Edit report at https://bugs.php.net/bug.php?id=81607&edit=1
ID: 81607
Comment by: mails at thomasbley dot de
Reported by: mails at thomasbley dot de
Summary: Segmentation fault for opcache.enable_cli=1
Status: Verified
Type: Bug
Package: opcache
Operating System: linux
PHP Version: 8.1.0RC5
Block user comment: N
Private report: N
New Comment:
Here is an update with 8.1.0RC6 and more debugging information:
git clone --branch=php-8.1.0RC6 --depth=1 git@github.com:php/php-src.git
cd php-src
./buildconf --force
./configure --enable-debug --without-sqlite3 --without-pdo-sqlite --enable-pcntl --enable-opcache
--enable-mbstring
make
/home/***/code/php-src/sapi/cli/php -dextension_dir=/home/***/code/php-src/modules
-dzend_extension=opcache.so -dopcache.enable_cli=1 psalm --config=psalm.xml.dist --no-cache
--threads=8
#0 0x00005640d022ee2d in php_var_unserialize_internal (rval=0x7fa1d8214940, p=0x7ffcb9318390,
max=0x7fa1d5aab2d8 "", var_hash=0x7ffcb9318398)
at ext/standard/var_unserializer.re:1271
#1 0x00005640d022d01a in php_var_unserialize (rval=0x7fa1d8214940, p=0x7ffcb9318390,
max=0x7fa1d5aab2d8 "", var_hash=0x7ffcb9318398)
at ext/standard/var_unserializer.re:831
#2 0x00005640d0218637 in php_unserialize_with_options (return_value=0x7fa1d8214940,
buf=0x7fa1d5aab298
"O:39:\"Psalm\\Internal\\Fork\\ForkTaskDoneMessage\":1:{s:4:\"data\";N;}",
buf_len=64, options=0x0,
function_name=0x5640d0cd8091 "unserialize") at
/home/***/code/php-src/ext/standard/var.c:1397
#3 0x00005640d0218af5 in zif_unserialize (execute_data=0x7fa1d8214960, return_value=0x7fa1d8214940)
at /home/***/code/php-src/ext/standard/var.c:1447
#4 0x00005640d0349faa in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER () at
/home/***/code/php-src/Zend/zend_vm_execute.h:1297
#5 0x00005640d03bcea8 in execute_ex (ex=0x7fa1d8214020) at
/home/***/code/php-src/Zend/zend_vm_execute.h:54509
#6 0x00005640d03c26d4 in zend_execute (op_array=0x7fa1d825d500, return_value=0x0) at
/home/***/code/php-src/Zend/zend_vm_execute.h:58868
#7 0x00005640d030e17b in zend_execute_scripts (type=8, retval=0x0, file_count=3) at
/home/***/code/php-src/Zend/zend.c:1761
#8 0x00005640d026b56a in php_execute_script (primary_file=0x7ffcb931ace0) at
/home/***/code/php-src/main/main.c:2534
#9 0x00005640d047e790 in do_cli (argc=8, argv=0x5640d28574f0) at
/home/***/code/php-src/sapi/cli/php_cli.c:965
#10 0x00005640d047f898 in main (argc=8, argv=0x5640d28574f0) at
/home/***/code/php-src/sapi/cli/php_cli.c:1367
#0 0x00005640d031556c in _object_and_properties_init (arg=0x7fa1d8214890,
class_type=0x657270707573006f, properties=0x0)
at /home/***/code/php-src/Zend/zend_API.c:1618
#1 0x00005640d03157c1 in object_init_ex (arg=0x7fa1d8214890, class_type=0x657270707573006f) at
/home/***/code/php-src/Zend/zend_API.c:1665
#2 0x00005640d035eccc in ZEND_NEW_SPEC_CONST_UNUSED_HANDLER () at
