php / php/php-src

preloading shutdown frees objects before module shutdown

Open
#9,957 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug Extension: opcache Status: Needs Triage
Dominant language
C
Stars
40.4k
Forks
8.1k
Avg merge
2d 13h
Merged PRs (30d)
96

Description

Description

Since cecea72a10aa6470b3426a8d2f905f5ef2fe29b3, preloading executes zend_shutdown_executor_values() early in accel_preload() directly, causing zend_objects_store_free_object_storage() to be called long before php_request_shutdown() is called, which calls php_module_shutdown() - before zend_shutdown_executor_values, normally.

Can we bring consistency here between regular request shutdown and preloading shutdown, so that the latter needs no special handling?

This change led to a crash in our extension creating an object at rinit and accessing it in rshutdown: https://github.com/DataDog/dd-trace-php/issues/1795

==77== Invalid read of size 8
==77==    at 0x583BB80: ddtrace_close_all_open_spans (span.c:504)
==77==    by 0x582CAAB: zm_deactivate_ddtrace (ddtrace.c:897)
==77==    by 0x582CAAB: zm_deactivate_ddtrace (ddtrace.c:882)
==77==    by 0x51C81B: zend_deactivate_modules (in /usr/local/sbin/php-fpm)
==77==    by 0x4B0FB3: php_request_shutdown (in /usr/local/sbin/php-fpm)
==77==    by 0x56155FF: accel_finish_startup_preload (in /usr/local/lib/php/extensions/no-debug-non-zts-20210902/opcache.so)
==77==    by 0x5810D13: zai_interceptor_post_startup (interceptor.c:683)
==77==    by 0x515397: zend_post_startup (in /usr/local/sbin/php-fpm)
==77==    by 0x4B18DF: php_module_startup (in /usr/local/sbin/php-fpm)
==77==  Address 0x5a63b88 is 184 bytes inside a block of size 272 free'd
==77==    at 0x48C7488: free (in /usr/libexec/valgrind/vgpreload_memcheck-arm64-linux.so)
==77==    by 0x5B2B4B: zend_objects_store_del (in /usr/local/sbin/php-fpm)
==77==    by 0x5ADA7F: zend_object_std_dtor (in /usr/local/sbin/php-fpm)
==77==    by 0x5B2A3B: zend_objects_store_free_object_storage (in /usr/local/sbin/php-fpm)
==77==    by 0x504A17: zend_shutdown_executor_values (in /usr/local/sbin/php-fpm)
==77==    by 0x5613F5B: accel_preload (in /usr/local/lib/php/extensions/no-debug-non-zts-20210902/opcache.so)
==77==    by 0x56155CB: accel_finish_startup_preload (in /usr/local/lib/php/extensions/no-debug-non-zts-20210902/opcache.so)
==77==    by 0x5810D13: zai_interceptor_post_startup (interceptor.c:683)
==77==    by 0x515397: zend_post_startup (in /usr/local/sbin/php-fpm)
==77==    by 0x4B18DF: php_module_startup (in /usr/local/sbin/php-fpm)
==77==  Block was alloc'd at
==77==    at 0x48C4EC0: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-arm64-linux.so)
==77==    by 0x4E6FB3: __zend_malloc (in /usr/local/sbin/php-fpm)
==77==    by 0x4EBA4F: _ecalloc (in /usr/local/sbin/php-fpm)
==77==    by 0x5828C8B: ddtrace_span_data_create (ddtrace.c:404)
==77==    by 0x5181EB: object_init_ex (in /usr/local/sbin/php-fpm)
==77==    by 0x583B063: ddtrace_init_span (span.c:247)
==77==    by 0x583B063: ddtrace_push_root_span (span.c:284)
==77==    by 0x582AA9B: zm_activate_ddtrace (ddtrace.c:834)
==77==    by 0x51C67F: zend_activate_modules (in /usr/local/sbin/php-fpm)
==77==    by 0x4B0BAB: php_request_startup (in /usr/local/sbin/php-fpm)

(ping @nikic being commit author)

PHP Version

PHP 8.1+

Operating System

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing accel_preload() and zend_shutdown_executor_values(), then compare their ordering with php_request_shutdown() and php_module_shutdown(). Use the reported PHP 8.1+ preload scenario and Valgrind trace as the reproduction reference. Done means preload shutdown no longer frees objects before the module shutdown path needs them, without the reported invalid read.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, php
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.