Skip to content

Segmentation fault in fpm_status_export_to_zval #12705

Closed

Description

@pprasse

Description

We noticed a segmentation fault once in a while (about every 1-2 days) in fpm_status_export_to_zval:
child 42587 exited on signal 11 (SIGSEGV - core dumped) after 102557.206146 seconds from start

gdb revealed it is in fpm_status_export_to_zval:

gdb /usr/sbin/php-fpm core-php-fpm-42587
(gdb) bt
#0  __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:74
#1  0x0000555a44410c8e in format_converter (odp=0x7ffc26f89ff0, fmt=0x555a450f542f "s] status: scoreboard already in use.", ap=0x7ffc26f8a0a0) at /usr/src/php-src/main/snprintf.c:844
#2  0x0000555a44411724 in strx_printv (buf=0x7ffc26f8a120 "[pool ", len=2048, format=0x555a450f5428 "[pool %s] status: scoreboard already in use.", ap=0x7ffc26f8a0a0) at /usr/src/php-src/main/snprintf.c:1094
#3  0x0000555a444119f7 in ap_php_vsnprintf (buf=0x7ffc26f8a120 "[pool ", len=2048, format=0x555a450f5428 "[pool %s] status: scoreboard already in use.", ap=0x7ffc26f8a0a0) at /usr/src/php-src/main/snprintf.c:1143
#4  0x0000555a44654530 in zlog_external (flags=2, buf=0x7ffc26f8a120 "[pool ", buf_size=2048, fmt=0x555a450f5428 "[pool %s] status: scoreboard already in use.", args=0x7ffc26f8a960)
    at /usr/src/php-src/sapi/fpm/fpm/zlog.c:143
#5  0x0000555a44654888 in vzlog (function=0x555a450f6d90 <__func__.4> "fpm_status_export_to_zval", line=58, flags=2, fmt=0x555a450f5428 "[pool %s] status: scoreboard already in use.", args=0x7ffc26f8a960)
    at /usr/src/php-src/sapi/fpm/fpm/zlog.c:202
#6  0x0000555a44654c2e in zlog_ex (function=0x555a450f6d90 <__func__.4> "fpm_status_export_to_zval", line=58, flags=2, fmt=0x555a450f5428 "[pool %s] status: scoreboard already in use.")
    at /usr/src/php-src/sapi/fpm/fpm/zlog.c:258
#7  0x0000555a4464fbad in fpm_status_export_to_zval (status=0x7f7844e194a0) at /usr/src/php-src/sapi/fpm/fpm/fpm_status.c:58
#8  0x0000555a44647db1 in zif_fpm_get_status (execute_data=0x7f7844e194d0, return_value=0x7f7844e194a0) at /usr/src/php-src/sapi/fpm/fpm/fpm_main.c:1516
#9  0x0000555a444f9ece in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER () at /usr/src/php-src/Zend/zend_vm_execute.h:1312
#10 0x0000555a44572ad8 in execute_ex (ex=0x7f7844e19020) at /usr/src/php-src/Zend/zend_vm_execute.h:56032
#11 0x0000555a44578316 in zend_execute (op_array=0x7f7844e6f000, return_value=0x0) at /usr/src/php-src/Zend/zend_vm_execute.h:60396
#12 0x0000555a444b72b5 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/src/php-src/Zend/zend.c:1827
#13 0x0000555a4440e7f6 in php_execute_script (primary_file=0x7ffc26f8c380) at /usr/src/php-src/main/main.c:2542
#14 0x0000555a44648a70 in main (argc=8, argv=0x7ffc26f8c828) at /usr/src/php-src/sapi/fpm/fpm/fpm_main.c:1924

Looking at the source:

(gdb) frame 7
#7  0x0000555a4464fbad in fpm_status_export_to_zval (status=0x7f7844e194a0) at /usr/src/php-src/sapi/fpm/fpm/fpm_status.c:58
58			zlog(ZLOG_NOTICE, "[pool %s] status: scoreboard already in use.", scoreboard_p->pool);
(gdb) list 50,60
50		zval fpm_proc_stats, fpm_proc_stat;
51		time_t now_epoch;
52		struct timeval duration, now;
53		double cpu;
54		int i;
55	
56		scoreboard_p = fpm_scoreboard_acquire(NULL, 1);
57		if (!scoreboard_p) {
58			zlog(ZLOG_NOTICE, "[pool %s] status: scoreboard already in use.", scoreboard_p->pool);
59			return -1;
60		}

It is obvious that scoreboard_p is already known to be NULL and the result of using scoreboard_p->pool in zlog must lead to a segfault.

I'll submit a pull-request with the fix soon.

PHP Version

all with php-fpm

Operating System

all

Activity

  1. added a commit that references this issue on Dec 1, 2023
  2. bukka commented on Dec 1, 2023

    @bukka
    Member

    Fixed by df259f8

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions