php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #69547 php-fpm segfault (reproducible)
Submitted: 2015-04-29 15:27 UTC Modified: 2015-08-02 04:22 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:0 (0.0%)
From: waldner at katamail dot com Assigned:
Status: No Feedback Package: FPM related
PHP Version: 5.6.10 OS: Debian wheezy
Private report: No CVE-ID: None
Have you experienced this issue?
Rate the importance of this bug to you:

 [2015-04-29 15:27 UTC] waldner at katamail dot com
Description:
------------
The following request crashes a php-fpm process almost 100% reliably for me. This is nginx + fpm via unix socket from the dotdeb repository.
Crucially a request with less headers works (and after that, requests like the one below start working too - though not always).



Test script:
---------------
curl -X POST -d '{}' -H 'Connection: close' -H 'X-FORWARDED-FOR: 127.0.0.1' -H 'X-REAL-IP: 127.0.0.1' -H 'X-FORWARDED-HOST: 1.2.3.4' -H 'X-FORWARDED-PROTO: https' -H 'Content-Length: 2' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:37.0) Gecko/20100101 Firefox/37.0' -H 'Accept: application/json' -H 'Accept-Language: ca,en-US;q=0.7,en;q=0.3' -H 'Accept-Encoding: gzip, deflate' -H 'Content-Type: application/json; charset=UTF-8' -H 'apikey: YmRhZjQ3MGRlYTczYTllZmFjMTNjNTRhYTgxZDg5YTgyODU0OTVhOQ==' -H 'Referer: https://xxxxxxxxxx.xxxxx.xxx/documentation/' -H 'Cookie: PHPSESSID=9be03814eea0ef3e3a7fbc9a1f69c062' -H 'Pragma: no-cache' -H 'Cache-Control: no-cache' http://127.0.0.1/api/clients

Expected result:
----------------
The pool process should process the request without segfaulting.

Actual result:
--------------
Backtrace:

(gdb) bt full
#0  0x00000000006e88ea in zend_hash_find (ht=ht@entry=0x7ff11fa6f9b0, 
    arKey=arKey@entry=0x238a820 "Europe/Madrid", nKeyLength=14, pData=pData@entry=0x7ffe4538fac0)
    at /usr/src/php5.6/nonzts/source/dotdeb-php5/Zend/zend_hash.c:849
        h = 1394799404352781269
        nIndex = 15313
        p = <optimized out>
#1  0x000000000043aad4 in php_date_parse_tzfile (formal_tzname=0x238a820 "Europe/Madrid", tzdb=0xea4e00)
    at /usr/src/php5.6/nonzts/source/dotdeb-php5/ext/date/php_date.c:918
        ptzi = <optimized out>
#2  0x000000000043c4ca in get_timezone_info ()
    at /usr/src/php5.6/nonzts/source/dotdeb-php5/ext/date/php_date.c:997
        tz = 0x238a820 "Europe/Madrid"
        tzi = <optimized out>
#3  0x000000000043e6c5 in php_format_date (format=format@entry=0xb88939 "d-M-Y H:i:s e", 
    format_len=format_len@entry=13, ts=1430320522, localtime=localtime@entry=1)
    at /usr/src/php5.6/nonzts/source/dotdeb-php5/ext/date/php_date.c:1250
        t = 0x271b050
        tzi = <optimized out>
        string = <optimized out>
#4  0x0000000000673c92 in php_log_err (
    log_message=0x7ff11faa0170 "PHP Deprecated:  Automatically populating $HTTP_RAW_POST_DATA is deprecated and will be removed in a future version. To avoid this warning set 'always_populate_raw_post_data' to '-1' in php.ini and us"...) at /usr/src/php5.6/nonzts/source/dotdeb-php5/main/main.c:713
        tmp = <optimized out>
        len = <optimized out>
        error_time_str = <optimized out>
        fd = <optimized out>
        error_time = 1430320522
#5  0x00000000006740a7 in php_error_cb (type=8192, error_filename=0xb6e9d1 "Unknown", error_lineno=0, 
    format=<optimized out>, args=<optimized out>)
    at /usr/src/php5.6/nonzts/source/dotdeb-php5/main/main.c:1144
        log_buffer = 0x7ff11faa0170 "PHP Deprecated:  Automatically populating $HTTP_RAW_POST_DATA is deprecated and will be removed in a future version. To avoid this warning set 'always_populate_raw_post_data' to '-1' in php.ini and us"...
        error_type_str = 0xb6bf0a "Deprecated"
        buffer = 0x7ff11faa0010 "Automatically populating $HTTP_RAW_POST_DATA is deprecated and will be removed in a future version. To avoid this warning set 'always_populate_raw_post_data' to '-1' in php.ini and use the php://input"...
        buffer_len = 216
        display = <optimized out>
#6  0x00000000005887c0 in soap_error_handler (error_num=8192, error_filename=0xb6e9d1 "Unknown", 
    error_lineno=0, 
    format=0xb95098 "Automatically populating $HTTP_RAW_POST_DATA is deprecated and will be removed in a future version. To avoid this warning set 'always_populate_raw_post_data' to '-1' in php.ini and use the php://input"..., args=0x7ffe453902e0) at /usr/src/php5.6/nonzts/source/dotdeb-php5/ext/soap/soap.c:2216
        copy = {{gp_offset = 16, fp_offset = 48, overflow_arg_area = 0x7ffe45390400, 
            reg_save_area = 0x7ffe45390310}}
        tmp = 0x553787cb
        use_exceptions = <optimized out>
        _old_in_compilation = 0 '\000'
        _old_in_execution = 0 '\000'
        _old_current_execute_data = 0x0
        _old_http_response_code = 200
        _old_http_status_line = 0x0
#7  0x00000000006da92c in zend_error (type=8192, 
    format=0xb95098 "Automatically populating $HTTP_RAW_POST_DATA is deprecated and will be removed in a future version. To avoid this warning set 'always_populate_raw_post_data' to '-1' in php.ini and use the php://input"...) at /usr/src/php5.6/nonzts/source/dotdeb-php5/Zend/zend.c:1142
        args = {{gp_offset = 16, fp_offset = 48, overflow_arg_area = 0x7ffe45390400, 
            reg_save_area = 0x7ffe45390310}}
        usr_copy = {{gp_offset = 2, fp_offset = 0, overflow_arg_area = 0x2002, 
            reg_save_area = 0x7ff11fa9fa18}}
        params = <optimized out>
        retval = <optimized out>
        z_error_type = <optimized out>
        z_error_message = <optimized out>
        z_error_filename = <optimized out>
        z_error_lineno = <optimized out>
        z_context = <optimized out>
        error_filename = 0xb6e9d1 "Unknown"
        error_lineno = <optimized out>
        orig_user_error_handler = <optimized out>
        in_compilation = <optimized out>
        saved_class_entry = <optimized out>
        bp_stack = <optimized out>
        function_call_stack = <optimized out>
        switch_cond_stack = <optimized out>
        foreach_copy_stack = <optimized out>
        object_stack = <optimized out>
        declare_stack = <optimized out>
        list_stack = <optimized out>
        context_stack = <optimized out>
#8  0x0000000000681c97 in php_default_post_reader ()
    at /usr/src/php5.6/nonzts/source/dotdeb-php5/main/php_content_types.c:75
        length = <optimized out>
        data = 0x7ff11fa9fd40 "{}"
#9  php_default_post_reader () at /usr/src/php5.6/nonzts/source/dotdeb-php5/main/php_content_types.c:51
No locals.
#10 0x000000000067e4c7 in sapi_read_post_data ()
    at /usr/src/php5.6/nonzts/source/dotdeb-php5/main/SAPI.c:247
        content_type_length = <optimized out>
        content_type = 0x7ff11fa9f9b0 "application/json; charset=UTF-8"
        oldchar = <optimized out>
        post_entry = 0x705846
        p = 0x7ff11fa9f9c1 " charset=UTF-8"
        post_reader_func = <optimized out>
#11 sapi_activate () at /usr/src/php5.6/nonzts/source/dotdeb-php5/main/SAPI.c:482
No locals.
#12 0x00000000006754cc in php_request_startup ()
    at /usr/src/php5.6/nonzts/source/dotdeb-php5/main/main.c:1632
        __orig_bailout = <optimized out>
        __bailout = {{__jmpbuf = {15610304, -798298996382607278, 140673594877200, 0, 140673594879856, 
              15501569, 799201161399785554, -798298749005047726}, __mask_was_saved = 0, __saved_mask = {
              __val = {140673568943750, 140730059785568, 140673594877488, 0, 7876671, 81739, 15610304, 
                140673594877488, 7912927, 15501628, 2, 81739, 856902, 0, 15610304, 0}}}}
        retval = 0
#13 0x0000000000433e97 in main (argc=<optimized out>, argv=<optimized out>)
    at /usr/src/php5.6/nonzts/source/dotdeb-php5/sapi/fpm/fpm/fpm_main.c:1902
        primary_script = 0x0
        __orig_bailout = 0x0
        __bailout = {{__jmpbuf = {0, -798298996382082990, 70, 4294967295, 140730059802835, 15501628, 
              799201161435437138, -798298438956328878}, __mask_was_saved = 0, __saved_mask = {__val = {
                140673540653051, 0, 140673593026626, 0, 0, 0, 0, 0, 0, 0, 0, 4294967296, 0, 0, 0, 0}}}}
        exit_status = 0
        c = <optimized out>
        use_extended_info = 0
        file_handle = {type = ZEND_HANDLE_FILENAME, filename = 0x0, opened_path = 0x0, handle = {fd = 0, 
            fp = 0x0, stream = {handle = 0x0, isatty = 0, mmap = {len = 0, pos = 0, map = 0x0, buf = 0x0, 
                old_handle = 0x0, old_closer = 0}, reader = 0, fsizer = 0, closer = 0}}, 
          free_filename = 0 '\000'}
        orig_optind = 1
        orig_optarg = 0x0
        ini_entries_len = 0
        max_requests = 0
        requests = 0
        fcgi_fd = 15610304
        request = {listen_socket = 0, fd = 4, id = 1, keep = 0, closed = 0, in_len = 0, in_pad = 6, 
          out_hdr = 0x0, out_pos = 0x7ffe45390900 "", out_buf = '\000' <repeats 8191 times>, 
          reserved = '\000' <repeats 15 times>, env = 0x7ff11fa6e310}
        fpm_config = 0x7ffe453948d3 ""
        fpm_prefix = 0x0
        fpm_pid = 0x0
        test_conf = 0
        force_daemon = 1
        force_stderr = 0
        php_information = 0
        php_allow_to_run_as_root = 0
        __func__ = "main"

