Bug #75294 [NEW]: Piwik login SIGSEV [zend_mm_alloc_small via Zend_Db_Statement_Mysqli->_execute]

From: greenreaper at hotmail dot com Operating system: Debian Stretch (w/Linux 4.12.6) PHP version: 7.2.0RC3 Package: Reproducible crash Bug Type: Bug Bug description:Piwik login SIGSEV [zend_mm_alloc_small via Zend_Db_Statement_Mysqli->_execute] Description: ------------ Attempting to access the UI/login page (index.php) of the Piwik web analytics system leads to a PHP-FPM worker SIGSEV in PHP 7.2.0RC3 - not occuring with PHP 7.2.0RC1 - during small memory allocation while executing a just-prepared MySQL query. Installed PHP packages: php-apcu php-apcu-bc php-common php-geoip php-igbinary php7.2-cli php7.2-common php7.2-curl php7.2-fpm php7.2-gd php7.2-intl php7.2-json php7.2-mbstring php7.2-mysql php7.2-opcache php7.2-pgsql php7.2-readline php7.2-xml The crash occurs 100% repeatably for me, at what I think is (from bt address): heap->free_slot[bin_num] = p->next_free_slot; in zend_mm_alloc_small(), when called from ZEND_FE_FETCH_RW_SPEC_VAR_HANDLER(): if (EXPECTED((value_type & Z_TYPE_MASK) != IS_REFERENCE)) { zend_refcounted *gc = Z_COUNTED_P(value); zval *ref; > ZVAL_NEW_EMPTY_REF(value); ref = Z_REFVAL_P(value); ZVAL_COPY_VALUE_EX(ref, value, gc, value_type); } At this point Mysqli is being used to execute a default login command (for the user "anonymous", password "anonymous"). I imagine the crash might be due to earlier corruption, though. Piwik's *tracking* code appears to still be working, judging by MySQL traffic. The crash occurred consistently when I ran the UI alone with a separate master process of php-fpm via a separate Unix socket and a copy of your production ini: php-fpm7.2 --nodaemonize --fpm-config /etc/php/7.2/fpmtest/php-fpm.conf -c /etc/php/7.2/fpmtest/php.ini.production ...as well as when it was sharing a pool and socket with the tracking code and the website it was tracking. With USE_ZEND_ALLOC=0 it also crashes, around mysqlnd_mysqlnd_object_factory_get_prepared_statement_pub (see backtrace). Test script: --------------- I am using Piwik 3.1.2-b2, which was working with PHP 7.2.0RC1: https://poser.pugx.org/piwik/piwik/v/unstable https://packagist.org/packages/piwik/piwik To run PHP I am currently using Sury's packages for Debian Stretch (x86_64, dual-CPU, 8 cores each): https://packages.sury.org/php/pool/main/p/php7.2/ https://packages.sury.org/php/README.txt Actual result: -------------- (gdb) bt #0 zend_mm_alloc_small (bin_num=2, size=<optimized out>, heap=0x7f3a6b400040) at ./Zend/zend_alloc.c:1261 #1 _emalloc_24 () at ./Zend/zend_alloc.c:2336 #2 0x00005569188438e0 in ZEND_FE_FETCH_RW_SPEC_VAR_HANDLER () at ./Zend/zend_vm_execute.h:17139 #3 0x00005569188630bb in execute_ex (ex=0x7f3a6b400040) at ./Zend/zend_vm_execute.h:60823 #4 0x000055691886a87e in zend_execute (op_array=op_array@entry=0x7f3a6b4740e0, return_value=return_value@entry=0x7f3a59393c98) at ./Zend/zend_vm_execute.h:63763 #5 0x00005569187b8f73 in zend_execute_scripts (type=1799489152, type@entry=8, retval=0x7f3a59393c98, retval@entry=0x0, file_count=file_count@entry=3) at ./Zend/zend.c:1496 #6 0x0000556918754048 in php_execute_script (primary_file=0x7ffddc6bd320) at ./main/main.c:2590 #7 0x000055691860c50a in main (argc=<optimized out>, argv=<optimized out>) at ./sapi/fpm/fpm/fpm_main.c:1966 (gdb) zbacktrace [0x7f3a6b420680] Zend_Db_Statement_Mysqli->_execute(reference) /[censored]/piwik/libs/Zend/Db/Statement/Mysqli.php:246 [0x7f3a6b4205d0] Zend_Db_Statement->execute(array(1)[0x7f3a6b420620]) /[censored]/piwik/libs/Zend/Db/Statement.php:300 [0x7f3a6b420540] Zend_Db_Adapter_Abstract->query("SELECT * FROM piwik_user WHERE login = ?", array(1)[0x7f3a6b4205a0]) /[censored]/piwik/libs/Zend/Db/Adapter/Abstract.php:479 [0x7f3a6b420490] Zend_Db_Adapter_Abstract->fetchAll("SELECT * FROM piwik_user WHERE login = ?", "anonymous") /[censored]/piwik/libs/Zend/Db/Adapter/Abstract.php:736 [0x7f3a6b4203d0] Piwik\Plugins\UsersManager\Model->getUser("anonymous") /[censored]/piwik/plugins/UsersManager/Model.php:167 [0x7f3a6b420330] Piwik\Plugins\Login\Auth->authenticateWithTokenOrHashToken("anonymous", "anonymous") /[censored]/piwik/plugins/Login/Auth.php:101 [0x7f3a6b4202c0] Piwik\Plugins\Login\Auth->authenticate() /[censored]/piwik/plugins/Login/Auth.php:61 [0x7f3a6b420240] Piwik\Access->reloadAccess(object[0x7f3a6b420290]) /[censored]/piwik/core/Access.php:154 [0x7f3a6b420140] Piwik\FrontController->init() /[censored]/piwik/core/FrontController.php:374 [0x7f3a6b4200a0] (main) /[censored]/piwik/core/dispatch.php:33 [0x7f3a6b420030] (main) /[censored]/piwik/index.php:27 --- With USE_ZEND_ALLOC=0 Program received signal SIGSEGV, Segmentation fault. malloc_consolidate (av=av@entry=0x7f9a1a507b00 <main_arena>) at malloc.c:4213 4213 malloc.c: No such file or directory. (gdb) bt #0 malloc_consolidate (av=av@entry=0x7f9a1a507b00 <main_arena>) at malloc.c:4213 #1 0x00007f9a1a1e6dca in _int_malloc (av=av@entry=0x7f9a1a507b00 <main_arena>, bytes=bytes@entry=4104) at malloc.c:3488 #2 0x00007f9a1a1e8f34 in __GI___libc_malloc (bytes=4104) at malloc.c:2928 #3 0x000055dd52d39499 in __zend_malloc (len=len@entry=4104) at ./Zend/zend_alloc.c:2811 #4 0x00007f9a1655a631 in _mysqlnd_pemalloc (size=4096, persistent=<optimized out>) at ./ext/mysqlnd/mysqlnd_alloc.c:139 #5 0x00007f9a165640a8 in mysqlnd_mysqlnd_object_factory_get_prepared_statement_pub (conn=0x55dd53bad6e8, persistent=<optimized out>) at ./ext/mysqlnd/mysqlnd_driver.c:219 #6 0x00007f9a0d076514 in zif_mysqli_prepare (execute_data=<optimized out>, return_value=0x7f9a1c48c770) at ./ext/mysqli/mysqli_api.c:1862 #7 0x000055dd52e16406 in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER () at ./Zend/zend_vm_execute.h:1032 #8 execute_ex (ex=0x7f9a1a507b00 <main_arena>) at ./Zend/zend_vm_execute.h:59755 #9 0x000055dd52e1687e in zend_execute (op_array=0x55dd53a1eb30, return_value=<optimized out>) at ./Zend/zend_vm_execute.h:63763 #10 0x000055dd52d64f73 in zend_execute_scripts (type=474531584, retval=0x7f9a01487020, file_count=3) at ./Zend/zend.c:1496 #11 0x000055dd52d00048 in php_execute_script (primary_file=0x7fff8d6dd930) at ./main/main.c:2590 #12 0x000055dd52bb850a in main (argc=<optimized out>, argv=<optimized out>) at ./sapi/fpm/fpm/fpm_main.c:1966 (gdb) info locals fb = 0x7f9a1a507b08 <main_arena+8> maxfb = 0x7f9a1a507b50 <main_arena+80> p = 0xd1b00cadee4bc14c nextp = 0x55dd53be785000 unsorted_bin = 0x7f9a1a507b58 <main_arena+88> first_unsorted = <optimized out> nextchunk = 0x55dd53be521f size = 3337247791795835091 nextsize = 7074365763643912960 prevsize = 3337247791795826531 nextinuse = <optimized out> bck = <optimized out> fwd = <optimized out> (gdb) frame 1 #1 0x00007f9a1a1e6dca in _int_malloc (av=av@entry=0x7f9a1a507b00 <main_arena>, bytes=bytes@entry=4104) at malloc.c:3488 3488 in malloc.c (gdb) info locals nb = 4112 idx = 99 [others optimized out] (gdb) frame 5 (gdb) frame 5 #5 0x00007f9a165640a8 in mysqlnd_mysqlnd_object_factory_get_prepared_statement_pub (conn=0x55dd53bad6e8, persistent=<optimized out>) at ./ext/mysqlnd/mysqlnd_driver.c:219 219 ./ext/mysqlnd/mysqlnd_driver.c: No such file or directory. (gdb) info locals alloc_size = <optimized out> ret = 0x55dd53ba2eb8 stmt = 0x55dd53ba2b98 (gdb) frame 6 #6 0x00007f9a0d076514 in zif_mysqli_prepare (execute_data=<optimized out>, return_value=0x7f9a1c48c770) at ./ext/mysqli/mysqli_api.c:1862 1862 ./ext/mysqli/mysqli_api.c: No such file or directory. (gdb) info locals mysql = 0x55dd53b8f9e0 stmt = 0x55dd53ba41f0 query = 0x55dd53be2638 "SELECT * FROM piwik_user WHERE login = ?" query_len = 40 mysql_link = 0x7f9a1c48c7c0 mysqli_resource = <optimized out> -- Edit bug report at https://bugs.php.net/bug.php?id=75294&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=75294&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=75294&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=75294&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=75294&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=75294&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=75294&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=75294&r=needscript Try newer version: https://bugs.php.net/fix.php?id=75294&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=75294&r=support Expected behavior: https://bugs.php.net/fix.php?id=75294&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=75294&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=75294&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=75294&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=75294&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=75294&r=dst IIS Stability: https://bugs.php.net/fix.php?id=75294&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=75294&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=75294&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=75294&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=75294&r=mysqlcfg