Fix GH-13903: ASAN false positive underflow when executing copy()

Closes GH-13917.

Zend/fibers: Ensure fiber stack is not backed by THP. (#13306)

Ending with fiber stack mapped in hugepages will affect performance
badly.
Until < Linux 6.8-rc2 MAP_STACK was a noop,

Zend/fibers: Ensure fiber stack is not backed by THP. (#13306)

Ending with fiber stack mapped in hugepages will affect performance
badly.
Until < Linux 6.8-rc2 MAP_STACK was a noop, now it implies no THP, older releases
need madvise.

show more ...

Fix GH-11121: ReflectionFiber segfault

Closes GH-12391.

Co-authored-by: Aaron Piotrowski <aaron@trowski.com>

Fix potential NULL pointer access in zend_fiber_object_gc

Accidentally introduced in GH-11208.

Fixes oss-fuzz #58795

Fix use-of-undefined in zend_fiber_object_gc of ex->call

ex->call is only set for user calls, we shouldn't access it here.
zend_unfinished_execution_gc_ex wouldn't actually use it for in

Fix use-of-undefined in zend_fiber_object_gc of ex->call

ex->call is only set for user calls, we shouldn't access it here.
zend_unfinished_execution_gc_ex wouldn't actually use it for internal calls, so
it didn't cause any serious issues.

Closes GH-11208

show more ...

Zend/zend_fibers: change return value to zend_result

According to @nikic:

> The current guideline for use of bool and zend_result in php-src is
> that bool is an appropriate ret

Zend/zend_fibers: change return value to zend_result

According to @nikic:

> The current guideline for use of bool and zend_result in php-src is
> that bool is an appropriate return value for "is" or "has" style
> functions, which return a yes/no answer. zend_result is an
> appropriate return value for functions that perform some operation
> that may succeed or fail.

Closes GH-10622.

show more ...

Fix GH-10496: Fibers must not be garbage collected while implicitly suspended by resumption of another fiber

Fix colletion of unfinished function call in fibers

Fixes GH-10496.

Co-authored-by: Bob Weinand <bobwei9@hotmail.com>

Fix GH-10437: Set active fiber to null on bailout (#10443)

Handle non-INDIRECT symbol table entries in zend_fiber_object_gc() (#10386)

Fixes GH-10340

Revert GH-10220

Cf. <https://github.com/php/php-src/pull/10220#issuecomment-1383739816>.

This reverts commit ecc880f491d66081298a16634629f149459706a9.
This reverts commit 588a07

Revert GH-10220

Cf. <https://github.com/php/php-src/pull/10220#issuecomment-1383739816>.

This reverts commit ecc880f491d66081298a16634629f149459706a9.
This reverts commit 588a07f7371ee2b5fac17de147926780e427fae6.
This reverts commit f377e15751d3aa48b69cd9bcc366ede7803d511f.
This reverts commit b4ba16fe189b109144aff669e11d81365160104b.
This reverts commit 694ec1deea36e366b28b6349a52be49824e1a1a8.
This reverts commit 6b34de8eba9f66882ae16e6073af28783670ac53.
This reverts commit aa1cd02a4367834026ea2205ea13a2f904455aa1.
This reverts commit 308fd311ea6fcf3094b448df7f2b264f08e4fe4f.
This reverts commit 16203b53e1822a37b6ba6f2ab198bb435d05fdad.
This reverts commit 738fb5ca5412f5e833a7fab82b11519e635a3357.
This reverts commit 9fdbefacd3c382d731aa175b7bdc002ec9cb2b30.
This reverts commit cd4a7c1d90562ebb5f89caf94d00d579631b9fbe.
This reverts commit 928685eba2b2f0ded90e7f78fd806ea164002f6e.
This reverts commit 01e5ffc85cd4357fd7b5b7ceefa29f2d10ca26b7.

show more ...

GC fiber unfinished executions (#9810)

Fix GH-10249: Assertion `size >= page_size + 1 * page_size' failed.

Co-authored-by: Changochen <changochen1@gmail.com>

Closes GH-10284

Zend/zend_fibers: include cleanup

Limit stack size (#9104)

Fiber: add shadow stack support

Shadow stack is part of Intel's Control-Flow Enforcement Technology (CET).

Whenever a function is called, the return address is pushed onto both

Fiber: add shadow stack support

Shadow stack is part of Intel's Control-Flow Enforcement Technology (CET).

Whenever a function is called, the return address is pushed onto both
the regular stack and the shadow stack. When that function returns, the
return addresses are popped off both stacks and compared; if they fail
to match, #CP raised.

With this commit, we create shadow stack for each fiber context and
switch the shadow stack accordingly during fcontext switch.

