Bug #75633 [NEW]: In multi-threaded code, if a thread handle is reused by the OS, the app crashes

From: rperper at litespeedtech dot com Operating system: OpenSuSE PHP version: 7.2.0 Package: Reproducible crash Bug Type: Bug Bug description:In multi-threaded code, if a thread handle is reused by the OS, the app crashes Description: ------------ I am a developer at LiteSpeed Technologies and am working on a thread-capable version of the PHP module to be included in the Open-LiteSpeed web server. During load testing, our application would occasionally crash and always at the same place: at a "zend_first_try". In testing, the crash would occur just by reading the value in EG(bailout) (the first thing done by zend_first_try). After quite a bit of examination, it was determined that a thread was being created, destroyed, a new thread was created and it had the same pthread_self value. In examining TSRM.c it appears that the thread_self value is hashed to reference globals. This will fail if the thread_self value is reused (which it is by the operating system). I have recreated the problem with a test program which is included. Test script: --------------- Install in a php 7.2.0 installation in the sapi directory: https://drive.google.com/file/d/1VK7tcSq3zk-DFNF678OQSWxo03QPpmaK/view?usp=sharing Copy the tar file to that directory and extract it: tar xvf phptest.tar The instructions on how to compile and test it are in the README. But it basically comes down to running ./buildconf --force, configure and make. The crash will occur on execution of the generated phptest program. Expected result: ---------------- Either have a method to automatically detect that a pthread_self value is an actual different thread (which can be done using the syscall interface) or provide a function for us to call to clear out a thread's details when we destroy the thread. Actual result: -------------- Backtrace in gdb: #0 process_req() at /home/user/proj/phptest/php-7.2.0/sapi/phptest/phptest.c:392 #1 begin_process() at /home/user/proj/phptest/php-7.2.0/sapi/phptest/phptest.c:423 #2 thread() at /home/user/proj/phptest/php-7.2.0/sapi/phptest/phptest.c:429 #3 start_thread() at /lib64/libpthread.so.0 #4 clone() at /lib64/libc.so.6 -- Edit bug report at https://bugs.php.net/bug.php?id=75633&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=75633&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=75633&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=75633&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=75633&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=75633&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=75633&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=75633&r=needscript Try newer version: https://bugs.php.net/fix.php?id=75633&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=75633&r=support Expected behavior: https://bugs.php.net/fix.php?id=75633&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=75633&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=75633&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=75633&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=75633&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=75633&r=dst IIS Stability: https://bugs.php.net/fix.php?id=75633&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=75633&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=75633&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=75633&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=75633&r=mysqlcfg