Bug #74760 [NEW]: strduo() from signal handler causing a deadlock

From: rasmus Operating system: PHP version: 5.6Git-2017-06-14 (snap) Package: *General Issues Bug Type: Bug Bug description:strduo() from signal handler causing a deadlock Description: ------------ We have a strdup call at in the php_error_cb() function which can cause a deadlock in malloc: https://github.com/php/php-src/blob/master/main/main.c#L1046-L1047 On a timeout, we might be in a malloc() in some third-party lib and since malloc isn't reentrant this can deadlock. Example (from PHP 7.0 but the code is similar in master): #0 0x00007f6410c246ac in __lll_lock_wait_private () from /lib64/libc.so.6 #1 0x00007f6410ba31c7 in _L_lock_14687 () from /lib64/libc.so.6 #2 0x00007f6410ba02c3 in malloc () from /lib64/libc.so.6 #3 0x00007f6410ba6aba in strdup () from /lib64/libc.so.6 #4 0x00007f640993ca25 in php_error_cb (type=1, error_filename=0x7f62b4fb0988 "/var/www/script.php", error_lineno=26, format=<optimized out>, args=<optimized out>) at /builddir/build/BUILD/php-src-7ed028b1080c44a8de4da1d775fd8e38c6536845/main/main.c:1012 #5 0x00007f6409b6d15b in soap_error_handler (error_num=1, error_filename=0x7f62b4fb0988 "/var/www/script.php", error_lineno=26, format=0x7f640a2d9560 "Maximum execution time of %pd second%s exceeded", args=0x7ffc65849ff0) at /builddir/build/BUILD/php-src-7ed028b1080c44a8de4da1d775fd8e38c6536845/ext/soap/soap.c:2210 #6 0x00007f640993e811 in zend_error (type=type@entry=1, format=format@entry=0x7f640a2d9560 "Maximum execution time of %pd second%s exceeded") at /builddir/build/BUILD/php-src-7ed028b1080c44a8de4da1d775fd8e38c6536845/Zend/zend.c:1163 #7 0x00007f6409ce0fdf in zend_timeout (dummy=<optimized out>) at /builddir/build/BUILD/php-src-7ed028b1080c44a8de4da1d775fd8e38c6536845/Zend/zend_execute_API.c:1207 #8 <signal handler called> #9 0x00007f6410b9bb1a in malloc_consolidate () from /lib64/libc.so.6 #10 0x00007f6410b9ded5 in _int_malloc () from /lib64/libc.so.6 #11 0x00007f6410ba026c in malloc () from /lib64/libc.so.6 #12 0x00007f63f854facc in _string_check(memcached_string_st*, unsigned long) () from /lib64/libmemcached.so.11 #13 0x00007f63f85494ae in _read_one_response(memcached_instance_st*, char*, unsigned long, memcached_result_st*) () from /lib64/libmemcached.so.11 #14 0x00007f63f854973c in memcached_response(memcached_instance_st*, char*, unsigned long, memcached_result_st*) () from /lib64/libmemcached.so.11 #15 0x00007f63f85427a2 in memcached_fetch_result () from /lib64/libmemcached.so.11 -- Edit bug report at https://bugs.php.net/bug.php?id=74760&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=74760&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=74760&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=74760&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=74760&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=74760&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=74760&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=74760&r=needscript Try newer version: https://bugs.php.net/fix.php?id=74760&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=74760&r=support Expected behavior: https://bugs.php.net/fix.php?id=74760&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=74760&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=74760&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=74760&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=74760&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=74760&r=dst IIS Stability: https://bugs.php.net/fix.php?id=74760&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=74760&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=74760&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=74760&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=74760&r=mysqlcfg