[Bug 1182864] New: php segfaults with pcre2 build with --enable-jit-sealloc
https://bugzilla.suse.com/show_bug.cgi?id=1182864 Bug ID: 1182864 Summary: php segfaults with pcre2 build with --enable-jit-sealloc Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs@suse.de Reporter: pgajdos@suse.com QA Contact: qa-bugs@suse.de Found By: --- Blocker: --- Hello Christian, Jason and others, in Tubmleweed, I get segfaults, for example with phoronix-test-suite. $ export TOTAL_LOOP_TIME="10080" $ phoronix-test-suite stress-run cachebench [..] Wait for few minutes, you will start to see crashes. #0 0x00007ff46f696808 in ?? () #1 0x00007ff47126deeb in pcre2_jit_match_8 (code=0x55e9180e74a0, subject=subject@entry=0x7ff46ee9ed18 "Executing Test: pts/cachebench-1.1.2", length=length@entry=36, start_offset=start_offset@entry=0, options=options@entry=1073741824, match_data=match_data@entry=0x55e917f91100, mcontext=0x55e918007560) at src/pcre2_jit_match.c:165 #2 0x000055e915a6868a in php_pcre_replace_impl (pce=0x7ff46f17f200, subject_str=0x7ff46ee9ed00, subject=0x7ff46ee9ed18 "Executing Test: pts/cachebench-1.1.2", subject_len=36, replace_str=0x55e917f3cb70, limit=18446744073709551615, replace_count=0x7ffd18300420) at /usr/src/debug/php7-7.4.15-1.2.x86_64/ext/pcre/php_pcre.c:1654 #3 0x000055e915a6a0ba in php_pcre_replace (replace_count=0x7ffd18300420, limit=18446744073709551615, replace_str=<optimized out>, subject_len=36, subject=0x7ff46ee9ed18 "Executing Test: pts/cachebench-1.1.2", subject_str=0x7ff46ee9ed00, regex=<optimized out>) at /usr/src/debug/php7-7.4.15-1.2.x86_64/ext/pcre/php_pcre.c:1596 #4 php_replace_in_subject (replace_count=0x7ffd18300420, limit=18446744073709551615, subject=<optimized out>, replace=<optimized out>, regex=<optimized out>) at /usr/src/debug/php7-7.4.15-1.2.x86_64/ext/pcre/php_pcre.c:2177 #5 preg_replace_common (execute_data=<optimized out>, return_value=0x7ff470c174c0, is_filter=0) at /usr/src/debug/php7-7.4.15-1.2.x86_64/ext/pcre/php_pcre.c:2318 #6 0x000055e915c5ae1b in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER (execute_data=0x7ff470c17450) at /usr/src/debug/php7-7.4.15-1.2.x86_64/Zend/zend_vm_execute.h:1314 #7 0x000055e915caaf98 in execute_ex (ex=<optimized out>) at /usr/src/debug/php7-7.4.15-1.2.x86_64/Zend/zend_vm_execute.h:53655 #8 0x000055e915cae65d in zend_execute (op_array=0x7ff470c802a0, return_value=0x0) at /usr/src/debug/php7-7.4.15-1.2.x86_64/Zend/zend_vm_execute.h:57957 #9 0x000055e915c022bd in zend_execute (return_value=0x0, op_array=0x7ff470c802a0) at /usr/src/debug/php7-7.4.15-1.2.x86_64/Zend/zend_llist.c:94 #10 zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/src/debug/php7-7.4.15-1.2.x86_64/Zend/zend.c:1679 #11 0x000055e915b8c660 in php_execute_script (primary_file=<optimized out>) at /usr/src/debug/php7-7.4.15-1.2.x86_64/main/main.c:2621 #12 0x000055e915cb0463 in do_cli (argc=4, argv=0x55e917f32650) at /usr/src/debug/php7-7.4.15-1.2.x86_64/sapi/cli/php_cli.c:964 #13 0x000055e915a3b053 in main (argc=4, argv=0x55e917f32650) at /usr/src/debug/php7-7.4.15-1.2.x86_64/sapi/cli/php_cli.c:1359 (gdb) I have stumbled over: https://bugs.php.net/bug.php?id=79261 and indeed, quoting https://www.pcre.org/readme.txt: . If you are enabling JIT under SELinux environment you may also want to add --enable-jit-sealloc, which enables the use of an executable memory allocator that is compatible with SELinux. Warning: this allocator is experimental! It does not support fork() operation and may crash when no disk space is available. This option has no effect if JIT is disabled. And indeed, when I either turn off pcre jit by pcre.jit=0 or when I replace pcre2 with that built without --enable-jit-sealloc, I stopped to see soonish segfaults. Should we consider to drop --enable-jit-sealloc for now? Or is there other way out? -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1182864 Petr Gajdos <pgajdos@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |crrodriguez@opensuse.org, | |otto.hollmann@suse.com, | |pgajdos@suse.com, | |suse+build@de-korte.org Assignee|screening-team-bugs@suse.de |jsikes@suse.com -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1182864 https://bugzilla.suse.com/show_bug.cgi?id=1182864#c1 --- Comment #1 from Cristian Rodr�guez <crrodriguez@opensuse.org> --- You could...however all systemd services using the memory protection settings in unit files will stop working. (the default allocator is incompatible with MemoryDenyWriteExecute=) -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1182864 https://bugzilla.suse.com/show_bug.cgi?id=1182864#c3 --- Comment #3 from Petr Gajdos <pgajdos@suse.com> --- To some extent minimal testcase in https://bugs.php.net/bug.php?id=78927 :/182864 # cat test.php <?php function regex() { preg_match('/(foo)(bar)(baz)/', 'foobarbaz', $matches, PREG_OFFSET_CAPTURE); } regex(); $pid = pcntl_fork(); if ($pid == -1) { die('error.'); } else if ($pid) { echo 'parent... '; pcntl_wait($pid); echo 'wait done'; } else { echo 'child.'; } ?> :/182864 # valgrind -q php test.php [..] parent... child. wait done ==21579== ==21579== Process terminating with default action of signal 11 (SIGSEGV): dumping core ==21579== Bad permissions for mapped region at address 0x531E5C0 ==21579== at 0x4BAC4DB: ??? (in /usr/lib64/libpcre2-8.so.0.10.1) ==21579== by 0x4BE3FE2: ??? (in /usr/lib64/libpcre2-8.so.0.10.1) ==21579== by 0x4B92A19: pcre2_code_free_8 (in /usr/lib64/libpcre2-8.so.0.10.1) ==21579== by 0x76BC41: php_efree_pcre_cache (php_pcre.c:156) ==21579== by 0x91C06C: zend_hash_destroy (zend_hash.c:1541) ==21579== by 0x76D4AF: zm_deactivate_pcre.lto_priv.0 (php_pcre.c:483) ==21579== by 0x90B413: zend_deactivate_modules (zend_API.c:2636) ==21579== by 0x88D134: php_request_shutdown (main.c:1895) ==21579== by 0x9B77AA: do_cli (php_cli.c:1132) ==21579== by 0x743052: main (php_cli.c:1359) Segmentation fault (core dumped) :/182864 # -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1182864 https://bugzilla.suse.com/show_bug.cgi?id=1182864#c4 --- Comment #4 from Petr Gajdos <pgajdos@suse.com> --- https://src.fedoraproject.org/rpms/pcre2/blob/rawhide/f/pcre2.spec -----------------------------8<---------------------------- # Disable SELinux-frindly JIT allocator because it seems not to be fork-safe, # https://bugs.exim.org/show_bug.cgi?id=1749#c45 %bcond_with pcre2_enables_sealloc ----------------------------->8---------------------------- -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1182864 https://bugzilla.suse.com/show_bug.cgi?id=1182864#c5 --- Comment #5 from Petr Gajdos <pgajdos@suse.com> --- https://bugs.archlinux.org/task/64799 -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1182864 https://bugzilla.suse.com/show_bug.cgi?id=1182864#c6 Petr Gajdos <pgajdos@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|php segfaults with pcre2 |pcre2: build with |build with |--enable-jit-sealloc |--enable-jit-sealloc |segfaults consumers --- Comment #6 from Petr Gajdos <pgajdos@suse.com> --- Following https://bugs.exim.org/show_bug.cgi?id=1749#c45 and https://github.com/rurban/re-engine-PCRE2/issues/29 and https://github.com/rurban/re-engine-PCRE2/commit/e9330addf0e20ac952cc0b7296c... and the result in home:pgajdos/perl-re-engine-PCRE2 it really seems that it is not an issue in php. -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1182864 https://bugzilla.suse.com/show_bug.cgi?id=1182864#c7 --- Comment #7 from Petr Gajdos <pgajdos@suse.com> --- Re MemoryDenyWriteExecute=, for example: https://github.com/php/php-src/commit/67cd4271e922ee3082b416a7563598274d13a1... Grep over packed sources in TW (i. e. no upstream service files checked): $ grep -r MemoryDenyWriteExecute ceph/ceph-test.changes: + systemd: ceph-mgr: set MemoryDenyWriteExecute to false ceph/ceph.changes: + systemd: ceph-mgr: set MemoryDenyWriteExecute to false pulseaudio/pulseaudio-old-systemd-workaround.patch: MemoryDenyWriteExecute=yes tor/tor.service:MemoryDenyWriteExecute=yes vnstat/systemd234.patch:-MemoryDenyWriteExecute=yes gnuhealth/gnuhealth.service:MemoryDenyWriteExecute=true Binary file upower/upower-0.99.11.obscpio matches orthanc/orthanc.service:MemoryDenyWriteExecute=true coturn/coturn.service:MemoryDenyWriteExecute=yes coturn/coturn@.service:MemoryDenyWriteExecute=yes galene/galene.service:MemoryDenyWriteExecute=yes Binary file monero/monero-0.17.1.9.obscpio matches $ In time being, I cannot comment the impact given my current knowledge in this area. -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1182864 Petr Gajdos <pgajdos@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|pcre2: build with |pcre2: build with |--enable-jit-sealloc |--enable-jit-sealloc may |segfaults consumers |segfault consumers -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1182864 https://bugzilla.suse.com/show_bug.cgi?id=1182864#c8 Petr Gajdos <pgajdos@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |security-team@suse.de, | |systemd-maintainers@suse.de --- Comment #8 from Petr Gajdos <pgajdos@suse.com> --- CCing systemd-maintainers@ and security-team@ to let them know and eventually hear their advice. -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1182864 https://bugzilla.suse.com/show_bug.cgi?id=1182864#c9 --- Comment #9 from Cristian Rodr�guez <crrodriguez@opensuse.org> --- Interesting..if it is not fork safe..then it will crash a lot of stuff.. if disabled, selinux policy may need adaptation, and tools using PCRE2 *AND* MemoryDenyWriteExecute= needed adjustment in the unit files *last time I checked* -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1182864 https://bugzilla.suse.com/show_bug.cgi?id=1182864#c15 --- Comment #15 from Marcus R�ckert <mrueckert@suse.com> --- *** Bug 1198046 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1182864 https://bugzilla.suse.com/show_bug.cgi?id=1182864#c16 Petr Gajdos <pgajdos@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #16 from Petr Gajdos <pgajdos@suse.com> --- I think this is done. -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠suse.com