From: mglinski at sonnysdirect dot com
Operating system: RHEL 7.1
PHP version: 5.6.18
Package: MySQLi related
Bug Type: Bug
Bug description:PHP Segfaults when querying MySQL when using a MySQL user with a netmask block
Description:
------------
Hello!
We encountered a bug today when testing out our new production
environment. We are running RHEL 7.1 Using the Remi-php56 repository to
run the latest php 5.6 Stable (5.6.18). We are using MySQL 5.6.28
Community Edition.
We are connecting to the MySQL server over the local network, and the
PHP and MySQL servers are on the same subnet. The MySQL server user we
are using to connect has a host restriction in the ip_address/netmask
format (192.168.1.0/255.255.255.0).
When using this user restriction, trying to render some report pages we
have implemented, results in either a segfault, or a MySQLi Exception:
app.ERROR: exception 'Doctrine\DBAL\Driver\Mysqli\MysqliException' with
message 'Commands out of sync; you can't run this command now' in
./vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/Mysqli/MysqliStatement.php:250
when PHP segaults, we get this error output in our php-fpm logs:
Feb 25 17:17:02 fllws3711 php-fpm[7155]: [WARNING] [pool www] child 7157
exited on signal 11 (SIGSEGV - core dumped) after 175.219328 seconds
from start
Feb 25 17:17:02 fllws3711 php-fpm[7155]: [NOTICE] [pool www] child 7182
started
The interesting thing, is that we can run other queries in PHP using
that user with the netmask restrictions with no issue. When we change
the host restriction in MySQL to "%", we have no issues running the
report queries.
Test script:
---------------
Our application is very large, so I am just putting version numbers of
software in here.
---------------------------------------
$ cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.1 (Maipo)
$ php-fpm --version
PHP 5.6.18 (fpm-fcgi) (built: Feb 3 2016 13:07:32)
Copyright (c) 1997-2016 The PHP Group
Zend Engine v2.6.0, Copyright (c) 1998-2016 Zend Technologies
with Zend OPcache v7.0.6-dev, Copyright (c) 1999-2016, by Zend
Technologies
$ mysqld --version
mysqld Ver 5.6.28 for Linux on x86_64 (MySQL Community Server (GPL))
Expected result:
----------------
Database result rows.
Actual result:
--------------
Either a MySQLi Exception:
OR a php segfault, with the gdb backtrack reproduced below:
$ gdb /usr/sbin/php-fpm
/tmp/systemd-private-41d9b0ad9000430fa7104008e110103c-php-fpm.service-A0bfRP/tmp/coredump-php-fpm.7157
GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-80.el7
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show
copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/sbin/php-fpm...Reading symbols from
/usr/lib/debug/usr/sbin/php-fpm.debug...done.
done.
[New LWP 7157]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `php-fpm: pool www '.
Program terminated with signal 11, Segmentation fault.
#0 zend_mm_remove_from_free_list (heap=0x7f165644b310,
mm_block=0x7f165672dd50) at
/usr/src/debug/php-5.6.18/Zend/zend_alloc.c:837
837 if (UNEXPECTED(prev->next_free_block != mm_block) ||
UNEXPECTED(next->prev_free_block != mm_block)) {
(gdb) bt
#0 zend_mm_remove_from_free_list (heap=0x7f165644b310,
mm_block=0x7f165672dd50) at
/usr/src/debug/php-5.6.18/Zend/zend_alloc.c:837
#1 0x00007f1655658eac in _zend_mm_free_int (heap=0x7f165644b310,
p=0x7f165672cd50) at /usr/src/debug/php-5.6.18/Zend/zend_alloc.c:2105
#2 0x00007f164600caf4 in _mysqlnd_efree (ptr=<optimized out>) at
/usr/src/debug/php-5.6.18/ext/mysqlnd/mysqlnd_alloc.c:347
#3 0x00007f164602727d in php_mysqlnd_stmt_store_result_pub
(s=<optimized out>) at
/usr/src/debug/php-5.6.18/ext/mysqlnd/mysqlnd_ps.c:132
#4 0x00007f16438038ab in zif_mysqli_stmt_store_result (ht=<optimized
out>, return_value=0x7f16582e37c8, return_value_ptr=<optimized out>,
this_ptr=<optimized out>, return_value_used=<optimized out>)
