Skip to content

php_admin_value[extension]= in FPM pool configuration unsafely runs RINIT #19520

@TimWolla

Description

@TimWolla

Description

With the following configuration:

[global]
log_level = debug
error_log = /dev/stderr

[www]
listen = 9999
pm = ondemand
pm.max_children = 3
php_admin_value[extension]=session.so
catch_workers_output=true

and a small patch to session.c to enable session auto start by default (custom INI flags are not loaded in time, other in-tree extensions do not crash):

diff --git i/ext/session/session.c w/ext/session/session.c
index 70e1673d87f..fd6c6cef77d 100644
--- i/ext/session/session.c
+++ w/ext/session/session.c
@@ -900,7 +900,7 @@ PHP_INI_BEGIN()
        STD_PHP_INI_ENTRY("session.save_path",          "",          PHP_INI_ALL, OnUpdateSaveDir,       save_path,          php_ps_globals,    ps_globals)
        STD_PHP_INI_ENTRY("session.name",               "PHPSESSID", PHP_INI_ALL, OnUpdateName,          session_name,       php_ps_globals,    ps_globals)
        PHP_INI_ENTRY("session.save_handler",           "files",     PHP_INI_ALL, OnUpdateSaveHandler)
-       STD_PHP_INI_BOOLEAN("session.auto_start",       "0",         PHP_INI_PERDIR, OnUpdateBool,       auto_start,         php_ps_globals,    ps_globals)
+       STD_PHP_INI_BOOLEAN("session.auto_start",       "1",         PHP_INI_PERDIR, OnUpdateBool,       auto_start,         php_ps_globals,    ps_globals)
        STD_PHP_INI_ENTRY("session.gc_probability",     "1",         PHP_INI_ALL, OnUpdateSessionGcProbability,    gc_probability,     php_ps_globals,    ps_globals)
        STD_PHP_INI_ENTRY("session.gc_divisor",         "100",       PHP_INI_ALL, OnUpdateSessionDivisor,gc_divisor,         php_ps_globals,    ps_globals)
        STD_PHP_INI_ENTRY("session.gc_maxlifetime",     "1440",      PHP_INI_ALL, OnUpdateSessionLong,          gc_maxlifetime,     php_ps_globals,    ps_globals)

and then running:

sapi/fpm/php-fpm -y fpm.conf -F

and sending a request results in this output:

