Opcache bad signal 139 crash in ZTS bookworm (frankenphp) #16727

Activity

1. AlliBalliBaba

   added

   Bug

   Status: Needs Triage

   on Nov 7, 2024
2. ndossche commented on Nov 8, 2024

   

   ndossche

   on Nov 8, 2024

   Member

   More actions

   That shouldn't be a problem. Also the trace shows heap corruption.
   Can you please give more steps on how to run the reproducer? I have no experience with FrankenPHP, note that it's also possible that the issue is in there...

   👍React with 👍1Reacted by Christoph M. Becker
3. ndossche

   added

   Status: Needs Feedback

   and removed

   Status: Needs Triage

   on Nov 8, 2024
4. AlliBalliBaba commented on Nov 8, 2024

   

   AlliBalliBaba

   on Nov 8, 2024

   Author

   More actions

   I'll try to create a consistent reproducer

   👍React with 👍1Reacted by Nora Dossche
5. AlliBalliBaba commented on Nov 9, 2024

   

   AlliBalliBaba

   on Nov 9, 2024

   Author

   More actions

   Here's a Dockerfile with Laravel/FrankenPHP that should reproduce the crash. Laravel uses a cli script with pcntl to control the frankenPHP process (might also be related).
   All I know is if I replace opcache.enable=1 with opcache.enable=0, the crash won't happen. It's also possible though that disabling opcache will slow the process down enough to avoid the race condition.

   Steps to reproduce:

   • Put the following into a Dockerfile (I'll call it laravel.Dockerfile)
   • Build the dockerfile docker build -t lara-fr-php -f laravel.Dockerfile .
   • Run the dockerfile (exposing the port isn't strictly necessary for the crash) docker run -it -p 8888:80 lara-fr-php
   • Start and stop the docker a few times to eventually get the crash (core dump)

   FROM dunglas/frankenphp
   
   # install git
   RUN apt-get update && apt-get install -y --no-install-recommends git
   
   # install composer and pcntl
   RUN install-php-extensions @composer pcntl
   
   # install empty laravel + octane application
   WORKDIR /app
   RUN rm -r ./* && \
       git clone https://github.com/laravel/laravel.git . && \
   	composer install && \
       cp .env.example .env && \
       php artisan key:generate && \
       composer require laravel/octane && \
       php artisan octane:install --server=frankenphp
   
   # enable opcache
   RUN cp $PHP_INI_DIR/php.ini-development $PHP_INI_DIR/php.ini && \
       echo "zend_extension=opcache.so" >> $PHP_INI_DIR/php.ini && \
       echo "opcache.enable=1" >> $PHP_INI_DIR/php.ini
   
   ENV APP_ENV=production \
       SESSION_DRIVER=array
   
   # start the server
   ENTRYPOINT ["php", "artisan", "octane:frankenphp", "--port=80", "--host=localhost", "--admin-port=2019"]
   

   ---

   For PHP with debug symbols, you can also add this somewhere in the Dockerfile (haven't tried these exact instructions):

   ENV PHPIZE_DEPS="\
   	autoconf \
   	dpkg-dev \
   	file \
   	g++ \
   	gcc \
   	libc-dev \
   	make \
   	pkg-config \
   	re2c"
   
   SHELL ["/bin/bash", "-o", "pipefail", "-c"]
   
   # hadolint ignore=DL3009
   RUN apt-get update && \
   	apt-get -y --no-install-recommends install \
   	$PHPIZE_DEPS \
   	libargon2-dev \
   	bison \
   	# Dev tools \
   	git \
   	clang \
   	cmake \
   	llvm \
   	gdb \
   	valgrind \
   	zsh \
   	libtool-bin && \
   	echo 'set auto-load safe-path /' > /root/.gdbinit && \
   	echo '* soft core unlimited' >> /etc/security/limits.conf \
   	&& \
   	apt-get clean 
   WORKDIR /usr/local/src/php
   RUN git clone --branch=PHP-8.3 https://github.com/php/php-src.git . && \
   	# --enable-embed is only necessary to generate libphp.so, we don't use this SAPI directly
   	./buildconf --force && \
   	./configure \
   		--enable-embed \
   		--enable-zts \
   		--disable-zend-signals \
   		--enable-zend-max-execution-timers \
   		--enable-debug && \
   	make -j"$(nproc)" && \
   	make install && \
   	ldconfig && \
   	cp php.ini-development /usr/local/lib/php.ini && \
   	echo "zend_extension=opcache.so" >> /usr/local/lib/php.ini && \
   	echo "opcache.enable=1" >> /usr/local/lib/php.ini && \
   	php --version
   
