜￜ' require_once(): Failed opening required '/var/www-foo-project/vendor/composer/autoload_real.pfp' require_once(): Failed opening required '/var/www/foo-project/vendor/composer/autoload_real.pgpￜￜ' include(): Failed opening '/var/www/foo-project/vendor/nette/utils/src/Utils/DateTime.phpï¿œ/Cube`' Fatal Error: Class 'Solarium\Core\Configurableÿÿ' not found-obleceni/ Error: Class 'Nette\Http\SessionSectionÿÿÿ' not found Error: Class 'Nette\Caching\Storages\FileStorageÿÿ' not found Uncaught Error: Call to undefined method ComposerAutoloaderInit41,89608998d7c84bcc13a727394dca1::getLoader() Error: Class 'App\Security\UserStorageÿÿÿÿ' not found in /var/www/foo-project/temp/cache/Nette.Configurator/Container_1efc2a7985.php:7427 sometimes "only" segfault has happened, but opcache was not corrupted (IIRC), therefore other requests didn't fail: Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00007f47ada7dfb7 in kill () at ../sysdeps/unix/syscall-template.S:81 81 ../sysdeps/unix/syscall-template.S: Adresář nebo soubor neexistuje. (gdb) bt #0 0x00007f47ada7dfb7 in kill () at ../sysdeps/unix/syscall-template.S:81 #1 0x0000000000a1663f in zend_mm_panic (message=0x1135a1d "zend_mm_heap corrupted") at /home/matej21/tmp/php-7.0.3/Zend/zend_alloc.c:364 #2 0x0000000000a18346 in zend_mm_free_heap (heap=0x7f47a7800040, ptr=0x7f47a35988b0, __zend_filename=0x113ce20 "/home/matej21/tmp/php-7.0.3/Zend/zend_string.h", __zend_lineno=271, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /home/matej21/tmp/php-7.0.3/Zend/zend_alloc.c:1400 #3 0x0000000000a1ac7e in _efree (ptr=0x7f47a35988b0, __zend_filename=0x113ce20 "/home/matej21/tmp/php-7.0.3/Zend/zend_string.h", __zend_lineno=271, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /home/matej21/tmp/php-7.0.3/Zend/zend_alloc.c:2458 #4 0x0000000000a5ea2c in zend_string_release (s=0x7f47a35988b0) at /home/matej21/tmp/php-7.0.3/Zend/zend_string.h:271 #5 0x0000000000a629f1 in zend_hash_destroy (ht=0x7f47a2920fc0) at /home/matej21/tmp/php-7.0.3/Zend/zend_hash.c:1265 #6 0x0000000000a3b042 in destroy_zend_class (zv=0x7fffbfa67e60) at /home/matej21/tmp/php-7.0.3/Zend/zend_opcode.c:289 #7 0x0000000000a6203f in _zend_hash_del_el_ex (ht=0x20884a0, idx=535, p=0x23b3360, prev=0x0) at /home/matej21/tmp/php-7.0.3/Zend/zend_hash.c:1013 #8 0x0000000000a6210a in _zend_hash_del_el (ht=0x20884a0, idx=535, p=0x23b3360) at /home/matej21/tmp/php-7.0.3/Zend/zend_hash.c:1037 #9 0x0000000000a639a6 in zend_hash_reverse_apply (ht=0x20884a0, apply_func=0xa3454a <clean_non_persistent_class>) at /home/matej21/tmp/php-7.0.3/Zend/zend_hash.c:1615 #10 0x0000000000a35269 in shutdown_executor () at /home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:367 #11 0x0000000000a4cf98 in zend_deactivate () at /home/matej21/tmp/php-7.0.3/Zend/zend.c:967 #12 0x00000000009ba30d in php_request_shutdown (dummy=0x0) at /home/matej21/tmp/php-7.0.3/main/main.c:1823 #13 0x0000000000b1d4ae in main (argc=4, argv=0x7fffbfa686c8) at /home/matej21/tmp/php-7.0.3/sapi/fpm/fpm/fpm_main.c:1972 Program terminated with signal SIGABRT, Aborted. #0 0x00007f47ada7dcc9 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 56 ../nptl/sysdeps/unix/sysv/linux/raise.c: Adresář nebo soubor neexistuje. (gdb) bt #0 0x00007f47ada7dcc9 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 #1 0x00007f47ada810d8 in __GI_abort () at abort.c:89 #2 0x00007f47ada76b86 in __assert_fail_base (fmt=0x7f47b1835029 <error: Cannot access memory at address 0x7f47b1835029>, assertion=assertion@entry=0x113d04d "*end == '\\0'", file=file@entry=0x113cf08 "/home/matej21/tmp/php-7.0.3/Zend/zend_hash.c", line=line@entry=2432, function=function@entry=0x113d200 <__PRETTY_FUNCTION__.8927> "_zend_handle_numeric_str_ex") at assert.c:92 #3 0x00007f47ada76c32 in __GI___assert_fail (assertion=0x113d04d "*end == '\\0'", file=0x113cf08 "/home/matej21/tmp/php-7.0.3/Zend/zend_hash.c", line=2432, function=0x113d200 <__PRETTY_FUNCTION__.8927> "_zend_handle_numeric_str_ex") at assert.c:101 #4 0x0000000000a65c03 in _zend_handle_numeric_str_ex (key=0x7f47a36645c8 "234\377", length=3, idx=0x7fffbfa65c18) at /home/matej21/tmp/php-7.0.3/Zend/zend_hash.c:2432 #5 0x0000000000aa0236 in _zend_handle_numeric_str (key=0x7f47a36645c8 "234\377", length=3, idx=0x7fffbfa65c18) at /home/matej21/tmp/php-7.0.3/Zend/zend_hash.h:264 #6 0x0000000000b07c30 in ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_TMPVAR_CV_HANDLER () at /home/matej21/tmp/php-7.0.3/Zend/zend_vm_execute.h:44069 #7 0x0000000000aa93ff in execute_ex (ex=0x7f47a7815060) at /home/matej21/tmp/php-7.0.3/Zend/zend_vm_execute.h:414 #8 0x0000000000a36ce7 in zend_call_function (fci=0x7fffbfa65e90, fci_cache=0x7fffbfa65e60) at /home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:860 #9 0x00000000008943f8 in zif_call_user_func_array (execute_data=0x7f47a7814fe0, return_value=0x7f47a7814fa0) at /home/matej21/tmp/php-7.0.3/ext/standard/basic_functions.c:4811 #10 0x0000000000aa9f6a in ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER () at /home/matej21/tmp/php-7.0.3/Zend/zend_vm_execute.h:714 #11 0x0000000000aa93ff in execute_ex (ex=0x7f47a7814030) at /home/matej21/tmp/php-7.0.3/Zend/zend_vm_execute.h:414 #12 0x0000000000aa9511 in zend_execute (op_array=0x7f47a7865000, return_value=0x0) at /home/matej21/tmp/php-7.0.3/Zend/zend_vm_execute.h:458 #13 0x0000000000a4e394 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /home/matej21/tmp/php-7.0.3/Zend/zend.c:1427 #14 0x00000000009bb7a1 in php_execute_script (primary_file=0x7fffbfa683d0) at /home/matej21/tmp/php-7.0.3/main/main.c:2484 #15 0x0000000000b1d368 in main (argc=4, argv=0x7fffbfa686c8) at /home/matej21/tmp/php-7.0.3/sapi/fpm/fpm/fpm_main.c:1944 Program terminated with signal SIGSEGV, Segmentation fault. #0 memset () at ../sysdeps/x86_64/memset.S:93 93 ../sysdeps/x86_64/memset.S: Adresář nebo soubor neexistuje. (gdb) bt #0 memset () at ../sysdeps/x86_64/memset.S:93 #1 0x0000000000aa83e6 in i_init_code_execute_data (execute_data=0x7f47a7814a50, op_array=0x7f47a7873700, return_value=0x0) at /home/matej21/tmp/php-7.0.3/Zend/zend_execute.c:2200 #2 0x0000000000ae5790 in ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER () at /home/matej21/tmp/php-7.0.3/Zend/zend_vm_execute.h:29164 #3 0x0000000000aa93ff in execute_ex (ex=0x7f47a7814930) at /home/matej21/tmp/php-7.0.3/Zend/zend_vm_execute.h:414 #4 0x0000000000a36ce7 in zend_call_function (fci=0x7fffbfa64ad0, fci_cache=0x7fffbfa64aa0) at /home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:860 #5 0x0000000000a73f76 in zend_call_method (object=0x7f47a7802d28, obj_ce=0x7f47a7805380, fn_proxy=0x7f47a7802d20, function_name=0x7f47a792fbe8 "composer\\autoload\\classloader::loadclass\001", function_name_len=44, retval_ptr=0x0, param_count=1, arg1=0x7f47a7814920, arg2=0x0) at /home/matej21/tmp/php-7.0.3/Zend/zend_interfaces.c:104 #6 0x000000000083e7fc in zif_spl_autoload_call (execute_data=0x7f47a78148c0, return_value=0x7fffbfa64da0) at /home/matej21/tmp/php-7.0.3/ext/spl/php_spl.c:429 #7 0x0000000000a36e0e in zend_call_function (fci=0x7fffbfa64de0, fci_cache=0x7fffbfa64db0) at /home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:879 #8 0x0000000000a3758c in zend_lookup_class_ex (name=0x7f47a359b1d8, key=0x7f47a398ef20, use_autoload=1) at /home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:1041 #9 0x0000000000a380d5 in zend_fetch_class_by_name (class_name=0x7f47a359b1d8, key=0x7f47a398ef20, fetch_type=6) at /home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:1387 #10 0x0000000000aac681 in ZEND_ADD_TRAIT_SPEC_HANDLER () at /home/matej21/tmp/php-7.0.3/Zend/zend_vm_execute.h:1449 #11 0x0000000000aa93ff in execute_ex (ex=0x7f47a7814730) at /home/matej21/tmp/php-7.0.3/Zend/zend_vm_execute.h:414 #12 0x0000000000a36ce7 in zend_call_function (fci=0x7fffbfa65140, fci_cache=0x7fffbfa65110) at /home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:860 #13 0x0000000000a73f76 in zend_call_method (object=0x7f47a7802d28, obj_ce=0x7f47a7805380, fn_proxy=0x7f47a7802d20, function_name=0x7f47a792fbe8 "composer\\autoload\\classloader::loadclass\001", function_name_len=44, retval_ptr=0x0, param_count=1, arg1=0x7f47a7814720, arg2=0x0) at /home/matej21/tmp/php-7.0.3/Zend/zend_interfaces.c:104 #14 0x000000000083e7fc in zif_spl_autoload_call (execute_data=0x7f47a78146c0, return_value=0x7fffbfa65410) at /home/matej21/tmp/php-7.0.3/ext/spl/php_spl.c:429 #15 0x0000000000a36e0e in zend_call_function (fci=0x7fffbfa65450, fci_cache=0x7fffbfa65420) at /home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:879 #16 0x0000000000a3758c in zend_lookup_class_ex (name=0x7f47a359b5d8, key=0x0, use_autoload=1) at /home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:1041 #17 0x0000000000a6c0e3 in zif_class_alias (execute_data=0x7f47a7814640, return_value=0x7f47a7814620) at /home/matej21/tmp/php-7.0.3/Zend/zend_builtin_functions.c:1585 #18 0x0000000000aa99d0 in ZEND_DO_ICALL_SPEC_HANDLER () at /home/matej21/tmp/php-7.0.3/Zend/zend_vm_execute.h:586 #19 0x0000000000aa93ff in execute_ex (ex=0x7f47a7814590) at /home/matej21/tmp/php-7.0.3/Zend/zend_vm_execute.h:414 #20 0x0000000000a36ce7 in zend_call_function (fci=0x7fffbfa657e0, fci_cache=0x7fffbfa657b0) at /home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:860 #21 0x0000000000a73f76 in zend_call_method (object=0x0, obj_ce=0x0, fn_proxy=0x7f47a78fe190, function_name=0x7f47a7901bf8 "closure::__invoke\003", function_name_len=21, retval_ptr=0x0, param_count=1, arg1=0x7f47a7814580, arg2=0x0) at /home/matej21/tmp/php-7.0.3/Zend/zend_interfaces.c:104 #22 0x000000000083e7fc in zif_spl_autoload_call (execute_data=0x7f47a7814520, return_value=0x7fffbfa65ab0) at /home/matej21/tmp/php-7.0.3/ext/spl/php_spl.c:429 #23 0x0000000000a36e0e in zend_call_function (fci=0x7fffbfa65af0, fci_cache=0x7fffbfa65ac0) at /home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:879 #24 0x0000000000a3758c in zend_lookup_class_ex (name=0x7f47a359bbc0, key=0x0, use_autoload=1) at /home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:1041 #25 0x0000000000a37685 in zend_lookup_class (name=0x7f47a359bbc0) at /home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:1062 #26 0x0000000000a6b557 in zif_class_exists (execute_data=0x7f47a78144b0, return_value=0x7fffbfa65e50) at /home/matej21/tmp/php-7.0.3/Zend/zend_builtin_functions.c:1437 #27 0x0000000000a36e0e in zend_call_function (fci=0x7fffbfa65ea0, fci_cache=0x7fffbfa65e70) at /home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:879 #28 0x000000000088de93 in zif_array_map (execute_data=0x7f47a7814430, return_value=0x7f47a7814420) at /home/matej21/tmp/php-7.0.3/ext/standard/array.c:5290 #29 0x0000000000aa99d0 in ZEND_DO_ICALL_SPEC_HANDLER () at /home/matej21/tmp/php-7.0.3/Zend/zend_vm_execute.h:586 #30 0x0000000000aa93ff in execute_ex (ex=0x7f47a7814030) at /home/matej21/tmp/php-7.0.3/Zend/zend_vm_execute.h:414 #31 0x0000000000aa9511 in zend_execute (op_array=0x7f47a7873000, return_value=0x0) at /home/matej21/tmp/php-7.0.3/Zend/zend_vm_execute.h:458 #32 0x0000000000a4e394 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /home/matej21/tmp/php-7.0.3/Zend/zend.c:1427 #33 0x00000000009bb7a1 in php_execute_script (primary_file=0x7fffbfa683d0) at /home/matej21/tmp/php-7.0.3/main/main.c:2484 #34 0x0000000000b1d368 in main (argc=4, argv=0x7fffbfa686c8) at /home/matej21/tmp/php-7.0.3/sapi/fpm/fpm/fpm_main.c:1944 ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=71135 -- Edit this bug report at https://bugs.php.net/bug.php?id=71135&edit=1