[19-Aug-2025 12:48:16.712084] DEBUG: pid 700863, fpm_pctl_on_socket_accept(), line 553: [pool www] got accept without idle child available .... I forked
[19-Aug-2025 12:48:16.712117] DEBUG: pid 700863, fpm_event_loop(), line 426: event module triggered 1 events
[19-Aug-2025 12:48:16.715649] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "php-src/Zend/zend_hash.c:783:8: runtime error: applying non-zero offset 3667908216 to null pointer"
[19-Aug-2025 12:48:16.715734] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior php-src/Zend/zend_hash.c:783:8 in "
[19-Aug-2025 12:48:16.715807] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "AddressSanitizer:DEADLYSIGNAL"
[19-Aug-2025 12:48:16.715850] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "================================================================="
[19-Aug-2025 12:48:16.715884] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "==700924==ERROR: AddressSanitizer: SEGV on unknown address 0x00009b537acf (pc 0x591d64517a26 bp 0x7ffd030695a0 sp 0x7ffd03069480 T0)"
[19-Aug-2025 12:48:16.715929] DEBUG: pid 700863, fpm_event_loop(), line 426: event module triggered 1 events
[19-Aug-2025 12:48:16.715997] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "==700924==The signal is caused by a READ memory access."
[19-Aug-2025 12:48:16.716042] DEBUG: pid 700863, fpm_event_loop(), line 426: event module triggered 1 events
[19-Aug-2025 12:48:16.966689] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "    #0 0x591d64517a26 in zend_hash_str_find_bucket php-src/Zend/zend_hash.c:783:8"
[19-Aug-2025 12:48:16.966738] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "    #1 0x591d6451776e in zend_hash_str_find php-src/Zend/zend_hash.c:2697:6"
[19-Aug-2025 12:48:16.966753] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "    #2 0x74debef243e8 in php_session_start php-src/ext/session/session.c:1669:34"
[19-Aug-2025 12:48:16.966771] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "    #3 0x74debef60478 in php_rinit_session php-src/ext/session/session.c:2906:3"
[19-Aug-2025 12:48:16.966784] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "    #4 0x74debef4b0de in zm_activate_session php-src/ext/session/session.c:2914:9"
[19-Aug-2025 12:48:16.966804] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "    #5 0x591d62ee3f62 in php_load_extension php-src/ext/standard/dl.c:247:7"
[19-Aug-2025 12:48:16.966820] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "    #6 0x591d62ee2294 in php_dl php-src/ext/standard/dl.c:284:6"
[19-Aug-2025 12:48:16.966838] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "    #7 0x591d64939582 in fpm_php_apply_defines_ex php-src/sapi/fpm/fpm/fpm_php.c:105:3"
[19-Aug-2025 12:48:16.966851] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "    #8 0x591d6493ae66 in fpm_php_apply_defines php-src/sapi/fpm/fpm/fpm_php.c:151:18"
[19-Aug-2025 12:48:16.966871] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "    #9 0x591d6493a7c4 in fpm_php_init_child php-src/sapi/fpm/fpm/fpm_php.c:246:10"
[19-Aug-2025 12:48:16.966886] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "    #10 0x591d648da060 in fpm_child_init php-src/sapi/fpm/fpm/fpm_children.c:199:10"
[19-Aug-2025 12:48:16.966906] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "    #11 0x591d648d8fa0 in fpm_children_make php-src/sapi/fpm/fpm/fpm_children.c:461:5"
[19-Aug-2025 12:48:16.966922] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "    #12 0x591d64946be4 in fpm_pctl_on_socket_accept php-src/sapi/fpm/fpm/fpm_process_ctl.c:547:2"
[19-Aug-2025 12:48:16.966939] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "    #13 0x591d64918192 in fpm_event_fire php-src/sapi/fpm/fpm/fpm_events.c:478:2"
[19-Aug-2025 12:48:16.966953] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "    #14 0x591d6498fc67 in fpm_event_epoll_wait php-src/sapi/fpm/fpm/events/epoll.c:141:3"
[19-Aug-2025 12:48:16.966973] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "    #15 0x591d6491447a in fpm_event_loop php-src/sapi/fpm/fpm/fpm_events.c:418:9"
[19-Aug-2025 12:48:16.966988] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "    #16 0x591d648d4c33 in fpm_run php-src/sapi/fpm/fpm/fpm.c:113:2"
[19-Aug-2025 12:48:16.967005] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "    #17 0x591d64923f22 in main php-src/sapi/fpm/fpm/fpm_main.c:1845:12"
[19-Aug-2025 12:48:16.967018] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "    #18 0x74dec122a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16"
[19-Aug-2025 12:48:16.967036] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "    #19 0x74dec122a28a in __libc_start_main csu/../csu/libc-start.c:360:3"
[19-Aug-2025 12:48:16.967052] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "    #20 0x591d61603434 in _start (php-src/sapi/fpm/php-fpm+0x1c03434) (BuildId: 7efba1981fd9239610ec7542417a9d447b071b1b)"
[19-Aug-2025 12:48:16.967070] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "AddressSanitizer can not provide additional info."
[19-Aug-2025 12:48:16.967087] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "SUMMARY: AddressSanitizer: SEGV php-src/Zend/zend_hash.c:783:8 in zend_hash_str_find_bucket"
[19-Aug-2025 12:48:16.967106] WARNING: pid 700863, (null)(), line 0: [pool www] child 700924 said into stderr: "==700924==ABORTING"

But I expected this output instead: No crash.

PHP Version

PHP 8.4.13-dev (fpm-fcgi) (built: Aug 19 2025 12:40:44) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.4.13-dev, Copyright (c) Zend Technologies

Operating System

No response

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions