php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #47540 CLI can go into an infinite write() loop when ignore_user_abort(true)
Submitted: 2009-03-02 04:01 UTC Modified: 2016-09-28 04:22 UTC
From: tstarling at wikimedia dot org Assigned: tstarling (profile)
Status: Closed Package: CGI/CLI related
PHP Version: 5.2CVS-2009-03-02 (CVS) OS: Linux
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: tstarling at wikimedia dot org
New email:
PHP Version: OS:

 

 [2009-03-02 04:01 UTC] tstarling at wikimedia dot org
Description:
------------
sapi_cli_ub_write() is faulty and may go into a tight infinite loop under certain circumstances. If write() produces an error, it calls php_handle_aborted_connection(), but if ignore_user_abort(true) has been called, this does not exit the request. Thus it enters an infinite loop.

Bug #20053 is a similar bug in a different SAPI. It's likely that many SAPIs have copied this code and suffer the same problem.

Reproduce code:
---------------
<?php
ignore_user_abort(true);
while ( true ) {
	fwrite( STDERR, microtime(true) . "\n" );
	echo "Hello\n";
	usleep(500000);
}
?>

Run it like this:

$ php nfs-test.php > /mnt/some-nfs-mount/test-file

Then while that is running, on another server:

$ rm /mnt/some-nfs-mount/test-file



Expected result:
----------------
It should exit when the file is removed, like it does when ignore_user_abort(true) is not called.

Actual result:
--------------
After a few seconds, the stderr output will stop ticking, and strace will show a flood of:

write(1, "Hello\n", 6)                  = -1 ESTALE (Stale NFS file handle)
write(1, "Hello\n", 6)                  = -1 ESTALE (Stale NFS file handle)
write(1, "Hello\n", 6)                  = -1 ESTALE (Stale NFS file handle)
write(1, "Hello\n", 6)                  = -1 ESTALE (Stale NFS file handle)
write(1, "Hello\n", 6)                  = -1 ESTALE (Stale NFS file handle)
write(1, "Hello\n", 6)                  = -1 ESTALE (Stale NFS file handle)


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2009-05-22 14:42 UTC] lbarnaud@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php5.2-latest.tar.gz
 
For Windows:

  http://windows.php.net/snapshots/

I believe a similar bug has been fixed in 5.2.7.
 [2009-05-30 01:00 UTC] php-bugs at lists dot php dot net
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 [2016-09-28 04:22 UTC] tstarling@php.net
-Status: No Feedback +Status: Closed -Assigned To: +Assigned To: tstarling
 [2016-09-28 04:22 UTC] tstarling@php.net
I confirmed that this is fixed.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Thu Jul 03 11:01:34 2025 UTC