Skip to content

PHP 8.0.20 (ZTS) zend_signal_handler_defer crashes on apache #8789

Closed
@gavgavych

Description

@gavgavych

Description

PHP (zts) and Apache build:

httpd -V
Server version: Apache/2.4.54 (Unix)
Server built:   Jun 14 2022 17:15:53
Server's Module Magic Number: 20120211:124
Server loaded:  APR 1.7.0, APR-UTIL 1.6.1, PCRE 8.39 2016-06-14
Compiled using: APR 1.7.0, APR-UTIL 1.6.1, PCRE 8.39 2016-06-14
Architecture:   64-bit
Server MPM:     event
  threaded:     yes (fixed thread count)
    forked:     yes (variable process count)
php --version
PHP 8.0.20 (cli) (built: Jun 14 2022 17:24:49) ( ZTS )
Copyright (c) The PHP Group
Zend Engine v4.0.20, Copyright (c) Zend Technologies
    with Zend OPcache v8.0.20, Copyright (c), by Zend Technologies
    with SourceGuardian v13.0.2, Copyright (c) 2000-2022, by SourceGuardian Ltd.

The following code:

info.php:

<?php

phpinfo();
$: wrk -t 3 -c 3 -d 20 "http://localhost/info.php"

Resulted in this output:

gdb:

Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007f1f4a448da4 in zend_signal_handler_defer (signo=1, siginfo=0x7f1f0f7cd830, context=0x7f1f0f7cd700) at /php/Zend/zend_signal.c:96
96    /php/Zend/zend_signal.c: No such file or directory.
[Current thread is 1 (Thread 0x7f1f0f7ce700 (LWP 7751))]
(gdb) bt
#0  0x00007f1f4a448da4 in zend_signal_handler_defer (signo=1, siginfo=0x7f1f0f7cd830, context=0x7f1f0f7cd700) at /php/Zend/zend_signal.c:96
#1  <signal handler called>
#2  __pthread_kill (threadid=<optimized out>, signo=1) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
#3  0x00007f1f4acab4e2 in wakeup_listener () from /opt/server/lib/webmanager/mod_mpm_event.so
#4  0x00007f1f4acab51c in signal_threads () from /opt/server/lib/webmanager/mod_mpm_event.so
#5  0x00007f1f4acad4d0 in check_infinite_requests () from /opt/server/lib/webmanager/mod_mpm_event.so
#6  0x00007f1f4acae541 in listener_thread () from /opt/server/lib/webmanager/mod_mpm_event.so
#7  0x000055644d671f09 in thread_start ()
#8  0x00007f1f4af44ea7 in start_thread (arg=<optimized out>) at pthread_create.c:477
#9  0x00007f1f4ae74def in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
Slice: system.slice
Boot ID: 10b358fb6fbd4abfac2ee9b9a6f14cca
Machine ID: ff5db65b2db34c9cbf8de05ba4d322e6
Hostname: debian
Storage: /var/lib/systemd/coredump/core.httpd.998.10b358fb6fbd4abfac2ee9b9a6f14cca.7649.1655302730000000.zst
 Message: Process 7649 (httpd) of user 998 dumped core.                
                Stack trace of thread 7751:
                #0  0x00007f1f4a448da4 zend_signal_handler_defer (libphp.so + 0x406da4)
                #1  0x00007f1f4af50140 __restore_rt (libpthread.so.0 + 0x14140)
                #2  0x00007f1f4af4cf44 __pthread_kill (libpthread.so.0 + 0x10f44)
                #3  0x00007f1f4acab4e2 wakeup_listener (mod_mpm_event.so + 0x54e2)
                #4  0x00007f1f4acab51c signal_threads (mod_mpm_event.so + 0x551c)
                #5  0x00007f1f4acad4d0 check_infinite_requests (mod_mpm_event.so + 0x74d0)
                #6  0x00007f1f4acae541 listener_thread (mod_mpm_event.so + 0x8541)
                #7  0x000055644d671f09 thread_start (httpd + 0x43f09)
                #8  0x00007f1f4af44ea7 start_thread (libpthread.so.0 + 0x8ea7)
                #9  0x00007f1f4ae74def __clone (libc.so.6 + 0xfddef)
                
                Stack trace of thread 7733:
                #0  0x00007f1f4af4b7b2 futex_wait_cancelable (libpthread.so.0 + 0xf7b2)
                #1  0x000055644d6b2b05 ap_queue_pop_something (httpd + 0x84b05)
                #2  0x00007f1f4acb020d worker_thread (mod_mpm_event.so + 0xa20d)
                #3  0x000055644d671f09 thread_start (httpd + 0x43f09)
                #4  0x00007f1f4af44ea7 start_thread (libpthread.so.0 + 0x8ea7)
                #5  0x00007f1f4ae74def __clone (libc.so.6 + 0xfddef)
                
