[php-src] PR #25154: fpm: fix event queue use-after-free in select and poll backends
| From: | iliaal | Date: | Mon, 02 Nov 2026 15:07:13 +0000 |
| Subject: | [php-src] PR #25154: fpm: fix event queue use-after-free in select and poll backends | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40225@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25154
Author: iliaal
When a worker pipe reaches EOF, fpm_stdio_child_said() deletes its own event, freeing the queue node
that fpm_event_select_wait() and fpm_event_poll_wait() then read
next from. With
catch_workers_output = yes this happens when a worker exits under select, and under
poll when it leaves unread output (on Linux an empty pipe at EOF raises only POLLHUP); with glibc
the master segfaults. The loops now save the successor before firing, as the timer loop already
does, and no fd callback can free that node. Found by code review; the new tests crash the master on
unpatched PHP-8.4 (Linux, glibc).