Segmentation fault in apache from apc_cache_find about apcu

[krakjoe]

Can you do a print out of the cache variable in frame 0 ?

[krakjoe]

Can you let me know if you are using HEAD ?? There's been some updates in the last week or so that might have affected this.

If you are still experiencing a problem can you get me some more output from gdb, a test script would be great but there's not really enough to go on here ??

[malern]

We are also experiencing the same problem. Apache processes appear to randomly start segfaulting, and all subsequent requests segfault until the apache is restarted. Sometimes it'll be a week before the problem reoccurs, sometimes it'll just be a few hours. The apache error logs contain "[notice] child pid 1134 exit signal Segmentation fault (11)" messages.

This is happening on a production machine and I haven't been able to reproduce the issue on my dev machine, so I'm unable to provide a trace at the moment.

We are running
APCU 4.0.1
PHP 5.5.4
Apache HTTPD 2.2.25
linux 3.11.1 x86_64

[iMojito]

Same here

linux 3.11.6 x86_64 with grsec
apcu 4.0.2
php 5.5.5
Apache 2.2.25

[iMojito]

Any update here?

[krakjoe]

Nothing good to say ....

I'll tell you what I know so far ...

Here's the line in question verbatim:

            if ((h == (*slot)->key.h) && !memcmp((*slot)->key.str, strkey, keylen)) {

Here's the line so that everyone definitely understands it:

            if (($h == $slot["key"]["h"]) && strcmp($slot["key"]["str"], $strkey, $keylen) === 0) {

There are two unbelievably unlikely ways that this line could conceivably segfault:

• The hash of two different keys of a different length clash
• The memory at $slot["key"] is free'd

There is no logical pathway to the second, and the chances of the first, given that we know the keylength are infinitesimally small.

I cannot reproduce the bug locally, if anyone has a machine where this occurs reliably and can grant me access to it, that would be super ... else I'm at a bit of a loss ...

[sourcecodes2]

I believe I'm also experiencing this bug, with the exception of running NGINX instead of Apache.

The server is making 1,000-2,000 apc_ calls a second depending on time of day. The entire cache is wiped clean every hour or so, but only after the PHP process has been running for about a day. Restarting PHP (php5-fpm in this case) immediately fixes the issue for another day.

I would be happy to give you access to the server, although this is a production server so flexibility may be limited.

[iMojito]

Took this before apache hung

apache 2.4.7
PHP 5.5.8
ttl 7200
gc.ttl 600

[gunjanpatidar]

@krakjoe is it possible to detect a possible segmentation fault and return NULL. That should solve this for the most cases as this happens pretty infrequently.

[krakjoe]

According to other reports, this was fixed in later versions, upgrade to 4.0.6 or 4.0.7.