Skip to content

[wip] Refresh zend mm shadow key on fork #16765

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 1 commit into
base: PHP-8.4
Choose a base branch
from
Draft

[wip] Refresh zend mm shadow key on fork #16765

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 38 additions & 15 deletions Zend/zend_alloc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,8 +70,6 @@
# include <wincrypt.h>
# include <process.h>
# include "win32/winutil.h"
# define getpid _getpid
typedef int pid_t;
#endif

#include <stdio.h>
Expand Down Expand Up @@ -307,7 +305,6 @@ struct _zend_mm_heap {
} custom_heap;
HashTable *tracked_allocs;
#endif
pid_t pid;
zend_random_bytes_insecure_state rand_state;
};

Expand Down Expand Up @@ -1300,15 +1297,20 @@ static zend_always_inline zend_mm_free_slot* zend_mm_encode_free_slot(const zend
#endif
}

static zend_always_inline zend_mm_free_slot* zend_mm_decode_free_slot(zend_mm_heap *heap, zend_mm_free_slot *slot)
static zend_always_inline zend_mm_free_slot* zend_mm_decode_free_slot_key(uintptr_t shadow_key, zend_mm_free_slot *slot)
{
#ifdef WORDS_BIGENDIAN
return (zend_mm_free_slot*)((uintptr_t)slot ^ heap->shadow_key);
return (zend_mm_free_slot*)((uintptr_t)slot ^ shadow_key);
#else
return (zend_mm_free_slot*)(BSWAPPTR((uintptr_t)slot ^ heap->shadow_key));
return (zend_mm_free_slot*)(BSWAPPTR((uintptr_t)slot ^ shadow_key));
#endif
}

static zend_always_inline zend_mm_free_slot* zend_mm_decode_free_slot(zend_mm_heap *heap, zend_mm_free_slot *slot)
{
return zend_mm_decode_free_slot_key(heap->shadow_key, slot);
}

static zend_always_inline void zend_mm_set_next_free_slot(zend_mm_heap *heap, uint32_t bin_num, zend_mm_free_slot *slot, zend_mm_free_slot *next)
{
ZEND_ASSERT(bin_data_size[bin_num] >= ZEND_MM_MIN_USEABLE_BIN_SIZE);
Expand Down Expand Up @@ -2017,6 +2019,30 @@ static void zend_mm_init_key(zend_mm_heap *heap)
zend_mm_refresh_key(heap);
}

static void zend_mm_refresh_key_child(zend_mm_heap *heap)
{
uintptr_t old_key = heap->shadow_key;

zend_mm_init_key(heap);

/* Update shadow pointers with new key */
for (int i = 0; i < ZEND_MM_BINS; i++) {
zend_mm_free_slot *slot = heap->free_slot[i];
if (!slot) {
continue;
}
zend_mm_free_slot *next;
while ((next = slot->next_free_slot)) {
zend_mm_free_slot *shadow = ZEND_MM_FREE_SLOT_PTR_SHADOW(slot, i);
if (UNEXPECTED(next != zend_mm_decode_free_slot_key(old_key, shadow))) {
zend_mm_panic("zend_mm_heap corrupted");
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can these corruption cases be tested with a help of zend_test easily?

}
zend_mm_set_next_free_slot(heap, i, slot, next);
slot = next;
}
}
}

static zend_mm_heap *zend_mm_init(void)
{
zend_mm_chunk *chunk = (zend_mm_chunk*)zend_mm_chunk_alloc_int(ZEND_MM_CHUNK_SIZE, ZEND_MM_CHUNK_SIZE);
Expand Down Expand Up @@ -2065,7 +2091,6 @@ static zend_mm_heap *zend_mm_init(void)
heap->storage = NULL;
#endif
heap->huge_list = NULL;
heap->pid = getpid();
return heap;
}

Expand Down Expand Up @@ -2511,13 +2536,7 @@ ZEND_API void zend_mm_shutdown(zend_mm_heap *heap, bool full, bool silent)
p->free_map[0] = (1L << ZEND_MM_FIRST_PAGE) - 1;
p->map[0] = ZEND_MM_LRUN(ZEND_MM_FIRST_PAGE);

pid_t pid = getpid();
if (heap->pid != pid) {
zend_mm_init_key(heap);
heap->pid = pid;
} else {
zend_mm_refresh_key(heap);
}
zend_mm_refresh_key(heap);
}
}

