Bug #73939 [NEW]: Memory allocation in signal handler causes segfault

From: as Operating system: Linux 4.4 PHP version: 7.1.0 Package: PCNTL related Bug Type: Bug Bug description:Memory allocation in signal handler causes segfault Description: ------------ Memory allocation in signal handler introduced by https://wiki.php.net/rfc/additional-context-in-pcntl-signal-handler causes a segfault when compiled with HAVE_STRUCT_SIGINFO_T. To reproduce, run php test.php in one terminal, and run `while true; do pkill -n -SIGTERM php; done` in another terminal. PHP will eventually segfault. Sample stack trace: 0x00000000008f7073 in zend_mm_alloc_small (heap=0x7ffff3600040, size=64, bin_num=7, __zend_filename=0x104da28 "/home/adam/php-src/Zend/zend_string.h", __zend_lineno=122, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /home/adam/php-src/Zend/zend_alloc.c:1261 1261 heap->free_slot[bin_num] = p->next_free_slot; (gdb) bt #0 0x00000000008f7073 in zend_mm_alloc_small (heap=0x7ffff3600040, size=64, bin_num=7, __zend_filename=0x104da28 "/home/adam/php-src/Zend/zend_string.h", __zend_lineno=122, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /home/adam/php-src/Zend/zend_alloc.c:1261 #1 0x00000000008f7316 in zend_mm_alloc_heap (heap=0x7ffff3600040, size=64, __zend_filename=0x104da28 "/home/adam/php-src/Zend/zend_string.h", __zend_lineno=122, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /home/adam/php-src/Zend/zend_alloc.c:1332 #2 0x00000000008f9e56 in _emalloc (size=32, __zend_filename=0x104da28 "/home/adam/php-src/Zend/zend_string.h", __zend_lineno=122, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /home/adam/php-src/Zend/zend_alloc.c:2417 #3 0x0000000000951557 in zend_string_alloc (len=4, persistent=0) at /home/adam/php-src/Zend/zend_string.h:122 #4 0x00000000009515c0 in zend_string_init (str=0xffe6fe "code", len=4, persistent=0) at /home/adam/php-src/Zend/zend_string.h:158 #5 0x0000000000954035 in _zend_hash_str_update (ht=0x7ffff365a600, str=0xffe6fe "code", len=4, pData=0x7fffffffafb0, __zend_filename=0x104c288 "/home/adam/php-src/Zend/zend_hash.h", __zend_lineno=446) at /home/adam/php-src/Zend/zend_hash.c:650 #6 0x000000000093eaf0 in zend_symtable_str_update (ht=0x7ffff365a600, str=0xffe6fe "code", len=4, pData=0x7fffffffafb0) at /home/adam/php-src/Zend/zend_hash.h:446 #7 0x0000000000945351 in add_assoc_long_ex (arg=0x7fffffffb040, key=0xffe6fe "code", key_len=4, n=0) at /home/adam/php-src/Zend/zend_API.c:1325 #8 0x00000000006bb9f6 in pcntl_siginfo_to_zval (signo=15, siginfo=0x7fffffffb370, user_siginfo=0x7fffffffb040) at /home/adam/php-src/ext/pcntl/pcntl.c:1221 #9 0x00000000006bc0fe in pcntl_signal_handler (signo=15, siginfo=0x7fffffffb370, context=0x7fffffffb240) at /home/adam/php-src/ext/pcntl/pcntl.c:1384 #10 0x00000000009806cf in zend_signal_handler (signo=15, siginfo=0x7fffffffb370, context=0x7fffffffb240) at /home/adam/php-src/Zend/zend_signal.c:207 #11 0x000000000097feac in zend_signal_handler_defer (signo=15, siginfo=0x7fffffffb370, context=0x7fffffffb240) at /home/adam/php-src/Zend/zend_signal.c:101 #12 <signal handler called> #13 __memcpy_avx_unaligned () at ../sysdeps/x86_64/multiarch/memcpy-avx-unaligned.S:238 #14 0x000000000093344e in concat_function (result=0x7ffff36150e0, op1=0x7ffff36150d0, op2=0x7fffffffb950) at /home/adam/php-src/Zend/zend_operators.c:1764 #15 0x0000000000a3013f in ZEND_CONCAT_SPEC_TMPVAR_CV_HANDLER () at /home/adam/php-src/Zend/zend_vm_execute.h:51598 #16 0x00000000009ac2e6 in execute_ex (ex=0x7ffff3615030) at /home/adam/php-src/Zend/zend_vm_execute.h:429 #17 0x00000000009ac4e7 in zend_execute (op_array=0x7ffff3672400, return_value=0x0) at /home/adam/php-src/Zend/zend_vm_execute.h:474 #18 0x000000000093e36a in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /home/adam/php-src/Zend/zend.c:1546 #19 0x000000000087755c in php_execute_script (primary_file=0x7fffffffd0b0) at /home/adam/php-src/main/main.c:2535 #20 0x0000000000a3ccca in do_cli (argc=2, argv=0x13b4cd0) at /home/adam/php-src/sapi/cli/php_cli.c:997 #21 0x0000000000a3e15c in main (argc=2, argv=0x13b4cd0) at /home/adam/php-src/sapi/cli/php_cli.c:1390 Test script: --------------- <?php declare(ticks = 1); pcntl_signal(SIGTERM, function() { echo "signal\n"; }); $c = 0; while(1) { $c += 1; str_repeat('a', 8192) . $c; } Expected result: ---------------- no segfault Actual result: -------------- segfault -- Edit bug report at https://bugs.php.net/bug.php?id=73939&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=73939&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=73939&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=73939&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=73939&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=73939&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=73939&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=73939&r=needscript Try newer version: https://bugs.php.net/fix.php?id=73939&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=73939&r=support Expected behavior: https://bugs.php.net/fix.php?id=73939&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=73939&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=73939&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=73939&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=73939&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=73939&r=dst IIS Stability: https://bugs.php.net/fix.php?id=73939&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=73939&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=73939&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=73939&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=73939&r=mysqlcfg