Bug #79252 [Opn->Csd]: preloading causes php-fpm to segfault during exit

Edit report at https://bugs.php.net/bug.php?id=79252&edit=1 ID: 79252 Updated by: nikic@php.net Reported by: jakub at tuenti dot com Summary: preloading causes php-fpm to segfault during exit -Status: Open +Status: Closed Type: Bug Package: opcache Operating System: Linux PHP Version: 7.4.3RC1 Block user comment: N Private report: N New Comment: Automatic comment on behalf of nikita.ppv@gmail.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=30ee3f48d4046c48314ad4b6953dbaf54337fe6c Log: Fixed bug #79252 Previous Comments: ------------------------------------------------------------------------ [2020-02-24 15:22:01] nikic@php.net This patch seems to fix it: diff --git a/ext/opcache/ZendAccelerator.c b/ext/opcache/ZendAccelerator.c index c7d73a999a..0c8722418c 100644 --- a/ext/opcache/ZendAccelerator.c +++ b/ext/opcache/ZendAccelerator.c @@ -4233,9 +4233,11 @@ static void preload_load(void) EG(persistent_classes_count) = EG(class_table)->nNumUsed; } if (CG(map_ptr_last) != ZCSG(map_ptr_last)) { + size_t old_map_ptr_last = CG(map_ptr_last); CG(map_ptr_last) = ZCSG(map_ptr_last); CG(map_ptr_size) = ZEND_MM_ALIGNED_SIZE_EX(CG(map_ptr_last) + 1, 4096); CG(map_ptr_base) = perealloc(CG(map_ptr_base), CG(map_ptr_size) * sizeof(void*), 1); + memset(CG(map_ptr_base) + old_map_ptr_last, 0, (CG(map_ptr_last) - old_map_ptr_last) * sizeof(void *)); } } I assume the problem is that the relevant process does not execute a PHP request, as such never goes through zend_active and as such never initializes the map region. Not positive on this being the right fix though, also wondering if it's fine to just zero the whole map area there. ------------------------------------------------------------------------ [2020-02-24 14:48:26] nikic@php.net I see... I can reproduce the issue when running php-fpm under root. Annoyingly running CLI server under root is not sufficient. ------------------------------------------------------------------------ [2020-02-24 14:30:22] jakub at tuenti dot com I also noted that when running the daemon with -D (daemonize), the daemon starts but the command that started the daemon segfaults (maybe because it also does the cleanup before exit?), so it should be easier to trace this way since you don't need to do the Ctrl+C: $ docker run --rm -i -v $PWD/preload.php:/preload.php -v $PWD/test.php:/test.php php:7.4.3-fpm php-fpm -D -dzend_extension=opcache -dopcache.enabled=1 -dopcache.preload=/preload.php -dopcache.preload_user=root; echo $? [24-Feb-2020 14:30:03] NOTICE: fpm is running, pid 9 [24-Feb-2020 14:30:03] NOTICE: ready to handle connections 139 ------------------------------------------------------------------------ [2020-02-24 14:23:51] jakub at tuenti dot com It should be reproduceable by starting the official image with those two files, then running php-fpm and pressing Ctrl+C to make it exit. $ docker run --rm -ti -v $PWD/preload.php:/preload.php -v $PWD/test.php:/test.php php:7.4.3-fpm bash root@7820c56cbbda:/var/www/html# php-fpm -dzend_extension=opcache -dopcache.enabled=1 -dopcache.preload=/preload.php -dopcache.preload_user=root [24-Feb-2020 14:17:16] NOTICE: fpm is running, pid 7 [24-Feb-2020 14:17:16] NOTICE: ready to handle connections ^C[24-Feb-2020 14:17:18] NOTICE: Terminating ... [24-Feb-2020 14:17:18] NOTICE: exiting, bye-bye! Segmentation fault (core dumped) Note that you need to have the preload.php and test.php files in the folder where you run the command. In this next example (running the command and then pressing Ctrl+C) the "Segmentation fault" message doesn't appear, but the exit code is the segfault one (139), so it was probably just hidden by Docker: $ docker run --rm -i -v $PWD/preload.php:/preload.php -v $PWD/test.php:/test.php php:7.4.3-fpm php-fpm -dzend_extension=opcache -dopcache.enabled=1 -dopcache.preload=/preload.php -dopcache.preload_user=root; echo $? [24-Feb-2020 14:18:06] NOTICE: fpm is running, pid 1 [24-Feb-2020 14:18:06] NOTICE: ready to handle connections ^C[24-Feb-2020 14:18:06] NOTICE: Terminating ... [24-Feb-2020 14:18:06] NOTICE: exiting, bye-bye! 139 ------------------------------------------------------------------------ [2020-02-24 12:14:43] nikic@php.net Can't reproduce this with FPM either. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=79252 -- Edit this bug report at https://bugs.php.net/bug.php?id=79252&edit=1