FPM - fpm_status_export_to_zval segfault for parallel execution

[craiglondon]

Description

Getting sporadic PHP-FPM segfaults

           PID: 1702021 (php-fpm)
           UID: 48 (apache)
           GID: 48 (apache)
        Signal: 11 (SEGV)
     Timestamp: Fri 2025-09-26 05:51:17 EDT (5h 34min ago)
  Command Line: $'php-fpm: pool www'
    Executable: /opt/remi/php83/root/usr/sbin/php-fpm
 Control Group: /system.slice/php83-php-fpm.service
          Unit: php83-php-fpm.service
         Slice: system.slice
       Boot ID: e4714d2eaf2644ddb9648b21923ead2e
    Machine ID: 6227364aab3f41cb9f4da11e86b139f9
      Hostname: hostingcloudxyz.com
       Storage: /var/lib/systemd/coredump/core.php-fpm.48.e4714d2eaf2644ddb9648b21923ead2e.1702021.1758880277000000.zst (present)
  Size on Disk: 19.7M
       Message: Process 1702021 (php-fpm) of user 48 dumped core.
                
                Stack trace of thread 1702021:
                #0  0x0000558c20d140ce fpm_request_get_stage_name (php-fpm + 0x5140ce)
                #1  0x0000558c20d17a0a fpm_status_export_to_zval (php-fpm + 0x517a0a)
                #2  0x0000558c20d11ddb zif_fpm_get_status (php-fpm + 0x511ddb)
                #3  0x0000558c20c8a2ac execute_ex (php-fpm + 0x48a2ac)
                #4  0x0000558c20c8ecd5 zend_execute (php-fpm + 0x48ecd5)
                #5  0x0000558c20c19300 zend_execute_scripts (php-fpm + 0x419300)
                #6  0x0000558c20bac70a php_execute_script (php-fpm + 0x3ac70a)
                #7  0x0000558c20a42ab3 main (php-fpm + 0x242ab3)
                #8  0x00007f9febe295d0 __libc_start_call_main (libc.so.6 + 0x295d0)
                #9  0x00007f9febe29680 __libc_start_main@@GLIBC_2.34 (libc.so.6 + 0x29680)
                #10 0x0000558c20a448f5 _start (php-fpm + 0x2448f5)
                ELF object binary architecture: AMD x86-64

(gdb) bt
#0  0x00005566b05140ce in fpm_request_get_stage_name (stage=-1236952832) at /usr/src/debug/php83-php-8.3.25-1.el9.remi.x86_64/sapi/fpm/fpm/fpm_request.c:35
#1  0x00005566b0517a0a in fpm_status_export_to_zval (status=status@entry=0x7f6fb6413090) at /usr/src/debug/php83-php-8.3.25-1.el9.remi.x86_64/sapi/fpm/fpm/fpm_status.c:114
#2  0x00005566b0511ddb in zif_fpm_get_status (execute_data=<optimized out>, return_value=0x7f6fb6413090) at /usr/src/debug/php83-php-8.3.25-1.el9.remi.x86_64/sapi/fpm/fpm/fpm_main.c:1531
#3  0x00005566b048a2ac in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER () at /usr/src/debug/php83-php-8.3.25-1.el9.remi.x86_64/Zend/zend_vm_execute.h:1337
#4  execute_ex (ex=0xffffffffb6459900) at /usr/src/debug/php83-php-8.3.25-1.el9.remi.x86_64/Zend/zend_vm_execute.h:57277
#5  0x00005566b048ecd5 in zend_execute (op_array=0x7f6fb647c000, return_value=0x0) at /usr/src/debug/php83-php-8.3.25-1.el9.remi.x86_64/Zend/zend_vm_execute.h:61665
#6  0x00005566b0419300 in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=3) at /usr/src/debug/php83-php-8.3.25-1.el9.remi.x86_64/Zend/zend.c:1895
#7  0x00005566b03ac70a in php_execute_script (primary_file=primary_file@entry=0x7fff7508a660) at /usr/src/debug/php83-php-8.3.25-1.el9.remi.x86_64/main/main.c:2529
#8  0x00005566b0242ab3 in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/php83-php-8.3.25-1.el9.remi.x86_64/sapi/fpm/fpm/fpm_main.c:1936

PHP Version

PHP 8.3.25 (cli) (built: Aug 26 2025 15:05:30) (NTS gcc x86_64)
Copyright (c) The PHP Group
Zend Engine v4.3.25, Copyright (c) Zend Technologies
    with Zend OPcache v8.3.25, Copyright (c), by Zend Technologies

PHP 8.3.25 (fpm-fcgi) (built: Aug 26 2025 15:05:30)
Copyright (c) The PHP Group
Zend Engine v4.3.25, Copyright (c) Zend Technologies
    with Zend OPcache v8.3.25, Copyright (c), by Zend Technologies

Operating System

Rocky Linux 9.6 (Blue Onyx)

[devnexen]

Hi would you be able to have a debug version of php fpm ? That seems an overflow but the whole struct (e.g. fpm_scoreboard_proc_s) pointer calling it might be just a dangling one.

[devnexen]

nevermind, you re already have a debug version just saw the output. can you access the frame 1 then printing procs[i] eventually ?

[craiglondon]

@devnexen I would like to provide this. This is all new to me. First time ever using coredumpctl debug. Can you give me some more detailed instructions or provide a link with instructions to do so?

[craiglondon]

(gdb) f 0
#0  0x00005566b05140ce in fpm_request_get_stage_name (stage=1429357298) at /usr/src/debug/php83-php-8.3.25-1.el9.remi.x86_64/sapi/fpm/fpm/fpm_request.c:35
35		return requests_stages[stage];
(gdb) f 1
#1  0x00005566b0517a0a in fpm_status_export_to_zval (status=status@entry=0x7f6fb6413090) at /usr/src/debug/php83-php-8.3.25-1.el9.remi.x86_64/sapi/fpm/fpm/fpm_status.c:114
114			add_assoc_string(&fpm_proc_stat, "state", fpm_request_get_stage_name(procs[i].request_stage));

[devnexen]

Absolutely, just right after you enter your gdb session, you can type f 1 then p procs[i].

[craiglondon]

@devnexen Thanks! Here is the output

(gdb) f 1
#1  0x00005566b0517a0a in fpm_status_export_to_zval (status=status@entry=0x7f6fb6413090) at /usr/src/debug/php83-php-8.3.25-1.el9.remi.x86_64/sapi/fpm/fpm/fpm_status.c:114
114			add_assoc_string(&fpm_proc_stat, "state", fpm_request_get_stage_name(procs[i].request_stage));
(gdb) p procs[i]
value has been optimized out

[devnexen]

Ok, can you do f 0 and info args ?

[craiglondon]

(gdb) f 0
#0  0x00005566b05140ce in fpm_request_get_stage_name (stage=1429357298) at /usr/src/debug/php83-php-8.3.25-1.el9.remi.x86_64/sapi/fpm/fpm/fpm_request.c:35
35		return requests_stages[stage];
(gdb) info args
stage = 1429357298