The offending code line is:

p = ht->arBuckets[nIndex];

ht here is date_globals.tzcache:

date_globals.tzcache->arBuckets = (Bucket **) 0x0

It seems to have a valid value until 

SG(request_info).request_body = php_stream_temp_create_ex(TEMP_STREAM_DEFAULT, SAPI_POST_BLOCK_SIZE, PG(upload_tmp_dir));

(main/SAPI.c, line 282). When php_stream_temp_create_ex returns, it's 0x0.

It looks like memory of date_globals.tzcache->arBuckets gets overwritten by emalloc() or similar at some point.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2015-04-29 15:42 UTC] waldner at katamail dot com
/etc/php5/fpm/php.ini:

[PHP]
engine = On
zend.ze1_compatibility_mode = Off
zend.enable_gc = On
short_open_tag = On
asp_tags = Off
precision    =  14
y2k_compliance = On
output_buffering = 4096
zlib.output_compression = Off
implicit_flush = Off
unserialize_callback_func=
serialize_precision = 17
allow_call_time_pass_reference = Off
safe_mode = Off
safe_mode_gid = Off
safe_mode_include_dir =
safe_mode_exec_dir =
safe_mode_allowed_env_vars = PHP_
safe_mode_protected_env_vars = LD_LIBRARY_PATH
disable_functions =
disable_classes =
expose_php = Off
max_execution_time = 90
max_input_time = 90
; workaround for HOT extranet monster-input

max_input_vars = 4000

; workaround end
; Another workaround for session encryption

;
memory_limit = 128M
error_reporting = E_ALL
;& ~E_NOTICE
display_errors = On
display_startup_errors = Off
log_errors = On
log_errors_max_len = 1024
ignore_repeated_errors = Off
ignore_repeated_source = Off
report_memleaks = On
track_errors = Off
error_log = "/dev/null"
;error_log = "/tmp/eee"
variables_order = "GPCS"
register_globals = Off
register_argc_argv = Off
auto_globals_jit = On
post_max_size = 10M
magic_quotes_runtime = Off
magic_quotes_sybase = Off
auto_prepend_file = ""
auto_append_file =
default_mimetype = "text/html"
default_charset = "iso-8859-1"
include_path = ".:/usr/share/php"
doc_root =
user_dir =
enable_dl = On
file_uploads = On
upload_max_filesize = 2M
allow_url_fopen = On
allow_url_include = Off
default_socket_timeout = 90
browscap = /etc/browscap.ini



[mail function]
SMTP = localhost
smtp_port = 25

[Date]
date.timezone = "Europe/Madrid"

[Syslog]
define_syslog_variables  = Off

[SQL]
sql.safe_mode = Off

[MySQL]
mysql.allow_persistent = On
mysql.max_persistent = -1
mysql.max_links = -1
mysql.default_port =
mysql.default_socket = 
mysql.default_host =
mysql.default_user =
mysql.default_password =
mysql.connect_timeout = 60
mysql.trace_mode = Off

[MySQLi]
mysqli.max_links = -1
mysqli.default_port = 3306
mysqli.default_socket = 
mysqli.default_host =
mysqli.default_user =
mysqli.default_pw =
mysqli.reconnect = Off

[bcmath]
bcmath.scale = 0

[Session]
session.save_handler = files

session.use_cookies = 1
session.use_only_cookies = 1
session.name = PHPSESSID
session.auto_start = 0
session.cookie_lifetime = 0
session.cookie_path = /
session.cookie_domain =
session.cookie_httponly = 1
session.serialize_handler = php
session.gc_probability = 1
session.gc_divisor     = 10000
session.gc_maxlifetime = 1800
session.bug_compat_42 = 0
session.bug_compat_warn = 1
session.referer_check =
session.entropy_length = 0
session.entropy_file =
session.cache_limiter = nocache
session.cache_expire = 180
session.use_trans_sid = 0
session.hash_function = 0
session.hash_bits_per_character = 4
url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=fakeentry"

