Bug #66799 [Fbk->NoF]: Subsequent requests after opcache_reset() causes php5-fpm segfault

Edit report at https://bugs.php.net/bug.php?id=66799&edit=1 ID: 66799 Updated by: php-bugs@lists.php.net Reported by: ptr dot wang at gmail dot com Summary: Subsequent requests after opcache_reset() causes php5-fpm segfault -Status: Feedback +Status: No Feedback Type: Bug Package: opcache Operating System: Linux - Ubuntu Precise PHP Version: 5.5.9 Assigned To: cmb Private report: N New Comment: No feedback was provided. The bug is being suspended because we assume that you are no longer experiencing the problem. If this is not the case and you are able to provide the information that was requested earlier, please do so and change the status of the bug back to "Re-Opened". Thank you. Previous Comments: ------------------------------------------------------------------------ [2021-07-08 11:18:27] cmb@php.net Is this still an issue with any of the actively supported PHP versions[1]? [1] <https://www.php.net/supported-versions.php> ------------------------------------------------------------------------ [2015-01-28 19:02:07] gabe at tumblr dot com We can reproduce this at will on 5.5.19 and 5.5.21. If you throw traffic at php-fpm while opcache.fast_shutdown=1 is in opcache.ini, each call to opcache_reset() segfaults. When disabling fast_shutdown, fpm stops segfaulting. (gdb) bt full #0 zend_mm_add_to_free_list (heap=<value optimized out>, mm_block=0x1813530) at /usr/src/debug/php-5.5.21/Zend/zend_alloc.c:752 m = <value optimized out> p = <value optimized out> size = 600 index = <value optimized out> #1 0x00000000005946f2 in _zend_mm_free_int (heap=0x11ad330, p=0x1813570) at /usr/src/debug/php-5.5.21/Zend/zend_alloc.c:2118 mm_block = 0x1813530 next_block = 0x18135f8 size = 600 #2 0x00000000005c9521 in zend_hash_destroy (ht=0x9d1290) at /usr/src/debug/php-5.5.21/Zend/zend_hash.c:565 p = 0x17f4f88 q = 0x1813570 #3 0x00000000005ae113 in shutdown_executor () at /usr/src/debug/php-5.5.21/Zend/zend_execute_API.c:319 __orig_bailout = 0x7fffadd01b10 __bailout = {{__jmpbuf = {10293472, 4937089388971144863, 140393336324944, 0, 0, 0, -4937269333167851873, 4937089399494522527}, __mask_was_saved = 0, __saved_mask = {__val = {4937089253390923423, 13509474739399163904, 206845602437, 40, 5850866, 192, 5850866, 140393336564752, 44279120, 112, 10293208, 1, 140393336324944, 0, 6005774, 10293120}}}} #4 0x00000000005bc2a2 in zend_deactivate () at /usr/src/debug/php-5.5.21/Zend/zend.c:946 No locals. #5 0x000000000055c11c in php_request_shutdown (dummy=<value optimized out>) at /usr/src/debug/php-5.5.21/main/main.c:1808 report_memleaks = 1 '\001' #6 0x0000000000675159 in main (argc=<value optimized out>, argv=<value optimized out>) at /usr/src/debug/php-5.5.21/sapi/fpm/fpm/fpm_main.c:1977 primary_script = <value optimized out> __orig_bailout = 0x0 __bailout = {{__jmpbuf = {0, -4937269333980498273, 3, 0, 10271136, 0, -4937269332796655969, 4937089637171181215}, __mask_was_saved = 0, __saved_mask = {__val = {0 <repeats 14 times>, 206840036063, 0}}}} exit_status = 0 c = <value optimized out> use_extended_info = 0 file_handle = {type = ZEND_HANDLE_FILENAME, filename = 0x7fafdef0c170 "È \342\002", opened_path = 0x0, handle = {fd = -554436664, fp = 0x7fafdef3f7c8, stream = {handle = 0x7fafdef3f7c8, isatty = 0, mmap = {len = 3966, pos = 0, map = 0x0, buf = 0x7fafbd41a000 <Address 0x7fafbd41a000 out of bounds>, old_handle = 0x0, old_closer = 0}, reader = 0x5749b0 <_php_stream_read>, fsizer = 0x55c9a0 <php_zend_stream_fsizer>, closer = 0x55c990 <php_zend_stream_mmap_closer>}}, free_filename = 0 '\000'} orig_optind = 1 orig_optarg = 0x0 ini_entries_len = <value optimized out> max_requests = 800 requests = 188 fcgi_fd = 10292128 request = {listen_socket = 0, fd = -1, id = 1, keep = 0, closed = 0, in_len = 0, in_pad = 6, out_hdr = 0x0, out_pos = 0x7fffadd01ca0 "\001\006", out_buf = "<tumblr request here>..., reserved = '\000' <repeats 15 times>, env = 0x7fafdef0c040} fpm_config = 0x0 fpm_prefix = 0x0 fpm_pid = 0x7fffadd056c9 "ol POOLNAME" test_conf = 0 force_daemon = -1 php_information = 0 php_allow_to_run_as_root = 0 __func__ = "main" ------------------------------------------------------------------------ [2014-02-28 16:08:14] ptr dot wang at gmail dot com Description: ------------ PHP Packages used. ii php-apc 4.0.2-2+debphp.org~precise+1 APC User Cache for PHP 5 (transitional package) ii php-pear 5.5.9+dfsg-1+sury.org~precise+1 PEAR - PHP Extension and Application Repository ii php5 5.5.9+dfsg-1+sury.org~precise+1 server-side, HTML-embedded scripting language (metapackage) ii php5-apcu 4.0.2-2+debphp.org~precise+1 APC User Cache for PHP 5 ii php5-cli 5.5.9+dfsg-1+sury.org~precise+1 command-line interpreter for the php5 scripting language ii php5-common 5.5.9+dfsg-1+sury.org~precise+1 Common files for packages built from the php5 source ii php5-curl 5.5.9+dfsg-1+sury.org~precise+1 CURL module for php5 ii php5-dbg 5.5.9+dfsg-1+sury.org~precise+1 Debug symbols for PHP5 ii php5-dev 5.5.9+dfsg-1+sury.org~precise+1 Files for PHP5 module development ii php5-fpm 5.5.9+dfsg-1+sury.org~precise+1 server-side, HTML-embedded scripting language (FPM-CGI binary) ii php5-gd 5.5.9+dfsg-1+sury.org~precise+1 GD module for php5 ii php5-intl 5.5.9+dfsg-1+sury.org~precise+1 internationalisation module for php5 ii php5-json 1.3.2-3+debphp.org~precise+1 JSON module for php5 ii php5-pgsql 5.5.9+dfsg-1+sury.org~precise+1 PostgreSQL module for php5 ii php5-readline 5.5.9+dfsg-1+sury.org~precise+1 Readline module for php5 Opcache configs: [opcache] opcache.memory_consumption=128 opcache.interned_strings_buffer=8 opcache.max_accelerated_files=4000 opcache.revalidate_freq=60 opcache.fast_shutdown=1 PHP Modules installed: [PHP Modules] amqp apc apcu bcmath bz2 calendar Core ctype curl date dba dom ereg exif fileinfo filter ftp gd gettext hash iconv intl json libxml mbstring mhash OAuth openssl pcntl pcre PDO pdo_pgsql pgsql Phar posix readline Reflection session shmop SimpleXML soap sockets sphinx SPL standard sysvmsg sysvsem sysvshm tokenizer wddx xhprof xml xmlreader xmlwriter Zend OPcache zip zlib [Zend Modules] Zend OPcache GDB backtrace: # gdb -q /usr/sbin/php5-fpm /tmp/core-php5-fpm.33858 Reading symbols from /usr/sbin/php5-fpm...Reading symbols from /usr/lib/debug/usr/sbin/php5-fpm...done. done. [New LWP 33858] warning: Can't read pathname for load map: Input/output error. [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Core was generated by `php-fpm: pool www '. Program terminated with signal 11, Segmentation fault. #0 zend_mm_add_to_free_list (heap=<optimized out>, mm_block=0x7ffe95410288) at /build/buildd/php5-5.5.9+dfsg/Zend/zend_alloc.c:752 752 /build/buildd/php5-5.5.9+dfsg/Zend/zend_alloc.c: No such file or directory. (gdb) bt full #0 zend_mm_add_to_free_list (heap=<optimized out>, mm_block=0x7ffe95410288) at /build/buildd/php5-5.5.9+dfsg/Zend/zend_alloc.c:752 prev = 0x350b8e800 m = 9223372036854775808 p = 0x2f6102f size = 616 index = 9 #1 0x00000000006b84b0 