Logging during module shutdown results in segmentation fault

[dhuang00]

Description

The following code:

php_log_err_with_severity("[Debug:242921] Response HTTP Status = 404", 7)

Resulted in this output:

Segmentation fault (core dumped)

But I expected this output instead:
No output and the log message appended to /var/log/php_errors.log

Here is the gdb backtrace:

#0  __memcpy_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:318
#1  0x000060f4457a21df in memcpy (__len=<optimized out>, __src=<optimized out>, __dest=<optimized out>) at /usr/include/x86_64-linux-gnu/bits/string_fortified.h:29
#2  virtual_open (path=path@entry=0x60f45913ee48 "/var/log/php_errors.log", flags=flags@entry=1089) at /tmp/php-8.4.8/Zend/zend_virtual_cwd.c:1446
#3  0x000060f445235e36 in php_log_err_with_severity (log_message=0x60f45943a520 "[Debug:242921] Response HTTP Status = 404", syslog_type_int=7) at /tmp/php-8.4.8/main/main.c:887
#4  0x00007c6a75e0a627 in logging::Logger::Flush() () from /usr/local/php-zts/lib/php/extensions/no-debug-zts-20240924/myext.so
#5  0x00007c6a75da9e13 in zm_shutdown_myext () from /usr/local/php-zts/lib/php/extensions/no-debug-zts-20240924/myext.so
#6  0x000060f4456b0352 in module_destructor (module=0x7c6a75f85bf0 <myext_module_entry>) at /tmp/php-8.4.8/Zend/zend_API.c:3325
#7  0x000060f445754d90 in _zend_hash_del_el_ex (prev=<optimized out>, p=<optimized out>, idx=41, ht=<optimized out>) at /tmp/php-8.4.8/Zend/zend_hash.c:1487
#8  _zend_hash_del_el (p=0x60f4591e1f70, idx=41, ht=0x60f446825000 <module_registry>) at /tmp/php-8.4.8/Zend/zend_hash.c:1514
#9  zend_hash_graceful_reverse_destroy (ht=ht@entry=0x60f446825000 <module_registry>) at /tmp/php-8.4.8/Zend/zend_hash.c:2039
#10 0x000060f4456af1a6 in zend_destroy_modules () at /tmp/php-8.4.8/Zend/zend_API.c:2583
#11 0x000060f4457a7522 in zend_shutdown () at /tmp/php-8.4.8/Zend/zend.c:1166
#12 0x000060f4456384ad in php_module_shutdown () at /tmp/php-8.4.8/main/main.c:2447
#13 php_module_shutdown () at /tmp/php-8.4.8/main/main.c:2424
#14 0x000060f44525d3c8 in main (argc=4, argv=0x60f4590fc3a0) at /tmp/php-8.4.8/sapi/cli/php_cli.c:1323

Removing the error_log = /var/log/php_errors.log setting from my php.ini causes the log message to appear in standard out as expected without a segmentation fault.

PHP Version

PHP 8.4.8 (cli) (built: Sep 10 2025 11:56:48) (ZTS)
Copyright (c) The PHP Group
Zend Engine v4.4.8, Copyright (c) Zend Technologies

Operating System

Ubuntu 24.04

[DanielEScherzer]

Can you please try with the latest version of PHP 8.4? Either 8.4.12 or the release candidate 8.4.13RC1 ?
The snippet above also does not indicate that this happens in module shutdown, please provide a full reproduction case

[dhuang00]

I am able to reproduce it in the php:8.4.12-zts docker image:

1. Run

docker-php-source extract
php /usr/src/php/ext/ext_skel.php --ext test --dir .
cd test

2. Add the following to test.c

PHP_MSHUTDOWN_FUNCTION(test)
{
    php_log_err_with_severity("foo", 7);
}

and add PHP_MSHUTDOWN(test) to the module entry

3. Build extension

phpize
./configure
make
cp modules/test.so $(php-config --extension-dir)

4. This should now segfault:

php -d extension=test -d error_log=/var/log/php_errors.log -m

The segfault is not present when I try the same with the NTS docker image, i.e. php:8.4.12

[iluuu1994]

I can't reproduce this. I tried with a bundled extension, with an out-of-tree build, and then also with your docker container example. Side-note: You should be returning zend_result from PHP_MSHUTDOWN(test). It's not impossible that you're running into memory corruption.

[dhuang00]

Strange. It's happening consistently on my end. I did miss returning zend_result in my example. Thank you for noting that.

In case it helps, and just to be sure I'm not missing anything, here is a 1 minute video of the issue being reproduced using the steps I posted.

repro-zts-logging-crash.mp4