Fix GH-22516: widen zend_mm srun free counter to cover bin 0#22530
Open
iliaal wants to merge 1 commit into
Open
Fix GH-22516: widen zend_mm srun free counter to cover bin 0#22530iliaal wants to merge 1 commit into
iliaal wants to merge 1 commit into
Conversation
The per-page free-slot counter in zend_mm_gc() is stored in a 9-bit field (ZEND_MM_SRUN_FREE_COUNTER_MASK, max 511). Bin 0 holds 512 slots, so a fully-free bin-0 page drives the counter to 512, which overflows the field and reads back as 0; the counter == bin_elements checks then never fire and the page is never reclaimed. Widen the field to 10 bits (0x03ff0000); bit 25 was unused and the write side already stays below it for every other bin. Bin 0 is only reachable where ZEND_MM_MIN_USEABLE_BIN_SIZE == 8 (32-bit, or heap-protection-disabled builds). Fixes phpGH-22516
iliaal
requested review from
iluuu1994 and
ndossche
and removed request for
dstogov
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix is trivial, but given it is only 32bit... not 100% sure if needed
zend_mm_gc()'s per-page free-slot counter is stored in a 9-bit field (ZEND_MM_SRUN_FREE_COUNTER_MASK, max 511), but bin 0 has 512 slots, so a fully-free bin-0 page drives the counter to 512, overflows the field, and reads back as 0. The fully-free-page checks (counter == bin_elements) then never fire and the page is never reclaimed. Widening the field to 10 bits (0x03ff0000) fixes it: bit 25 was unused, and the change is a no-op for every other bin since they all hold at most 256 slots.
Reachable only where ZEND_MM_MIN_USEABLE_BIN_SIZE == 8, i.e. 32-bit or heap-protection-disabled builds. On 64-bit with heap protection, zend_mm_alloc_heap() rounds every sub-16-byte request up to bin 1, so bin 0 is never used and the change is inert there.
Fixes #22516