Repository navigation
php_admin_value[extension]= in FPM pool configuration unsafely runs RINIT #19520
Description
Description
With the following configuration:
[global]
log_level = debug
error_log = /dev/stderr
[www]
listen = 9999
pm = ondemand
pm.max_children = 3
php_admin_value[extension]=session.so
catch_workers_output=trueand a small patch to session.c to enable session auto start by default (custom INI flags are not loaded in time, other in-tree extensions do not crash):
diff --git i/ext/session/session.c w/ext/session/session.c
index 70e1673d87f..fd6c6cef77d 100644
--- i/ext/session/session.c
+++ w/ext/session/session.c
@@ -900,7 +900,7 @@ PHP_INI_BEGIN()
STD_PHP_INI_ENTRY("session.save_path", "", PHP_INI_ALL, OnUpdateSaveDir, save_path, php_ps_globals, ps_globals)
STD_PHP_INI_ENTRY("session.name", "PHPSESSID", PHP_INI_ALL, OnUpdateName, session_name, php_ps_globals, ps_globals)
PHP_INI_ENTRY("session.save_handler", "files", PHP_INI_ALL, OnUpdateSaveHandler)
- STD_PHP_INI_BOOLEAN("session.auto_start", "0", PHP_INI_PERDIR, OnUpdateBool, auto_start, php_ps_globals, ps_globals)
+ STD_PHP_INI_BOOLEAN("session.auto_start", "1", PHP_INI_PERDIR, OnUpdateBool, auto_start, php_ps_globals, ps_globals)
STD_PHP_INI_ENTRY("session.gc_probability", "1", PHP_INI_ALL, OnUpdateSessionGcProbability, gc_probability, php_ps_globals, ps_globals)
STD_PHP_INI_ENTRY("session.gc_divisor", "100", PHP_INI_ALL, OnUpdateSessionDivisor,gc_divisor, php_ps_globals, ps_globals)
STD_PHP_INI_ENTRY("session.gc_maxlifetime", "1440", PHP_INI_ALL, OnUpdateSessionLong, gc_maxlifetime, php_ps_globals, ps_globals)and then running:
sapi/fpm/php-fpm -y fpm.conf -F
and sending a request results in this output:
[19-Aug-2025 12:48:16.712084] DEBUG: pid 700863, fpm_pctl_on_socket_accept(), line 553: [pool www] got accept without idle child available .... I forked
[19-Aug-2025 12:48:16.712117] DEBUG: pid 700863, fpm_event_loop(), line 426: event module triggered 1 events
[19-Aug-2025 12:48:16.715649] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "php-src/Zend/zend_hash.c:783:8: runtime error: applying non-zero offset 3667908216 to null pointer"
[19-Aug-2025 12:48:16.715734] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior php-src/Zend/zend_hash.c:783:8 in "
[19-Aug-2025 12:48:16.715807] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "AddressSanitizer:DEADLYSIGNAL"
[19-Aug-2025 12:48:16.715850] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "================================================================="
[19-Aug-2025 12:48:16.715884] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "==700924==ERROR: AddressSanitizer: SEGV on unknown address 0x00009b537acf (pc 0x591d64517a26 bp 0x7ffd030695a0 sp 0x7ffd03069480 T0)"
[19-Aug-2025 12:48:16.715929] DEBUG: pid 700863, fpm_event_loop(), line 426: event module triggered 1 events
[19-Aug-2025 12:48:16.715997] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "==700924==The signal is caused by a READ memory access."
[19-Aug-2025 12:48:16.716042] DEBUG: pid 700863, fpm_event_loop(), line 426: event module triggered 1 events
[19-Aug-2025 12:48:16.966689] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #0 0x591d64517a26 in zend_hash_str_find_bucket php-src/Zend/zend_hash.c:783:8"
[19-Aug-2025 12:48:16.966738] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #1 0x591d6451776e in zend_hash_str_find php-src/Zend/zend_hash.c:2697:6"
[19-Aug-2025 12:48:16.966753] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #2 0x74debef243e8 in php_session_start php-src/ext/session/session.c:1669:34"
[19-Aug-2025 12:48:16.966771] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #3 0x74debef60478 in php_rinit_session php-src/ext/session/session.c:2906:3"
[19-Aug-2025 12:48:16.966784] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #4 0x74debef4b0de in zm_activate_session php-src/ext/session/session.c:2914:9"
[19-Aug-2025 12:48:16.966804] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #5 0x591d62ee3f62 in php_load_extension php-src/ext/standard/dl.c:247:7"
[19-Aug-2025 12:48:16.966820] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #6 0x591d62ee2294 in php_dl php-src/ext/standard/dl.c:284:6"
[19-Aug-2025 12:48:16.966838] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #7 0x591d64939582 in fpm_php_apply_defines_ex php-src/sapi/fpm/fpm/fpm_php.c:105:3"
[19-Aug-2025 12:48:16.966851] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #8 0x591d6493ae66 in fpm_php_apply_defines php-src/sapi/fpm/fpm/fpm_php.c:151:18"
[19-Aug-2025 12:48:16.966871] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #9 0x591d6493a7c4 in fpm_php_init_child php-src/sapi/fpm/fpm/fpm_php.c:246:10"
[19-Aug-2025 12:48:16.966886] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #10 0x591d648da060 in fpm_child_init php-src/sapi/fpm/fpm/fpm_children.c:199:10"
[19-Aug-2025 12:48:16.966906] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #11 0x591d648d8fa0 in fpm_children_make php-src/sapi/fpm/fpm/fpm_children.c:461:5"
[19-Aug-2025 12:48:16.966922] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #12 0x591d64946be4 in fpm_pctl_on_socket_accept php-src/sapi/fpm/fpm/fpm_process_ctl.c:547:2"
[19-Aug-2025 12:48:16.966939] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #13 0x591d64918192 in fpm_event_fire php-src/sapi/fpm/fpm/fpm_events.c:478:2"
[19-Aug-2025 12:48:16.966953] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #14 0x591d6498fc67 in fpm_event_epoll_wait php-src/sapi/fpm/fpm/events/epoll.c:141:3"
[19-Aug-2025 12:48:16.966973] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #15 0x591d6491447a in fpm_event_loop php-src/sapi/fpm/fpm/fpm_events.c:418:9"
[19-Aug-2025 12:48:16.966988] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #16 0x591d648d4c33 in fpm_run php-src/sapi/fpm/fpm/fpm.c:113:2"
[19-Aug-2025 12:48:16.967005] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #17 0x591d64923f22 in main php-src/sapi/fpm/fpm/fpm_main.c:1845:12"
[19-Aug-2025 12:48:16.967018] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #18 0x74dec122a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16"
[19-Aug-2025 12:48:16.967036] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #19 0x74dec122a28a in __libc_start_main csu/../csu/libc-start.c:360:3"
[19-Aug-2025 12:48:16.967052] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: " #20 0x591d61603434 in _start (php-src/sapi/fpm/php-fpm+0x1c03434) (BuildId: 7efba1981fd9239610ec7542417a9d447b071b1b)"
[19-Aug-2025 12:48:16.967070] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "AddressSanitizer can not provide additional info."
[19-Aug-2025 12:48:16.967087] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "SUMMARY: AddressSanitizer: SEGV php-src/Zend/zend_hash.c:783:8 in zend_hash_str_find_bucket"
[19-Aug-2025 12:48:16.967106] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "==700924==ABORTING"
But I expected this output instead: No crash.
PHP Version
PHP 8.4.13-dev (fpm-fcgi) (built: Aug 19 2025 12:40:44) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.4.13-dev, Copyright (c) Zend Technologies
Operating System
No response
Activity
TimWolla commentedon Aug 19, 2025
It would probably be best to disable
php_admin_value[extension]entirely, it already requireszend_rc_debug = false:php-src/sapi/fpm/fpm/fpm_php.c
Lines 97 to 109 in 38b9c33
Alternatively, since the extension is loaded as
MODULE_PERSISTENTrather thanMODULE_TEMPORARY, it should just runMINIT+GINIT, but notRINIT? It should also be noted, that for theRINITduring loading there is no matchingRSHUTDOWN, which might also result in memory leaks.TimWolla commentedon Aug 19, 2025
Related #9921.
TimWolla commentedon Aug 19, 2025
Indeed.
mbstringtriggers:or
bukka commentedon Sep 4, 2025
Oh no, I was hoping to never look into this again... 😄
bukka commentedon Sep 5, 2025
There are likely users of this feature so disabling would be a BC break. I think this was actually introduced before some other changes but this RINIT issue might have been there. In any case we should find a fix for the stable version first which cannot be not allowing extensions to be set.
I agree that doing RINIT in this context does not make much sense. I think it's just side effect of using php_dl. I guess we can't easily fix it without breaking ABI in php_load_extension so we might need some extra wrapper that would allow passing some parameter to skip RINIT.
TimWolla commentedon Sep 5, 2025
I'm not sure if it is necessary to fix this for stable versions. From the bundled extensions, only mbstring is affected and for that one it seems unlikely to be loaded dynamically. And for external extensions, the workaround is simple. I would just fix this for master, as this allows much greater flexibility in fixing the issue. And as suggested above, I think removing the “feature” entirely is reasonable, given the existing workarounds (e.g. the RC check).
bukka commentedon Oct 10, 2025
I thought about this and I don't think we should remove it just because of the RC check because then we would need to remove PHP
dlfunction as well (it does the same). And mainly there are users of that feature and in some setups everything is even configured through the fcgi envs - using PHP_ADMIN_VALUE so some users don't even use or have option to use php.ini (there are really such users) so this would no longer be possible (even though configuring extension in that way seems a bit strange but it might still cause break for some users). The thing is that this mostly works for them so I don't think we should be changing it.I agree that master only fix should be fine. That will make that RINIT fix easier. Do you want to tackle it or should I?
TimWolla commentedon Oct 10, 2025
@bukka since you seem to have a specific solution in mind, please look into this.
Fix phpGH-19520: php_admin_value[extension] in FPM unsafely runs RINIT
bukka commentedon Dec 3, 2025
I just created and initial draft PR: #20636 . It needs testing and I would like to add a test for this. I think it should be possible to tweak dl_test for that purpose so will look into it later.
Fix phpGH-19520: php_admin_value[extension] in FPM unsafely runs RINIT