6. ndossche commented on Nov 9, 2024

   

   ndossche

   on Nov 9, 2024

   Member

   More actions

   Thanks a lot! I can reproduce the signal 139, I'll check what's going on and whether the bug is in PHP or somewhere else.
7. ndossche

   added

   Status: Needs Triage

   and removed

   Status: Needs Feedback

   on Nov 9, 2024
8. ndossche commented on Nov 9, 2024

   

   ndossche

   on Nov 9, 2024

   Member

   More actions

   I can reliably get it to crash with the setting opcache.protect_memory=1. I.e. write failures into SHM. I wonder whether this happens because the memory mappings are per process and multiple threads may race to compile at the same time. This could cause the following:

   T1                                           T2
   ...                                          ...
   SHM_UNPROTECT
                                                SHM_PROTECT
   WRITE <<< problem
                                                SHM_UNPROTECT
   

      INFO  ==182594==ERROR: AddressSanitizer: SEGV on unknown address 0x000041af8ff0 (pc 0x7ca3eb67154a bp 0x7ca3ea9fe010 sp 0x7ca3ea9fde70 T14).  
   
      INFO  ==182594==The signal is caused by a WRITE memory access.  
      INFO  AddressSanitizer:DEADLYSIGNAL.  
      INFO  AddressSanitizer:DEADLYSIGNAL.  
      INFO  #0 0x7ca3eb67154a in persistent_compile_file /usr/local/src/php/ext/opcache/ZendAccelerator.c:2175.  
      INFO  #1 0x7ca43eb65143 in compile_filename Zend/zend_language_scanner.l:704.  
      INFO  #2 0x7ca43ed3fe5b in zend_include_or_eval /usr/local/src/php/Zend/zend_execute.c:4946.  
      INFO  #3 0x7ca43ed70586 in ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER /usr/local/src/php/Zend/zend_vm_execute.h:4985.  
      INFO  #4 0x7ca43eeb8c94 in execute_ex /usr/local/src/php/Zend/zend_vm_execute.h:57625.  
      INFO  #5 0x7ca43eec8f46 in zend_execute /usr/local/src/php/Zend/zend_vm_execute.h:61604.  
      INFO  #6 0x7ca43eca34de in zend_execute_scripts /usr/local/src/php/Zend/zend.c:1895.  
      INFO  #7 0x7ca43eac8538 in php_execute_script /usr/local/src/php/main/main.c:2528.  
      INFO  #8 0x18d0f00 (/usr/local/bin/frankenphp+0x18d0f00).  
      INFO  AddressSanitizer can not provide additional info.  
      INFO  SUMMARY: AddressSanitizer: SEGV /usr/local/src/php/ext/opcache/ZendAccelerator.c:2175 in persistent_compile_file.  
      INFO  Thread T14 (php-1) created by T12 (php-main) here:  
      INFO  #0 0x7ca440049726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207.  
      INFO  #1 0x18d029a (/usr/local/bin/frankenphp+0x18d029a).  
      INFO  Thread T12 (php-main) created by T0 here:  
      INFO  #0 0x7ca440049726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207.  
      INFO  #1 0x18d0d07 (/usr/local/bin/frankenphp+0x18d0d07).  
      INFO  ==182594==ABORTING.  
   

   Anyway, that's likely not the root cause. I was able to get this UAF without opcache.protect_memory:

     INFO  ==182766==ERROR: AddressSanitizer: heap-use-after-free on address 0x61100041f2c8 at pc 0x7eb0bbcd7638 bp 0x7eb0615fbd50 sp 0x7eb0615fbd48.  
   
      INFO  READ of size 8 at 0x61100041f2c8 thread T24 (php-b).  
      INFO  #0 0x7eb0bbcd7637 in zend_string_hash_val /usr/local/src/php/Zend/zend_string.h:139.  
      INFO  #1 0x7eb0bbcdec39 in _zend_hash_add_or_update_i /usr/local/src/php/Zend/zend_hash.c:821.  
      INFO  #2 0x7eb0bbcdfed5 in zend_hash_add /usr/local/src/php/Zend/zend_hash.c:989.  
      INFO  #3 0x7eb0bbbf37cc in zend_hash_add_ptr Zend/zend_hash.h:653.  
      INFO  #4 0x7eb0bbc37134 in zend_compile_class_decl /usr/local/src/php/Zend/zend_compile.c:8229.  
      INFO  #5 0x7eb0bbc1a95f in zend_compile_new /usr/local/src/php/Zend/zend_compile.c:4876.  
      INFO  #6 0x7eb0bbc4abbe in zend_compile_expr_inner /usr/local/src/php/Zend/zend_compile.c:10513.  
      INFO  #7 0x7eb0bbc4af07 in zend_compile_expr /usr/local/src/php/Zend/zend_compile.c:10626.  
      INFO  #8 0x7eb0bbc447fe in zend_compile_array /usr/local/src/php/Zend/zend_compile.c:9766.  
      INFO  #9 0x7eb0bbc4ade6 in zend_compile_expr_inner /usr/local/src/php/Zend/zend_compile.c:10588.  
      INFO  #10 0x7eb0bbc4af07 in zend_compile_expr /usr/local/src/php/Zend/zend_compile.c:10626.  
      INFO  #11 0x7eb0bbc0e541 in zend_compile_assign /usr/local/src/php/Zend/zend_compile.c:3389.  
      INFO  #12 0x7eb0bbc4ab8e in zend_compile_expr_inner /usr/local/src/php/Zend/zend_compile.c:10507.  
      INFO  #13 0x7eb0bbc4af07 in zend_compile_expr /usr/local/src/php/Zend/zend_compile.c:10626.  
      INFO  #14 0x7eb0bbc4a5ea in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10466.  
      INFO  #15 0x7eb0bbc2882b in zend_compile_stmt_list /usr/local/src/php/Zend/zend_compile.c:6405.  
      INFO  #16 0x7eb0bbc4a392 in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10374.  
      INFO  #17 0x7eb0bbc32aac in zend_compile_func_decl /usr/local/src/php/Zend/zend_compile.c:7678.  
      INFO  #18 0x7eb0bbc4a4f0 in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10427.  
      INFO  #19 0x7eb0bbc2882b in zend_compile_stmt_list /usr/local/src/php/Zend/zend_compile.c:6405.  
      INFO  #20 0x7eb0bbc4a392 in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10374.  
      INFO  #21 0x7eb0bbc36642 in zend_compile_class_decl /usr/local/src/php/Zend/zend_compile.c:8164.  
      INFO  #22 0x7eb0bbc4a55e in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10442.  
      INFO  #23 0x7eb0bbc2882b in zend_compile_stmt_list /usr/local/src/php/Zend/zend_compile.c:6405.  
      INFO  #24 0x7eb0bbc4a392 in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10374.  
      INFO  #25 0x7eb0bbc2163c in zend_compile_if /usr/local/src/php/Zend/zend_compile.c:5643.  