Expand Down Expand Up @@ -2924,6 +2943,11 @@ ZEND_API void shutdown_memory_manager(bool silent, bool full_shutdown)
zend_mm_shutdown(AG(mm_heap), full_shutdown, silent);
}

ZEND_API void refresh_memory_manager(void)
{
zend_mm_refresh_key_child(AG(mm_heap));
}

static ZEND_COLD ZEND_NORETURN void zend_out_of_memory(void)
{
fprintf(stderr, "Out of memory\n");
Expand Down Expand Up @@ -3268,7 +3292,6 @@ ZEND_API zend_mm_heap *zend_mm_startup_ex(const zend_mm_handlers *handlers, void
memcpy(storage->data, data, data_size);
}
heap->storage = storage;
heap->pid = getpid();
return heap;
#else
return NULL;
Expand Down
1 change: 1 addition & 0 deletions Zend/zend_alloc.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -220,6 +220,7 @@ ZEND_API bool zend_alloc_in_memory_limit_error_reporting(void);

ZEND_API void start_memory_manager(void);
ZEND_API void shutdown_memory_manager(bool silent, bool full_shutdown);
ZEND_API void refresh_memory_manager(void);
ZEND_API bool is_zend_mm(void);
ZEND_API bool is_zend_ptr(const void *ptr);

Expand Down
2 changes: 2 additions & 0 deletions ext/pcntl/pcntl.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@
#include "php_signal.h"
#include "php_ticks.h"
#include "zend_fibers.h"
#include "main/php_main.h"

#if defined(HAVE_GETPRIORITY) || defined(HAVE_SETPRIORITY) || defined(HAVE_WAIT3)
#include <sys/wait.h>
Expand Down Expand Up @@ -292,6 +293,7 @@ PHP_FUNCTION(pcntl_fork)

}
} else if (id == 0) {
php_child_init();
zend_max_execution_timer_init();
}

Expand Down
5 changes: 5 additions & 0 deletions main/main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1797,6 +1797,11 @@ static void sigchld_handler(int apar)
/* }}} */
#endif

PHPAPI void php_child_init(void)
{
refresh_memory_manager();
}

/* {{{ php_request_startup */
zend_result php_request_startup(void)
{
Expand Down
1 change: 1 addition & 0 deletions main/php_main.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@ PHPAPI unsigned int php_version_id(void);
PHPAPI char *php_get_version(sapi_module_struct *sapi_module);
PHPAPI void php_print_version(sapi_module_struct *sapi_module);

PHPAPI void php_child_init(void);
PHPAPI zend_result php_request_startup(void);
PHPAPI void php_request_shutdown(void *dummy);
PHPAPI zend_result php_module_startup(sapi_module_struct *sf, zend_module_entry *additional_module);
Expand Down
1 change: 1 addition & 0 deletions sapi/apache2handler/sapi_apache2.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -751,6 +751,7 @@ zend_first_try {
static void php_apache_child_init(apr_pool_t *pchild, server_rec *s)
{
apr_pool_cleanup_register(pchild, NULL, php_apache_child_shutdown, apr_pool_cleanup_null);
php_child_init();
}

#ifdef ZEND_SIGNALS
Expand Down
2 changes: 2 additions & 0 deletions sapi/cgi/cgi_main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2043,6 +2043,8 @@ consult the installation file that came with this distribution, or visit \n\
*/
parent = 0;

php_child_init();

/* don't catch our signals */
sigaction(SIGTERM, &old_term, 0);
sigaction(SIGQUIT, &old_quit, 0);
Expand Down
1 change: 1 addition & 0 deletions sapi/cli/php_cli_server.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2528,6 +2528,7 @@ static void php_cli_server_startup_workers(void) {
#if defined(HAVE_PRCTL) || defined(HAVE_PROCCTL)
php_cli_server_worker_install_pdeathsig();
#endif
php_child_init();
return;
} else {
php_cli_server_workers[php_cli_server_worker] = pid;
Expand Down
3 changes: 3 additions & 0 deletions sapi/fpm/fpm/fpm_php.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -239,6 +239,9 @@ int fpm_php_init_child(struct fpm_worker_pool_s *wp) /* {{{ */
limit_extensions = wp->limit_extensions;
wp->limit_extensions = NULL;
}

php_child_init();

return 0;
}
/* }}} */
Expand Down