at /usr/src/debug/php-5.6.18/ext/mysqli/mysqli_api.c:2607
#5 0x00007f16556716cb in dtrace_execute_internal
(execute_data_ptr=<optimized out>, fci=<optimized out>,
return_value_used=<optimized out>) at
/usr/src/debug/php-5.6.18/Zend/zend_dtrace.c:97
#6 0x00007f165572abb4 in zend_do_fcall_common_helper_SPEC
(execute_data=<optimized out>) at
/usr/src/debug/php-5.6.18/Zend/zend_vm_execute.h:560
#7 0x00007f16556bf4a8 in execute_ex (execute_data=0x7f16553c7068) at
/usr/src/debug/php-5.6.18/Zend/zend_vm_execute.h:363
#8 0x00007f16556715a9 in dtrace_execute_ex (execute_data=<optimized
out>) at /usr/src/debug/php-5.6.18/Zend/zend_dtrace.c:73
#9 0x00007f165572b069 in zend_do_fcall_common_helper_SPEC
(execute_data=<optimized out>) at
/usr/src/debug/php-5.6.18/Zend/zend_vm_execute.h:592
#10 0x00007f16556bf4a8 in execute_ex (execute_data=0x7f16553c6ec8) at
/usr/src/debug/php-5.6.18/Zend/zend_vm_execute.h:363
#11 0x00007f16556715a9 in dtrace_execute_ex (execute_data=<optimized
out>) at /usr/src/debug/php-5.6.18/Zend/zend_dtrace.c:73
#12 0x00007f165572b069 in zend_do_fcall_common_helper_SPEC
(execute_data=<optimized out>) at
/usr/src/debug/php-5.6.18/Zend/zend_vm_execute.h:592
#13 0x00007f16556bf4a8 in execute_ex (execute_data=0x7f16553c6d40) at
/usr/src/debug/php-5.6.18/Zend/zend_vm_execute.h:363
#14 0x00007f16556715a9 in dtrace_execute_ex (execute_data=<optimized
out>) at /usr/src/debug/php-5.6.18/Zend/zend_dtrace.c:73
#15 0x00007f165572b069 in zend_do_fcall_common_helper_SPEC
(execute_data=<optimized out>) at
/usr/src/debug/php-5.6.18/Zend/zend_vm_execute.h:592
#16 0x00007f16556bf4a8 in execute_ex (execute_data=0x7f16553c6bc0) at
/usr/src/debug/php-5.6.18/Zend/zend_vm_execute.h:363
#17 0x00007f16556715a9 in dtrace_execute_ex (execute_data=<optimized
out>) at /usr/src/debug/php-5.6.18/Zend/zend_dtrace.c:73
#18 0x00007f165572b069 in zend_do_fcall_common_helper_SPEC
(execute_data=<optimized out>) at
/usr/src/debug/php-5.6.18/Zend/zend_vm_execute.h:592
#19 0x00007f16556bf4a8 in execute_ex (execute_data=0x7f16553c6a60) at
/usr/src/debug/php-5.6.18/Zend/zend_vm_execute.h:363
#20 0x00007f16556715a9 in dtrace_execute_ex (execute_data=<optimized
out>) at /usr/src/debug/php-5.6.18/Zend/zend_dtrace.c:73
#21 0x00007f165572b069 in zend_do_fcall_common_helper_SPEC
(execute_data=<optimized out>) at
/usr/src/debug/php-5.6.18/Zend/zend_vm_execute.h:592
#22 0x00007f16556bf4a8 in execute_ex (execute_data=0x7f16553c68d8) at
/usr/src/debug/php-5.6.18/Zend/zend_vm_execute.h:363
#23 0x00007f16556715a9 in dtrace_execute_ex (execute_data=<optimized
out>) at /usr/src/debug/php-5.6.18/Zend/zend_dtrace.c:73
#24 0x00007f165572b069 in zend_do_fcall_common_helper_SPEC
(execute_data=<optimized out>) at
/usr/src/debug/php-5.6.18/Zend/zend_vm_execute.h:592
#25 0x00007f16556bf4a8 in execute_ex (execute_data=0x7f16553c6780) at
/usr/src/debug/php-5.6.18/Zend/zend_vm_execute.h:363
#26 0x00007f16556715a9 in dtrace_execute_ex (execute_data=<optimized
out>) at /usr/src/debug/php-5.6.18/Zend/zend_dtrace.c:73
#27 0x00007f165572b069 in zend_do_fcall_common_helper_SPEC
(execute_data=<optimized out>) at
/usr/src/debug/php-5.6.18/Zend/zend_vm_execute.h:592
#28 0x00007f16556bf4a8 in execute_ex (execute_data=0x7f16553c6610) at
/usr/src/debug/php-5.6.18/Zend/zend_vm_execute.h:363
#29 0x00007f16556715a9 in dtrace_execute_ex (execute_data=<optimized
out>) at /usr/src/debug/php-5.6.18/Zend/zend_dtrace.c:73
#30 0x00007f16556733a3 in zend_call_function
(fci=fci@entry=0x7ffce3cd8fe0, fci_cache=<optimized out>,
fci_cache@entry=0x7ffce3cd8fb0) at
/usr/src/debug/php-5.6.18/Zend/zend_execute_API.c:829
#31 0x00007f16555bd343 in zif_call_user_func_array (ht=<optimized out>,
return_value=0x7f16568e8680, return_value_ptr=<optimized out>,
this_ptr=<optimized out>, return_value_used=<optimized out>)
at /usr/src/debug/php-5.6.18/ext/standard/basic_functions.c:4786
