php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #28547 Incorrect use of mysql_thread_init/end() functions
Submitted: 2004-05-27 20:06 UTC Modified: 2005-06-30 01:00 UTC
Votes:3
Avg. Score:3.3 ± 0.5
Reproduced:1 of 1 (100.0%)
Same Version:0 (0.0%)
Same OS:0 (0.0%)
From: arkadi at mebius dot lv Assigned: georg (profile)
Status: No Feedback Package: MySQL related
PHP Version: 5CVS, 4CVS (2004-12-12) OS: *
Private report: No CVE-ID: None
 [2004-05-27 20:06 UTC] arkadi at mebius dot lv
Description:
------------
When PHP is compiled with --enable-experimental-zts (for Apache 2 Worker MPM) the following code is enabled in ext/mysql/php_mysql.c in ZEND_MODULE_STARTUP_D(mysql) and PHP_MSHUTDOWN_FUNCTION(mysql) functions:

init:
#ifdef ZTS
# if MYSQL_VERSION_ID >= 40000
        mysql_thread_init();
# endif
#endif

shutdown:
#ifdef ZTS
# if MYSQL_VERSION_ID >= 40000
        mysql_thread_end();
# endif
#endif

The use of these function is incorrect and may lead to segmentation fault dependending on pthreads and mysql client library internal implementation details. In case of FreeBSD 4.x pthreads it is a reproducible process crash on module shutdown time.
mysql_thread_init() must be called at least once for every thread that use mysql, but only after mysql_init() is called somewhere in the program. mysql_thread_end() must be called only in case mysql_init() is called before or else it will call pthread_getspecific() with an unallocated pthread key as an argument with an undefined results (according to specification). Then (on FreeBSD and in my particular PHP build) it will try to deallocate condition variable using bogus memory address leading to segfault.

Program received signal SIGSEGV, Segmentation fault.
0x28483089 in _atomic_lock () from /usr/lib/libc_r.so.4
(gdb) bt
#0  0x28483089 in _atomic_lock () from /usr/lib/libc_r.so.4
#1  0x28482ffb in _spinlock_debug () from /usr/lib/libc_r.so.4
#2  0x2848a53a in pthread_cond_destroy () from /usr/lib/libc_r.so.4
#3  0x281f1f28 in my_thread_end () at my_thr_init.c:209
#4  0x281e6460 in mysql_thread_end () at libmysql.c:136
#5  0x807c2ee in zm_shutdown_mysql ()
#6  0x0 in ?? ()
(gdb) up 3
#3  0x281f1f28 in my_thread_end () at my_thr_init.c:209
209         pthread_cond_destroy(&tmp->suspend);
(gdb) p *tmp
$9 = {thr_errno = 136209024, suspend = 0x17, mutex = 0x81bb000, current_mutex = 0x0, current_cond = 0x81d6080, 
  pthread_self = 0x0, id = 0, cmp_length = 0, abort = 1130656883, init = 108 'l'}

On a related note I wish to say that PHP build process must link to libmysqlclient_r.so (instead of libmysqlclient.so) in case thread safety is enabled. There is patch easily found by Google to ext/mysql/config.m4, for now I just edited Makefile.
 
Additional information:
- http://dev.mysql.com/doc/mysql/en/Threaded_clients.html (near the end of the page)
- MySQL source: mysql-4.0.20/mysys/my_thr_init.c
mysql_thread_* function are just wrappers that calls my_thread_*.

my_bool my_thread_init(void)
{
  struct st_my_thread_var *tmp;
  my_bool error=0;

#ifdef EXTRA_DEBUG_THREADS
  fprintf(stderr,"my_thread_init(): thread_id=%ld\n",pthread_self());
#endif  
#if !defined(__WIN__) || defined(USE_TLS) || ! defined(SAFE_MUTEX)
  pthread_mutex_lock(&THR_LOCK_lock);
#endif

#if !defined(__WIN__) || defined(USE_TLS)
  if (my_pthread_getspecific(struct st_my_thread_var *,THR_KEY_mysys))
  {
#ifdef EXTRA_DEBUG_THREADS
    fprintf(stderr,"my_thread_init() called more than once in thread %ld\n",
                pthread_self());
#endif    
    goto end;
  }
  if (!(tmp= (struct st_my_thread_var *) calloc(1, sizeof(*tmp))))
  {
    error= 1;
    goto end;
  }
  pthread_setspecific(THR_KEY_mysys,tmp);

#else
  /*
    Skip initialization if the thread specific variable is already initialized
  */
  if (THR_KEY_mysys.id)
    goto end;
  tmp= &THR_KEY_mysys;
#endif
  tmp->id= ++thread_id;
#if defined(__WIN__) && defined(EMBEDDED_LIBRARY)
  tmp->thread_self= (pthread_t)getpid();
#endif
  pthread_mutex_init(&tmp->mutex,MY_MUTEX_INIT_FAST);
  pthread_cond_init(&tmp->suspend, NULL);
  tmp->init= 1;

end:
#if !defined(__WIN__) || defined(USE_TLS) || ! defined(SAFE_MUTEX)
  pthread_mutex_unlock(&THR_LOCK_lock);
#endif
  return error;
}

void my_thread_end(void)
{
  struct st_my_thread_var *tmp;
  tmp= my_pthread_getspecific(struct st_my_thread_var*,THR_KEY_mysys);

#ifdef EXTRA_DEBUG_THREADS
  fprintf(stderr,"my_thread_end(): tmp=%p,thread_id=%ld\n",
          tmp,pthread_self());
#endif  
  if (tmp && tmp->init)
  {
#if !defined(DBUG_OFF)
    /* tmp->dbug is allocated inside DBUG library */
    if (tmp->dbug)
    {
      free(tmp->dbug);
      tmp->dbug=0;
    }
#endif
#if !defined(__bsdi__) || defined(HAVE_mit_thread) /* bsdi dumps core here */
    pthread_cond_destroy(&tmp->suspend);
#endif
    pthread_mutex_destroy(&tmp->mutex);
#if (!defined(__WIN__) && !defined(OS2)) || defined(USE_TLS)
    free(tmp);
#else
    tmp->init= 0;
#endif
  }
  /* The following free has to be done, even if my_thread_var() is 0 */
#if (!defined(__WIN__) && !defined(OS2)) || defined(USE_TLS)
  pthread_setspecific(THR_KEY_mysys,0);
#endif
}



Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2005-06-22 21:53 UTC] tony2001@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php5-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php5-win32-latest.zip


 [2005-06-30 01:00 UTC] php-bugs at lists dot php dot net
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Wed Oct 16 04:01:27 2024 UTC