/home/***/code/php-src/Zend/zend_vm_execute.h:10143
#3 0x00005640d03be2ef in execute_ex (ex=0x7fa1d8214020) at
/home/***/code/php-src/Zend/zend_vm_execute.h:55412
#4 0x00005640d03c26d4 in zend_execute (op_array=0x7fa1d825d500, return_value=0x0) at
/home/***/code/php-src/Zend/zend_vm_execute.h:58868
#5 0x00005640d030e17b in zend_execute_scripts (type=8, retval=0x0, file_count=3) at
/home/***/code/php-src/Zend/zend.c:1761
#6 0x00005640d026b56a in php_execute_script (primary_file=0x7ffcb931ace0) at
/home/***/code/php-src/main/main.c:2534
#7 0x00005640d047e790 in do_cli (argc=8, argv=0x5640d28574f0) at
/home/***/code/php-src/sapi/cli/php_cli.c:965
#8 0x00005640d047f898 in main (argc=8, argv=0x5640d28574f0) at
/home/***/code/php-src/sapi/cli/php_cli.c:1367
#0 0x00005640d031556c in _object_and_properties_init (arg=0x7fa1d8214890,
class_type=0x657270707573006f, properties=0x0)
at /home/***/code/php-src/Zend/zend_API.c:1618
#1 0x00005640d03157c1 in object_init_ex (arg=0x7fa1d8214890, class_type=0x657270707573006f) at
/home/***/code/php-src/Zend/zend_API.c:1665
#2 0x00005640d035eccc in ZEND_NEW_SPEC_CONST_UNUSED_HANDLER () at
/home/***/code/php-src/Zend/zend_vm_execute.h:10143
#3 0x00005640d03be2ef in execute_ex (ex=0x7fa1d8214020) at
/home/***/code/php-src/Zend/zend_vm_execute.h:55412
#4 0x00005640d03c26d4 in zend_execute (op_array=0x7fa1d825d500, return_value=0x0) at
/home/***/code/php-src/Zend/zend_vm_execute.h:58868
#5 0x00005640d030e17b in zend_execute_scripts (type=8, retval=0x0, file_count=3) at
/home/***/code/php-src/Zend/zend.c:1761
#6 0x00005640d026b56a in php_execute_script (primary_file=0x7ffcb931ace0) at
/home/***/code/php-src/main/main.c:2534
#7 0x00005640d047e790 in do_cli (argc=8, argv=0x5640d28574f0) at
/home/***/code/php-src/sapi/cli/php_cli.c:965
#8 0x00005640d047f898 in main (argc=8, argv=0x5640d28574f0) at
/home/***/code/php-src/sapi/cli/php_cli.c:1367
#0 0x00005640d031556c in _object_and_properties_init (arg=0x7fa1d8214890,
class_type=0x657270707573006f, properties=0x0)
at /home/***/code/php-src/Zend/zend_API.c:1618
#1 0x00005640d03157c1 in object_init_ex (arg=0x7fa1d8214890, class_type=0x657270707573006f) at
/home/***/code/php-src/Zend/zend_API.c:1665
#2 0x00005640d035eccc in ZEND_NEW_SPEC_CONST_UNUSED_HANDLER () at
/home/***/code/php-src/Zend/zend_vm_execute.h:10143
#3 0x00005640d03be2ef in execute_ex (ex=0x7fa1d8214020) at
/home/***/code/php-src/Zend/zend_vm_execute.h:55412
#4 0x00005640d03c26d4 in zend_execute (op_array=0x7fa1d825d500, return_value=0x0) at
/home/***/code/php-src/Zend/zend_vm_execute.h:58868
#5 0x00005640d030e17b in zend_execute_scripts (type=8, retval=0x0, file_count=3) at
/home/***/code/php-src/Zend/zend.c:1761
#6 0x00005640d026b56a in php_execute_script (primary_file=0x7ffcb931ace0) at
/home/***/code/php-src/main/main.c:2534
#7 0x00005640d047e790 in do_cli (argc=8, argv=0x5640d28574f0) at
/home/***/code/php-src/sapi/cli/php_cli.c:965
#8 0x00005640d047f898 in main (argc=8, argv=0x5640d28574f0) at
/home/***/code/php-src/sapi/cli/php_cli.c:1367
/home/***/code/php-src/sapi/cli/php -e -dextension_dir=/home/***/code/php-src/modules
-dzend_extension=opcache.so -dopcache.enable_cli=1 psalm --config=psalm.xml.dist --no-cache
--threads=8
#0 zend_update_class_constants (class_type=0x55597c8bbec0) at
/home/***/code/php-src/Zend/zend_API.c:1384
#1 0x000055597a574693 in _object_and_properties_init (arg=0x7f82a8a14940,
class_type=0x55597c8bbec0, properties=0x0)
at /home/***/code/php-src/Zend/zend_API.c:1634
#2 0x000055597a5747c1 in object_init_ex (arg=0x7f82a8a14940, class_type=0x55597c8bbec0) at
/home/***/code/php-src/Zend/zend_API.c:1665
#3 0x000055597a48e09b in php_var_unserialize_internal (rval=0x7f82a8a14940, p=0x7ffd7e5b1a60,
max=0x7f82a62d52d8 "", var_hash=0x7ffd7e5b1a68)
at ext/standard/var_unserializer.re:1316
#4 0x000055597a48c01a in php_var_unserialize (rval=0x7f82a8a14940, p=0x7ffd7e5b1a60,
max=0x7f82a62d52d8 "", var_hash=0x7ffd7e5b1a68)
at ext/standard/var_unserializer.re:831
#5 0x000055597a477637 in php_unserialize_with_options (return_value=0x7f82a8a14940,
buf=0x7f82a62d5298
"O:39:\"Psalm\\Internal\\Fork\\ForkTaskDoneMessage\":1:{s:4:\"data\";N;}",
buf_len=64, options=0x0,
function_name=0x55597af37091 "unserialize") at
/home/***/code/php-src/ext/standard/var.c:1397
#6 0x000055597a477af5 in zif_unserialize (execute_data=0x7f82a8a14960, return_value=0x7f82a8a14940)
at /home/***/code/php-src/ext/standard/var.c:1447
#7 0x000055597a5a8faa in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER () at
/home/***/code/php-src/Zend/zend_vm_execute.h:1297
#8 0x000055597a61bea8 in execute_ex (ex=0x7f82a8a14020) at
/home/***/code/php-src/Zend/zend_vm_execute.h:54509
#9 0x000055597a6216d4 in zend_execute (op_array=0x7f82a8a5d280, return_value=0x0) at
/home/***/code/php-src/Zend/zend_vm_execute.h:58868
#10 0x000055597a56d17b in zend_execute_scripts (type=8, retval=0x0, file_count=3) at
/home/***/code/php-src/Zend/zend.c:1761
#11 0x000055597a4ca56a in php_execute_script (primary_file=0x7ffd7e5b43b0) at
/home/***/code/php-src/main/main.c:2534
#12 0x000055597a6dd790 in do_cli (argc=9, argv=0x55597c6d94f0) at
/home/***/code/php-src/sapi/cli/php_cli.c:965
#13 0x000055597a6de898 in main (argc=9, argv=0x55597c6d94f0) at
/home/***/code/php-src/sapi/cli/php_cli.c:1367
#0 zend_update_class_constants (class_type=0x55597c8bbec0) at
/home/***/code/php-src/Zend/zend_API.c:1384
#1 0x000055597a574693 in _object_and_properties_init (arg=0x7f82a8a14890,
class_type=0x55597c8bbec0, properties=0x0)
at /home/***/code/php-src/Zend/zend_API.c:1634
#2 0x000055597a5747c1 in object_init_ex (arg=0x7f82a8a14890, class_type=0x55597c8bbec0) at
/home/***/code/php-src/Zend/zend_API.c:1665
#3 0x000055597a5bdccc in ZEND_NEW_SPEC_CONST_UNUSED_HANDLER () at
/home/***/code/php-src/Zend/zend_vm_execute.h:10143
#4 0x000055597a61d2ef in execute_ex (ex=0x7f82a8a14020) at
/home/***/code/php-src/Zend/zend_vm_execute.h:55412
#5 0x000055597a6216d4 in zend_execute (op_array=0x7f82a8a5d280, return_value=0x0) at
/home/***/code/php-src/Zend/zend_vm_execute.h:58868
#6 0x000055597a56d17b in zend_execute_scripts (type=8, retval=0x0, file_count=3) at
/home/***/code/php-src/Zend/zend.c:1761
#7 0x000055597a4ca56a in php_execute_script (primary_file=0x7ffd7e5b43b0) at
/home/***/code/php-src/main/main.c:2534
#8 0x000055597a6dd790 in do_cli (argc=9, argv=0x55597c6d94f0) at
/home/***/code/php-src/sapi/cli/php_cli.c:965
#9 0x000055597a6de898 in main (argc=9, argv=0x55597c6d94f0) at
/home/***/code/php-src/sapi/cli/php_cli.c:1367
#0 zend_update_class_constants (class_type=0x55597c8bbec0) at
/home/***/code/php-src/Zend/zend_API.c:1384
#1 0x000055597a574693 in _object_and_properties_init (arg=0x7f82a8a14890,
class_type=0x55597c8bbec0, properties=0x0)
at /home/***/code/php-src/Zend/zend_API.c:1634
#2 0x000055597a5747c1 in object_init_ex (arg=0x7f82a8a14890, class_type=0x55597c8bbec0) at
/home/***/code/php-src/Zend/zend_API.c:1665
#3 0x000055597a5bdccc in ZEND_NEW_SPEC_CONST_UNUSED_HANDLER () at
/home/***/code/php-src/Zend/zend_vm_execute.h:10143
#4 0x000055597a61d2ef in execute_ex (ex=0x7f82a8a14020) at
/home/***/code/php-src/Zend/zend_vm_execute.h:55412
#5 0x000055597a6216d4 in zend_execute (op_array=0x7f82a8a5d280, return_value=0x0) at
/home/***/code/php-src/Zend/zend_vm_execute.h:58868
#6 0x000055597a56d17b in zend_execute_scripts (type=8, retval=0x0, file_count=3) at
/home/***/code/php-src/Zend/zend.c:1761
#7 0x000055597a4ca56a in php_execute_script (primary_file=0x7ffd7e5b43b0) at
/home/***/code/php-src/main/main.c:2534
#8 0x000055597a6dd790 in do_cli (argc=9, argv=0x55597c6d94f0) at
/home/***/code/php-src/sapi/cli/php_cli.c:965
#9 0x000055597a6de898 in main (argc=9, argv=0x55597c6d94f0) at
/home/***/code/php-src/sapi/cli/php_cli.c:1367
#0 zend_update_class_constants (class_type=0x55597c8bbec0) at
/home/***/code/php-src/Zend/zend_API.c:1384
#1 0x000055597a574693 in _object_and_properties_init (arg=0x7f82a8a14890,
class_type=0x55597c8bbec0, properties=0x0)
at /home/***/code/php-src/Zend/zend_API.c:1634
#2 0x000055597a5747c1 in object_init_ex (arg=0x7f82a8a14890, class_type=0x55597c8bbec0) at
/home/***/code/php-src/Zend/zend_API.c:1665
#3 0x000055597a5bdccc in ZEND_NEW_SPEC_CONST_UNUSED_HANDLER () at
/home/***/code/php-src/Zend/zend_vm_execute.h:10143
#4 0x000055597a61d2ef in execute_ex (ex=0x7f82a8a14020) at
/home/***/code/php-src/Zend/zend_vm_execute.h:55412
#5 0x000055597a6216d4 in zend_execute (op_array=0x7f82a8a5d280, return_value=0x0) at
/home/***/code/php-src/Zend/zend_vm_execute.h:58868
#6 0x000055597a56d17b in zend_execute_scripts (type=8, retval=0x0, file_count=3) at
/home/***/code/php-src/Zend/zend.c:1761
#7 0x000055597a4ca56a in php_execute_script (primary_file=0x7ffd7e5b43b0) at
/home/***/code/php-src/main/main.c:2534
#8 0x000055597a6dd790 in do_cli (argc=9, argv=0x55597c6d94f0) at
/home/***/code/php-src/sapi/cli/php_cli.c:965
#9 0x000055597a6de898 in main (argc=9, argv=0x55597c6d94f0) at
/home/***/code/php-src/sapi/cli/php_cli.c:1367
#0 zend_update_class_constants (class_type=0x55597c89a730) at
/home/***/code/php-src/Zend/zend_API.c:1384
#1 0x000055597a574693 in _object_and_properties_init (arg=0x7f82a8a151f0,
class_type=0x55597c89a730, properties=0x0)
at /home/***/code/php-src/Zend/zend_API.c:1634
#2 0x000055597a5747c1 in object_init_ex (arg=0x7f82a8a151f0, class_type=0x55597c89a730) at
/home/***/code/php-src/Zend/zend_API.c:1665
#3 0x000055597a5bdccc in ZEND_NEW_SPEC_CONST_UNUSED_HANDLER () at
/home/***/code/php-src/Zend/zend_vm_execute.h:10143
#4 0x000055597a61d2ef in execute_ex (ex=0x7f82a8a14020) at
/home/***/code/php-src/Zend/zend_vm_execute.h:55412
#5 0x000055597a6216d4 in zend_execute (op_array=0x7f82a8a5d280, return_value=0x0) at
/home/***/code/php-src/Zend/zend_vm_execute.h:58868
#6 0x000055597a56d17b in zend_execute_scripts (type=8, retval=0x0, file_count=3) at
/home/***/code/php-src/Zend/zend.c:1761
#7 0x000055597a4ca56a in php_execute_script (primary_file=0x7ffd7e5b43b0) at
/home/***/code/php-src/main/main.c:2534
#8 0x000055597a6dd790 in do_cli (argc=9, argv=0x55597c6d94f0) at
/home/***/code/php-src/sapi/cli/php_cli.c:965
#9 0x000055597a6de898 in main (argc=9, argv=0x55597c6d94f0) at
/home/***/code/php-src/sapi/cli/php_cli.c:1367
Previous Comments:
------------------------------------------------------------------------
[2021-11-11 15:57:35] nikic@php.net
Here's a small reproducer:
<?php
// Create a SHM interned string for FooBar.
var_dump("FooBar");
$pid = pcntl_fork();
if ($pid == 0) {
// Child: Declare class FooBar {} to allocate CE cache slot.
require __DIR__ . '/t480_2.php';
} else if ($pid > 0) {
pcntl_wait($status);
var_dump(new FooBar); // Crash.
} else {
echo "pcntl_fork() failed\n";
}
t480_2.php:
<?php
class FooBar {}
------------------------------------------------------------------------
[2021-11-11 15:51:59] nikic@php.net
I believe this is a suspected issue where one process allocates a new map ptr slot on an existing
shm interned string and another tries to use it with a too small map ptr segment.
At least the ce cache slot seems to be one past the end of the map ptr segment.
------------------------------------------------------------------------
[2021-11-11 15:44:23] nikic@php.net
Can at least confirm the segfault. The class entry read from CE cache is corrupted.
