#43295 [NEW]: php-cgi crash

pioklo at serveradmin dot pl Wed, 14 Nov 2007 06:41:35 -0800

From:             pioklo at serveradmin dot pl
Operating system: Debian 4.0 kernel 2.6.23.1
PHP version:      5.2.5
PHP Bug Type:     CGI related
Bug description:  php-cgi crash


Description:
------------
Hello There !

I have installed lighttpd and php-cgi as backend.
i started 1500 process php-cgi trought spawn-cgi from lighttpd
Everything is ok but when more connections is  coming i mean more than 1k
per second i have problem with PHP
php proces crashed every 1-2 minutes..

ns78:/tmp/phpcore# ls -la
total 68004
drwxr-xr-x 2 apache apache     4096 2007-11-14 12:54 .
drwxrwxrwt 6 root   root       4096 2007-11-14 14:00 ..
-rw------- 1 apache apache 69554176 2007-11-14 15:23 core
ns78:/tmp/phpcore# gdb /usr/local/bin/php-cgi  core
GNU gdb 6.4.90-debian
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you
are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for
details.
This GDB was configured as "i486-linux-gnu"...Using host libthread_db
library "/lib/tls/libthread_db.so.1".


warning: Can't read pathname for load map: Input/output error.
Reading symbols from /lib/tls/libcrypt.so.1...done.
Loaded symbols for /lib/tls/libcrypt.so.1
Reading symbols from /lib/tls/librt.so.1...done.
Loaded symbols for /lib/tls/librt.so.1
Reading symbols from
/usr/local/mysql/lib/mysql/libmysqlclient.so.15...done.
Loaded symbols for /usr/local/mysql/lib/mysql/libmysqlclient.so.15
Reading symbols from /usr/lib/libz.so.1...done.
Loaded symbols for /usr/lib/libz.so.1
Reading symbols from /usr/local/lib/libiconv.so.2...done.
Loaded symbols for /usr/local/lib/libiconv.so.2
Reading symbols from /usr/local/lib/libfreetype.so.6...done.
Loaded symbols for /usr/local/lib/libfreetype.so.6
Reading symbols from /usr/local/lib/libpng.so.3...done.
Loaded symbols for /usr/local/lib/libpng.so.3
Reading symbols from /lib/tls/libresolv.so.2...done.
Loaded symbols for /lib/tls/libresolv.so.2
Reading symbols from /lib/tls/libm.so.6...done.
Loaded symbols for /lib/tls/libm.so.6
Reading symbols from /lib/tls/libdl.so.2...done.
Loaded symbols for /lib/tls/libdl.so.2
Reading symbols from /lib/tls/libnsl.so.1...done.
Loaded symbols for /lib/tls/libnsl.so.1
Reading symbols from /usr/lib/libxml2.so.2...done.
Loaded symbols for /usr/lib/libxml2.so.2
Reading symbols from /lib/tls/libc.so.6...done.
Loaded symbols for /lib/tls/libc.so.6
Reading symbols from /lib/tls/libpthread.so.0...done.
Loaded symbols for /lib/tls/libpthread.so.0
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
Reading symbols from
/usr/local/lib/php/extensions/no-debug-non-zts-20060613/xcache.so...done.
Loaded symbols for
/usr/local/lib/php/extensions/no-debug-non-zts-20060613/xcache.so
Reading symbols from
/usr/local/lib/php/extensions/no-debug-non-zts-20060613/fileinfo.so...done.
Loaded symbols for
/usr/local/lib/php/extensions/no-debug-non-zts-20060613/fileinfo.so
Reading symbols from /usr/lib/libmagic.so.1...done.
Loaded symbols for /usr/lib/libmagic.so.1
Reading symbols from /lib/tls/libnss_files.so.2...done.
Loaded symbols for /lib/tls/libnss_files.so.2
Reading symbols from /lib/tls/libnss_dns.so.2...done.
Loaded symbols for /lib/tls/libnss_dns.so.2
Core was generated by `/usr/local/bin/php-cgi'.
Program terminated with signal 11, Segmentation fault.
#0  0x082e28cc in zend_cleanup_class_data (pce=0x86b0773) at
/root/root/php-5.2.5/Zend/zend_opcode.c:153
153             if ((*pce)->type == ZEND_USER_CLASS) {
(gdb) bt
#0  0x082e28cc in zend_cleanup_class_data (pce=0x86b0773) at
/root/root/php-5.2.5/Zend/zend_opcode.c:153
#1  0x082f4b6c in zend_hash_apply (ht=0x85fe3e8, apply_func=0x82e28c0
<zend_cleanup_class_data>)
    at /root/root/php-5.2.5/Zend/zend_hash.c:673
#2  0x082df3b9 in shutdown_executor () at
/root/root/php-5.2.5/Zend/zend_execute_API.c:281
#3  0x082eb18d in zend_deactivate () at
/root/root/php-5.2.5/Zend/zend.c:860
#4  0x082ac129 in php_request_shutdown (dummy=0x0) at
/root/root/php-5.2.5/main/main.c:1485
#5  0x083666b7 in main (argc=1, argv=0xbfdbe404) at
/root/root/php-5.2.5/sapi/cgi/cgi_main.c:1972
(gdb) up
#1  0x082f4b6c in zend_hash_apply (ht=0x85fe3e8, apply_func=0x82e28c0
<zend_cleanup_class_data>)
    at /root/root/php-5.2.5/Zend/zend_hash.c:673
673                     int result = apply_func(p->pData TSRMLS_CC);
(gdb) print *p
$1 = {h = 726206240, nKeyLength = 8, pData = 0x86b0773, pDataPtr =
0x86b4718, pListNext = 0x86b0774, pListLast = 0x86b2fc0,
  pNext = 0x769, pLast = 0x0, arKey = "l"}
(gdb) print (char *)&*p->arKey
$2 = 0x86b4ae0 "l\amattr"
(gdb)