                Stack trace of thread 7649:
                #0  0x00007f1f4af4f08c __libc_read (libpthread.so.0 + 0x1308c)
                #1  0x000055644d6b12cc ap_mpm_podx_check (httpd + 0x832cc)
                #2  0x00007f1f4acb1abf child_main (mod_mpm_event.so + 0xbabf)
                #3  0x00007f1f4acb1ff7 make_child (mod_mpm_event.so + 0xbff7)
                #4  0x00007f1f4acb208e startup_children (mod_mpm_event.so + 0xc08e)
                #5  0x00007f1f4acb3192 server_main_loop (mod_mpm_event.so + 0xd192)
                #6  0x00007f1f4acb357f event_run (mod_mpm_event.so + 0xd57f)
                #7  0x000055644d67344d ap_run_mpm (httpd + 0x4544d)
                #8  0x000055644d669555 main (httpd + 0x3b555)
                #9  0x00007f1f4ad9dd0a __libc_start_main (libc.so.6 + 0x26d0a)
                #10 0x000055644d6675ba _start (httpd + 0x395ba)
                
                Stack trace of thread 7650:
                #0  0x00007f1f4af4b7b2 futex_wait_cancelable (libpthread.so.0 + 0xf7b2)
                #1  0x00007f1f4a799c11 get_next (mod_http2.so + 0x46c11)
                #2  0x00007f1f4a799dd2 slot_run (mod_http2.so + 0x46dd2)
                #3  0x000055644d671f09 thread_start (httpd + 0x43f09)
                #4  0x00007f1f4af44ea7 start_thread (libpthread.so.0 + 0x8ea7)
                #5  0x00007f1f4ae74def __clone (libc.so.6 + 0xfddef)
                
                Stack trace of thread 7651:
                #0  0x00007f1f4af4b7b2 futex_wait_cancelable (libpthread.so.0 + 0xf7b2)
                #1  0x00007f1f4a799c11 get_next (mod_http2.so + 0x46c11)
                #2  0x00007f1f4a799dd2 slot_run (mod_http2.so + 0x46dd2)
                #3  0x000055644d671f09 thread_start (httpd + 0x43f09)
                #4  0x00007f1f4af44ea7 start_thread (libpthread.so.0 + 0x8ea7)
                #5  0x00007f1f4ae74def __clone (libc.so.6 + 0xfddef)
                
                Stack trace of thread 7652:
                #0  0x00007f1f4af4b7b2 futex_wait_cancelable (libpthread.so.0 + 0xf7b2)
                #1  0x00007f1f4a799c11 get_next (mod_http2.so + 0x46c11)
                #2  0x00007f1f4a799dd2 slot_run (mod_http2.so + 0x46dd2)
                #3  0x000055644d671f09 thread_start (httpd + 0x43f09)
                #4  0x00007f1f4af44ea7 start_thread (libpthread.so.0 + 0x8ea7)
                #5  0x00007f1f4ae74def __clone (libc.so.6 + 0xfddef)
                
                Stack trace of thread 7653:
                #0  0x00007f1f4af4b7b2 futex_wait_cancelable (libpthread.so.0 + 0xf7b2)
                #1  0x00007f1f4a799c11 get_next (mod_http2.so + 0x46c11)
                #2  0x00007f1f4a799dd2 slot_run (mod_http2.so + 0x46dd2)
                #3  0x000055644d671f09 thread_start (httpd + 0x43f09)
                #4  0x00007f1f4af44ea7 start_thread (libpthread.so.0 + 0x8ea7)
                #5  0x00007f1f4ae74def __clone (libc.so.6 + 0xfddef)
                
                Stack trace of thread 7654:
                #0  0x00007f1f4af4b7b2 futex_wait_cancelable (libpthread.so.0 + 0xf7b2)
                #1  0x00007f1f4a799c11 get_next (mod_http2.so + 0x46c11)
                #2  0x00007f1f4a799dd2 slot_run (mod_http2.so + 0x46dd2)
                #3  0x000055644d671f09 thread_start (httpd + 0x43f09)
                #4  0x00007f1f4af44ea7 start_thread (libpthread.so.0 + 0x8ea7)
                #5  0x00007f1f4ae74def __clone (libc.so.6 + 0xfddef)
                
                Stack trace of thread 7655:
                #0  0x00007f1f4af4b7b2 futex_wait_cancelable (libpthread.so.0 + 0xf7b2)
                #1  0x00007f1f4a799c11 get_next (mod_http2.so + 0x46c11)
                #2  0x00007f1f4a799dd2 slot_run (mod_http2.so + 0x46dd2)
                #3  0x000055644d671f09 thread_start (httpd + 0x43f09)
                #4  0x00007f1f4af44ea7 start_thread (libpthread.so.0 + 0x8ea7)
                #5  0x00007f1f4ae74def __clone (libc.so.6 + 0xfddef)

PHP Version

PHP 8.0.20

Operating System

Debian 11

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions