libapache2-mod-php5: Segmentation fault on mediawiki POST requests after apache2 reload

[Philipp Kaluza]

SRU request:

[impact]
Reloading apache2 will cause php5 to fail to work correctly, and will result in some website failures. This has been solved by backporting a minimal patch from more recent versions of php.

[test case]
Reproducing this requires a specific setup, but the original bug reporter has tested the update and it has resolved the issue. The issue was also known to php upstream and has been fixed in saucy and higher.

[regression potential]
An issue with this patch would cause php sessions to break, so it should be quickly discoverable.

Original report:

This is the affected following setup:
* apache2-mpm-worker
* libapache2-mod-php5
* mediawiki
(all from quantal in my case).

After doing "/etc/init.d/apache2 reload", POST requests to mediawiki (e.g. page preview or save) fail with a lost connection. The log files only show a line like this:
[Mon Jan 21 12:21:06 2013] [notice] child pid 16018 exit signal Segmentation fault (11)

Doing "/etc/init.d/apache2 restart" works around the problem.

This seems to be the same as http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=691318 and possibly http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=694473 . I'm blaming PHP for now, in accordance with the upstream reporters. :-)

Creating a backtrace from the apache child processes has proved quite challenging, so I'm stopping here.

Thank you for your consideration,
  Philipp

ProblemType: Bug
DistroRelease: Ubuntu 12.10
Package: libapache2-mod-php5 5.4.6-1ubuntu1.1
ProcVersionSignature: Ubuntu 3.5.0-19.30-generic 3.5.7
Uname: Linux 3.5.0-19-generic x86_64
ApportVersion: 2.6.1-0ubuntu9
Architecture: amd64
Date: Mon Jan 21 12:34:51 2013
MarkForUpload: True
SourcePackage: php5
UpgradeStatus: Upgraded to quantal on 2012-12-10 (41 days ago)

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Jarl (jarl-dk)]

Happens for me as well.

Easy to reproduce: `sudo service apache2 reload` and hit "Preview" on a mediawiki edit page
Easy to workaround `sudo service apache2 restart`

[Jarl (jarl-dk)]

Happens on 12.10 with libapache2-mod-php5 version 5.4.6-1ubuntu1.1

So the claim in the debian bug that it should be fixed in 5.4.4-12 is not true.

[Ondřej Surý (ondrej)]

Your claim isn't based on reality, please go read the changelogs and at least get a basic understanding of Debian/Ubuntu versioning schema before you make a bold claims without actually testing anything next time.

[picometer (picometer)]

https://bugs.php.net/bug.php?id=62129
It has an effect on not only Mediawiki but also everything that performing POST request

[Julio Auto (mindvortex)]

Agreed with picometer. This bug _is_ affecting POST-performing code regardless of mediawiki being installed or not. I have checked myself that the fixes employed on Debian for bug #694473 have not propagated to subsequent Ubuntu releases. Furthermore I do have a (non-symbolicated) backtrace for this occurence and it's remarkably similar to the one posted for the Debian bug #696626 (a duplicate of #694473), so I'm very confident that we're talking about the same bug here.

I'd definitely give this some meaningful importance. It basically breaks my application weekly (when logrotate runs and reloads Apache) and it was a pain to diagnose. It's not unrealistic to believe it's happening to many others.

By the way, I'm Running PHP 5.4.6-1ubuntu1.4 on Ubuntu 12.10.

(gdb) bt full
#0 0x00007f8d99138771 in ?? () from /usr/lib/apache2/modules/libphp5.so
No symbol table info available.
...
(many frames later...)
...
#87279 0x00007f8d9913879b in ?? () from /usr/lib/apache2/modules/libphp5.so
#87280 0x00007f8d9913879b in ?? () from /usr/lib/apache2/modules/libphp5.so
#87281 0x00007f8d9913879b in ?? () from /usr/lib/apache2/modules/libphp5.so
#87282 0x00007f8d9913879b in ?? () from /usr/lib/apache2/modules/libphp5.so
#87283 0x00007f8d9923efc5 in rfc1867_post_handler () from /usr/lib/apache2/modules/libphp5.so
#87284 0x00007f8d9923c893 in sapi_handle_post () from /usr/lib/apache2/modules/libphp5.so
#87285 0x00007f8d99243988 in php_default_treat_data () from /usr/lib/apache2/modules/libphp5.so
#87286 0x00007f8d990f4cdd in mbstr_treat_data () from /usr/lib/apache2/modules/libphp5.so
#87287 0x00007f8d992424dc in ?? () from /usr/lib/apache2/modules/libphp5.so
#87288 0x00007f8d99271c4b in ?? () from /usr/lib/apache2/modules/libphp5.so
#87289 0x00007f8d992a2fd5 in zend_hash_apply () from /usr/lib/apache2/modules/libphp5.so
#87290 0x00007f8d99243cee in ?? () from /usr/lib/apache2/modules/libphp5.so
#87291 0x00007f8d992341f5 in php_request_startup () from /usr/lib/apache2/modules/libphp5.so
#87292 0x00007f8d9933f39b in ?? () from /usr/lib/apache2/modules/libphp5.so
#87293 0x00007f8d9da655f0 in ap_run_handler (r=0x7f8d9d8354c0) at config.c:159
#87294 0x00007f8d9da65a3b in ap_invoke_handler (r=r@entry=0x7f8d9d8354c0...

[Marc Deslauriers (mdeslaur)]

This is related to the following php bug:
https://bugs.php.net/bug.php?id=62129

The following commits are probably required:
http://git.php.net/?p=php-src.git;a=commit;h=336a8e1943af85bb49cb5986d897d967ba73dcc0
http://git.php.net/?p=php-src.git;a=commit;h=ba3234888dfbe14dadac7ac6c403a58bc1fdd220

This affects quantal and raring, as the upstream changes are in the php version included in saucy.

[Marc Deslauriers (mdeslaur)]

I have uploaded a php5 package with the patch to my testing PPA here:

https://launchpad.net/~mdeslaur/+archive/testing

Please test it, and if it solves the problem, please comment, and I will upload it to quantal-proposed. Thanks!

[Julio Auto (mindvortex)]

Yes. Tested it extensively and it does work for me. Thank you.

[Marc Deslauriers (mdeslaur)]

Uploaded to quantal for processing by the SRU team. Thanks!

[Julio Auto (mindvortex)]

Nice! Any plans for raring? One of my raring setups is also affected.

On Tue, Jan 7, 2014 at 12:17 PM, Marc Deslauriers <
<email address hidden>> wrote:

> Uploaded to quantal for processing by the SRU team. Thanks!
>
> ** Description changed:
>
> + SRU request:
> +
> + [impact]
> + Reloading apache2 will cause php5 to fail to work correctly, and will
> result in some website failures. This has been solved by backporting a
> minimal patch from more recent versions of php.
> +
> + [test case]
> + Reproducing this requires a specific setup, but the original bug
> reporter has tested the update and it has resolved the issue. The issue was
> also known to php upstream and has been fixed in saucy and higher.
> +
> + [regression potential]
> + An issue with this patch would cause php sessions to break, so it should
> be quickly discoverable.
> +
> +
> + Original report:
> +
> This is the affected following setup:
> * apache2-mpm-worker
> * libapache2-mod-php5
> * mediawiki
> (all from quantal in my case).
>
> After doing "/etc/init.d/apache2 reload", POST requests to mediawiki
> (e.g. page preview or save) fail with a lost connection. The log files only
> show a line like this:
> [Mon Jan 21 12:21:06 2013] [notice] child pid 16018 exit signal
> Segmentation fault (11)
>
> Doing "/etc/init.d/apache2 restart" works around the problem.
>
> This seems to be the same as http://bugs.debian.org/cgi-
> bin/bugreport.cgi?bug=691318 and possibly http://bugs.debian.org/cgi-
> bin/bugreport.cgi?bug=694473 . I'm blaming PHP for now, in accordance
> with the upstream reporters. :-)
>
> Creating a backtrace from the apache child processes has proved quite
> challenging, so I'm stopping here.
>
> Thank you for your consideration,
> - Philipp
> + Philipp
>
> ProblemType: Bug
> DistroRelease: Ubuntu 12.10
> Package: libapache2-mod-php5 5.4.6-1ubuntu1.1
> ProcVersionSignature: Ubuntu 3.5.0-19.30-generic 3.5.7
> Uname: Linux 3.5.0-19-generic x86_64
> ApportVersion: 2.6.1-0ubuntu9
> Architecture: amd64
> Date: Mon Jan 21 12:34:51 2013
> MarkForUpload: True
> SourcePackage: php5
> UpgradeStatus: Upgraded to quantal on 2012-12-10 (41 days ago)
>
> ** Changed in: php5 (Ubuntu Quantal)
> Status: Confirmed => In Progress
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1102366
>
> Title:
> libapache2-mod-php5: Segmentation fault on mediawiki POST requests
> after apache2 reload
>
> Status in “php5” package in Ubuntu:
> Invalid
> Status in “php5” source package in Quantal:
> In Progress
> Status in “php5” source package in Raring:
> Confirmed
> Status in “php5” package in Debian:
> Fix Released
>
> Bug description:
> SRU request:
>
> [impact]
> Reloading apache2 will cause php5 to fail to work correctly, and will
> result in some website failures. This has been solved by backporting a
> minimal patch from more recent versions of php.
>
> [test case]
> Reproducing this requires a specific setup, but the original bug
> reporter has tested the update and it has resolved the issue. The issue was
> also known t...

