[php-src] PR #25154: fpm: fix event queue use-after-free in select and poll backends

From: Date: Mon, 02 Nov 2026 15:07:13 +0000
Subject: [php-src] PR #25154: fpm: fix event queue use-after-free in select and poll backends
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-40225@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/25154 Author: iliaal When a worker pipe reaches EOF, fpm_stdio_child_said() deletes its own event, freeing the queue node that fpm_event_select_wait() and fpm_event_poll_wait() then read next from. With catch_workers_output = yes this happens when a worker exits under select, and under poll when it leaves unread output (on Linux an empty pipe at EOF raises only POLLHUP); with glibc the master segfaults. The loops now save the successor before firing, as the timer loop already does, and no fd callback can free that node. Found by code review; the new tests crash the master on unpatched PHP-8.4 (Linux, glibc).

« previous php.git-pulls (#40225) next »