Bug #75882 [Opn]: a simple way for segfaults in threadsafe php just with configuration

Edit report at https://bugs.php.net/bug.php?id=75882&edit=1 ID: 75882 Updated by: ab@php.net Reported by: hajo dot locke at gmx dot de Summary: a simple way for segfaults in threadsafe php just with configuration Status: Open Type: Bug Package: Apache2 related Operating System: Ubuntu 16.04 PHP Version: 7.2.1 Block user comment: N Private report: N New Comment: Thanks for more info. I can now reproduce the crash and investigating a way to fix. Btw., the configuration misses "AllowOverride all". That might might be also a temp solution for you, as "AllowOverride none" is viable in your situation. Thanks. Previous Comments: ------------------------------------------------------------------------ [2018-01-29 09:59:52] hajo dot locke at gmx dot de I was not able to get a core-file. I followed alternative way and started httpd within gdb by: gdb /usr/sbin/httpd run -X I started the requests and got this: [Thread 0x7fffc96c1700 (LWP 29479) exited] Thread 52 "httpd" received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fffbe7f4700 (LWP 29493)] 0x00007ffff12aca38 in _efree () from /usr/lib/apache2/modules/libphp70.so (gdb) bt #0 0x00007ffff12aca38 in _efree () from /usr/lib/apache2/modules/libphp70.so #1 0x00007ffff13066e9 in ?? () from /usr/lib/apache2/modules/libphp70.so #2 0x00007ffff130b1fa in zend_hash_destroy () from /usr/lib/apache2/modules/libphp70.so #3 0x00007ffff13f8bc9 in ?? () from /usr/lib/apache2/modules/libphp70.so #4 0x00007ffff7728e3e in apr_pool_destroy () from /usr/lib/x86_64-linux-gnu/libapr-1.so.0 #5 0x00007ffff26ededc in ?? () from /usr/lib/apache2/modules/mod_http2.so #6 0x00007ffff26ee067 in ?? () from /usr/lib/apache2/modules/mod_http2.so #7 0x00007ffff270c82b in ?? () from /usr/lib/apache2/modules/mod_http2.so #8 0x00007ffff26f9e12 in ?? () from /usr/lib/apache2/modules/mod_http2.so #9 0x00007ffff771fb76 in apr_hash_do () from /usr/lib/x86_64-linux-gnu/libapr-1.so.0 #10 0x00007ffff270e1ef in ?? () from /usr/lib/apache2/modules/mod_http2.so #11 0x00007ffff26fbafb in ?? () from /usr/lib/apache2/modules/mod_http2.so #12 0x00007ffff2704d33 in ?? () from /usr/lib/apache2/modules/mod_http2.so #13 0x00007ffff26f175e in ?? () from /usr/lib/apache2/modules/mod_http2.so #14 0x00007ffff26f7cb1 in ?? () from /usr/lib/apache2/modules/mod_http2.so #15 0x00005555555b6fc0 in ap_run_process_connection () #16 0x00007ffff1a64038 in ?? () from /usr/lib/apache2/modules/mod_mpm_event.so #17 0x00007ffff1a64a1d in ?? () from /usr/lib/apache2/modules/mod_mpm_event.so #18 0x00007ffff74f86ba in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0 #19 0x00007ffff722e41d in clone () from /lib/x86_64-linux-gnu/libc.so.6 (gdb) If i remove libphp7.so from Apache, no error is happen. This is my VHost-Config. I run this tests with http2-Configuration, but should not make any difference. <IfModule mod_ssl.c> NameVirtualHost *:443 SSLStrictSNIVHostCheck off <VirtualHost *:443> Serveradmin webmaster@example.com ServerName example.com DocumentRoot /public_html php_value memory_limit 55M ScriptAlias /cgi-bin/ "/public_html/cgi-bin/" ScriptAlias /cgi-fpm/ "/public_html/myuser" SSLEngine on SSLCertificateFile /etc/mycerts/mycert.pem SSLCertificateKeyFile /etc/mycerts/mycert.pem SSLCACertificateFile /etc/mycerts/mycert.pem SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire SetEnvIf User-Agent ".*MSIE.*" \ nokeepalive ssl-unclean-shutdown \ downgrade-1.0 force-response-1.0 <IfModule http2_module> Protocols h2 http/1.1 </IfModule> </VirtualHost> </IfModule> ------------------------------------------------------------------------ [2018-01-29 08:59:06] ab@php.net Thank you for this bug report. To properly diagnose the problem, we need a backtrace to see what is happening behind the scenes. To find out how to generate a backtrace, please read http://bugs.php.net/bugs-generating-backtrace.php for *NIX and http://bugs.php.net/bugs-generating-backtrace-win32.php for Win32 Once you have generated a backtrace, please submit it to this bug report and change the status back to "Open". Thank you for helping us make PHP better. ------------------------------------------------------------------------ [2018-01-29 08:58:22] ab@php.net Thanks for the report. As discussed on the ML, this quick description didn't reproduce any crash. Please put - the backtrace you receive - the concrete configuration reproducing the crash Thanks. ------------------------------------------------------------------------ [2018-01-29 08:02:36] hajo dot locke at gmx dot de Description: ------------ This is a easy way to have massive segfaults in threadsafe php, just without code, only configuration is needed. - compile a minimal threadsafe libphp7.so and enable thread safety ./configure --disable-all --enable-static --prefix=/usr --with-apxs2=/usr/bin/apxs2 --enable-maintainer-zts - just load this libphp7.so into apache2. no further configuration needed. LoadModule php7_module /usr/lib/apache2/modules/libphp7.so - activate a threadsafe mpm in apache like mpm_worker/mpm_event a2enmod mpm_event - add a php_value directive in VHost-Config for this particular VHost along with a php_value directive in .htaccess in docroot of this VHost. It is not needed to request a php-file, just requesting a small static file is enough. The smaller the requested file and higher requests per second the higher is count of segfaults. you can do some mass-requests with ab from apache2-utils or h2load. Test script: --------------- none Expected result: ---------------- i expect to have no segfaults and every single request should be served fine. Actual result: -------------- You will see massive segfaults and failed requests. threadsafe php is currently not able to edit environment of each request safely. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=75882&edit=1