Bug #75601 [Ver->Csd]: Thread race in PCRE JIT support

Edit report at https://bugs.php.net/bug.php?id=75601&edit=1 ID: 75601 Updated by: ab@php.net Reported by: rperper at litespeedtech dot com Summary: Thread race in PCRE JIT support -Status: Verified +Status: Closed Type: Bug Package: PCRE related Operating System: OpenSuSE PHP Version: 7.2.0 Assigned To: ab Block user comment: N Private report: N New Comment: Automatic comment on behalf of ab Revision: http://git.php.net/?p=php-src.git;a=commit;h=31b2b14a712f9a8e6beddec4522e12484259422b Log: Fixed bug #75601 Thread race in PCRE JIT support Previous Comments: ------------------------------------------------------------------------ [2017-11-30 20:08:18] ab@php.net Confirmed. What is merely needed is to mutex protect the jit stack allocation, patching the bundled library is not needed. If you have a patch for this, please attach, otherwise i'm going to work on a fix next days. Thanks. ------------------------------------------------------------------------ [2017-11-30 14:23:12] rperper at litespeedtech dot com Description: ------------ I am a developer at LiteSpeed Technologies and am working on a thread-capable version of the PHP module to be included in the Open-LiteSpeed web server. During load testing, using PCRE with JIT support enabled (the default) with the thread-sanitizer enabled, we detected a race condition in sljitUtils.c line 224. It appears that there are unprotected globals which will never be successful in a multi-threaded environment. We recommend protecting these globals with atomic functions, or in some other way to avoid the race conditions. Test script: --------------- Can not be reproduced in a script. Actual result: -------------- WARNING: ThreadSanitizer: data race (pid=49992)  Read of size 8 at 0x7ffff4de1798 by thread T2 (mutexes: write M546):  #0 sljit_allocate_stack /home/user/proj/openlitespeed/src/modules/mod_lsphp/php-7.2/ext/pcre/pcrelib/sljit/sljitUtils.c:224 (mod_lsphp72.so+0x000000323c2f) #1 php_pcre_jit_stack_alloc /home/user/proj/openlitespeed/src/modules/mod_lsphp/php-7.2/ext/pcre/pcrelib/pcre_jit_compile.c:11625 (mod_lsphp72.so+0x000000323b9f) #2 zm_activate_pcre /home/user/proj/openlitespeed/src/modules/mod_lsphp/php-7.2/ext/pcre/php_pcre.c:229 (mod_lsphp72.so+0x00000037f31b) #3 zend_activate_modules /home/user/proj/openlitespeed/src/modules/mod_lsphp/php-7.2/Zend/zend_API.c:2600 (mod_lsphp72.so+0x0000012ebfab) #4 php_request_startup /home/user/proj/openlitespeed/src/modules/mod_lsphp/php-7.2/main/main.c:1696 (mod_lsphp72.so+0x0000010c528e) #5 lsiapi_module_main /home/user/proj/openlitespeed/src/modules/mod_lsphp/php-7.2/sapi/mod_lsphp/mod_lsphp.c:1489 (mod_lsphp72.so+0x000001586250) #6 process_req /home/user/proj/openlitespeed/src/modules/mod_lsphp/php-7.2/sapi/mod_lsphp/mod_lsphp.c:1536 (mod_lsphp72.so+0x0000015847c5) #7 mod_lsphp_begin_process /home/user/proj/openlitespeed/src/modules/mod_lsphp/php-7.2/sapi/mod_lsphp/mod_lsphp.c:1667 (mod_lsphp72.so+0x00000157f3a0) #8 MtHandlerProcess(ls_lfnodei_s*) /home/user/proj/openlitespeed/src/lsiapi/modulehandler.cpp:46 (openlitespeed+0x00000088ced5) #9 WorkCrew::workerRoutine(CrewWorker*) /home/user/proj/openlitespeed/src/thread/workcrew.cpp:448 (openlitespeed+0x000000944a11) #10 CrewWorker::thr_main(void*) /home/user/proj/openlitespeed/src/thread/crewworker.cpp:36 (openlitespeed+0x00000094531e) #11 Thread::start_routine(void*) /home/user/proj/openlitespeed/src/thread/thread.cpp:43 (openlitespeed+0x000000942657) ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=75601&edit=1