Bug #16492: php_passthru_fd() which uses mmap() crashes machine

From: fuf@mobil.cz Operating system: linux 2.2.x, 2.4.x PHP version: 4.1.2 PHP Bug Type: Reproducible crash Bug description: php_passthru_fd() which uses mmap() crashes machine hello, short: function fd_passthru_fd() which uses the mmap() function to read a file contents crashes the whole machine after 2 days of heavy use. with #undef HAVE_MMAP the machine is rock solid. long: we have a dual cpu download server that uses apache and a php script to control access to files. the script first checks whether the user is allowed to download a desired file and then sends it to the user with the use of function readfile(). however with HAVE_MMAP = 1 and thus a different code in php_passthru_fd() the server crashed repeatedly with this kernel message: Oops: 0000 CPU: 1 EIP: 0010:[kmem_cache_free+64/436] EFLAGS: 00010086 eax: d7fff020 ebx: d7fff020 ecx: 7dd3035c edx: cd76e95c esi: cd76e920 edi: 00000292 ebp: d7fff260 esp: d7fe1f1c ds: 0018 es: 0018 ss: 0018 Process kswapd (pid: 4, process nr: 5, stackpage=d7fe1000) Stack: ce32c000 d7fff260 00000000 c036e6e0 c0100018 00000202 ffffff09 c0126dda 00000010 c0125cdc d7fff020 cd76e920 d7fe0000 c0125cc7 d7fe0000 00000020 d7fe02c5 00000030 c036e3e8 c0120bff 00000010 d7fff268 c0266fc0 00000000 Call Trace: [startup_32+24/169] [__free_pages+282/356] [kmem_cache_reap+684/744] [kmem_cache_reap+663/744] [ shrink_mmap+139/476] [try_to_free_pages+108/260] [tvecs+6062/13120] [tvecs+6062/13120] [kswapd+106/160] [kswapd+82/160] [kernel_thread+31/56] [kernel_thread+40/56] Code: 8b 41 08 3d 2b 2f c3 a5 0f 85 ee 00 00 00 8b 41 0c 85 c0 74 after having #undef'ed HAVE_MMAP the machine runs all okay (even under much heavier load). i'm not sure whether this is a php or kernel related bug, but i guess you'd be interested. thanks, Michal Vitecek -- Edit bug report at http://bugs.php.net/?id=16492&edit=1 -- Fixed in CVS: http://bugs.php.net/fix.php?id=16492&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=16492&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=16492&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=16492&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=16492&r=support Expected behavior: http://bugs.php.net/fix.php?id=16492&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=16492&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=16492&r=submittedtwice