Timer leaks on pcntl_fork in ZTS build
Open
Nobody has claimed this yet.
Bug
Extension: pcntl
Status: Needs Triage
- Dominant language
- C
- Stars
- 40.4k
- Forks
- 8.1k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 96
Description
Description
The following code:
<?php
pcntl_fork();
Resulted in this output (in child process):
=================================================================
==58097==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 8 byte(s) in 1 object(s) allocated from:
#0 0xffffa37f943b in malloc (/usr/lib/aarch64-linux-gnu/libasan.so.5+0xcf43b)
#1 0xffffa3622aaf in timer_create ../sysdeps/unix/sysv/linux/timer_create.c:59
#2 0xaaaacd663a6b in zend_max_execution_timer_init /usr/local/src/php/Zend/zend_max_execution_timer.c:46
#3 0xaaaacd2913c7 in init_executor /usr/local/src/php/Zend/zend_execute_API.c:202
#4 0xaaaacd2e3497 in zend_activate /usr/local/src/php/Zend/zend.c:1257
#5 0xaaaacd0b09c3 in php_request_startup /usr/local/src/php/main/main.c:1758
#6 0xaaaacd7b92db in do_cli /usr/local/src/php/sapi/cli/php_cli.c:934
#7 0xaaaacd7bbd57 in main /usr/local/src/php/sapi/cli/php_cli.c:1340
#8 0xffffa08c7da3 in __libc_start_main ../csu/libc-start.c:308
#9 0xaaaacbea50f3 (/opt/php/debug-zts-asan/bin/php+0x5b50f3)
There's an explicit comment that this shouldn't be freed after a fork:
void zend_max_execution_timer_shutdown(void) /* {{{ */
{
/* Don't try to delete a timer created before a call to fork() */
if (EG(pid) != getpid()) {
return;
}
So paging @dunglas who wrote that comment.
PHP Version
PHP 8.3
Operating System
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the PHP 8.3 ZTS case with pcntl_fork under AddressSanitizer, then read zend_max_execution_timer.c alongside the initialization and shutdown paths shown in the report. Use the child-process leak trace as the baseline; done means the reproducer no longer reports the leaked timer without regressing timer handling in the parent process.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, php
- Domain
- backend, operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100