Edit report at https://bugs.php.net/bug.php?id=77955&edit=1
ID: 77955
Comment by: victoria at sharksmedia dot dk
Reported by: victoria at sharksmedia dot dk
Summary: Random segmentation fault in mysqlnd from php-fpm
Status: Assigned
Type: Bug
Package: PDO MySQL
Operating System: CentOS 7.6.1810
PHP Version: 7.3.4
Assigned To: dmitry
Block user comment: N
Private report: N
New Comment:
(gdb) up
#1 mysqlnd_mysqlnd_res_meta_free_pub (meta=0x7f492977a718) at
/usr/src/debug/php-7.3.4/ext/mysqlnd/mysqlnd_result_meta.c:106
106 php_mysqlnd_free_field_metadata(fields++);
(gdb) up
#2 0x00007f49392c3daa in mysqlnd_mysqlnd_res_free_result_contents_internal_pub
(result=0x7f492977a048) at /usr/src/debug/php-7.3.4/ext/mysqlnd/mysqlnd_result.c:300
300 result->meta->m->free_metadata(result->meta);
(gdb) p result->meta
$1 = (MYSQLND_RES_METADATA *) 0x7f492977a718
(gdb) p *result->memory_pool.arena
$2 = {ptr = 0x7f492977a188 "pK,9I\177", end = 0x7f492977de80 "\001", prev = 0x0}
(gdb)
Previous Comments:
------------------------------------------------------------------------
[2019-05-07 14:20:19] dmitry@php.net
Nikita, I can't create a script to confirm your idea.
Victoria, please check this by printing data.
(gdb) up
(gdb) up
(gdb) p result->meta
(gdb) p *result->memory_pool.arena
------------------------------------------------------------------------
[2019-05-07 13:19:28] victoria at sharksmedia dot dk
(gdb) up
#1 mysqlnd_mysqlnd_res_meta_free_pub (meta=0x7f492977a718) at
/usr/src/debug/php-7.3.4/ext/mysqlnd/mysqlnd_result_meta.c:106
106 php_mysqlnd_free_field_metadata(fields++);
(gdb) p *meta
$1 = {fields = 0x7f4929401018, m = 0x7f49394e1080 <mysqlnd_mysqlnd_res_meta_methods>,
current_field = 0, field_count = 159}
(gdb) p i
$2 = <optimized out>
(gdb) p meta.fields[0]
Cannot access memory at address 0x7f4929401018
(gdb) p meta.fields[i-1]
value has been optimized out
(gdb)
------------------------------------------------------------------------
[2019-05-07 13:14:31] dmitry@php.net
Few more commands.
(gdb) up
(gdb) p *meta
(gdb) p i
(gdb) p meta.fields[0]
(gdb) p meta.fields[i-1]
Probably, "meta.fields" was somehow corrupted or used after free, but I can't guess
how this might happen just analysing sources. I need a way to reproduce this, to catch the problem.
------------------------------------------------------------------------
[2019-05-07 13:05:14] nikic@php.net
My theory here would be that we need to swap the free_result_buffer() and free_metadata() calls
inside https://github.com/php/php-src/blob/master/ext/mysqlnd/mysqlnd_result.c#L293,
because free_result_internal() will destroy the mempool, which is shared with the metadata.
Does that sound plausible Dmitry?
------------------------------------------------------------------------
[2019-05-07 12:52:02] Scott at exussum dot co dot uk
Not sure if it helps but we have a long running job which gets this same issue. It happens at a
different point each time. My guess was it was something to do with gc but not proved it.
I have 7.3 from ondrej
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=77955
--
Edit this bug report at https://bugs.php.net/bug.php?id=77955&edit=1