0001770: fpm child process crashes when there is a php error

ID	Project	Category	View Status	Date Submitted	Last Update
0001770	Xdebug	Uncategorized	public	2020-03-23 11:54	2020-04-30 09:52

Reporter	ylandsman	Assigned To
Priority	high	Severity	crash	Reproducibility	always
Status	resolved	Resolution	unable to reproduce
Platform	nginx 1.17.9 php-fpm 7.3.x	OS	centos	OS Version	7 & 8
Product Version	2.9.4

Summary	0001770: fpm child process crashes when there is a php error
Description	As an example: - <?php ob_start(); $result = eval("?>".$string."<"."?p"."hp return 1;"); $new_string = ob_get_clean(); What I expect is a string undefined error when xdebug is not enabled in my php,ini that is exactly what I get when xdebug is enabled I get a 502 error and child 7584 exited on signal 6 (SIGABRT) in the php log
Steps To Reproduce	start php-fpm with xdebug started, run the above code nginx will give a 502 error and the php log will show the above quoted error
Tags	No tags attached.

Operating System
PHP Version	7.3.10-7.3.14

derick 2020-03-23 13:18 administrator ~0005332	Would you mind trying Xdebug 2.9.4 that I've just released first? If that doesn't work, then please provide more information so that I can try to reproduce this at home. Particularly your set-up, your Xdebug php.ini settings, which OS and how you've installed nginx, php-fpm, and Xdebug.

ylandsman 2020-03-23 13:29 reporter ~0005333	Thank you for your speedy response Unfortunately didn't work. php.ini is included here. php and nginx were built by me from source xdebug was installed through pecl

derick 2020-03-23 15:12 administrator ~0005336	Nothing weird in the INI settings. I'd love to reproduce this, but I've not ever used nginx and php-fpm. Can you provider either a Dockerfile that demonstrates the problem, a Vagrant image, or the full and exact steps to reproduce this locally? Assume I know nothing of nginx and php-fpm :-)

ylandsman 2020-03-24 16:49 reporter ~0005339	I don't have any experience with docker or vagrant, but it occurred to me to try running php-fpm in a non daemonized process, and I got the following backtrace. Maybe this will give you the clues you need. *Error in `php-fpm: pool brgb': free(): invalid next size (fast): 0x0000000003771b70* ======= Backtrace: ========= /lib64/libc.so.6(+0x81679)[0x7f978bbdd679] php-fpm: pool brgb[0x9042e2] php-fpm: pool brgb[0x904456] php-fpm: pool brgb(php_log_err_with_severity+0x12f)[0x449a13] /usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(xdebug_log_stack+0x7c)[0x7f97820a1dec] /usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(xdebug_error_cb+0x4ec)[0x7f97820a32fc] php-fpm: pool brgb(zend_error+0x251)[0x44bf9d] php-fpm: pool brgb[0x44b532] php-fpm: pool brgb[0x8443b7] php-fpm: pool brgb(php_output_get_contents+0x32)[0x81df62] php-fpm: pool brgb[0x822388] /usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x12c7d)[0x7f97820a0c7d] php-fpm: pool brgb[0x454a4a] php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839] /usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f] php-fpm: pool brgb[0x4549d2] php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839] /usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f] php-fpm: pool brgb[0x4549d2] php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839] /usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f] php-fpm: pool brgb[0x4549d2] php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839] /usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f] php-fpm: pool brgb[0x4546a3] php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839] /usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f] php-fpm: pool brgb[0x4546a3] php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839] /usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f] php-fpm: pool brgb[0x4546a3] php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839] /usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f] php-fpm: pool brgb[0x4546a3] php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839] /usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f] php-fpm: pool brgb[0x8e20c9] php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839] /usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f] php-fpm: pool brgb[0x4549d2] php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839] /usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f] php-fpm: pool brgb[0x4549d2] php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839] /usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f] php-fpm: pool brgb[0x4549d2] php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839] /usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f] php-fpm: pool brgb[0x4546a3] php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839] /usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f] php-fpm: pool brgb(zend_call_function+0x679)[0x85d129] php-fpm: pool brgb[0x7231e7] /usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x12c7d)[0x7f97820a0c7d] php-fpm: pool brgb[0x454714] php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839] /usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f] php-fpm: pool brgb[0x4549d2] php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839] /usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f] php-fpm: pool brgb[0x4549d2] php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839] /usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f] ======= Memory map: ======== 00400000-01159000 r-xp 00000000 fd:01 79691904 /usr/local/php7/sbin/php-fpm 01358000-01415000 r--p 00d58000 fd:01 79691904 /usr/local/php7/sbin/php-fpm 01415000-01426000 rw-p 00e15000 fd:01 79691904 /usr/local/php7/sbin/php-fpm 01426000-0144c000 rw-p 00000000 00:00 0 03303000-0350f000 rw-p 00000000 00:00 0 [heap] 0350f000-037a3000 rw-p 00000000 00:00 0 [heap] 7f9770000000-7f9770021000 rw-p 00000000 00:00 0 7f9770021000-7f9774000000 ---p 00000000 00:00 0 7f9777e00000-7f9779a8e000 rw-p 00000000 00:00 0 7f977ac00000-7f977ba28000 rw-p 00000000 00:00 0 7f977cc00000-7f977da28000 rw-p 00000000 00:00 0 7f977dc00000-7f977ea5c000 rw-p 00000000 00:00 0 7f977fa00000-7f9781e00000 rw-p 00000000 00:00 0 7f9781e7b000-7f9781e87000 r-xp 00000000 fd:01 108952 /usr/lib64/libnss_files-2.17.so 7f9781e87000-7f9782086000 ---p 0000c000 fd:01 108952 /usr/lib64/libnss_files-2.17.so 7f9782086000-7f9782087000 r--p 0000b000 fd:01 108952 /usr/lib64/libnss_files-2.17.so 7f9782087000-7f9782088000 rw-p 0000c000 fd:01 108952 /usr/lib64/libnss_files-2.17.so 7f9782088000-7f978208e000 rw-p 00000000 00:00 0 7f978208e000-7f97820d1000 r-xp 00000000 fd:01 8458170 /usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so 7f97820d1000-7f97822d1000 ---p 00043000 fd:01 8458170 /usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so 7f97822d1000-7f97822d3000 r--p 00043000 fd:01 8458170 /usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so 7f97822d3000-7f97822d5000 rw-p 00045000 fd:01 8458170 /usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so 7f97822d5000-7f97822d6000 rw-p 00000000 00:00 0 7f97822d6000-7f9788800000 r--p 00000000 fd:01 108921 /usr/lib/locale/locale-archive 7f9788800000-7f9788a00000 rw-p 00000000 00:00 0 7f9788b34000-7f9788b94000 r-xp 00000000 fd:01 109054 /usr/lib64/libpcre.so.1.2.0 7f9788b94000-7f9788d94000 ---p 00060000 fd:01 109054 /usr/lib64/libpcre.so.1.2.0 7f9788d94000-7f9788d95000 r--p 00060000 fd:01 109054 /usr/lib64/libpcre.so.1.2.0 7f9788d95000-7f9788d96000 rw-p 00061000 fd:01 109054 /usr/lib64/libpcre.so.1.2.0 7f9788d96000-7f9788d9a000 r-xp 00000000 fd:01 109278 /usr/lib64/libcap-ng.so.0.0.0 7f9788d9a000-7f9788f9a000 ---p 00004000 fd:01 109278 /usr/lib64/libcap-ng.so.0.0.0 7f9788f9a000-7f9788f9b000 r--p 00004000 fd:01 109278 /usr/lib64/libcap-ng.so.0.0.0 7f9788f9b000-7f9788f9c000 rw-p 00005000 fd:01 109278 /usr/lib64/libcap-ng.so.0.0.0 7f9788f9c000-7f9788fb8000 r-xp 00000000 fd:01 118167 /usr/lib64/libsasl2.so.3.0.0 7f9788fb8000-7f97891b7000 ---p 0001c000 fd:01 118167 [24-Mar-2020 16:16:30.377939] DEBUG: pid 24627, fpm_got_signal(), line 82: received SIGCHLD

derick 2020-03-24 17:12 administrator ~0005341	How do I "try running php-fpm in a non daemonized process" ? Please provide the exact steps to reproduce this. I can't guess what you have done :-)

ylandsman 2020-03-24 17:55 reporter ~0005343	Add the -F switch to the command line, and it will stay within the current shell context. Then from the web server, go the the url for the script I showed earlier and you will get this backtrace. As an aside, if it will help, I would be happy to recompile xdebug in a debug mode, and generate a backtrace from gdb. I would however require instructions on how to do this, as when I tried php didn't recognize the binary as being correct for the debug instance of php.

ylandsman 2020-03-24 18:36 reporter ~0005345	Just discovered that if I turn off the php configuration directive log_errors the problem goes away. Of course this doesn't work for a production environment, but it gives you more information on what is going on.

derick 2020-03-26 15:45 administrator ~0005354	I've spent another hour trying to reproduce this, but I'm not having any luck. I've used the attached Dockerfile, build it with "docker image build -t issue1770:1.0 ." and then run it with "docker run -i -t issue1770:1.0" and then requested a page with "lynx -source -dump http://172.17.0.2:80/1770.php". No errors. So, unless you can give me the exact steps on a clean OS install, a Dockerfile, or a VM, or access to a place where you can demonstrate the problem, I can't do much.

derick 2020-04-16 15:31 administrator ~0005395	Hi, I've asked for follow up information three weeks ago. If this does not get provided soon, I will close this ticket out. cheers, Derick

derick 2020-04-30 09:52 administrator ~0005408	I can't reproduce this, and the requested feedback was no provided, so I am closing this bug report. Please feel free to add the requested information, and at that point we can continue investigating.

View Issue Details

Activities