      INFO  #26 0x7eb0bbc4a496 in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10414.  
      INFO  #27 0x7eb0bbc49f92 in zend_compile_top_stmt /usr/local/src/php/Zend/zend_compile.c:10352.  
      INFO  #28 0x7eb0bbc49bc3 in zend_compile_top_stmt /usr/local/src/php/Zend/zend_compile.c:10338.  
      INFO  #29 0x7eb0bbb642e1 in zend_compile Zend/zend_language_scanner.l:618.  
      INFO  #30 0x7eb0bbb64887 in compile_file Zend/zend_language_scanner.l:653.  
      INFO  #31 0x7eb0bb6910fd in phar_compile_file /usr/local/src/php/ext/phar/phar.c:3352.  
      INFO  #32 0x7eb06866cc44 in opcache_compile_file /usr/local/src/php/ext/opcache/ZendAccelerator.c:1817.  
      INFO  #33 0x7eb0686710fe in persistent_compile_file /usr/local/src/php/ext/opcache/ZendAccelerator.c:2147.  
      INFO  #34 0x7eb0bbb65143 in compile_filename Zend/zend_language_scanner.l:704.  
      INFO  #35 0x7eb0bbd3fe5b in zend_include_or_eval /usr/local/src/php/Zend/zend_execute.c:4946.  
      INFO  #36 0x7eb0bbe5a2f4 in ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER /usr/local/src/php/Zend/zend_vm_execute.h:39836.  
      INFO  #37 0x7eb0bbec4ca4 in execute_ex /usr/local/src/php/Zend/zend_vm_execute.h:60595.  
      INFO  #38 0x7eb0bbc5ecf8 in zend_call_function /usr/local/src/php/Zend/zend_execute_API.c:957.  
      INFO  #39 0x7eb0bbc60064 in zend_call_known_function /usr/local/src/php/Zend/zend_execute_API.c:1051.  
      INFO  #40 0x7eb0bb7c3ff4 in spl_perform_autoload /usr/local/src/php/ext/spl/php_spl.c:448.  
      INFO  #41 0x7eb0bbc61775 in zend_lookup_class_ex /usr/local/src/php/Zend/zend_execute_API.c:1221.  
      INFO  #42 0x7eb0bbc63678 in zend_fetch_class_by_name /usr/local/src/php/Zend/zend_execute_API.c:1740.  
      INFO  #43 0x7eb0bbd79254 in ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_CONST_HANDLER /usr/local/src/php/Zend/zend_vm_execute.h:6946.  
      INFO  #44 0x7eb0bbeb98e1 in execute_ex /usr/local/src/php/Zend/zend_vm_execute.h:57813.  
      INFO  #45 0x7eb0bbec8f46 in zend_execute /usr/local/src/php/Zend/zend_vm_execute.h:61604.  
      INFO  #46 0x7eb0bbca34de in zend_execute_scripts /usr/local/src/php/Zend/zend.c:1895.  
      INFO  #47 0x7eb0bbac8538 in php_execute_script /usr/local/src/php/main/main.c:2528.  
      INFO  #48 0x18d0f00 (/usr/local/bin/frankenphp+0x18d0f00).  
      INFO  #49 0x18cecc6 (/usr/local/bin/frankenphp+0x18cecc6).  
      INFO  #50 0x47d623 (/usr/local/bin/frankenphp+0x47d623).  
      INFO  0x61100041f2c8 is located 8 bytes inside of 208-byte region [0x61100041f2c0,0x61100041f390).  
   
      INFO  freed by thread T24 (php-b) here:  
      INFO  #0 0x7eb0bd0b76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52.  
      INFO  #1 0x7eb0bbbee429 in _efree_custom /usr/local/src/php/Zend/zend_alloc.c:2500.  
      INFO  #2 0x7eb0bbbee779 in _efree /usr/local/src/php/Zend/zend_alloc.c:2620.  
      INFO  #3 0x7eb06865af7c in zend_string_release /usr/local/src/php/Zend/zend_string.h:346.  
      INFO  #4 0x7eb0686604f0 in accel_new_interned_string_for_php /usr/local/src/php/ext/opcache/ZendAccelerator.c:569.  
      INFO  #5 0x7eb0bbbf9142 in zval_make_interned_string /usr/local/src/php/Zend/zend_compile.c:535.  
      INFO  #6 0x7eb0bbbf9296 in zend_insert_literal /usr/local/src/php/Zend/zend_compile.c:547.  
      INFO  #7 0x7eb0bbbf9730 in zend_add_literal /usr/local/src/php/Zend/zend_compile.c:568.  
      INFO  #8 0x7eb0bbc36f62 in zend_compile_class_decl /usr/local/src/php/Zend/zend_compile.c:8223.  
      INFO  #9 0x7eb0bbc1a95f in zend_compile_new /usr/local/src/php/Zend/zend_compile.c:4876.  
      INFO  #10 0x7eb0bbc4abbe in zend_compile_expr_inner /usr/local/src/php/Zend/zend_compile.c:10513.  
      INFO  #11 0x7eb0bbc4af07 in zend_compile_expr /usr/local/src/php/Zend/zend_compile.c:10626.  
      INFO  #12 0x7eb0bbc447fe in zend_compile_array /usr/local/src/php/Zend/zend_compile.c:9766.  
      INFO  #13 0x7eb0bbc4ade6 in zend_compile_expr_inner /usr/local/src/php/Zend/zend_compile.c:10588.  
      INFO  #14 0x7eb0bbc4af07 in zend_compile_expr /usr/local/src/php/Zend/zend_compile.c:10626.  
      INFO  #15 0x7eb0bbc0e541 in zend_compile_assign /usr/local/src/php/Zend/zend_compile.c:3389.  
      INFO  #16 0x7eb0bbc4ab8e in zend_compile_expr_inner /usr/local/src/php/Zend/zend_compile.c:10507.  
      INFO  #17 0x7eb0bbc4af07 in zend_compile_expr /usr/local/src/php/Zend/zend_compile.c:10626.  
      INFO  #18 0x7eb0bbc4a5ea in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10466.  
      INFO  #19 0x7eb0bbc2882b in zend_compile_stmt_list /usr/local/src/php/Zend/zend_compile.c:6405.  
      INFO  #20 0x7eb0bbc4a392 in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10374.  
      INFO  #21 0x7eb0bbc32aac in zend_compile_func_decl /usr/local/src/php/Zend/zend_compile.c:7678.  
      INFO  #22 0x7eb0bbc4a4f0 in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10427.  
      INFO  #23 0x7eb0bbc2882b in zend_compile_stmt_list /usr/local/src/php/Zend/zend_compile.c:6405.  
      INFO  #24 0x7eb0bbc4a392 in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10374.  
      INFO  #25 0x7eb0bbc36642 in zend_compile_class_decl /usr/local/src/php/Zend/zend_compile.c:8164.  
      INFO  #26 0x7eb0bbc4a55e in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10442.  
      INFO  #27 0x7eb0bbc2882b in zend_compile_stmt_list /usr/local/src/php/Zend/zend_compile.c:6405.  
      INFO  #28 0x7eb0bbc4a392 in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10374.  
      INFO  #29 0x7eb0bbc2163c in zend_compile_if /usr/local/src/php/Zend/zend_compile.c:5643.  
      INFO  previously allocated by thread T24 (php-b) here:  
      INFO  #0 0x7eb0bd0b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69.  
      INFO  #1 0x7eb0bbbf1372 in __zend_malloc /usr/local/src/php/Zend/zend_alloc.c:3128.  
      INFO  #2 0x7eb0bbbee2ac in _malloc_custom /usr/local/src/php/Zend/zend_alloc.c:2491.  
      INFO  #3 0x7eb0bbbee66c in _emalloc /usr/local/src/php/Zend/zend_alloc.c:2610.  
      INFO  #4 0x7eb0bbc72ea0 in zend_string_alloc /usr/local/src/php/Zend/zend_string.h:174.  
      INFO  #5 0x7eb0bbc8dbeb in zend_string_tolower_ex /usr/local/src/php/Zend/zend_operators.c:3058.  
      INFO  #6 0x7eb0bbbf498b in zend_string_tolower Zend/zend_operators.h:470.  
      INFO  #7 0x7eb0bbc35dfc in zend_compile_class_decl /usr/local/src/php/Zend/zend_compile.c:8109.  
      INFO  #8 0x7eb0bbc1a95f in zend_compile_new /usr/local/src/php/Zend/zend_compile.c:4876.  
      INFO  #9 0x7eb0bbc4abbe in zend_compile_expr_inner /usr/local/src/php/Zend/zend_compile.c:10513.  
      INFO  #10 0x7eb0bbc4af07 in zend_compile_expr /usr/local/src/php/Zend/zend_compile.c:10626.  
      INFO  #11 0x7eb0bbc447fe in zend_compile_array /usr/local/src/php/Zend/zend_compile.c:9766.  