[Tidy]
tidy.clean_output = Off

[soap]
soap.wsdl_cache_enabled=1
soap.wsdl_cache_dir="/tmp/"
soap.wsdl_cache_ttl=86400


[opcache]
opcache.enable=1
opcache.enable_cli=0
opcache.memory_consumption=256
opcache.interned_strings_buffer=8
opcache.max_accelerated_files=7963
opcache.max_wasted_percentage=5
opcache.use_cwd=1
opcache.validate_timestamps=0
opcache.revalidate_freq=2
opcache.revalidate_path=0
opcache.save_comments=1
opcache.load_comments=1
opcache.fast_shutdown=1
opcache.enable_file_override=0
opcache.optimization_level=0xffffffff
opcache.inherited_hack=1
opcache.dups_fix=0
opcache.blacklist_filename=

opcache.max_file_size=0
opcache.consistency_checks=0
opcache.force_restart_timeout=180
opcache.error_log=
opcache.log_verbosity_level=1
opcache.preferred_memory_model=
opcache.protect_memory=None
opcache.mmap_base=
 [2015-04-29 15:44 UTC] waldner at katamail dot com
/etc/php5/fpm/php-fpm.conf:
[global]
pid = /run/php5-fpm.pid
error_log = /var/log/php5-fpm.log 
include=/etc/php5/fpm/pool.d/*.conf

/etc/php5/fpm/pool.d/www.conf:

[www]
user = www-data
group = www-data
listen = /var/run/php5-fpm.sock
listen.owner = www-data
listen.group = www-data
 
pm = static
pm.max_children = 1
pm.start_servers = 1
pm.min_spare_servers = 1
pm.max_spare_servers = 1

chdir = /
 [2015-04-29 15:45 UTC] waldner at katamail dot com
php -m:

[PHP Modules]
apc
apcu
bcmath
bz2
calendar
Core
ctype
curl
date
dba
dom
ereg
exif
fileinfo
filter
ftp
gd
gettext
gmp
hash
iconv
imagick
intl
json
libxml
mbstring
mcrypt
mhash
mysql
mysqli
mysqlnd
openssl
pcntl
pcre
PDO
pdo_mysql
Phar
posix
readline
Reflection
session
shmop
SimpleXML
soap
sockets
SPL
standard
sysvmsg
sysvsem
sysvshm
tidy
tokenizer
wddx
xml
xmlreader
xmlrpc
xmlwriter
xsl
Zend OPcache
zip
zlib

[Zend Modules]
Zend OPcache
 [2015-04-29 15:55 UTC] waldner at katamail dot com
Happens also via TCP socket (127.0.0.1:9000).
 [2015-04-30 09:02 UTC] waldner at katamail dot com
Making seemingly random changes to php.ini sometimes fixes the problem, for example changing

error_log = "/dev/null"

to

error_log = "/tmp/a.log"

or commenting out the line

browscap = /etc/browscap.ini

makes it work. Still (or even more because of this), looks like memory corruption.
 [2015-05-19 09:59 UTC] waldner at katamail dot com
-PHP Version: 5.6.8 +PHP Version: 5.6.9
 [2015-05-19 09:59 UTC] waldner at katamail dot com
This happens with 5.6.9 as well.
 [2015-06-16 11:45 UTC] waldner at katamail dot com
-PHP Version: 5.6.9 +PHP Version: 5.6.10
 [2015-06-16 11:45 UTC] waldner at katamail dot com
And with 5.6.10.
 [2015-07-22 11:07 UTC] mike@php.net
-Status: Open +Status: Feedback
 [2015-07-22 11:07 UTC] mike@php.net
Hi, could you try 

always_populate_raw_post_data=-1

in php.ini?
 [2015-08-02 04:22 UTC] php-bugs at lists dot php dot net
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Re-Opened". Thank you.
 [2016-05-09 12:20 UTC] php at syntacs dot com
definitely memory corruption here

fully patched 14.04 LTS, nginx & php-fpm via unix socket

always_populate_raw_post_data=-1 didn't change anything

short version of coredump, complete version available (can I post files ?)

#0  0x00000000006ea07a in zend_hash_find (ht=0x4b, arKey=0x7fef3c662dd0 "minify", nKeyLength=7, pData=0x7ffca4f10d90)
    at /build/php5-SqUzIS/php5-5.6.21+dfsg/Zend/zend_hash.c:849
        h = 229474855223889
        nIndex = <error reading variable nIndex (Cannot access memory at address 0x4f)>
        p = <optimized out>
#1  0x00007fef4bf16c87 in xc_restore_zend_op_array () from /usr/lib/php5/20131226/xcache.so
No symbol table info available.
#2  0x00007fef4bf17623 in xc_restore_HashTable_zend_function () from /usr/lib/php5/20131226/xcache.so
No symbol table info available.
#3  0x00007fef4bf17f82 in xc_restore_zend_class_entry () from /usr/lib/php5/20131226/xcache.so
No symbol table info available.
#4  0x00007fef4bf1872f in xc_restore_xc_entry_data_php_t () from /usr/lib/php5/20131226/xcache.so
No symbol table info available.
#5  0x00007fef4bf18814 in xc_processor_restore_xc_entry_data_php_t () from /usr/lib/php5/20131226/xcache.so
No symbol table info available.
#6  0x00007fef4bf1c31d in ?? () from /usr/lib/php5/20131226/xcache.so
No symbol table info available.
#7  0x00007fef4bf1ed0c in ?? () from /usr/lib/php5/20131226/xcache.so
No symbol table info available.
#8  0x00007fef4bf2071f in ?? () from /usr/lib/php5/20131226/xcache.so
No symbol table info available.
#9  0x00007fef4bf2294c in ?? () from /usr/lib/php5/20131226/xcache.so
No symbol table info available.
#10 0x000000000078000d in ZEND_INCLUDE_OR_EVAL_SPEC_TMP_HANDLER (execute_data=0x7fef550d6c80) at /build/php5-SqUzIS/php5-5.6.21+dfsg/Zend/zend_vm_execute.h:8334
        file_handle = {type = ZEND_HANDLE_FILENAME, filename = 0x34d78b0 "/var/www/www.xxxxx.xxx.edu/plugins/compresseur/lib/minify_html/class.minify_html.php", 
          opened_path = 0x34d7918 "/var/www/www.xxxxx.xxx.edu/plugins/compresseur/lib/minify_html/class.minify_html.php", handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, 
              isatty = 27, mmap = {len = 54112224, pos = 1, map = 0xe9e880 <executor_globals+576>, buf = 0xe83dfc <php_execute.return_semaphore> "", 
                old_handle = 0x6b600f <_estrndup+79>, old_closer = 0x7fef550d6c20}, reader = 0x7fef3c05b6e0, fsizer = 0xe9e640 <executor_globals>, closer = 0x7fef550d6c80}}, 
          free_filename = 0 '\000'}
        resolved_path = <optimized out>
        opline = 0x7fef3c05b740
        new_op_array = 0x0
        free_op1 = {var = 0x7fef550d6c40}
        inc_filename = 0x7fef550d6c40
        tmp_inc_filename = <optimized out>
        failure_retval = <optimized out>
 [2016-05-09 12:23 UTC] php at syntacs dot com
last lines of strace:

poll([{fd=7, events=POLLIN|POLLPRI}], 1, 0) = 0 (Timeout)
write(7, "#\0\0\0\3SHOW CREATE TABLE `spip_doc"..., 39) = 39
read(7, "\1\0\0\1\2\33\0\0\2\3def\0\0\0\5Table\0\f!\0\300\0\0\0\375\1"..., 16384) = 1128
access("tmp/cache/", W_OK)              = 0
getcwd("/var/www/www.xxxxx.xxx.edu", 4096) = 27
open("/var/www/www.xxxxx.xxx.edu/tmp/cache/sql_desc_7b6cd88d.txt", O_WRONLY|O_CREAT|O_APPEND, 0666) = 8
fstat(8, {st_mode=S_IFREG|0666, st_size=31721, ...}) = 0
lseek(8, 0, SEEK_CUR)                   = 0
lseek(8, 0, SEEK_CUR)                   = 0
flock(8, LOCK_EX)                       = 0
getcwd("/var/www/www.xxxxx.xxx.edu", 4096) = 27
lstat("/var/www/www.xxxxx.xxx.edu/tmp/cache/sql_desc_7b6cd88d.txt.136518740557307cacb69125.85335574", 0x7ffd5b477b10) = -1 ENOENT (No such file or directory)
open("/var/www/www.xxxxx.xxx.edu/tmp/cache/sql_desc_7b6cd88d.txt.136518740557307cacb69125.85335574", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 9
fstat(9, {st_mode=S_IFREG|0666, st_size=0, ...}) = 0
lseek(9, 0, SEEK_CUR)                   = 0
flock(9, LOCK_EX)                       = 0
write(9, "a:11:{s:14:\"spip_rubriques\";a:39"..., 8192) = 8192
write(9, "ticles\";s:9:\"connexion\";s:0:\"\";s"..., 8192) = 8192
write(9, "OT NULL DEFAULT '0000-00-00 00:0"..., 8192) = 8192
write(9, "credit\";s:13:\"text NOT NULL\";s:7"..., 8192) = 8192
write(9, "3:\"text NOT NULL\";s:7:\"fichier\";"..., 2962) = 2962
flock(9, LOCK_UN)                       = 0
close(9)                                = 0
flock(8, LOCK_UN)                       = 0
close(8)                                = 0
rename("tmp/cache/sql_desc_7b6cd88d.txt.136518740557307cacb69125.85335574", "tmp/cache/sql_desc_7b6cd88d.txt") = 0
unlink("tmp/cache/sql_desc_7b6cd88d.txt.136518740557307cacb69125.85335574") = -1 ENOENT (No such file or directory)
access("tmp/cache/sql_desc_7b6cd88d.txt", F_OK) = 0
chmod("tmp/cache/sql_desc_7b6cd88d.txt", 0666) = 0
getcwd("/var/www/www.xxxxx.xxx.edu", 4096) = 27
lstat("/var/www/www.xxxxx.xxx.edu/tmp/cache/sql_desc_7b6cd88d.txt", {st_mode=S_IFREG|0666, st_size=35730, ...}) = 0
lstat("/var/www/www.xxxxx.xxx.edu/tmp/cache", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
lstat("/var/www/www.xxxxx.xxx.edu/tmp", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
lstat("/var/www/www.xxxxx.xxx.edu", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
lstat("/var/www", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
lstat("/var", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
lstat("/var/www/www.xxxxx.xxx.edu/tmp/cache/sql_desc_7b6cd88d.txt", {st_mode=S_IFREG|0666, st_size=35730, ...}) = 0
access("tmp/cache/7/.ok", F_OK)         = 0
getcwd("/var/www/www.xxxxx.xxx.edu", 4096) = 27
lstat("/var/www/www.xxxxx.xxx.edu/tmp/cache/7/mod-2016_05_09%2014%3A-1-44c982ae", 0x7ffd5b477830) = -1 ENOENT (No such file or directory)
lstat("/var/www/www.xxxxx.xxx.edu/tmp/cache/7", {st_mode=S_IFDIR|0777, st_size=49152, ...}) = 0
open("/var/www/www.xxxxx.xxx.edu/tmp/cache/7/mod-2016_05_09%2014%3A-1-44c982ae", O_RDONLY) = -1 ENOENT (No such file or directory)
access("plugins-dist/medias/modeles/img.en.html", F_OK) = -1 ENOENT (No such file or directory)
access("tmp/cache/skel/html_acd6c646362c1be2aa249ca2d7c42bd8.php", F_OK) = 0
access("plugins-dist/medias/modeles/img.html", F_OK) = 0
stat("plugins-dist/medias/modeles/img.html", {st_mode=S_IFREG|0644, st_size=2296, ...}) = 0
stat("tmp/cache/skel/html_acd6c646362c1be2aa249ca2d7c42bd8.php", {st_mode=S_IFREG|0666, st_size=7612, ...}) = 0
getcwd("/var/www/www.xxxxx.xxx.edu", 4096) = 27
lstat("/var/www/www.xxxxx.xxx.edu/./tmp/cache/skel/html_acd6c646362c1be2aa249ca2d7c42bd8.php", {st_mode=S_IFREG|0666, st_size=7612, ...}) = 0
lstat("/var/www/www.xxxxx.xxx.edu/./tmp/cache/skel", {st_mode=S_IFDIR|0777, st_size=32768, ...}) = 0
lstat("/var/www/www.xxxxx.xxx.edu/./tmp/cache", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
lstat("/var/www/www.xxxxx.xxx.edu/./tmp", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
fcntl(3, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=1}) = 0
fcntl(3, F_SETLK, {type=F_UNLCK, whence=SEEK_SET, start=0, len=1}) = 0
stat("/var/www/www.xxxxx.xxx.edu/tmp/cache/skel/html_acd6c646362c1be2aa249ca2d7c42bd8.php", {st_mode=S_IFREG|0666, st_size=7612, ...}) = 0
fcntl(4, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=1}) = 0
fcntl(4, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=1}) = 0
access("plugins-dist/medias/modeles/img_fonctions.php", F_OK) = -1 ENOENT (No such file or directory)
poll([{fd=7, events=POLLIN|POLLPRI}], 1, 0) = 0 (Timeout)
write(7, "\214\1\0\0\3\nSELECT documents.id_docume"..., 400) = 400
read(7, "\1\0\0\1\10N\0\0\2\3def\xxxxxxxxxxx\tdocume"..., 16384) = 659
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/medias/urls/generer_url_document.php", F_OK) = 0
stat("/var/www/www.xxxxx.xxx.edu/plugins-dist/medias/urls/generer_url_document.php", {st_mode=S_IFREG|0644, st_size=1221, ...}) = 0
fcntl(4, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=1}) = 0
fcntl(4, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=1}) = 0