Signed-off-by: Chen, Hu <hu1.chen@intel.com>

Closes GH-9283.

show more ...

Revert "Store default object handlers alongside the class entry"

This reverts commit 9e6eab3c139b41dc976dd5305fd1a6e387e5e27f.

Reverted along a01dd9fedaecd2e5b95bc5c2e8d6542116addea

Revert "Store default object handlers alongside the class entry"

This reverts commit 9e6eab3c139b41dc976dd5305fd1a6e387e5e27f.

Reverted along a01dd9fedaecd2e5b95bc5c2e8d6542116addeae.

show more ...

Store default object handlers alongside the class entry

Object handlers being separate from class entries is a legacy inherited from PHP 5. Today it has little benefit to keep them separate:

Store default object handlers alongside the class entry

Object handlers being separate from class entries is a legacy inherited from PHP 5. Today it has little benefit to keep them separate: in fact, accessing object handlers usually requires not-so-safe hacks.
While it is possible to swap handlers in a custom installed create_object handler, this mostly is tedious, as well as it requires allocating the object handlers struct at runtime, possibly caching it etc..

This allows extensions, which intend to observe other classes to install their own class handlers.
The life cycle of internal classes may now be simply observed by swapping the class handlers in post_startup stage.
The life cycle of userland classes may be observed by iterating over the new classes in zend_compile_file and zend_compile_string and then swapping their handlers.

In general, this would also be a first step in directly tying the object handlers to classes. Especially given that I am not aware of any case where the object handlers would be different between various instances of a given class.

Signed-off-by: Bob Weinand <bobwei9@hotmail.com>

show more ...

Delay fiber VM stack cleanup until after observer has been called

Signed-off-by: Bob Weinand <bobwei9@hotmail.com>

Fix memory leak in fiber constructor by throwing an error (#9098)

Zend, ext/opcache: use PR_SET_VMA_ANON_NAME (Linux 5.17) (#8234)

The new Linux 5.17 feature PR_SET_VMA_ANON_NAME can give names to
anonymous private memory, see:

https://lwn.ne

Zend, ext/opcache: use PR_SET_VMA_ANON_NAME (Linux 5.17) (#8234)

The new Linux 5.17 feature PR_SET_VMA_ANON_NAME can give names to
anonymous private memory, see:

https://lwn.net/Articles/867818/

It can be useful while debugging, to identify which portion of the
process's memory belongs to which subsystem.

This is how /proc/PID/maps can look like:

555ccd400000-555ccdc00000 r-xp 00000000 00:00 0 [anon:huge_code_pages]
7f6ec6600000-7f6ec6800000 rw-p 00000000 00:00 0 [anon:zend_alloc]

The first mapping is the PHP executable copied to anonymous memory by
option "opcache.huge_code_pages". The second one is a memory area for
the "zend_alloc.h" memory allocator library.

Unfortunately, it is not possible to give names to shared memory
(MAP_SHARED), because Linux MAP_SHARED really maps /dev/zero (see
shmem_zero_setup()), which makes madvise_vma_anon_name() believe this
is a file mapping, failing the prctl() with EBADF.

show more ...

Add IBT support for fiber

Indirect Branch Tracking (IBT) is part of Intel's Control-Flow
Enforcement Technology (CET). IBT is hardware based, forward edge
Control-Flow-Integrity mech

Add IBT support for fiber

Indirect Branch Tracking (IBT) is part of Intel's Control-Flow
Enforcement Technology (CET). IBT is hardware based, forward edge
Control-Flow-Integrity mechanism where any indirect CALL/JMP must target
an ENDBR instruction or suffer #CP.

This commit adds IBT support for fiber:
1. Add endbr32/64 in assembly
2. Inform compiler jump_fcontext may return via indirect branch

Furthermore:
gcc support CET since v8.1 and set it to default since gcc 11. That is,
the ELF header of sapi/cli/php has a property named IBT. However, such
property is lost since PHP8.1 because the assembly introduced by Fiber.
This commit also fixes this.

Closes GH-8339

Signed-off-by: Chen, Hu <hu1.chen@intel.com>
Co-authored-by: Christoph M. Becker <cmbecker69@gmx.de>

show more ...

Fix zend_fibers.c build with ZEND_FIBER_UCONTEXT

Avoids (Solaris SPARC) issue:
zend_fibers.c:77:9: error: unknown type name 'ucontext_t'

Closes GH-7773.

Don't return reference from Fiber::getReturn()

Even if the fiber function returns by reference, we must return
a value from Fiber::getReturn() to satisfy the function signature.

Don't return reference from Fiber::getReturn()

Even if the fiber function returns by reference, we must return
a value from Fiber::getReturn() to satisfy the function signature.

Fixes oss-fuzz #36417.

show more ...

more fiber notifications (#7293)