In lighttpd logs:

mod_proxy_backend_fastcgi.c.484: (trace) 8192 / 0 -> 8192
mod_proxy_backend_fastcgi.c.487: (error) looks like the fastcgi-backend
(/gry.php?co=1&co2=play&idm=1363) terminated before it sent a FIN packet

I dont know this is php bug or hardware issue :(

Every crash produce different core  :
ns78:/tmp/phpcore# ls -al
total 72196
drwxr-xr-x 2 apache apache     4096 2007-11-14 12:54 .
drwxrwxrwt 6 root   root       4096 2007-11-14 14:00 ..
-rw------- 1 apache apache 73842688 2007-11-14 15:28 core
ns78:/tmp/phpcore# gdb /usr/local/bin/php-cgi  core
GNU gdb 6.4.90-debian
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you
are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for
details.
This GDB was configured as "i486-linux-gnu"...Using host libthread_db
library "/lib/tls/libthread_db.so.1".


warning: Can't read pathname for load map: Input/output error.
Reading symbols from /lib/tls/libcrypt.so.1...done.
Loaded symbols for /lib/tls/libcrypt.so.1
Reading symbols from /lib/tls/librt.so.1...done.
Loaded symbols for /lib/tls/librt.so.1
Reading symbols from
/usr/local/mysql/lib/mysql/libmysqlclient.so.15...done.
Loaded symbols for /usr/local/mysql/lib/mysql/libmysqlclient.so.15
Reading symbols from /usr/lib/libz.so.1...done.
Loaded symbols for /usr/lib/libz.so.1
Reading symbols from /usr/local/lib/libiconv.so.2...done.
Loaded symbols for /usr/local/lib/libiconv.so.2
Reading symbols from /usr/local/lib/libfreetype.so.6...done.
Loaded symbols for /usr/local/lib/libfreetype.so.6
Reading symbols from /usr/local/lib/libpng.so.3...done.
Loaded symbols for /usr/local/lib/libpng.so.3
Reading symbols from /lib/tls/libresolv.so.2...done.
Loaded symbols for /lib/tls/libresolv.so.2
Reading symbols from /lib/tls/libm.so.6...done.
Loaded symbols for /lib/tls/libm.so.6
Reading symbols from /lib/tls/libdl.so.2...done.
Loaded symbols for /lib/tls/libdl.so.2
Reading symbols from /lib/tls/libnsl.so.1...done.
Loaded symbols for /lib/tls/libnsl.so.1
Reading symbols from /usr/lib/libxml2.so.2...done.
Loaded symbols for /usr/lib/libxml2.so.2
Reading symbols from /lib/tls/libc.so.6...done.
Loaded symbols for /lib/tls/libc.so.6
Reading symbols from /lib/tls/libpthread.so.0...done.
Loaded symbols for /lib/tls/libpthread.so.0
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
Reading symbols from
/usr/local/lib/php/extensions/no-debug-non-zts-20060613/xcache.so...done.
Loaded symbols for
/usr/local/lib/php/extensions/no-debug-non-zts-20060613/xcache.so
Reading symbols from
/usr/local/lib/php/extensions/no-debug-non-zts-20060613/fileinfo.so...done.
Loaded symbols for
/usr/local/lib/php/extensions/no-debug-non-zts-20060613/fileinfo.so
Reading symbols from /usr/lib/libmagic.so.1...done.
Loaded symbols for /usr/lib/libmagic.so.1
Reading symbols from /lib/tls/libnss_files.so.2...done.
Loaded symbols for /lib/tls/libnss_files.so.2
Reading symbols from /lib/tls/libnss_dns.so.2...done.
Loaded symbols for /lib/tls/libnss_dns.so.2
Core was generated by `/usr/local/bin/php-cgi'.
Program terminated with signal 11, Segmentation fault.
#0  0x082d1f77 in _zend_mm_free_int (heap=0x85fe120, p=<value optimized
out>) at /root/root/php-5.2.5/Zend/zend_alloc.c:822
822                     if (UNEXPECTED(prev->next_free_block != mm_block)
|| UNEXPECTED(next->prev_free_block != mm_block)) {
(gdb) bt full
#0  0x082d1f77 in _zend_mm_free_int (heap=0x85fe120, p=<value optimized
out>) at /root/root/php-5.2.5/Zend/zend_alloc.c:822
        prev = <value optimized out>
        next = <value optimized out>
        mm_block = (zend_mm_block *) 0xb3680110
        next_block = (zend_mm_block *) 0xb3680880
        size = 1904
#1  0x080fd722 in php_gd_gdImageDestroy (im=0xb7a160d8) at
/root/root/php-5.2.5/ext/gd/libgd/gd.c:234
        i = 651
#2  0x082f75d2 in list_entry_destructor (ptr=0xb36abf48) at
/root/root/php-5.2.5/Zend/zend_list.c:184
        ld = (zend_rsrc_list_dtors_entry *) 0x86a5128
#3  0x082f5aee in zend_hash_del_key_or_index (ht=0x85fd180, arKey=<value
optimized out>, nKeyLength=140759248, h=16, flag=1)
    at /root/root/php-5.2.5/Zend/zend_hash.c:497
        p = (Bucket *) 0xb366af48
#4  0x082f7817 in _zend_list_delete (id=16) at
/root/root/php-5.2.5/Zend/zend_list.c:58
        le = (zend_rsrc_list_entry *) 0xb36abf48
#5  0x080efa4e in zif_imagedestroy (ht=1, return_value=0xb36ecf7c,
return_value_ptr=0x0, this_ptr=0x0, return_value_used=0)
    at /root/root/php-5.2.5/ext/gd/gd.c:3044
        IM = (zval **) 0xb79f7914
#6  0x08309582 in zend_do_fcall_common_helper_SPEC
(execute_data=0xbfdb4220)
    at /root/root/php-5.2.5/Zend/zend_vm_execute.h:200
        class_name = <value optimized out>
        i = 1
        p = <value optimized out>
        arg_count = 0
        return_reference = 0 '\0'
        opline = (zend_op *) 0xb4b0d7b8
        original_return_value = <value optimized out>
        current_scope = (zend_class_entry *) 0x0
        current_this = (zval *) 0x0
        should_change_scope = 0 '\0'
#7  0x083085b8 in execute (op_array=0x8712a18) at
/root/root/php-5.2.5/Zend/zend_vm_execute.h:92
        execute_data = {opline = 0xb4b0d7b8, function_state =
{function_symbol_table = 0xb7a08718, function = 0x863d0d0,
    reserved = {0xb4aee300, 0xb7a02ed0, 0xbfdb4250, 0x11}}, fbc = 0x0,
op_array = 0x8712a18, object = 0x0, Ts = 0xbfdb4120,
  CVs = 0xbfdb40f0, original_in_execution = 1 '\001', symbol_table =
0xb7a0557c, prev_execute_data = 0xbfdb9e70,
  old_error_reporting = 0x0}
#8  0x08308fe8 in zend_do_fcall_common_helper_SPEC
(execute_data=0xbfdb9e70)
    at /root/root/php-5.2.5/Zend/zend_vm_execute.h:234
        opline = (zend_op *) 0xb4aeeaa0
        original_return_value = (zval **) 0xbfdb9f04
        current_scope = (zend_class_entry *) 0x0
        current_this = (zval *) 0x0
        should_change_scope = 1 '\001'
#9  0x083085b8 in execute (op_array=0xb7a0387c) at
/root/root/php-5.2.5/Zend/zend_vm_execute.h:92
        execute_data = {opline = 0xb4aeeaa0, function_state =
{function_symbol_table = 0xb7a0557c, function = 0x8712a18,
    reserved = {0x82e225a, 0xb7a03a14, 0xbfdbe300, 0x0}}, fbc = 0x8712a18,
op_array = 0xb7a0387c, object = 0x0,
  Ts = 0xbfdb4470, CVs = 0xbfdb4330, original_in_execution = 0 '\0',
symbol_table = 0x85fd0f0, prev_execute_data = 0x0,
---Type <return> to continue, or q <return> to quit---
  old_error_reporting = 0xbfdb5fa0}
#10 0x082eaf44 in zend_execute_scripts (type=8, retval=<value optimized
out>, file_count=3)
    at /root/root/php-5.2.5/Zend/zend.c:1134
        retval2 = (zval *) 0x0
        old_exception = (zval *) 0x0
        files = 0xbfdb9f34 ""
        i = 1
        file_handle = <value optimized out>
        orig_op_array = (zend_op_array *) 0x0
        orig_retval_ptr_ptr = (zval **) 0x0
        local_retval = (zval *) 0x0
#11 0x082ab920 in php_execute_script (primary_file=0xbfdbe300) at
/root/root/php-5.2.5/main/main.c:2004
        realfile =
"\000\000\000\000\001\000\000\000&#313;\025&#345;&#380;\034U\215&#281;\204&#379;&#368;&#380;&#313;XÝ&#729;\000\232\231&#350;\000~8&#350;Cy&#381;Ë!4'\025K%&#357;\235&#270;C&#355;&#347;*ÔV\217pÜ*y{dmSKO/:\220ne\b\237´&#380;&#318;\215&#350;qk&#346;Y&#368;&#268;^5\035?Ý\237&#378;c&#355;&#350;&#314;v&#366;H&#366;d_N8Q\231\235&#382;(ý3&#729;[EMAIL
 
PROTECTED]&#377;\223J\236¤&#258;&#367;Z0qB1&#728;\216\221&#327;s\032(&#369;(ë&#380;&#369;,U\néc¸\020É#Jx&#731;&#353;é&#355;W,*&#350;&#321;&#272;z&#282;&#378;&#366;Gî&#366;&#355;*b&#381;&#341;\205\017&#377;&#355;\227?&#731;&#323;&#328;&#313;\\8&#313;\b\202\0267K_÷o&#313;LU`\2221&#351;D"...
        prepend_file_p = (zend_file_handle *) 0x0
        append_file_p = <value optimized out>
        prepend_file = {type = 0 '\0', filename = 0x0, opened_path = 0x0,
handle = {fd = 0, fp = 0x0, stream = {
      handle = 0x0, reader = 0, closer = 0, fteller = 0, interactive =
0}}, free_filename = 0 '\0'}
        append_file = {type = 0 '\0', filename = 0x0, opened_path = 0x0,
handle = {fd = 0, fp = 0x0, stream = {
      handle = 0x0, reader = 0, closer = 0, fteller = 0, interactive =
0}}, free_filename = 0 '\0'}
        old_cwd = 0xbfdb9f40 ""
        retval = 0
#12 0x08366f4f in main (argc=1, argv=0xbfdbe404) at
/root/root/php-5.2.5/sapi/cgi/cgi_main.c:1909
        l = <value optimized out>
        path_translated_len = 0
        path_translated = <value optimized out>
        free_query_string = 0
        exit_status = 0
        cgi = <value optimized out>
        c = <value optimized out>
        i = <value optimized out>
        len = <value optimized out>
        file_handle = {type = 2 '\002',
  filename = 0xb79f7020
"/home/admin/domains/poszkole.pl/public_html/beta/galerie.php", opened_path
= 0x0, handle = {
    fd = 141686200, fp = 0x871f5b8, stream = {handle = 0x871f5b8, reader =
0xbfdbe3b0, closer = 0xb7f3c4f8,
      fteller = 0x806c723, interactive = 24641422}}, free_filename = 0
'\0'}
        retval = <value optimized out>
        s = 0x87218d8 "136005"
        behavior = 1
        no_headers = 0
        orig_optind = 1
        orig_optarg = 0x0
        script_file = 0x0
        ini_entries_len = 0
        max_requests = 50000
---Type <return> to continue, or q <return> to quit---
        requests = 427
        fastcgi = 1
        bindpath = 0x0
        fcgi_fd = <value optimized out>
        request = {listen_socket = 0, fd = 7, id = 1, keep = 1, in_len =
0, in_pad = 0, out_hdr = 0x0,
  out_pos = 0xbfdbc154 "\001\003",
  out_buf = "\001\003\000\001\000\b\000\000\000\000\000\000\000v
class=\"bord\"></div>\r\n\t\t\t\t\t\t\t</div>\r\n\t\t\t\t\t\t</div>\r\n\t\t\t\t\r\n\t\t\t\t\t\t<div
class=\"middle\">\r\n\t\t\t\t\t\t\t<ul>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t</ul>\r\n\t\t\t\t\t\t</div>\r\n\t\t\t\t\r\n\t\t\t\t\t\t<div
class=\"bottom\">\r\n\t\t\t\t\t\t\t<div clas"...,
  reserved = '\0' <repeats 15 times>, env = {nTableSize = 64, nTableMask =
63, nNumOfElements = 33, nNextFreeElement = 0,
    pInternalPointer = 0x8721da0, pListHead = 0x8721da0, pListTail =
0x871dd70, arBuckets = 0x87210c0,
    pDestructor = 0x83631a0 <fcgi_free_var>, persistent = 1 '\001',
nApplyCount = 0 '\0', bApplyProtection = 1 '\001'}}
        repeats = 1
        benchmark = 0
        start = {tv_sec = 134802161, tv_usec = -1208762380}
        end = {tv_sec = 140313464, tv_usec = -1076108440}
        status = 0
(gdb)



