php5-gd doesn't close /proc/NN/auxv - leaks FDs?

[Sander Smeenk]

The gd.so PHP5 extension (php5-gd, 5.3.10-1ubuntu3.6) 'leaks' FDs to /proc/NN/auxv or forgets to close them properly.

Without php5-gd active:

# apache2ctl start
# for pid in `pidof apache2`; do find /proc/$pid/fd -ls 2>&1 | grep auxv; done | awk '{print $11" "$12" "$13}'
# apache2ctl stop

With php5-gd active:

# mv /root/php/gd.ini .
# cat gd.ini
; configuration for php GD module
extension=gd.so

# apache2ctl start
# for pid in `pidof apache2`; do find /proc/$pid/fd -ls 2>&1 | grep auxv; done | awk '{print $11" "$12" "$13}'
/proc/30866/fd/387 -> /proc/30861/auxv
/proc/30865/fd/387 -> /proc/30861/auxv
/proc/30864/fd/387 -> /proc/30861/auxv
/proc/30863/fd/387 -> /proc/30861/auxv
/proc/30862/fd/387 -> /proc/30861/auxv
/proc/30861/fd/387 -> /proc/30861/auxv
#

With php5-gd active, after doing a graceful restart:

# apache2ctl graceful
# for pid in `pidof apache2`; do find /proc/$pid/fd -ls 2>&1 | grep auxv; done | awk '{print $11" "$12" "$13}'
/proc/30932/fd/387 -> /proc/30861/auxv
/proc/30932/fd/388 -> /proc/30861/auxv
/proc/30930/fd/387 -> /proc/30861/auxv
/proc/30930/fd/388 -> /proc/30861/auxv
/proc/30929/fd/387 -> /proc/30861/auxv
/proc/30929/fd/388 -> /proc/30861/auxv
/proc/30928/fd/387 -> /proc/30861/auxv
/proc/30928/fd/388 -> /proc/30861/auxv
/proc/30926/fd/387 -> /proc/30861/auxv
/proc/30926/fd/388 -> /proc/30861/auxv
/proc/30925/fd/387 -> /proc/30861/auxv
/proc/30925/fd/388 -> /proc/30861/auxv
/proc/30861/fd/387 -> /proc/30861/auxv
/proc/30861/fd/388 -> /proc/30861/auxv
root@dot:/etc/php5/conf.d#

Each 'graceful' increases the number of filehandles to /proc/NN/auxv.
The NN-pid is always the 'process leader' or 'main apache thread'.

Steps to reproduce:

Fresh and clean Ubuntu Precise 12.04.2 install

# apt-get install apache2-mpm-itk libapache2-mod-php5 php5-gd

Restart Apache to ensure gd.so is loaded

# for pid in `pidof apache2`; do find /proc/$pid/fd -ls; done | awk '/auxv/ {print $11" "$12" "$13}'
# apache2ctl graceful
# for pid in `pidof apache2`; do find /proc/$pid/fd -ls; done | awk '/auxv/ {print $11" "$12" "$13}'
# apache2ctl graceful
# for pid in `pidof apache2`; do find /proc/$pid/fd -ls; done | awk '/auxv/ {print $11" "$12" "$13}'
.. etc

This also happens with mpm-prefork.

Strange though, there is no reference to 'auxv' in the sources other than a #define in readelf.h

The filehandles might also be left open on other occations than a graceful restart, on my fairly loaded systems this quickly adds up. My nine webservers at this moment have a total of ~80000 filehandles opened for the procfs /proc/NN/auxv file

[Forest Bond (forest-bond)]

See also https://bugs.launchpad.net/ubuntu/+source/libjpeg-turbo/+bug/1189939

[Sander Smeenk (ubuntu-freshdot)]

Confirmed. The above mentioned bug (+ fix) fixes this issue.

[Sander Smeenk (ubuntu-freshdot)]

Can't find an option to close this bug. Feel free to close this. Will track libjpeg-turbo bug 1189939 instead.