#32 0x00007f16556716cb in dtrace_execute_internal
(execute_data_ptr=<optimized out>, fci=<optimized out>,
return_value_used=<optimized out>) at
/usr/src/debug/php-5.6.18/Zend/zend_dtrace.c:97
#33 0x00007f165572abb4 in zend_do_fcall_common_helper_SPEC
(execute_data=<optimized out>) at
/usr/src/debug/php-5.6.18/Zend/zend_vm_execute.h:560
#34 0x00007f16556bf4a8 in execute_ex (execute_data=0x7f16553c6420) at
/usr/src/debug/php-5.6.18/Zend/zend_vm_execute.h:363
#35 0x00007f16556715a9 in dtrace_execute_ex (execute_data=<optimized
out>) at /usr/src/debug/php-5.6.18/Zend/zend_dtrace.c:73
#36 0x00007f165572b069 in zend_do_fcall_common_helper_SPEC
(execute_data=<optimized out>) at
/usr/src/debug/php-5.6.18/Zend/zend_vm_execute.h:592
#37 0x00007f16556bf4a8 in execute_ex (execute_data=0x7f16553c62a0) at
/usr/src/debug/php-5.6.18/Zend/zend_vm_execute.h:363
#38 0x00007f16556715a9 in dtrace_execute_ex (execute_data=<optimized
out>) at /usr/src/debug/php-5.6.18/Zend/zend_dtrace.c:73
#39 0x00007f165572b069 in zend_do_fcall_common_helper_SPEC
(execute_data=<optimized out>) at
/usr/src/debug/php-5.6.18/Zend/zend_vm_execute.h:592
#40 0x00007f16556bf4a8 in execute_ex (execute_data=0x7f16553c6148) at
/usr/src/debug/php-5.6.18/Zend/zend_vm_execute.h:363
#41 0x00007f16556715a9 in dtrace_execute_ex (execute_data=<optimized
out>) at /usr/src/debug/php-5.6.18/Zend/zend_dtrace.c:73
#42 0x00007f165572b069 in zend_do_fcall_common_helper_SPEC
(execute_data=<optimized out>) at
/usr/src/debug/php-5.6.18/Zend/zend_vm_execute.h:592
#43 0x00007f16556bf4a8 in execute_ex (execute_data=0x7f16553c6010) at
/usr/src/debug/php-5.6.18/Zend/zend_vm_execute.h:363
#44 0x00007f16556715a9 in dtrace_execute_ex (execute_data=<optimized
out>) at /usr/src/debug/php-5.6.18/Zend/zend_dtrace.c:73
#45 0x00007f165572b069 in zend_do_fcall_common_helper_SPEC
(execute_data=<optimized out>) at
/usr/src/debug/php-5.6.18/Zend/zend_vm_execute.h:592
#46 0x00007f16556bf4a8 in execute_ex (execute_data=0x7f16553c5ed8) at
/usr/src/debug/php-5.6.18/Zend/zend_vm_execute.h:363
#47 0x00007f16556715a9 in dtrace_execute_ex (execute_data=<optimized
out>) at /usr/src/debug/php-5.6.18/Zend/zend_dtrace.c:73
#48 0x00007f16556842cb in zend_execute_scripts (type=type@entry=8,
retval=retval@entry=0x0, file_count=file_count@entry=3) at
/usr/src/debug/php-5.6.18/Zend/zend.c:1341
#49 0x00007f165561f7c2 in php_execute_script
(primary_file=primary_file@entry=0x7ffce3cdbd10) at
/usr/src/debug/php-5.6.18/main/main.c:2610
#50 0x00007f165550278f in main (argc=<optimized out>, argv=<optimized
out>) at /usr/src/debug/php-5.6.18/sapi/fpm/fpm/fpm_main.c:1989
--
Edit bug report at https://bugs.php.net/bug.php?id=71663&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=71663&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=71663&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=71663&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=71663&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=71663&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=71663&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=71663&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=71663&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=71663&r=support
Expected behavior: https://bugs.php.net/fix.php?id=71663&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=71663&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=71663&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=71663&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=71663&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=71663&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=71663&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=71663&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=71663&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=71663&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=71663&r=mysqlcfg