php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #15642 system() with background execution hangs due to bogus filehandles open
Submitted: 2002-02-20 04:20 UTC Modified: 2003-05-18 13:08 UTC
Votes:4
Avg. Score:4.8 ± 0.4
Reproduced:4 of 4 (100.0%)
Same Version:1 (25.0%)
Same OS:3 (75.0%)
From: kk at netuse dot de Assigned:
Status: Not a bug Package: Program Execution
PHP Version: 4.0.5 OS: Linux 2.2.18
Private report: No CVE-ID:
 [2002-02-20 04:20 UTC] kk at netuse dot de
Using CGI PHP 4.0.5 on Linux 2.2.18. Starting a "PHP shell script" using the system function with

  system("/tmp/demo.php &");

will hang the parent PHP until /tmp/demo.php finishes execution. Replacing /tmp/demo.php with a shell script wrapper /tmp/demo.sh, which does

#! /bin/sh --

env
lsof $$
php -q ... /tmp/demo.php

shows the shell script is inheriting open file handles from the parent PHP. These handles include the session handler file handles, database file handles and other file handles. These handles are being passed on to the child php interpreter, where they are inaccessible except for the dio_*() functions (fds with no PHP ressource associated).

Since the session handle will LOCK on these fds, the parent CGI will hang until the child PHP completes execution.

Process traces are provided below.

We worked around the problem by writing a program closeme which closes all file handles 3-63 before starting the PHP subprocess. The PHP program execution functions system(), popen() and the like should do this automatically.

Kristian

NB: I am not on the php-dev list any more. Please be sure to cc all discussion to the address kk@netuse.de.

custsys:~ # lsof /tmp/sess_c8bf4bd82d100c7547aab62fcb9b36f4
COMMAND     PID   USER   FD   TYPE DEVICE SIZE  NODE NAME
php4      16569 wwwrun    4u   REG    3,2  348 44835 /tmp/sess_c8bf4bd82d100c7547aab62fcb9b36f4
gewinnlis 16572 wwwrun    4u   REG    3,2  348 44835 /tmp/sess_c8bf4bd82d100c7547aab62fcb9b36f4
custsys:~ #

wwwrun   16569 14188  0 10:13 ?        00:00:00 php4
wwwrun   16572     1  6 10:13 ?        00:00:02 php -q /home/www/servers/server-with-no-name.de/php/batch/gewinnliste.php lotterygewlst-20020
207-1312.csv 107 1 20.02.2002

custsys:~ # lsof -p 16572
COMMAND     PID   USER   FD   TYPE DEVICE    SIZE   NODE NAME
gewinnlis 16572 wwwrun  cwd    DIR    3,5     211  15925 /home/www/servers/server-with-no-name.de/php/batch
gewinnlis 16572 wwwrun  rtd    DIR    3,2     370      2 /
gewinnlis 16572 wwwrun  txt    REG    3,2 2596986  26151 /usr/local/php4/bin/php
gewinnlis 16572 wwwrun  mem    REG    3,2  106242   4418 /lib/ld-2.2.so
gewinnlis 16572 wwwrun  mem    REG    3,2   14330   4427 /lib/libdl.so.2
gewinnlis 16572 wwwrun  mem    REG    3,2  228284  19650 /usr/lib/libmysqlclient.so.10.0.0
gewinnlis 16572 wwwrun  mem    REG    3,2   60858  19721 /usr/lib/libmcrypt.so.4.0.4
gewinnlis 16572 wwwrun  mem    REG    3,2   19173  25711 /usr/lib/libltdl.so.0.1.2
gewinnlis 16572 wwwrun  mem    REG    3,2   66669   4440 /lib/libresolv.so.2
gewinnlis 16572 wwwrun  mem    REG    3,2  186132   4428 /lib/libm.so.6
gewinnlis 16572 wwwrun  mem    REG    3,2   27143   4424 /lib/libcrypt.so.1
gewinnlis 16572 wwwrun  mem    REG    3,2   92252   4430 /lib/libnsl.so.1
gewinnlis 16572 wwwrun  mem    REG    3,2 1382179   4423 /lib/libc.so.6
gewinnlis 16572 wwwrun  mem    REG    3,2   63381   7759 /lib/libz.so.1.1.3
gewinnlis 16572 wwwrun  mem    REG    3,2   45878   4434 /lib/libnss_files.so.2
gewinnlis 16572 wwwrun    0r   CHR    1,3           2511 /dev/null
gewinnlis 16572 wwwrun    1w   REG    3,2       0  44860 /tmp/demo
gewinnlis 16572 wwwrun    2w   REG    3,2       0  44840 /tmp/err
gewinnlis 16572 wwwrun    3u   REG    3,2       0  40917 /var/state/httpd/mm.14186.sem
gewinnlis 16572 wwwrun    4u   REG    3,2     348  44835 /tmp/sess_c8bf4bd82d100c7547aab62fcb9b36f4
gewinnlis 16572 wwwrun    5u  sock    0,0         306704 can't identify protocol
gewinnlis 16572 wwwrun    6u  IPv4 306716            TCP localhost:3755->localhost:mysql (ESTABLISHED)
gewinnlis 16572 wwwrun    7u  IPv4 306718            TCP custsys.nsz.netuse.de:3756->www.lottery-customer.de:mysql (ESTABLISHED)
gewinnlis 16572 wwwrun    8r   REG    3,5 7824333  16176 /home/custsys/import/lottery/gewinnliste/gewlst-20020207-1312.csv
custsys:~ #

custsys:~ # lsof -p 16569
COMMAND   PID   USER   FD   TYPE DEVICE    SIZE   NODE NAME
php4    16569 wwwrun  cwd    DIR    3,5      78  14153 /home/www/servers/server-with-no-name.de/cgi
php4    16569 wwwrun  rtd    DIR    3,2     370      2 /
php4    16569 wwwrun  txt    REG    3,5 2641883  14154 /home/www/servers/server-with-no-name.de/cgi/php4
php4    16569 wwwrun  mem    REG    3,2  106242   4418 /lib/ld-2.2.so
php4    16569 wwwrun  mem    REG    3,2   14330   4427 /lib/libdl.so.2
php4    16569 wwwrun  mem    REG    3,2  228284  19650 /usr/lib/libmysqlclient.so.10.0.0
php4    16569 wwwrun  mem    REG    3,2   60858  19721 /usr/lib/libmcrypt.so.4.0.4
php4    16569 wwwrun  mem    REG    3,2   19173  25711 /usr/lib/libltdl.so.0.1.2
php4    16569 wwwrun  mem    REG    3,2   66669   4440 /lib/libresolv.so.2
php4    16569 wwwrun  mem    REG    3,2  186132   4428 /lib/libm.so.6
php4    16569 wwwrun  mem    REG    3,2   27143   4424 /lib/libcrypt.so.1
php4    16569 wwwrun  mem    REG    3,2   92252   4430 /lib/libnsl.so.1
php4    16569 wwwrun  mem    REG    3,2  205939  15746 /usr/lib/libssl.so.0.9.6
php4    16569 wwwrun  mem    REG    3,2  892057  15743 /usr/lib/libcrypto.so.0.9.6
php4    16569 wwwrun  mem    REG    3,2 1382179   4423 /lib/libc.so.6
php4    16569 wwwrun  mem    REG    3,2   63381   7759 /lib/libz.so.1.1.3
php4    16569 wwwrun    0r  FIFO    0,0         306709 pipe
php4    16569 wwwrun    1w  FIFO    0,0         306710 pipe
php4    16569 wwwrun    2w   REG    3,5 2448931  14156 /home/www/servers/server-with-no-name.de/logs/error.log
php4    16569 wwwrun    3u   REG    3,2       0  40917 /var/state/httpd/mm.14186.sem
php4    16569 wwwrun    4u   REG    3,2     348  44835 /tmp/sess_c8bf4bd82d100c7547aab62fcb9b36f4

custsys:~ # strace -f -p 16569
flock(4, LOCK_EX <unfinished ...>

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2002-02-20 04:30 UTC] derick@php.net
Just wanted to add this tip from the notes in the manual:

Here's a neat trick that exploits an inherent php anomaly... if you want to
run a shell command but not have it take up two processes for the entire
life of the command (a child for the shell and a grandchild for the
command), add a "&" at the end of the command to kill the
shell and leave the grandchild command running... Though it's a bit
counterintuitive, php will continue to listen for the orphanized
grandchild command's STDOUT as long as it continues to run, provided
STDOUT hasn't been been redirected with a ">/some/file"...

Very helpful if you're in a low-process-quota situation - I might even go
so far as to say that this benefit might warrant ALWAYS using a
"&" in php Unix system command situations - though the
jury's still out on that one...



Derick
 [2002-09-26 10:28 UTC] wez@php.net
Apparently related to #15529.
 [2002-09-26 10:43 UTC] wez@php.net
And #16548
 [2003-05-18 13:08 UTC] sniper@php.net
Just add your comments to the bug #15529 which has 
good explanation why this happens.

 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Thu Apr 17 18:02:13 2014 UTC