php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #75731 Php-fpm will crash when perf runs with call graph option
Submitted: 2017-12-26 03:18 UTC Modified: 2017-12-26 03:21 UTC
From: ufo19890607 at gmail dot com Assigned:
Status: Open Package: Reproducible crash
PHP Version: 7.0Git-2017-12-26 (Git) OS: Centos7.3
Private report: No CVE-ID: None
View Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: ufo19890607 at gmail dot com
New email:
PHP Version: OS:

 

 [2017-12-26 03:18 UTC] ufo19890607 at gmail dot com
Description:
------------
The php version:7.0.6

gdb backtrace
#0  0x00007f044ff447bd in re_compile_fastmap_iter (bufp=0x7f044ff447bd <re_compile_fastmap_iter+1165>, 
    fastmap=0x46 <Address 0x46 out of bounds>, init_state=<optimized out>, init_state=<optimized out>) at regcomp.c:407
407			      if (__wcrtomb (buf, towlower (cset->mbchars[i]), &state)
(gdb) bt
#0  0x00007f044ff447bd in re_compile_fastmap_iter (bufp=0x7f044ff447bd <re_compile_fastmap_iter+1165>, 
    fastmap=0x46 <Address 0x46 out of bounds>, init_state=<optimized out>, init_state=<optimized out>) at regcomp.c:407
#1  0x0000000000831160 in virtual_file_ex (state=0x7fff9c1a4f70, path=<optimized out>, verify_path=0x0, use_realpath=1)
    at  phpng/php-7.0.6/Zend/zend_virtual_cwd.c:1392
#2  0x00000000007aacee in expand_filepath_with_mode (
    filepath=0x7f044d6020d8 "xx/xxxx/xxxxxx/xxxxxxx", 
    real_path=0x7fff9c1a4fc0 "\360X\032\234\377\177", relative_to=<optimized out>, relative_to_len=0, realpath_mode=1)
    at  phpng/php-7.0.6/main/fopen_wrappers.c:812
#3  0x00000000007c1536 in _php_stream_fopen (
    filename=0x7f044d6020d8 "xx/xxxx/xxxxxx/xxxxxxx", mode=0xdbb1f1 "rb", 
    opened_path=0x0, options=0) at  phpng/php-7.0.6/main/streams/plain_wrapper.c:970
#4  0x00000000007bd084 in _php_stream_open_wrapper_ex (
    path=0x7f044d6020d8 "xx/xxxx/xxxxxx/xxxxxxx", mode=0xdbb1f1 "rb", options=8, 
    opened_path=0x0, context=0x7f044d65f4c0) at  phpng/php-7.0.6/main/streams/streams.c:2060
#5  0x000000000071722b in zif_file_get_contents (execute_data=<optimized out>, return_value=0x7f044d615540)
    at  phpng/php-7.0.6/ext/standard/file.c:544
#6  0x000000000065387c in phar_file_get_contents (execute_data=0x7f044d615570, return_value=0x7f044d615540)
    at  phpng/php-7.0.6/ext/phar/func_interceptors.c:224
#7  0x00000000008798b8 in ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER (execute_data=0x7f044d615450)
    at  phpng/php-7.0.6/Zend/zend_vm_execute.h:714
#8  0x00000000008423d0 in execute_ex (ex=<optimized out>) at  phpng/php-7.0.6/Zend/zend_vm_execute.h:417
#9  0x00000000008952fb in zend_execute (op_array=0x7f044d66a000, return_value=<optimized out>)
    at  phpng/php-7.0.6/Zend/zend_vm_execute.h:458
#10 0x0000000000802333 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at  phpng/php-7.0.6/Zend/zend.c:1427
#11 0x00000000007a4b40 in php_execute_script (primary_file=0x7fff9c1a88b0) at  phpng/php-7.0.6/main/main.c:2494
#12 0x00000000008a318e in main (argc=<optimized out>, argv=<optimized out>) at  phpng/php-7.0.6/sapi/fpm/fpm/fpm_main.c:1968

Test script:
---------------
...

Expected result:
----------------
...

Actual result:
--------------
...

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2017-12-26 03:21 UTC] ufo19890607 at gmail dot com
I use perf to analyze the performance overhead for the server.
There are several dockers in the server. The php-fpm in the docker
will crash as long as the perf collects samples for all the cpus with call graph option(perf record -ag). Below is the stack trace
in the coredump.

This issue happens  always. The perf is running on the host machine and the command line is as follow:

         $perf record -ag -F 100

I add some output info in the php source code, and found that virtual_file_ex functions's rbp value is really strange,etc 0x1, 0x31. I guess when the perf collects samples for all the cpus with -g option, it may destroy the php-fpm's stack. When the perf is running without -g option, the php-fpm is normal. Who have ever encountered similar problems?

OS in the server: Centos7.3  , Kernel version: 3.10.0-514.16.1.el7.x86_64. php-fpm version: 7.0.6
Processor info: Intel(R) Xeon(R) CPU E5-2620 v3 @ 2.40GHz
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Oct 31 23:01:28 2024 UTC