Fix GH-22480: phpdbg use-after-free re-watching a watched variable by iliaal · Pull Request #22493 · php/php-src

iliaal · 2026-06-27T21:38:45Z

phpdbg_add_watch_element() frees the passed element and returns the existing one when the variable is already watched, but several callers kept using the freed pointer, so re-watching a variable was a use-after-free. The two reported derefs are not the whole bug: with only the proposed two-line capture, w a $a typed twice still crashes, relocated to a later interned-string read. This reports the duplicate back through the parse callback so the wrapper registers nothing, and rejects a recursive watch's hashtable element that collides with an existing watch, at creation and recreation, instead of freeing a still-referenced one.

Girgias · 2026-06-28T12:01:08Z

I don't know PHPDBG nor have the time to learn how it works rn.

ndossche · 2026-06-29T19:29:01Z

This will have to wait until the weekend, I don't have time right now.
I used to look into some phpdbg issues, but I stopped doing that because some people who were supposed to maintain that don't bother; so why should we bother?

ndossche · 2026-07-11T09:22:20Z

+GH-22480 (Use-after-free when re-watching an already-watched variable)
+--SKIPIF--
+<?php
+if (getenv('SKIP_ASAN')) {


Leftover from when the test demonstrated the crash. It's ASAN-clean with the fix, so I dropped the skip and let it run under ASAN.

Judging by the last force push, they are re-added now

Ugh, the drop didn't make it into the last push. Removed now.

ndossche · 2026-07-11T09:22:25Z

+GH-22480 (Use-after-free re-watching a sub-path of a recursive watchpoint)
+--SKIPIF--
+<?php
+if (getenv('SKIP_ASAN')) {


Same, a stale crash-marker. Dropped it so this one runs under ASAN too.

ndossche · 2026-07-11T09:22:56Z


 phpdbg_watch_element *phpdbg_add_bucket_watch_element(Bucket *bucket, phpdbg_watch_element *element) {
 	phpdbg_watchpoint_t watch;
+	phpdbg_watch_element *added;


Merge declaration and assignment

ndossche · 2026-07-11T09:23:04Z

-	phpdbg_watch_parent_ht(element);
-	return element;
+	added = phpdbg_add_watch_element(&watch, element);
+	if (added == element) {


Doesn't this risk ABA-like issues?

You're right, phpdbg_add_watch_element() frees element on a duplicate and returns the pre-existing one, so added == element read a freed pointer. Threaded a bool out-param through the add functions so callers test that instead, and did the same for the sibling checks at the recursion and array-watch sites.

ndossche

Complex / intricate code, but okay.
Please note the following:

I put a cleanup remark about using enum returns, this is non-blocking
watch_006 is marked as XFAIL, but likely no longer should. Please double check.

ndossche · 2026-07-13T22:24:13Z

-static int phpdbg_create_simple_watchpoint(zval *zv, phpdbg_watch_element *element) {
-	element->flags = PHPDBG_WATCH_SIMPLE;
-	phpdbg_add_bucket_watch_element((Bucket *) zv, element);
+#define PHPDBG_WATCH_DUPLICATE 1


Instead of mixing SUCCESS / this define; it would be cleaner if we had an enum and used that enum as a return type.

Done, phpdbg_watch_add_result enum on the create callbacks now.

ndossche

Actually, still shows a UAF in CI, but only on some targets? I didn't see it locally
EDIT: might be fast-shutdown / non-fast-shutdown related, you should check

iliaal · 2026-07-13T22:29:43Z

Interesting I didn't see UAFs locally or before in CI/CD let me investigate, this needs more checking

iliaal · 2026-07-14T01:56:56Z

You were right about non-fast shutdown. The watch tables are module-scoped but hold request-pool memory, so under the tracked allocator freeing $a at executor teardown re-queues an element after the last drain; tracked_free_all then frees the pool and phpdbg_destroy_watchpoints reads it at module shutdown. Fixed by doing the request-scoped teardown in a post_deactivate handler, which runs after values are freed but before the MM goes. Passes under --asan + jit=tracing; watch_006 passes too, so I dropped its xfail.

ndossche · 2026-07-14T07:28:56Z

Test failure on macos seems related

phpdbg_add_watch_element() frees the passed element and returns the existing one when the variable is already watched, but several callers kept using the freed pointer, so re-watching a variable was a use-after-free in more places than the two reported. Report the duplicate back through the parse callback and register nothing, and reject a recursive watch's hashtable element that collides with an existing watch, at creation and recreation, rather than freeing a still-referenced one. A recursive watch over an already-array-watched variable now watches only the root and skips the shared hashtable. Running the tests under ASAN exposed a second, latent use-after-free at shutdown: the watch tables are module-scoped but hold request-pool memory, so under the tracked allocator freeing a watched variable during executor teardown re-queues an element after the last drain, tracked_free_all frees the pool, and phpdbg_destroy_watchpoints reads it at module shutdown. Tear the watch state down in a post_deactivate handler, which runs after the executor frees values but before the memory manager is torn down. Dropping watch_006's xfail surfaced a separate pre-existing bug on large-page platforms: the fault handler rechecks every watchpoint on the faulting page, so on 16 KB pages a value-only write to an element can fault the page holding a watched hashtable's own struct and run the recursive rescan, which re-reported existing elements as freshly added. Only run that rescan when the element count actually changed. Fixes phpGH-22480

iliaal · 2026-07-14T13:29:32Z

macOS-arm64 went red because dropping watch_006's xfail exposed a separate pre-existing bug: on 16 KB pages the fault handler rechecks every watchpoint on the faulting page, so a value-only write to $a[0] sweeps in the recursive $b watch's hashtable-struct watchpoint and the rescan re-reported existing elements as added. Now gated on the element count actually changing. Reproduced by forcing phpdbg_pagesize to 16 KB locally (identical diff); watch_006 passes at 4 KB and 16 KB.

github-actions Bot added the SAPI: phpdbg label Jun 27, 2026

iliaal mentioned this pull request Jun 27, 2026

Fix GH-22480: phpdbg use-after-free re-watching a watched variable iliaal/php-src#136

Closed

iliaal requested a review from Girgias June 27, 2026 23:51

Girgias removed their request for review June 28, 2026 12:00

iliaal requested review from TimWolla and ndossche June 28, 2026 21:40

TimWolla removed their request for review June 29, 2026 16:49

ndossche reviewed Jul 11, 2026

View reviewed changes

iliaal force-pushed the fix/gh-22480-phpdbg-watch-uaf branch 2 times, most recently from cd00f35 to 6d9d07d Compare July 11, 2026 14:10

iliaal requested a review from ndossche July 11, 2026 15:09

iliaal force-pushed the fix/gh-22480-phpdbg-watch-uaf branch from 6d9d07d to 796b0fd Compare July 13, 2026 21:36

ndossche approved these changes Jul 13, 2026

View reviewed changes

ndossche requested changes Jul 13, 2026

View reviewed changes

iliaal force-pushed the fix/gh-22480-phpdbg-watch-uaf branch from 796b0fd to 0e500d1 Compare July 14, 2026 01:53

iliaal force-pushed the fix/gh-22480-phpdbg-watch-uaf branch from 0e500d1 to 2e970c8 Compare July 14, 2026 12:39

Uh oh!

Conversation

iliaal commented Jun 27, 2026

Uh oh!

Girgias commented Jun 28, 2026

Uh oh!

ndossche commented Jun 29, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ndossche left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ndossche left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

iliaal commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

iliaal commented Jul 14, 2026

Uh oh!

ndossche commented Jul 14, 2026

Uh oh!

iliaal commented Jul 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ndossche left a comment •

edited

Loading

iliaal commented Jul 13, 2026 •

edited

Loading