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/medias/inc/autoriser.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/plugins/compresseur/inc/autoriser.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/plugins/auto/piwik/v0.8.0/inc/autoriser.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/plugins/auto/menus/v1.6.1/inc/autoriser.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/plugins/auto/gis/v4.34.0/inc/autoriser.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/plugins/auto/saisies/v2.6.1/inc/autoriser.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/plugins/auto/forms/v0.5.6/inc/autoriser.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/plugins/auto/spip_bonux/v3.2.1/inc/autoriser.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/plugins/auto/couteau_suisse/v1.9.10/inc/autoriser.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/plugins/googlemap_api/inc/autoriser.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/plugins/auto/facteur/v3.3.5/inc/autoriser.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/textwheel/inc/autoriser.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/svp/inc/autoriser.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/statistiques/inc/autoriser.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/sites/inc/autoriser.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/safehtml/inc/autoriser.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/revisions/inc/autoriser.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/organiseur/inc/autoriser.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/mots/inc/autoriser.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/forum/inc/autoriser.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/filtres_images/inc/autoriser.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/dump/inc/autoriser.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/ecrire/inc/autoriser.php", F_OK) = 0
stat("/var/www/www.xxxxx.xxx.edu/ecrire/inc/autoriser.php", {st_mode=S_IFREG|0755, st_size=46607, ...}) = 0
fcntl(4, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=1}) = 0
fcntl(4, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=1}) = 0
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/forum/forum_autoriser.php", F_OK) = 0
stat("/var/www/www.xxxxx.xxx.edu/plugins-dist/forum/forum_autoriser.php", {st_mode=S_IFREG|0644, st_size=4766, ...}) = 0
fcntl(4, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=1}) = 0
fcntl(4, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=1}) = 0
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/mots/mots_autoriser.php", F_OK) = 0
stat("/var/www/www.xxxxx.xxx.edu/plugins-dist/mots/mots_autoriser.php", {st_mode=S_IFREG|0644, st_size=12476, ...}) = 0
fcntl(4, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=1}) = 0
fcntl(4, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=1}) = 0
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/organiseur/organiseur_autoriser.php", F_OK) = 0
stat("/var/www/www.xxxxx.xxx.edu/plugins-dist/organiseur/organiseur_autoriser.php", {st_mode=S_IFREG|0644, st_size=4161, ...}) = 0
fcntl(4, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=1}) = 0
fcntl(4, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=1}) = 0
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/petitions/petitions_autoriser.php", F_OK) = 0
stat("/var/www/www.xxxxx.xxx.edu/plugins-dist/petitions/petitions_autoriser.php", {st_mode=S_IFREG|0644, st_size=2846, ...}) = 0
fcntl(4, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=1}) = 0
fcntl(4, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=1}) = 0
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/porte_plume/porte_plume_pipelines.php", F_OK) = 0
stat("/var/www/www.xxxxx.xxx.edu/plugins-dist/porte_plume/porte_plume_pipelines.php", {st_mode=S_IFREG|0644, st_size=5852, ...}) = 0
fcntl(4, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=1}) = 0
fcntl(4, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=1}) = 0
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/revisions/inc/revisions_autoriser.php", F_OK) = 0
stat("/var/www/www.xxxxx.xxx.edu/plugins-dist/revisions/inc/revisions_autoriser.php", {st_mode=S_IFREG|0644, st_size=2624, ...}) = 0
fcntl(4, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=1}) = 0
fcntl(4, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=1}) = 0
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/sites/sites_autoriser.php", F_OK) = 0
stat("/var/www/www.xxxxx.xxx.edu/plugins-dist/sites/sites_autoriser.php", {st_mode=S_IFREG|0644, st_size=3472, ...}) = 0
fcntl(4, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=1}) = 0
fcntl(4, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=1}) = 0
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/statistiques/stats_autoriser.php", F_OK) = 0
stat("/var/www/www.xxxxx.xxx.edu/plugins-dist/statistiques/stats_autoriser.php", {st_mode=S_IFREG|0644, st_size=1391, ...}) = 0
fcntl(4, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=1}) = 0
fcntl(4, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=1}) = 0
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/svp/svp_pipelines.php", F_OK) = 0
stat("/var/www/www.xxxxx.xxx.edu/plugins-dist/svp/svp_pipelines.php", {st_mode=S_IFREG|0644, st_size=4032, ...}) = 0
fcntl(4, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=1}) = 0
fcntl(4, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=1}) = 0
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/urls_etendues/urls_pipeline.php", F_OK) = 0
stat("/var/www/www.xxxxx.xxx.edu/plugins-dist/urls_etendues/urls_pipeline.php", {st_mode=S_IFREG|0644, st_size=1800, ...}) = 0
fcntl(4, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=1}) = 0
fcntl(4, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=1}) = 0
access("/var/www/www.xxxxx.xxx.edu/plugins/auto/gis/v4.34.0/gis_autoriser.php", F_OK) = 0
stat("/var/www/www.xxxxx.xxx.edu/plugins/auto/gis/v4.34.0/gis_autoriser.php", {st_mode=S_IFREG|0777, st_size=3811, ...}) = 0
fcntl(4, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=1}) = 0
fcntl(4, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=1}) = 0
access("/var/www/www.xxxxx.xxx.edu/plugins/auto/menus/v1.6.1/inc/menus_autoriser.php", F_OK) = 0
stat("/var/www/www.xxxxx.xxx.edu/plugins/auto/menus/v1.6.1/inc/menus_autoriser.php", {st_mode=S_IFREG|0777, st_size=399, ...}) = 0
fcntl(4, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=1}) = 0
fcntl(4, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=1}) = 0
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/breves/breves_autoriser.php", F_OK) = 0
stat("/var/www/www.xxxxx.xxx.edu/plugins-dist/breves/breves_autoriser.php", {st_mode=S_IFREG|0644, st_size=2146, ...}) = 0
fcntl(4, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=1}) = 0
fcntl(4, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=1}) = 0
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/medias/medias_autoriser.php", F_OK) = 0
stat("/var/www/www.xxxxx.xxx.edu/plugins-dist/medias/medias_autoriser.php", {st_mode=S_IFREG|0644, st_size=8399, ...}) = 0
fcntl(4, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=1}) = 0
fcntl(4, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=1}) = 0
poll([{fd=7, events=POLLIN|POLLPRI}], 1, 0) = 0 (Timeout)
write(7, "P\0\0\0\3\nSELECT fichier,distant\nFRO"..., 84) = 84
read(7, "\1\0\0\1\2K\0\0\2\3def\vxxxxxxxxxxx\16spip_d"..., 16384) = 206
brk(0x148e000)                          = 0x148e000
access("/var/www/www.xxxxx.xxx.edu/plugins/compresseur/compresseur_pipeline.php", F_OK) = 0
stat("/var/www/www.xxxxx.xxx.edu/plugins/compresseur/compresseur_pipeline.php", {st_mode=S_IFREG|0644, st_size=3373, ...}) = 0
fcntl(4, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=1}) = 0
fcntl(4, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=1}) = 0
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/medias/inc/compresseur_minifier.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/plugins/compresseur/inc/compresseur_minifier.php", F_OK) = 0
stat("/var/www/www.xxxxx.xxx.edu/plugins/compresseur/inc/compresseur_minifier.php", {st_mode=S_IFREG|0644, st_size=11095, ...}) = 0
fcntl(4, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=1}) = 0
fcntl(4, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=1}) = 0
access("/var/www/www.xxxxx.xxx.edu/plugins/auto/forms/v0.5.6/public/sandbox.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/plugins/auto/spip_bonux/v3.2.1/public/sandbox.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/plugins/googlemap_api/public/sandbox.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/vertebres/public/sandbox.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/statistiques/public/sandbox.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/plugins-dist/forum/public/sandbox.php", F_OK) = -1 ENOENT (No such file or directory)
access("/var/www/www.xxxxx.xxx.edu/ecrire/public/sandbox.php", F_OK) = 0
stat("/var/www/www.xxxxx.xxx.edu/ecrire/public/sandbox.php", {st_mode=S_IFREG|0644, st_size=5078, ...}) = 0
fcntl(4, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=1}) = 0
fcntl(4, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=1}) = 0
stat("/var/www/www.xxxxx.xxx.edu/squelettes/lib/minify_html/", 0x7ffd5b479340) = -1 ENOENT (No such file or directory)
stat("/var/www/www.xxxxx.xxx.edu/plugins-dist/medias/lib/minify_html/", 0x7ffd5b479340) = -1 ENOENT (No such file or directory)
stat("/var/www/www.xxxxx.xxx.edu/plugins-dist/medias/squelettes/lib/minify_html/", 0x7ffd5b479340) = -1 ENOENT (No such file or directory)
stat("/var/www/www.xxxxx.xxx.edu/plugins/compresseur/lib/minify_html/", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
access("/var/www/www.xxxxx.xxx.edu/plugins/compresseur/lib/minify_html/class.minify_html.php", F_OK) = 0
stat("/var/www/www.xxxxx.xxx.edu/plugins/compresseur/lib/minify_html/class.minify_html.php", {st_mode=S_IFREG|0644, st_size=10430, ...}) = 0
fcntl(4, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=1}) = 0
fcntl(4, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=1}) = 0
--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0x4f} ---
+++ killed by SIGSEGV (core dumped) +++
 [2016-05-09 14:22 UTC] php at syntacs dot com
solved here by

apt-get purge php5-xcache
 
PHP Copyright © 2001-2017 The PHP Group
All rights reserved.
Last updated: Sun Nov 19 01:31:42 2017 UTC