      INFO  #12 0x7eb0bbc4ade6 in zend_compile_expr_inner /usr/local/src/php/Zend/zend_compile.c:10588.  
      INFO  #13 0x7eb0bbc4af07 in zend_compile_expr /usr/local/src/php/Zend/zend_compile.c:10626.  
      INFO  #14 0x7eb0bbc0e541 in zend_compile_assign /usr/local/src/php/Zend/zend_compile.c:3389.  
      INFO  #15 0x7eb0bbc4ab8e in zend_compile_expr_inner /usr/local/src/php/Zend/zend_compile.c:10507.  
      INFO  #16 0x7eb0bbc4af07 in zend_compile_expr /usr/local/src/php/Zend/zend_compile.c:10626.  
      INFO  #17 0x7eb0bbc4a5ea in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10466.  
      INFO  #18 0x7eb0bbc2882b in zend_compile_stmt_list /usr/local/src/php/Zend/zend_compile.c:6405.  
      INFO  #19 0x7eb0bbc4a392 in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10374.  
      INFO  #20 0x7eb0bbc32aac in zend_compile_func_decl /usr/local/src/php/Zend/zend_compile.c:7678.  
      INFO  #21 0x7eb0bbc4a4f0 in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10427.  
      INFO  #22 0x7eb0bbc2882b in zend_compile_stmt_list /usr/local/src/php/Zend/zend_compile.c:6405.  
      INFO  #23 0x7eb0bbc4a392 in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10374.  
      INFO  #24 0x7eb0bbc36642 in zend_compile_class_decl /usr/local/src/php/Zend/zend_compile.c:8164.  
      INFO  #25 0x7eb0bbc4a55e in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10442.  
      INFO  #26 0x7eb0bbc2882b in zend_compile_stmt_list /usr/local/src/php/Zend/zend_compile.c:6405.  
      INFO  #27 0x7eb0bbc4a392 in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10374.  
      INFO  #28 0x7eb0bbc2163c in zend_compile_if /usr/local/src/php/Zend/zend_compile.c:5643.  
      INFO  #29 0x7eb0bbc4a496 in zend_compile_stmt /usr/local/src/php/Zend/zend_compile.c:10414.  
      INFO  Thread T24 (php-b) created by T11 (php-main) here:  
      INFO  #0 0x7eb0bd049726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207.  
      INFO  #1 0x18d029a (/usr/local/bin/frankenphp+0x18d029a).  
      INFO  Thread T11 (php-main) created by T0 here:  
      INFO  #0 0x7eb0bd049726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207.  
      INFO  #1 0x18d0d07 (/usr/local/bin/frankenphp+0x18d0d07).  
      INFO  SUMMARY: AddressSanitizer: heap-use-after-free /usr/local/src/php/Zend/zend_string.h:139 in zend_string_hash_val.  
      INFO  Shadow bytes around the buggy address:  
      INFO  0x0c228007be00: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd.  
      INFO  0x0c228007be10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd.  
      INFO  0x0c228007be20: fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa.  
      INFO  0x0c228007be30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00.  
      INFO  0x0c228007be40: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa.  
      INFO  =>0x0c228007be50: fa fa fa fa fa fa fa fa fd[fd]fd fd fd fd fd fd.  
      INFO  0x0c228007be60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd.  
      INFO  0x0c228007be70: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa.  
      INFO  0x0c228007be80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00.  
      INFO  0x0c228007be90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa.  
      INFO  0x0c228007bea0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd.  
      INFO  Shadow byte legend (one shadow byte represents 8 application bytes):  
      INFO  Addressable: 00.  
      INFO  Partially addressable: 01 02 03 04 05 06 07 .  
      INFO  Heap left redzone: fa.  
      INFO  Freed heap region: fd.  
      INFO  Stack left redzone: f1.  
      INFO  Stack mid redzone: f2.  
      INFO  Stack right redzone: f3.  
      INFO  Stack after return: f5.  
      INFO  Stack use after scope: f8.  
      INFO  Global redzone: f9.  
      INFO  Global init order: f6.  
      INFO  Poisoned by user: f7.  
      INFO  Container overflow: fc.  
      INFO  Array cookie: ac.  
      INFO  Intra object redzone: bb.  
      INFO  ASan internal: fe.  
      INFO  Left alloca redzone: ca.  
      INFO  Right alloca redzone: cb.  
      INFO  ==182766==ABORTING.  
   
