php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #78796 Zend lex_scan BUS error
Submitted: 2019-11-08 20:51 UTC Modified: 2019-11-08 20:59 UTC
From: tannerp at supermicro dot com Assigned:
Status: Duplicate Package: Apache2 related
PHP Version: 7.2.24 OS: CentOS 7.6.1810
Private report: No CVE-ID: None
 [2019-11-08 20:51 UTC] tannerp at supermicro dot com
Description:
------------
The Setup is as follows:
Host environment is Kubernetes
Host supplimentary tool is HAProxy for health checking and load balancing.
a container with a derived image of CentOS 7.6.1810
the use of the Remi-repository for PHP 7.2.24

I am encountering an issue where apache 2 will crash with a BUS error

"[core:notice] [pid 13] AH00051: child pid 108 exit signal Bus error (7)"

These happen about 10 times per day. We can increase the frequency of the error if we run the http health check from HAProxy which does a basic http connection to the server.

Everything said web server still appears to be running fine, but we have it only open for internal use so its hard to gauge the actual impact of these crashes.

I ran a gdb on a few of the core dumps. The error differs but the bug always happens somewhere with a lex_scan call from the Zend library.

If any additional info is needed please let me know. 
I figured I'd report this issue for visibility.

Regards,

Tanner Posada



Test script:
---------------
No easy reproduce code.

Actual result:
--------------
Sample Backtrace:


#0  lex_scan (zendlval=zendlval@entry=0x7ffcfe6dedc0) at Zend/zend_language_scanner.c:7565
7565            if (yych == '<') goto yy801;


(gdb) bt full

#0  lex_scan (zendlval=zendlval@entry=0x7ffcfe6dedc0) at Zend/zend_language_scanner.c:7565
        yych = <error reading variable yych (Cannot access memory at address 0x7f434cdf1000)>
        yyaccept = 0
        start_line = 1
#1  0x00007f4348218234 in zendlex (elem=elem@entry=0x7ffcfe6dee90) at /usr/src/debug/php-7.2.24/Zend/zend_compile.c:1728
        zv = {value = {lval = 139926675799264, dval = 6.9132963449182091e-310, counted = 0x7f4337ce3ce0, str = 0x7f4337ce3ce0, arr = 0x7f4337ce3ce0, obj = 0x7f4337ce3ce0, res = 0x7f4337ce3ce0, ref = 0x7f4337ce3ce0,
            ast = 0x7f4337ce3ce0, zv = 0x7f4337ce3ce0, ptr = 0x7f4337ce3ce0, ce = 0x7f4337ce3ce0, func = 0x7f4337ce3ce0, ww = {w1 = 936262880, w2 = 32579}}, u1 = {v = {type = 0 '\000', type_flags = 0 '\000', const_flags = 0 '\000',
              reserved = 0 '\000'}, type_info = 0}, u2 = {next = 4003537210, cache_slot = 4003537210, lineno = 4003537210, num_args = 4003537210, fe_pos = 4003537210, fe_iter_idx = 4003537210, access_flags = 4003537210,
            property_guard = 4003537210, extra = 4003537210}}
        retval = <optimized out>
        start_lineno = 1


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2019-11-08 20:59 UTC] nikic@php.net
-Status: Open +Status: Duplicate
 [2019-11-08 20:59 UTC] nikic@php.net
Very likely duplicate of bug #52752.

This is fixed in PHP 7.4 in the sense that it will no longer cause a bus error, but the root cause is that you are concurrently modifying a file and trying to include it at the same time. Possibly you have some cache based on writing PHP files? This should be avoided (e.g. by using flock) as you may end up including a partially modified file.
 
PHP Copyright © 2001-2019 The PHP Group
All rights reserved.
Last updated: Thu Dec 12 16:01:24 2019 UTC