[Marc Deslauriers (mdeslaur)]

Seeing as how raring is going end of life in about three weeks, I don't think it's worth it. Sorry.

https://lists.ubuntu.com/archives/ubuntu-security-announce/2014-January/002367.html

[Julio Auto (mindvortex)]

Ouch :(
Ok, man. Thanks a lot!

On Tue, Jan 7, 2014 at 2:04 PM, Marc Deslauriers <
<email address hidden>> wrote:

> Seeing as how raring is going end of life in about three weeks, I don't
> think it's worth it. Sorry.
>
> https://lists.ubuntu.com/archives/ubuntu-security-
> announce/2014-January/002367.html
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1102366
>
> Title:
> libapache2-mod-php5: Segmentation fault on mediawiki POST requests
> after apache2 reload
>
> Status in “php5” package in Ubuntu:
> Invalid
> Status in “php5” source package in Quantal:
> In Progress
> Status in “php5” source package in Raring:
> Confirmed
> Status in “php5” package in Debian:
> Fix Released
>
> Bug description:
> SRU request:
>
> [impact]
> Reloading apache2 will cause php5 to fail to work correctly, and will
> result in some website failures. This has been solved by backporting a
> minimal patch from more recent versions of php.
>
> [test case]
> Reproducing this requires a specific setup, but the original bug
> reporter has tested the update and it has resolved the issue. The issue was
> also known to php upstream and has been fixed in saucy and higher.
>
> [regression potential]
> An issue with this patch would cause php sessions to break, so it should
> be quickly discoverable.
>
>
> Original report:
>
> This is the affected following setup:
> * apache2-mpm-worker
> * libapache2-mod-php5
> * mediawiki
> (all from quantal in my case).
>
> After doing "/etc/init.d/apache2 reload", POST requests to mediawiki
> (e.g. page preview or save) fail with a lost connection. The log files only
> show a line like this:
> [Mon Jan 21 12:21:06 2013] [notice] child pid 16018 exit signal
> Segmentation fault (11)
>
> Doing "/etc/init.d/apache2 restart" works around the problem.
>
> This seems to be the same as http://bugs.debian.org/cgi-
> bin/bugreport.cgi?bug=691318 and possibly http://bugs.debian.org/cgi-
> bin/bugreport.cgi?bug=694473 . I'm blaming PHP for now, in accordance
> with the upstream reporters. :-)
>
> Creating a backtrace from the apache child processes has proved quite
> challenging, so I'm stopping here.
>
> Thank you for your consideration,
> Philipp
>
> ProblemType: Bug
> DistroRelease: Ubuntu 12.10
> Package: libapache2-mod-php5 5.4.6-1ubuntu1.1
> ProcVersionSignature: Ubuntu 3.5.0-19.30-generic 3.5.7
> Uname: Linux 3.5.0-19-generic x86_64
> ApportVersion: 2.6.1-0ubuntu9
> Architecture: amd64
> Date: Mon Jan 21 12:34:51 2013
> MarkForUpload: True
> SourcePackage: php5
> UpgradeStatus: Upgraded to quantal on 2012-12-10 (41 days ago)
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1102366/+subscriptions
>

[Brian Murray (brian-murray)]

Hello Philipp, or anyone else affected,

Accepted php5 into quantal-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/php5/5.4.6-1ubuntu1.6 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Rolf Leggewie (r0lf)]

quantal has seen the end of its life and is no longer receiving any updates. Marking the quantal task for this ticket as "Won't Fix".

[Rolf Leggewie (r0lf)]

raring has seen the end of its life and is no longer receiving any updates. Marking the raring task for this ticket as "Won't Fix".