Skip to content

FPM - fpm_status_export_to_zval segfault for parallel execution #19974

Closed
Closed
FPM - fpm_status_export_to_zval segfault for parallel execution#19974
Labels
BugSAPI: fpmStatus: Needs Triage

Description

@craiglondon
craiglondon
opened on Sep 26, 2025

Description

Getting sporadic PHP-FPM segfaults

           PID: 1702021 (php-fpm)
           UID: 48 (apache)
           GID: 48 (apache)
        Signal: 11 (SEGV)
     Timestamp: Fri 2025-09-26 05:51:17 EDT (5h 34min ago)
  Command Line: $'php-fpm: pool www'
    Executable: /opt/remi/php83/root/usr/sbin/php-fpm
 Control Group: /system.slice/php83-php-fpm.service
          Unit: php83-php-fpm.service
         Slice: system.slice
       Boot ID: e4714d2eaf2644ddb9648b21923ead2e
    Machine ID: 6227364aab3f41cb9f4da11e86b139f9
      Hostname: hostingcloudxyz.com
       Storage: /var/lib/systemd/coredump/core.php-fpm.48.e4714d2eaf2644ddb9648b21923ead2e.1702021.1758880277000000.zst (present)
  Size on Disk: 19.7M
       Message: Process 1702021 (php-fpm) of user 48 dumped core.
                
                Stack trace of thread 1702021:
                #0  0x0000558c20d140ce fpm_request_get_stage_name (php-fpm + 0x5140ce)
                #1  0x0000558c20d17a0a fpm_status_export_to_zval (php-fpm + 0x517a0a)
                #2  0x0000558c20d11ddb zif_fpm_get_status (php-fpm + 0x511ddb)
                #3  0x0000558c20c8a2ac execute_ex (php-fpm + 0x48a2ac)
                #4  0x0000558c20c8ecd5 zend_execute (php-fpm + 0x48ecd5)
                #5  0x0000558c20c19300 zend_execute_scripts (php-fpm + 0x419300)
                #6  0x0000558c20bac70a php_execute_script (php-fpm + 0x3ac70a)
                #7  0x0000558c20a42ab3 main (php-fpm + 0x242ab3)
                #8  0x00007f9febe295d0 __libc_start_call_main (libc.so.6 + 0x295d0)
                #9  0x00007f9febe29680 __libc_start_main@@GLIBC_2.34 (libc.so.6 + 0x29680)
                #10 0x0000558c20a448f5 _start (php-fpm + 0x2448f5)
                ELF object binary architecture: AMD x86-64

(gdb) bt
#0  0x00005566b05140ce in fpm_request_get_stage_name (stage=-1236952832) at /usr/src/debug/php83-php-8.3.25-1.el9.remi.x86_64/sapi/fpm/fpm/fpm_request.c:35
#1  0x00005566b0517a0a in fpm_status_export_to_zval (status=status@entry=0x7f6fb6413090) at /usr/src/debug/php83-php-8.3.25-1.el9.remi.x86_64/sapi/fpm/fpm/fpm_status.c:114
#2  0x00005566b0511ddb in zif_fpm_get_status (execute_data=<optimized out>, return_value=0x7f6fb6413090) at /usr/src/debug/php83-php-8.3.25-1.el9.remi.x86_64/sapi/fpm/fpm/fpm_main.c:1531
#3  0x00005566b048a2ac in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER () at /usr/src/debug/php83-php-8.3.25-1.el9.remi.x86_64/Zend/zend_vm_execute.h:1337
#4  execute_ex (ex=0xffffffffb6459900) at /usr/src/debug/php83-php-8.3.25-1.el9.remi.x86_64/Zend/zend_vm_execute.h:57277
#5  0x00005566b048ecd5 in zend_execute (op_array=0x7f6fb647c000, return_value=0x0) at /usr/src/debug/php83-php-8.3.25-1.el9.remi.x86_64/Zend/zend_vm_execute.h:61665
#6  0x00005566b0419300 in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=3) at /usr/src/debug/php83-php-8.3.25-1.el9.remi.x86_64/Zend/zend.c:1895
#7  0x00005566b03ac70a in php_execute_script (primary_file=primary_file@entry=0x7fff7508a660) at /usr/src/debug/php83-php-8.3.25-1.el9.remi.x86_64/main/main.c:2529
#8  0x00005566b0242ab3 in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/php83-php-8.3.25-1.el9.remi.x86_64/sapi/fpm/fpm/fpm_main.c:1936

PHP Version

PHP 8.3.25 (cli) (built: Aug 26 2025 15:05:30) (NTS gcc x86_64)
Copyright (c) The PHP Group
Zend Engine v4.3.25, Copyright (c) Zend Technologies
    with Zend OPcache v8.3.25, Copyright (c), by Zend Technologies

PHP 8.3.25 (fpm-fcgi) (built: Aug 26 2025 15:05:30)
Copyright (c) The PHP Group
Zend Engine v4.3.25, Copyright (c) Zend Technologies
    with Zend OPcache v8.3.25, Copyright (c), by Zend Technologies

Operating System

Rocky Linux 9.6 (Blue Onyx)

Activity

  1. craiglondon
    added
    Bug
    Status: Needs Triage
    on Sep 26, 2025
  2. devnexen
    added
    SAPI: fpm
    on Sep 26, 2025

  3. devnexen commented on Sep 26, 2025

    @devnexen
    devnexen
    on Sep 26, 2025
    Member

    Hi would you be able to have a debug version of php fpm ? That seems an overflow but the whole struct (e.g. fpm_scoreboard_proc_s) pointer calling it might be just a dangling one.

  4. devnexen
    added
    Status: Needs Feedback
    and removed
    Status: Needs Triage
    on Sep 26, 2025

  5. devnexen commented on Sep 26, 2025

    @devnexen
    devnexen
    on Sep 26, 2025
    Member

    nevermind, you re already have a debug version just saw the output. can you access the frame 1 then printing procs[i] eventually ?

  6. craiglondon commented on Sep 26, 2025

    @craiglondon
    craiglondon
    on Sep 26, 2025
    Author

    @devnexen I would like to provide this. This is all new to me. First time ever using coredumpctl debug. Can you give me some more detailed instructions or provide a link with instructions to do so?

  7. github-actions
    added
    Status: Needs Triage
    and removed
    Status: Needs Feedback
    on Sep 26, 2025

  8. craiglondon commented on Sep 26, 2025

    @craiglondon
    craiglondon
    on Sep 26, 2025
    Author
    (gdb) f 0
#0  0x00005566b05140ce in fpm_request_get_stage_name (stage=1429357298) at /usr/src/debug/php83-php-8.3.25-1.el9.remi.x86_64/sapi/fpm/fpm/fpm_request.c:35
35		return requests_stages[stage];
(gdb) f 1
#1  0x00005566b0517a0a in fpm_status_export_to_zval (status=status@entry=0x7f6fb6413090) at /usr/src/debug/php83-php-8.3.25-1.el9.remi.x86_64/sapi/fpm/fpm/fpm_status.c:114
114			add_assoc_string(&fpm_proc_stat, "state", fpm_request_get_stage_name(procs[i].request_stage));

  9. devnexen commented on Sep 26, 2025

    @devnexen
    devnexen
    on Sep 26, 2025
    Member

    Absolutely, just right after you enter your gdb session, you can type f 1 then p procs[i].

  10. craiglondon commented on Sep 26, 2025

    @craiglondon
    craiglondon
    on Sep 26, 2025
    Author

    @devnexen Thanks! Here is the output

    (gdb) f 1
#1  0x00005566b0517a0a in fpm_status_export_to_zval (status=status@entry=0x7f6fb6413090) at /usr/src/debug/php83-php-8.3.25-1.el9.remi.x86_64/sapi/fpm/fpm/fpm_status.c:114
114			add_assoc_string(&fpm_proc_stat, "state", fpm_request_get_stage_name(procs[i].request_stage));
(gdb) p procs[i]
value has been optimized out

  11. devnexen commented on Sep 26, 2025

    @devnexen
    devnexen
    on Sep 26, 2025
    Member

    Ok, can you do f 0 and info args ?

  12. craiglondon commented on Sep 26, 2025

    @craiglondon
    craiglondon
    on Sep 26, 2025
    Author
    (gdb) f 0
#0  0x00005566b05140ce in fpm_request_get_stage_name (stage=1429357298) at /usr/src/debug/php83-php-8.3.25-1.el9.remi.x86_64/sapi/fpm/fpm/fpm_request.c:35
35		return requests_stages[stage];
(gdb) info args
stage = 1429357298

  13. 4 remaining items

  14. txuna commented on Oct 4, 2025

    @txuna
    txuna
    on Oct 4, 2025
    Contributor

    @craiglondon Thank you for sharing this. Thanks to your input, I was able to submit a PR to address the issue.
    I hope it successfully resolves the problem.

  15. bukka
    changed the title [-]PHP FPM - child 1312025 exited on signal 11 (SIGSEGV - core dumped)[/-] [+]PHP FPM - fpm_status_export_to_zval segfault for parallel execution[/+] on Oct 9, 2025
  16. bukka
    changed the title [-]PHP FPM - fpm_status_export_to_zval segfault for parallel execution[/-] [+]FPM - fpm_status_export_to_zval segfault for parallel execution[/+] on Oct 9, 2025
  17. bukka
    linked a pull request that will close this issueFix GH-19974: fpm_status_export_to_zval segfault for parallel execution #20116on Oct 9, 2025
  18. bukka
    added 3 commits that reference this issue on Oct 9, 2025

    Fix GH-19974: fpm_status_export_to_zval segfault for parallel execution

    059f9f7

    Merge branch 'PHP-8.3' into PHP-8.4

    da7558a

    Merge branch 'PHP-8.4' into PHP-8.5

    1570ce9
  19. bukka
    closed this as completedin 059f9f7on Oct 9, 2025
  20. bukka
    added a commit that references this issue on Oct 9, 2025

    Merge branch 'PHP-8.5'

    02e38fe
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    BugSAPI: fpmStatus: Needs Triage

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions