zend (php-fpm) crashes in high load/memory server

[Rarylson Freitas]

When the server is with a big load and, mainly, using a lot of memory (and swapping), the php5-fpm process crashs with a SIGFAULT signal.

The service works again when I do a `service php5-fpm restart` command.

The problem occours a few times (everytime, the server was with 100% memory usage, and swapping). It occours 5 times in a single day when the application was with a uncommon CPU/memory usage (caused by a already solved bug).

dmesg returns a lot of messages like:

  [6463236.343483] php5-fpm[12724]: segfault at 30 ip 00000000006b9311 sp 00007fff6e724ab0 error 4 in php5-fpm[400000+75b000]
  [6463375.937315] php5-fpm[12676] general protection ip:7f9079aaa7ae sp:2acb364e9fa8a6e8 error:0 in libc-2.15.so[7f90799a0000+1b5000]
  [6464335.367274] php5-fpm[13456] general protection ip:6ba14f sp:7fff81fa8010 error:0 in php5-fpm[400000+75b000]

I'll attaching an /var/crash/_usr_sbin_php5-fpm.33.crash file (Set, 14). I'll try to attach a lot of core dumps (Set, 15 and Set, 16) generated using the php5-dbg package (with debug symbols) and send the entire dmesg output.

Environment: Ubuntu Server 12.04.3 LTS, Webserver with PHP5-FPM (5.3.10-1ubuntu3.8).

Environment second the apport report file:

ProblemType: Crash
Architecture: amd64
Date: Thu Sep 12 07:40:40 2013
DistroRelease: Ubuntu 12.04
ExecutablePath: /usr/sbin/php5-fpm
[...]
Signal: 11
Uname: Linux 3.2.0-40-virtual x86_64

gdb output (gdb /usr/sbin/php5-fpm core.14792):

Core was generated by `php-fpm: pool www '.
Program terminated with signal 11, Segmentation fault.
#0 _zval_ptr_dtor (zval_ptr=0xbaf98d27026e1500) at /build/buildd/php5-5.3.10/Zend/zend_execute_API.c:436
436 /build/buildd/php5-5.3.10/Zend/zend_execute_API.c: No such file or directory.

dgb `bt full` output (core.14792, main lines):

#0 _zval_ptr_dtor (zval_ptr=0xbaf98d27026e1500) at /build/buildd/php5-5.3.10/Zend/zend_execute_API.c:436
        zv = 0x26e14e8
#1 0x00000000006a7ac0 in zend_hash_destroy (ht=0x30d0e30) at /build/buildd/php5-5.3.10/Zend/zend_hash.c:729
No locals.
#2 0x0000000000690560 in destroy_zend_class (pce=0xbaf98d27026e1500) at /build/buildd/php5-5.3.10/Zend/zend_opcode.c:187
        ce = 0x30d0db8
#3 0x00000000006a7350 in _zend_hash_add_or_update (ht=0x1054c90, arKey=0x12afcd8 "", nKeyLength=92, pData=0x0, nDataSize=0, pDest=0x8006a691d, flag=6844698)
    at /build/buildd/php5-5.3.10/Zend/zend_hash.c:433
        h = 1730852247

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[David Gitman (r-david-2)]

I can reproduce this segfault under low / normal load.