in _zend_mm_free_int (heap=0x2aeb300, p=0x7ffe954102b8) at /build/buildd/php5-5.5.9+dfsg/Zend/zend_alloc.c:2118 mm_block = 0x7ffe95410288 next_block = 0x7ffe954103a8 size = 616 #2 0x00000000006ee78e in zend_hash_destroy (ht=0xe62550) at /build/buildd/php5-5.5.9+dfsg/Zend/zend_hash.c:565 p = 0x7ffe9533a048 q = 0x7ffe954102b8 #3 0x00000000006d0a43 in shutdown_executor () at /build/buildd/php5-5.5.9+dfsg/Zend/zend_execute_API.c:322 __orig_bailout = 0x7fffc7bcadd0 __bailout = {{__jmpbuf = {15082400, -9155287571838426016, 140731913859384, 0, 140731913856248, 48345344, 9155375864448656480, -9155287578921425824}, __mask_was_saved = 0, __saved_mask = {__val = {9291456000123053152, 0, 7268954, 15059776, 0, 140731914091208, 140728898420736, 140731914091256, 48389136, 140731408564984, 15082136, 1, 140731913859384, 0, 7204654, 15082048}}}} #4 0x00000000006e0385 in zend_deactivate () at /build/buildd/php5-5.5.9+dfsg/Zend/zend.c:935 No locals. #5 0x000000000067e5e7 in php_request_shutdown (dummy=<optimized out>) at /build/buildd/php5-5.5.9+dfsg/main/main.c:1808 report_memleaks = 1 '\001' #6 0x00000000004665c6 in main (argc=<optimized out>, argv=<optimized out>) at /build/buildd/php5-5.5.9+dfsg/sapi/fpm/fpm/fpm_main.c:1961 primary_script = <optimized out> __orig_bailout = 0x0 __bailout = {{__jmpbuf = {0, 9155375865309537376, 3, 140736544434492, 0, 4294967295, 9155375864291370080, -9155287927588150176}, __mask_was_saved = 0, __saved_mask = {__val = {0 <repeats 16 times>}}}} exit_status = 0 c = <optimized out> use_extended_info = 0 file_handle = {type = ZEND_HANDLE_MAPPED, filename = 0x7ffeb3bbf618 "\370\370\276\263\376\177", opened_path = 0x0, handle = {fd = -1279319376, fp = 0x7ffeb3bf22b0, stream = {handle = 0x7ffeb3bf22b0, isatty = 0, mmap = {len = 1806, pos = 0, map = 0x0, buf = 0x7ffeb3a57000 <Address 0x7ffeb3a57000 out of bounds>, old_handle = 0x0, old_closer = 0}, reader = 0x695e30 <_php_stream_read>, fsizer = 0x67c640 <php_zend_stream_fsizer>, closer = 0x67c630 <php_zend_stream_mmap_closer>}}, free_filename = 0 '\000'} orig_optind = 1 orig_optarg = 0x0 ini_entries_len = <optimized out> max_requests = 100 requests = 0 fcgi_fd = 15081056 request = {listen_socket = 0, fd = 6, id = 1, keep = 0, closed = 0, in_len = 0, in_pad = 3, out_hdr = 0x7fffc7bcb220, out_pos = 0x7fffc7bcb55e "", out_buf = "\000\006\000\000\000\000\000\000Cache-Control: max-age=0, private, no-cache, no-store, must-revalidate, no-transform\r\nX-XXXXXXXX-Localized: false\r\nVary: Accept-Encoding\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-H"..., reserved = '\000' <repeats 15 times>, env = 0x7ffeb3bbe2f0} fpm_config = 0x7fffc7bce93c "" fpm_prefix = 0x0 fpm_pid = 0x0 test_conf = 0 force_daemon = <optimized out> php_information = 0 php_allow_to_run_as_root = 0 __func__ = "main" (gdb) quit Test script: --------------- <?php /* PHP Script used Put this under docroot, then: curl http://mydomain/test.php, In order to get the coredump file more quickly, try to ab some other scripts in the meanwhile: ab -c9 -n99999 http://mydomain/other.php), Note: you need to make the OS generate the coredump files, do things like: 1. in the shell: ulimit -c unlimited 2. in php-fpm configs, add a line: rlimit_core = unlimited */ var_dump(opcache_reset()); Expected result: ---------------- PHP-FPM process should not segfault Actual result: -------------- PHP-FPM process segfault in the Subsequent requests after the opcache_reset() is called. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=66799&edit=1