------------------------------------------------------------------------
[2021-11-11 13:17:02] mails at thomasbley dot de
seems this code causes the segfault:
./src/Psalm/Internal/Fork/Pool.php:352
$message = unserialize(base64_decode($serialized_message, true));
data is:
O:39:"Psalm\Internal\Fork\ForkTaskDoneMessage":1:{s:4:"data";N;}
interface ForkMessage
{
}
class ForkTaskDoneMessage implements ForkMessage
{
/** @var mixed */
public $data;
/**
* @param mixed $data
*/
public function __construct($data)
{
$this->data = $data;
}
}
------------------------------------------------------------------------
[2021-11-11 12:54:53] mails at thomasbley dot de
yes
core-php.27635
#0 0x0000557656c14b67 in ?? ()
#1 0x0000557656c164fe in php_var_unserialize ()
#2 0x0000557656c0520a in php_unserialize_with_options ()
#3 0x0000557656c05457 in ?? ()
#4 0x0000557656cf4081 in execute_ex ()
#5 0x0000557656cfa24d in zend_execute ()
#6 0x0000557656c8b615 in zend_execute_scripts ()
#7 0x0000557656c288ca in php_execute_script ()
#8 0x0000557656d72e1e in ?? ()
#9 0x0000557656acdea8 in ?? ()
#10 0x00007f61a2a310b3 in __libc_start_main (main=0x557656acdaa0, argc=6, argv=0x7ffd37a1c568,
init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>,
stack_end=0x7ffd37a1c558) at ../csu/libc-start.c:308
#11 0x0000557656ace04e in _start ()
core-php.27636
#0 0x0000557656c81cc4 in instanceof_function_slow ()
#1 0x0000557656cadcfa in ?? ()
#2 0x0000557656cf29f6 in execute_ex ()
#3 0x0000557656cfa24d in zend_execute ()
#4 0x0000557656c8b615 in zend_execute_scripts ()
#5 0x0000557656c288ca in php_execute_script ()
#6 0x0000557656d72e1e in ?? ()
#7 0x0000557656acdea8 in ?? ()
#8 0x00007f61a2a310b3 in __libc_start_main (main=0x557656acdaa0, argc=6, argv=0x7ffd37a1c568,
init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>,
stack_end=0x7ffd37a1c558) at ../csu/libc-start.c:308
#9 0x0000557656ace04e in _start ()
core-php.27637
#0 0x0000557656c8dc74 in object_init_ex ()
#1 0x0000557656cc8495 in ?? ()
#2 0x0000557656cf147d in execute_ex ()
#3 0x0000557656cfa24d in zend_execute ()
#4 0x0000557656c8b615 in zend_execute_scripts ()
#5 0x0000557656c288ca in php_execute_script ()
#6 0x0000557656d72e1e in ?? ()
#7 0x0000557656acdea8 in ?? ()
#8 0x00007f61a2a310b3 in __libc_start_main (main=0x557656acdaa0, argc=6, argv=0x7ffd37a1c568,
init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>,
stack_end=0x7ffd37a1c558) at ../csu/libc-start.c:308
#9 0x0000557656ace04e in _start ()
core-php.27638
#0 0x0000557656c8dc74 in object_init_ex ()
#1 0x0000557656cc8495 in ?? ()
#2 0x0000557656cf147d in execute_ex ()
#3 0x0000557656cfa24d in zend_execute ()
#4 0x0000557656c8b615 in zend_execute_scripts ()
#5 0x0000557656c288ca in php_execute_script ()
#6 0x0000557656d72e1e in ?? ()
#7 0x0000557656acdea8 in ?? ()
#8 0x00007f61a2a310b3 in __libc_start_main (main=0x557656acdaa0, argc=6, argv=0x7ffd37a1c568,
init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>,
stack_end=0x7ffd37a1c558) at ../csu/libc-start.c:308
#9 0x0000557656ace04e in _start ()
core-php.27639
#0 0x0000557656c8dc74 in object_init_ex ()
#1 0x0000557656cc8495 in ?? ()
#2 0x0000557656cf147d in execute_ex ()
#3 0x0000557656cfa24d in zend_execute ()
#4 0x0000557656c8b615 in zend_execute_scripts ()
#5 0x0000557656c288ca in php_execute_script ()
#6 0x0000557656d72e1e in ?? ()
#7 0x0000557656acdea8 in ?? ()
#8 0x00007f61a2a310b3 in __libc_start_main (main=0x557656acdaa0, argc=6, argv=0x7ffd37a1c568,
init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>,
stack_end=0x7ffd37a1c558) at ../csu/libc-start.c:308
#9 0x0000557656ace04e in _start ()
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=81607
--
Edit this bug report at https://bugs.php.net/bug.php?id=81607&edit=1