Segfault in php-fpm 8.1 on Linux

Description

Hello,

Since migrating a big(ish) app on PHP 8.1, we get repeated segfaults, a few times per day (no more than 25 segfaults per day per server, for a few million hits per day per server). Here is a sample stack trace:

#0  0x00007f3ed8800556 in zend_accel_class_hash_copy (source=0x46736bb0, source=0x46736bb0, target=0x55ffcca9c330) at ./Zend/zend_types.h:1173
1173            return p->refcount;

(gdb) bt
#0  0x00007f3ed8800556 in zend_accel_class_hash_copy (source=0x46736bb0, source=0x46736bb0, target=0x55ffcca9c330) at ./Zend/zend_types.h:1173
#1  zend_accel_load_script (persistent_script=persistent_script@entry=0x46736a80, from_shared_memory=from_shared_memory@entry=1)
    at ./ext/opcache/zend_accelerator_util_funcs.c:230
#2  0x00007f3ed87eed26 in persistent_compile_file (type=<optimized out>, file_handle=<optimized out>) at ./ext/opcache/ZendAccelerator.c:2240
#3  persistent_compile_file (file_handle=<optimized out>, type=<optimized out>) at ./ext/opcache/ZendAccelerator.c:1951
#4  0x000055ffcc3edef8 in compile_filename (type=type@entry=2, filename=filename@entry=0x7f3ed210d820) at ./Zend/zend_language_scanner.c:707
#5  0x000055ffcc45ae40 in zend_include_or_eval (inc_filename_zv=<optimized out>, type=2) at ./Zend/zend_execute.c:4617
#6  0x000055ffcc4693ba in ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER () at ./Zend/zend_vm_execute.h:38713
#7  0x000055ffcc48f357 in execute_ex (ex=0x46736ce0) at ./Zend/zend_vm_execute.h:59122
#8  0x000055ffcc41b46e in zend_call_function (fci=<optimized out>, fci_cache=<optimized out>) at ./Zend/zend_execute_API.c:908
#9  0x000055ffcc41b785 in zend_call_known_function (fn=0x7f3ed8c05cd8, object=<optimized out>, called_scope=<optimized out>, retval_ptr=retval_ptr@entry=0x0, 
    param_count=param_count@entry=1, params=params@entry=0x7fff83b4f4e0, named_params=0x0) at ./Zend/zend_execute_API.c:997
#10 0x000055ffcc31b66a in spl_perform_autoload (class_name=0x40e9f288, lc_name=0x40e9f2c8) at ./ext/spl/php_spl.c:433
#11 0x000055ffcc41a6b6 in zend_lookup_class_ex (name=name@entry=0x40e9f288, key=0x40e9f2c8, flags=flags@entry=512) at ./Zend/zend_execute_API.c:1141
#12 0x000055ffcc41ba70 in zend_fetch_class_by_name (class_name=0x40e9f288, key=<optimized out>, fetch_type=fetch_type@entry=512)
    at ./Zend/zend_execute_API.c:1601
#13 0x000055ffcc466dd7 in ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_CONST_HANDLER () at ./Zend/zend_vm_execute.h:6778
#14 0x000055ffcc48fac0 in execute_ex (ex=0x46736ce0) at ./Zend/zend_vm_execute.h:56351
#15 0x000055ffcc41b46e in zend_call_function (fci=fci@entry=0x7fff83b4f770, fci_cache=<optimized out>, fci_cache@entry=0x7f3ed21b60d0)
    at ./Zend/zend_execute_API.c:908
#16 0x00007f3ed8754a0d in curl_write_header (data=data@entry=0x55ffccb729e0 "\r\n", size=size@entry=1, nmemb=nmemb@entry=2, ctx=0x7f3ed8cc2a80)
    at ./ext/curl/interface.c:1596
#17 0x00007f3ed86c572c in chop_write (conn=0x55ffcce9ea80, conn=0x55ffcce9ea80, olen=2, optr=0x55ffccb729e0 "\r\n", type=2) at sendf.c:623
#18 Curl_client_write (conn=0x55ffcce9ea80, type=2, ptr=0x55ffccb729e0 "\r\n", len=len@entry=2) at sendf.c:679
#19 0x00007f3ed86c3a72 in Curl_http_readwrite_headers (data=data@entry=0x55ffcce92f90, conn=conn@entry=0x55ffcce9ea80, nread=nread@entry=0x7fff83b4f960, 
    stop_reading=stop_reading@entry=0x7fff83b4f95f) at http.c:3405
#20 0x00007f3ed86d7778 in readwrite_data (comeback=0x7fff83b4f9eb, done=0x7fff83b4f9ea, didwhat=<synthetic pointer>, k=0x55ffcce93088, conn=0x55ffcce9ea80, 
    data=0x55ffcce92f90) at transfer.c:677
#21 Curl_readwrite (conn=0x55ffcce9ea80, data=data@entry=0x55ffcce92f90, done=done@entry=0x7fff83b4f9ea, comeback=comeback@entry=0x7fff83b4f9eb)
    at transfer.c:1294
#22 0x00007f3ed86e1933 in multi_runsingle (multi=multi@entry=0x55ffcce98a20, now=..., data=data@entry=0x55ffcce92f90) at multi.c:1933
#23 0x00007f3ed86e2bd9 in curl_multi_perform (multi=multi@entry=0x55ffcce98a20, running_handles=running_handles@entry=0x7fff83b4fb64) at multi.c:2218
#24 0x00007f3ed86d9742 in easy_transfer (multi=0x55ffcce98a20) at easy.c:686
#25 easy_perform (events=false, data=0x55ffcce92f90) at easy.c:780
#26 curl_easy_perform (data=0x55ffcce92f90) at easy.c:799
#27 0x00007f3ed8755b24 in zif_curl_exec (execute_data=0x7f3ed8c16750, return_value=0x7fff83b4fcc0) at ./ext/curl/interface.c:3063
#28 0x000055ffcc490eba in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER () at ./Zend/zend_vm_execute.h:1235
#29 execute_ex (ex=0x46736ce0) at ./Zend/zend_vm_execute.h:55752
#30 0x000055ffcc49773c in zend_execute (op_array=0x7f3ed8c02000, return_value=0x0) at ./Zend/zend_vm_execute.h:60123
#31 0x000055ffcc429875 in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=3) at ./Zend/zend.c:1792
#32 0x000055ffcc3c601f in php_execute_script (primary_file=<optimized out>) at ./main/main.c:2538
#33 0x000055ffcc26f335 in main (argc=<optimized out>, argv=<optimized out>) at ./sapi/fpm/fpm/fpm_main.c:1914

I suspect the errors are opcache-related; here is our opcache configuration:

[opcache]
opcache.memory_consumption=512
opcache.max_accelerated_files=1000000
opcache.revalidate_freq=0
opcache.revalidate_path=1
opcache.huge_code_pages=0
opcache.file_update_protection=30
opcache.jit=disable

We are running Debian 10 and PHP 8.1.6, up-to-date from packages.sury.org.

PHP Version

PHP 8.1.6 (cli) (built: May 17 2022 16:49:19) (NTS)

Operating System

Debian 10

Commencez par la trace de la pile dans ext/opcache/zend_accelerator_util_funcs.c:230 et Zend/zend_types.h:1173, puis examinez la configuration opcache de PHP 8.1.6 et l’environnement Debian 10 signalés. Recherchez un chemin reproductible vers le segfault de php-fpm et confirmez que le correctif qui en résulte empêche le plantage dans les conditions signalées.