php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Request #72055 php-fpm crashes on working with Runkit
Submitted: 2016-04-19 08:27 UTC Modified: 2023-04-10 14:08 UTC
Votes:2
Avg. Score:3.5 ± 0.5
Reproduced:2 of 2 (100.0%)
Same Version:0 (0.0%)
Same OS:0 (0.0%)
From: r at v2u dot org Assigned: bukka (profile)
Status: Wont fix Package: FPM related
PHP Version: 5.5.34 OS: Centos 2.6.32-431.el6.x86_64
Private report: No CVE-ID: None
 [2016-04-19 08:27 UTC] r at v2u dot org
Description:
------------
In cli mode the script works fine, but in php-fpm mode the fpm process crash on request finished.

Version and file:
https://github.com/php/php-src/blob/PHP-5.5.33/sapi/fpm/fpm/fastcgi.c#L1073
https://github.com/php/php-src/blob/PHP-5.6.20/sapi/fpm/fpm/fastcgi.c#L1073

compiling arguments:
--prefix=/opt/php5.5 --with-config-file-path=/opt/php5.5/etc --with-mysql --enable-pdo --with-pdo-mysql=/home/pubsrv/mysql-5.5.22 --with-mysqli=/home/pubsrv/mysql-5.5.22/bin/mysql_config --with-iconv-dir=/usr/local/ --enable-fpm --with-pcre-regex --with-zlib --with-bz2 --enable-soap --enable-inline-optimization --enable-mbregex --enable-calendar --with-curl --enable-dba --with-libxml-dir --with-openssl --enable-ftp --with-gd --with-jpeg-dir --with-png-dir --with-zlib-dir --with-freetype-dir --enable-gd-native-ttf --enable-gd-jis-conv --with-mhash --enable-mbstring --with-mcrypt --enable-pcntl --enable-xml --enable-shmop --enable-sockets --enable-zip --with-libdir=lib6 --enable-maintainer-zts --enable-debug

backtrace:

#0  fcgi_finish_request (req=0x0, force_close=force_close@entry=0) at /usr/local/src/php-5.5.33/sapi/fpm/fpm/fastcgi.c:1073
#1  0x00000000007c9bfe in sapi_cgi_deactivate (tsrm_ls=<optimized out>) at /usr/local/src/php-5.5.33/sapi/fpm/fpm/fpm_main.c:851
#2  0x0000000000696865 in sapi_deactivate (tsrm_ls=tsrm_ls@entry=0x271b5f0) at /usr/local/src/php-5.5.33/main/SAPI.c:536
#3  0x000000000068d06a in php_request_shutdown (dummy=dummy@entry=0x271b5f0) at /usr/local/src/php-5.5.33/main/main.c:1822
#4  0x00007f44b6fd1863 in php_runkit_sandbox_dtor (objval=0x7f44bfaa23b8, tsrm_ls=<optimized out>) at /usr/local/src/runkit/runkit_sandbox.c:1804
#5  0x0000000000726dc8 in zend_objects_store_del_ref_by_handle_ex (handle=1, handlers=<optimized out>, tsrm_ls=tsrm_ls@entry=0x24fb090) at /usr/local/src/php-5.5.33/Zend/zend_objects_API.c:226
#6  0x0000000000726e1e in zend_objects_store_del_ref (zobject=0x7f44bfaa21e8, tsrm_ls=0x24fb090) at /usr/local/src/php-5.5.33/Zend/zend_objects_API.c:178
#7  0x00000000006e96d0 in _zval_dtor (zvalue=0x7f44bfaa21e8) at /usr/local/src/php-5.5.33/Zend/zend_variables.h:35
#8  i_zval_ptr_dtor (zval_ptr=0x7f44bfaa21e8) at /usr/local/src/php-5.5.33/Zend/zend_execute.h:81
#9  _zval_ptr_dtor (zval_ptr=<optimized out>) at /usr/local/src/php-5.5.33/Zend/zend_execute_API.c:423
#10 0x0000000000708355 in zend_hash_apply_deleter (ht=ht@entry=0x24fe8d8, p=p@entry=0x7f44bfaa2468) at /usr/local/src/php-5.5.33/Zend/zend_hash.c:650
#11 0x0000000000709f5b in zend_hash_reverse_apply (ht=0x24fe8d8, apply_func=apply_func@entry=0x6e9650 <zval_call_destructor>, tsrm_ls=tsrm_ls@entry=0x24fb090) at /usr/local/src/php-5.5.33/Zend/zend_hash.c:804
#12 0x00000000006e9c8e in shutdown_destructors (tsrm_ls=tsrm_ls@entry=0x24fb090) at /usr/local/src/php-5.5.33/Zend/zend_execute_API.c:214
#13 0x00000000006fadf7 in zend_call_destructors (tsrm_ls=tsrm_ls@entry=0x24fb090) at /usr/local/src/php-5.5.33/Zend/zend.c:930
#14 0x000000000068cfe2 in php_request_shutdown (dummy=dummy@entry=0x0) at /usr/local/src/php-5.5.33/main/main.c:1754
#15 0x0000000000424685 in main (argc=<optimized out>, argv=<optimized out>) at /usr/local/src/php-5.5.33/sapi/fpm/fpm/fpm_main.c:1981





Test script:
---------------
<?php 
new Runkit_Sandbox([]) 
?>


Expected result:
----------------
don't crash the php-fpm processes.
no memory leaks.

Actual result:
--------------
don't crash now, but don't know if this patch is the right solution.

Patches

fpm-dangling-pointer (last revision 2016-04-19 08:28 UTC by r at v2u dot org)

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2023-04-10 14:08 UTC] bukka@php.net
-Status: Open +Status: Wont fix
 [2023-04-10 14:08 UTC] bukka@php.net
I had a look on this one and the Runkit_Sandbox wasn't really compatible with FPM so that would require some further work to integrate it correctly. I think it has no business to call php_request_shutdown in the first place. Anyway this extension no longer works with PHP 7+ and there is runkit7 that removed the sandbox support so this is no longer an issue.

I also thought about the patch from the generic point of view and we would really need to see the use case for supporting request shutdown out of PHP-FPM. It is probably better to not do that check as this crash can be sort of a good thing as it might show that there is some bigger problem that needs to be addressed in the extension.
 [2023-04-10 14:08 UTC] bukka@php.net
-Assigned To: +Assigned To: bukka
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Mon Oct 07 02:01:27 2024 UTC