9. ndossche commented on Nov 9, 2024

   

   ndossche

   on Nov 9, 2024

   Last edited by ndossche

   Member

   More actions

   It took a stupidly long time to debug and figure out, but I think I got it now.
   @AlliBalliBaba can you please test the following patch in your environment? https://gist.github.com/nielsdos/9608932fe79ae76024135224498dccec It seems to work for me at least
   Dockerfile I used based on yours: https://gist.github.com/nielsdos/9acc7400f67ffd71a8e1f143021f259a but I changed the entrypoint to bash so I could enter the container and edit files. This Dockerfile also downloads the patch I linked and does a debug build of PHP.

   The explanation is as follows:

   1. We allocate a lower cased name for an anonymous class here:

      php-src/Zend/zend_compile.c

      Line 8109 in f97353f

      lcname = zend_string_tolower(name);

   2. This gets looked up as an interned string here:

      php-src/Zend/zend_compile.c

      Line 8112 in f97353f

      lcname = zend_new_interned_string(lcname);

      
      Assuming that there are uppercase symbols in the string and therefore lcname != name and that lcname is not yet in the interned string table, the pointer value of lcname won't change.
   3. Here we add the string into the interned string table

      php-src/Zend/zend_compile.c

      Line 8223 in f97353f

      LITERAL_STR(opline->op1, lcname);

      However, in the meantime another thread could've added the string into the interned string table. This means that the following code will run, indirectly called via the LITERAL_STR macro, freeing lcname:

      php-src/ext/opcache/ZendAccelerator.c

      Lines 572 to 575 in 62e53e6

      	if (ret) {
      	zend_string_release(str);
      	return ret;
      	}

   4. In the reproducer we then access the freed lcname string here:

      php-src/Zend/zend_compile.c

      Line 8229 in f97353f

      if (!zend_hash_add_ptr(CG(class_table), lcname, ce)) {

   This is solved in my patch by retrieving the interned string pointer and putting it in lcname.

   👍React with 👍2Reacted by Alexander Stecher and Kévin Dunglas
10. ndossche

    added

    Category: Engine

    Status: Verified

    and removed

    Status: Needs Triage

    on Nov 9, 2024
11. AlliBalliBaba commented on Nov 10, 2024

    

    AlliBalliBaba

    on Nov 10, 2024

    Author

    More actions

    Thank you for the quick reply and explanation! I'll try your patch, I'm pretty sure this will resolve the crash 👍

    👍React with 👍1Reacted by Nora Dossche
12. AlliBalliBaba commented on Nov 10, 2024

    

    AlliBalliBaba

    on Nov 10, 2024

    Author

    More actions

    Your patch indeed solves the issue 👍
13. ndossche commented on Nov 10, 2024

    

    ndossche

    on Nov 10, 2024

    Member

    More actions

    Thanks for confirming, I'll get the PR up.
    Let's hope this was the only issue here. I'll double check if I see anything other suspicious in that file.

    👍React with 👍1Reacted by Alexander Stecher
14. ndossche

    added a commit that references this issue on Nov 10, 2024

    Fix phpGH-16727: Opcache bad signal 139 crash in ZTS bookworm (franke…

    ...

    This issue will close once commit 7f20fad is merged into the 'master' branch.

    7f20fad
15. ndossche

    linked a pull request that will close this issueFix GH-16727: Opcache bad signal 139 crash in ZTS bookworm (frankenphp) #16748on Nov 10, 2024
16. ndossche

    added 2 commits that reference this issue on Nov 11, 2024

    Fix GH-16727: Opcache bad signal 139 crash in ZTS bookworm (frankenphp)

    ...

    This issue will close once commit 02ee521 is merged into the 'master' branch.

    02ee521

    Merge branch 'PHP-8.2' into PHP-8.3

    ...

    This issue will close once commit fbf4cec is merged into the 'master' branch.

    fbf4cec
17. ndossche

    closed this as completedin 02ee521on Nov 11, 2024
18. ndossche

    added 2 commits that reference this issue on Nov 11, 2024

    Merge branch 'PHP-8.3' into PHP-8.4

    ...

    This issue will close once commit 382be92 is merged into the 'master' branch.

    382be92

    Merge branch 'PHP-8.4'

    ...

    This issue will close once commit dfba04e is merged into the 'master' branch.

    dfba04e