My config for php
./configure  --enable-fastcgi \
   --enable-discard-path \
      --enable-force-cgi-redirect \
       --with-gd --with-gettext \
 --with-jpeg-dir=/usr/local/lib \
--with-mysql=/usr/local/mysql --with-pear --with-png-dir=/usr/local/lib 
\
--with-zlib  \
--enable-ftp --enable-shared --enable-magic-quotes --enable-sockets \
--enable-mbstring \
--enable-exif \
--with-ttf --with-freetype-dir --enable-gd-native-ttf \
--with-iconv=/usr/local


Regards,
Piotr Kloc



-- 
Edit bug report at http://bugs.php.net/?id=43295&edit=1
-- 
Try a CVS snapshot (PHP 4.4): 
http://bugs.php.net/fix.php?id=43295&r=trysnapshot44
Try a CVS snapshot (PHP 5.2): 
http://bugs.php.net/fix.php?id=43295&r=trysnapshot52
Try a CVS snapshot (PHP 5.3): 
http://bugs.php.net/fix.php?id=43295&r=trysnapshot53
Try a CVS snapshot (PHP 6.0): 
http://bugs.php.net/fix.php?id=43295&r=trysnapshot60
Fixed in CVS:                 http://bugs.php.net/fix.php?id=43295&r=fixedcvs
Fixed in release:             
http://bugs.php.net/fix.php?id=43295&r=alreadyfixed
Need backtrace:               http://bugs.php.net/fix.php?id=43295&r=needtrace
Need Reproduce Script:        http://bugs.php.net/fix.php?id=43295&r=needscript
Try newer version:            http://bugs.php.net/fix.php?id=43295&r=oldversion
Not developer issue:          http://bugs.php.net/fix.php?id=43295&r=support
Expected behavior:            http://bugs.php.net/fix.php?id=43295&r=notwrong
Not enough info:              
http://bugs.php.net/fix.php?id=43295&r=notenoughinfo
Submitted twice:              
http://bugs.php.net/fix.php?id=43295&r=submittedtwice
register_globals:             http://bugs.php.net/fix.php?id=43295&r=globals
PHP 3 support discontinued:   http://bugs.php.net/fix.php?id=43295&r=php3
Daylight Savings:             http://bugs.php.net/fix.php?id=43295&r=dst
IIS Stability:                http://bugs.php.net/fix.php?id=43295&r=isapi
Install GNU Sed:              http://bugs.php.net/fix.php?id=43295&r=gnused
Floating point limitations:   http://bugs.php.net/fix.php?id=43295&r=float
No Zend Extensions:           http://bugs.php.net/fix.php?id=43295&r=nozend
MySQL Configuration Error:    http://bugs.php.net/fix.php?id=43295&r=mysqlcfg

#43295 [NEW]: php-cgi crash

Reply via email to