Skip to content

Use HTTP 2.4.54 to load PHP-8.1.9, and frequently call a certain PHP interface to cause a core dump. The core dump error log is AH00051: child pid 6663 exit signal Segmentation fault(11) #9337

Closed
@zqtop

Description

@zqtop

Description

Recurrence condition:

I have an httpd server, its version number is 2.4.54, the working mode is event, in order to prevent the httpd memory from occupying for a long time and not being released, I enabled the httpd-mpm.conf configuration file, and I modified the value of MaxConnectionsPerChild to a specific value, when its value is set to a small value, such as 10, the specific configuration is as follows:

StartServers 5 ServerLimit 10 ThreadLimit 200 MinSpareThreads 75 MaxSpareThreads 250 ThreadsPerChild 25 MaxRequestWorkers 400 MaxConnectionsPerChild 10 MaxClients 250

I wrote a simple test case on thinkphp V6.0.12 base framework using PHP 8.1.9,the code is as follows

<?php
namespace app\index\controller;
Class Test
{
   public function myTest()
   {

       $result=file_get_contents("/home/ivstool/version/version.xml");
       return json([
           "status" => 0,
           "resultCode" => 0,
           "msg" => 'SUCCESS',
           "data" => $result
           ]
       );

   }
    public function info() {
          phpinfo();
    }
}
?>

After completing the above basic conditions, I wrote a simple multi-threaded httpd request example using python's multi-threading, the code is as follows:
import requests
import threading
import json

class CoreTest:

    def __init__(self):
        self.ip ="Server IP address"
        requestSession = requests.session()
        self.session = requestSession
        self.headers = {
            'Host': self.ip,
            'User-Agent': 'Mozilla/5.0 (Windows NT 6.2; rv:16.0) Gecko/20100101 Firefox/16.0',
            'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
            'Connection': 'keep-alive',
            'referer': "https://{0}".format(self.ip)+":8443/"
        }
        for i in range(0,100):
            self.task('thread_{0}'.format(str(i)))

    def task(self, thread_name):
        print('I am' + thread_name + 'doing test work....')
        url = "https://{0}".format(self.ip)+":8443/index/Test/myTest"
        response = self.session.get(url=url, verify=False, headers= self.headers)
        print(response.text)

When this use case runs for a period of time, the longer the better, a surprising phenomenon occurs, PHP generates a segmentation fault, I can see that multiple core files are generated in the core dump directory, and I use the GDB tool to trace core file information, get the following stack information

Resulted in this output:

warning: File "/usr/lib64/libthread_db-1.0.so" auto-loading has been declined by your `auto-load safe-path' set to "$debugdir:$datadir/auto-load".
To enable execution of this file add
        add-auto-load-safe-path /usr/lib64/libthread_db-1.0.so
line to your configuration file "/root/.gdbinit".
To completely disable this security protection add
        set auto-load safe-path /
line to your configuration file "/root/.gdbinit".
For more information about this security protection see the
"Auto-loading safe path" section in the GDB manual.  E.g., run from the shell:
        info "(gdb)Auto-loading safe path"

warning: Unable to find libthread_db matching inferior's thread library, thread debugging will not be available.
bt

warning: File "/usr/lib64/libthread_db-1.0.so" auto-loading has been declined by your `auto-load safe-path' set to "$debugdir:$datadir/auto-load".

warning: Unable to find libthread_db matching inferior's thread library, thread debugging will not be available.
Core was generated by `/home/ivs_omu_portal/httpd/bin/httpd'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x0000ffffb5a194b8 in zend_signal_handler_defer (signo=1, siginfo=0xffffa2feb610, context=0xffffa2feb690)
    at /home/ivs_omu_portal/install/php-src-php-8.1.9/Zend/zend_signal.c:96
96      /home/ivs_omu_portal/install/php-src-php-8.1.9/Zend/zend_signal.c: No such file or directory.
[Current thread is 1 (LWP 1333780)]
(gdb) bt
#0  0x0000ffffb5a194b8 in zend_signal_handler_defer (signo=1, siginfo=0xffffa2feb610, context=0xffffa2feb690)
    at /home/ivs_omu_portal/install/php-src-php-8.1.9/Zend/zend_signal.c:96
#1  <signal handler called>
#2  0x0000ffffb6e2dd70 in pthread_kill () from /usr/lib64/libpthread.so.0
#3  0x000000000047641c in wakeup_listener () at event.c:605
#4  0x00000000004764ec in signal_threads (mode=mode@entry=1) at event.c:628
#5  0x000000000047a508 in signal_threads (mode=1) at event.c:619
#6  check_infinite_requests () at event.c:1251
#7  listener_thread (thd=0xffffa2fed1d0, dummy=<optimized out>) at event.c:1679
#8  0x0000ffffb6e267b0 in ?? () from /usr/lib64/libpthread.so.0
#9  0x0000ffffb6d5c23c in ?? () from /usr/lib64/libc.so.6

But I expected this output instead:

no core storage file

PHP Version

PHP-8.1.9

Operating System

Euler

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions