Bug #71135 [Com]: Random memory corruption with strings

Edit report at https://bugs.php.net/bug.php?id=71135&edit=1

 ID:                 71135
 Comment by:         iquito at gmx dot net
 Reported by:        iquito at gmx dot net
 Summary:            Random memory corruption with strings
 Status:             Assigned
 Type:               Bug
 Package:            opcache
 Operating System:   Debian Jessie
 PHP Version:        7.0.0
 Assigned To:        laruence
 Block user comment: N
 Private report:     N

 New Comment:

I cannot edit the bug report / change the status, the error message

"You aren't allowed to change a bug to that state."

always appears, although I provide the correct password, and therefore I cannot submit anything with the "Edit" method or provide "official" feedback. I therefore provided feedback via Add Comment, which does not seem to count.


Previous Comments:
------------------------------------------------------------------------
[2015-12-27 04:22:29] php-bugs at lists dot php dot net

No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Re-Opened". Thank you.

------------------------------------------------------------------------
[2015-12-16 17:05:20] iquito at gmx dot net

Unfortunately, I do not know how to make further tests in a "safe" way - this problem only occured in production with many requests per second, and only after at least 12 hours of PHP-FPM running. If any string can have a "flipped" character in it at some point, I cannot use PHP7 for now - really bad stuff could happen in my applications.

I switched back to PHP 5.6 for now - no problem like this occurs with 5.6. PHP 7 is still running on the server with the smarty "bug" in it, but I do not know if that helps or if any information about what caused this bug can be captured from a running PHP-FPM instance which exhibits this bug.

------------------------------------------------------------------------
[2015-12-16 15:20:03] [email protected]

hey, you may try opcache.protect_memory=on, which will segfault if string in shared memory is changed, which will be helpful for use to find the root cause

anyway, please note, enable this will slowdown the performance visibily


thanks

------------------------------------------------------------------------
[2015-12-16 12:18:15] iquito at gmx dot net

Description:
------------
I have been using PHP7 in production since Saturday, compiling it myself according to the instructions on https://www.howtoforge.com/tutorial/how-to-install-php-7-on-debian/ . I have about 0.5 million pageviews served per day, and two primary web servers running PHP-FPM.

First, everything worked fine - but after 12-36 hours, when everything is cached and running perfectly, at least one string in the cached PHP files seems to "flip" one character in it. One time, it changed a character in an SQL query, which generated these errors:

"Unknown column 'blocked_by_usdr' in 'field list':
SELECT 1 AS `exists`, noted, friend, friend_confirmed, friend_position, known, known_confirmed, blocked AS blocking, blocked_by_usdr AS blocked FROM userlist_new WHERE profile_id = 137137 AND friend_profile_id = 65297"

Instead of blocked_by_user, it changed to blocked_by_usdr, which suddenly generated 500 SQL-errors per minute. As soon as I restarted PHP7-FPM on the affected server, everything was fine again, and I actually checked the PHP file - the SQL query was correct, and never contained that error.

24 hours later, on the other server, this error completely broke all websites:

Warning: require(/srv_ssd/domains/website/vendor/smarty/smarty/libs/sysplugins/smarty_template_compiled-php): failed to open stream: No such file or directory in /srv_ssd/domains/website/vendor/smarty/smarty/libs/sysplugins/smarty_internal_template.php

As you can see, instead of including /srv_ssd/domains/website/vendor/smarty/smarty/libs/sysplugins/smarty_template_compiled.php the string was changed from a dot to a dash. Interestingly enough, this error appeared in all three projects running on the server, although each had its own (identical) version of smarty_internal_template.php - but maybe the PHP opcache caches them only once if they are all the same, even if they are in different directories.

This happened to me three times already, on two different production servers, and always at night when my webservers are less busy. As soon as PHP7 is restarted, everything is fine again. When the last error occured, an SQL query in another file was also broken, so in two files one character changed at the same time. Because these error occur always at night and sometimes "grouped", maybe the opcache does some garbage collection at that time, or some other internal changes?

Unfortunately, I do not know how to reproduce this bug - it always occurs within 12-36 hours on my servers, but it never occurs when starting PHP-FPM, and I do not see a clear pattern on when or why it happens. It is also possible some string changes happened but were not noticed by me, because they did not result in an immediate PHP or SQL error.

My configure line:

configure --prefix=/opt/php7 --with-pdo-pgsql --with-zlib-dir --with-freetype-dir --enable-mbstring --with-libxml-dir=/usr --enable-soap --enable-calendar --with-curl --with-mcrypt --with-zlib --with-gd --with-pgsql --disable-rpath --enable-inline-optimization --with-bz2 --with-zlib --enable-sockets --enable-sysvsem --enable-sysvshm --enable-pcntl --enable-mbregex --enable-exif --enable-bcmath --with-mhash --enable-zip --with-pcre-regex --with-pdo-mysql --with-mysqli --with-mysql-sock=/var/run/mysqld/mysqld.sock --with-jpeg-dir=/usr --with-png-dir=/usr --enable-gd-native-ttf --with-openssl --with-fpm-user=als --with-fpm-group=als --with-libdir=/lib/x86_64-linux-gnu --enable-ftp --with-imap --with-imap-ssl --with-kerberos --with-gettext --with-xmlrpc --with-xsl --with-iconv-dir --enable-intl --enable-opcache --enable-fpm



------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=71135&edit=1