PHP 8.5/aarch64: coroutine VM stack use-after-free under high coroutine churn

[smathersDT]

Hi there,

Im seeing some instability in the postgres driver, its doing some seg faults under load, i think its because the postgres driver is old
i see there was a change to include thirdparty/php85/pdo_pgsql/php_pdo_pgsql_int.h in #5940
Instead of wrapping php's version looks like swoole is using its own copy with a patch

its likely the culprit, unfortunately this is hard to reproduce

some logs:

Jul 2 13:15:53 ivr01 php[685]: [2026-07-02 13:15:53 $685.0]#011WARNING#011Worker::report_error(): worker(pid=3279, id=41) abnormal exit, status=0, signal=11
Jul 2 13:15:53 ivr01 php[685]: A process crash occurred in Swoole-v6.2.1. Please report this issue.
Jul 2 13:15:53 ivr01 php[685]: You can refer to the documentation below, submit an issue to us on GitHub.
Jul 2 13:15:53 ivr01 php[685]: >> https://github.com/swoole/swoole-src/blob/master/docs/ISSUE.md
Jul 2 13:15:53 ivr01 php[685]: OS: Linux 6.8.0-1021-aws #23~22.04.1-Ubuntu SMP Tue Dec 10 16:31:58 UTC 2024 aarch64
Jul 2 13:15:53 ivr01 php[685]: GCC_VERSION: 11.4.0
Jul 2 13:15:53 ivr01 php[685]: OPENSSL_VERSION: OpenSSL 3.0.2 15 Mar 2022
Jul 2 13:15:53 ivr01 php[685]: PHP_VERSION : 8.5.7

Jul 2 19:06:20 ivr04 php[3873860]: [2026-07-02 19:06:20 $3873860.0]#011WARNING#011Worker::report_error(): worker(pid=1232177, id=31) abnormal exit, status=0, signal=11
Jul 2 19:06:20 ivr04 php[3873860]: A process crash occurred in Swoole-v6.2.1. Please report this issue.
Jul 2 19:06:20 ivr04 php[3873860]: You can refer to the documentation below, submit an issue to us on GitHub.
Jul 2 19:06:20 ivr04 php[3873860]: >> https://github.com/swoole/swoole-src/blob/master/docs/ISSUE.md
Jul 2 19:06:20 ivr04 php[3873860]: OS: Linux 6.8.0-1021-aws #23~22.04.1-Ubuntu SMP Tue Dec 10 16:31:58 UTC 2024 aarch64
Jul 2 19:06:20 ivr04 php[3873860]: GCC_VERSION: 11.4.0
Jul 2 19:06:20 ivr04 php[3873860]: OPENSSL_VERSION: OpenSSL 3.0.2 15 Mar 2022
Jul 2 19:06:20 ivr04 php[3873860]: PHP_VERSION : 8.5.7

Machine details:
root@ivr04:/var/log# php --ri swoole

swoole

Swoole => enabled
Author => Swoole Team team@swoole.com
Version => 6.2.1
Built => Jun 12 2026 03:07:54
host byte order => little endian
coroutine => enabled with boost asm context
epoll => enabled
eventfd => enabled
signalfd => enabled
cpu_affinity => enabled
spinlock => enabled
rwlock => enabled
sockets => enabled
openssl => OpenSSL 3.0.2 15 Mar 2022
dtls => enabled
http2 => enabled
json => enabled
curl-native => enabled
curl-version => 7.81.0
zlib => 1.2.11
brotli => E16777225/D16777225
mutex_timedlock => enabled
pthread_barrier => enabled
futex => enabled
postgresql(libpq) version => 14.23
coroutine_pgsql => enabled
execinfo => enabled

Directive => Local Value => Master Value
swoole.enable_library => On => On
swoole.enable_fiber_mock => Off => Off
swoole.enable_preemptive_scheduler => Off => Off
swoole.display_errors => On => On
swoole.use_shortname => On => On
swoole.socket_buffer_size => 8388608 => 8388608
swoole.blocking_detection => Off => Off
swoole.blocking_threshold => 100000 => 100000
swoole.profile => Off => Off
swoole.leak_detection => Off => Off
root@ivr04:/var/log# php -v
PHP 8.5.7 (cli) (built: Jun 11 2026 03:32:06) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.5.7, Copyright (c) Zend Technologies
with Zend OPcache v8.5.7, Copyright (c), by Zend Technologies

Ill see if i can reproduce on my Dev machines with a thread dump...

thanks

[NathanFreeman]

We need to run php --ri pdo_pgsql to check if the libpq versions used by PHP and Swoole are the same.

[smathersDT]

root@ivr04:/home/ubuntu# php --ri pdo_pgsql

pdo_pgsql

PDO Driver for PostgreSQL => enabled
PostgreSQL(libpq) Version => 14.23

[NathanFreeman]

This thirdparty/php85/pdo_pgsql/php_pdo_pgsql_int.h file itself should not be the key factor. I previously fixed a pgsql-related defect, but I'm not sure whether that fix can resolve the current segmentation fault issue. It would be best if you could provide the corresponding function call stack for further analysis and diagnosis.

[smathersDT]

Ok. Im waiting for the crash to occur again on a monitored machine. Likely in a few days

Thanks

[smathersDT]

i doubt this will be helpful, ill need to re-compile swoole with debug flag.

root@ivr01:/tmp/phpcrash# gdb php CoreDump
GNU gdb (Ubuntu 12.1-0ubuntu1~22.04.2) 12.1
Copyright (C) 2022 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "aarch64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from php...

warning: Can't open file /dev/zero (deleted) during file-backed mapping note processing
[New LWP 3151]
[New LWP 3349]
[New LWP 3350]
[New LWP 3348]
[New LWP 3351]
[New LWP 3353]
[New LWP 3354]
[New LWP 3355]
[New LWP 3356]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/aarch64-linux-gnu/libthread_db.so.1".
Core was generated by `php sip_server                                    '.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x0000bba824bffd48 in ZEND_INIT_FCALL_SPEC_CONST_HANDLER () at /usr/local/src/php-8.5.7/Zend/zend_vm_execute.h:4170
4170            fbc = CACHED_PTR(opline->result.num);
[Current thread is 1 (Thread 0xf192b806d020 (LWP 3151))]
warning: File "/usr/bin/php" auto-loading has been declined by your `auto-load safe-path' set to "$debugdir:$datadir/auto-load".
To enable execution of this file add
        add-auto-load-safe-path /usr/bin/php
line to your configuration file "/root/.config/gdb/gdbinit".
To completely disable this security protection add
        set auto-load safe-path /
line to your configuration file "/root/.config/gdb/gdbinit".
For more information about this security protection see the
"Auto-loading safe path" section in the GDB manual.  E.g., run from the shell:
        info "(gdb)Auto-loading safe path"
(gdb) bt
#0  0x0000bba824bffd48 in ZEND_INIT_FCALL_SPEC_CONST_HANDLER () at /usr/local/src/php-8.5.7/Zend/zend_vm_execute.h:4170
#1  execute_ex (ex=0x0) at /usr/local/src/php-8.5.7/Zend/zend_vm_execute.h:51140
#2  0x0000bba824b9e70c in zend_call_function (fci=0xf192b3a23cc0, fci_cache=0xf192a82409d0) at /usr/local/src/php-8.5.7/Zend/zend_execute_API.c:1010
#3  0x0000f192b4142c7c in swoole::PHPCoroutine::main_func (_args=<optimized out>) at /usr/local/src/swoole-src/ext-src/swoole_coroutine.cc:773
#4  0x0000f192b41b0dc0 in std::function<void (void*)>::operator()(void*) const (__args#0=0xffffe59b36b8, this=<optimized out>) at /usr/include/c++/11/bits/st
#5  swoole::coroutine::Context::context_func (arg=...) at /usr/local/src/swoole-src/src/coroutine/context.cc:149
#6  0x0000f192b421a268 in swoole_make_fcontext () at make_arm64_aapcs_elf_gas.S:75
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

[smathersDT]

Ive not seen the error in a day now..

I let deepseek at it with all code context and machine state/logs:

I did start switching some of the shell_exec to swoole version for better performance

[smathersDT]

more:

Summary

jump_arm64_aapcs_elf_gas.S does not strip PAC (Pointer Authentication Code) signatures from registers during coroutine context switch, causing SIGSEGV on ARM64 CPUs with PAC enabled (AWS Graviton, Apple Silicon, etc.).

────────────────────────────────────────────────────────────────────────────────

Environment

• OS: Ubuntu 22.04, Linux 6.8.0-1021-aws
• CPU: ARM Neoverse-N1 (AWS Graviton2), 8 cores
• CPU features: paca pacg (Pointer Authentication), sve, ssbs
• PHP: 8.5.7 (NTS), built Jun 11 2026
• Swoole: 6.2.1, built Jun 12 2026
• ASLR: full (randomize_va_space = 2)
• PAC instructions in binaries: none (no paciasp/autiasp/xpaci in php or swoole.so)
• Affected: ivr01 crashed Jul 8, ivr04 crashed Jul 2 — 2 separate instances, same bug

────────────────────────────────────────────────────────────────────────────────

Reproduction

Minimal script at tools/reproduce_crash.php. Core pattern:

  // SWOOLE_HOOK_FILE enabled                                                                                                                                                                                                                                                                                      
  // Timer creates coroutine that does file I/O                                                                                                                                                                                                                                                                    
  swoole_timer_tick(100, function () {                                                                                                                                                                                                                                                                             
      go(function () {                                                                                                                                                                                                                                                                                             
          flock($fp, LOCK_EX | LOCK_NB);                                                                                                                                                                                                                                                                           
          fputs($fp, $data);                                                                                                                                                                                                                                                                                       
          fflush($fp);                                                                                                                                                                                                                                                                                             
          flock($fp, LOCK_UN);                                                                                                                                                                                                                                                                                     
      });                                                                                                                                                                                                                                                                                                          
  });                                                                                                                                                                                                                                                                                                              

Crashes within seconds to minutes on ARM64 with PAC. Does not reproduce on x86_64.

────────────────────────────────────────────────────────────────────────────────

Crash #1 — ivr01 (PID 3151)

Signal: SIGSEGV (11)
Faulting instruction: str x5, [x2, x1] at execute_ex+24232 (ZVAL_COPY_VALUE)

Register state (note PAC-signed pointers x2, x3):

  x0  = 0x0000fb1af1a23d00    # valid execute_data ptr                                                                                                                                                                                                                                                             
  x1  = 0x0000000000000050    # offset = 80                                                                                                                                                                                                                                                                        
  x2  = 0x73c45d2945c31925    # ← PAC-SIGNED (bits 55-48)                                                                                                                                                                                                                                                          
  x3  = 0x73c45d2945c31975    # ← x2+0x50, also PAC-signed                                                                                                                                                                                                                                                         
  x5  = 0x0000fb1ae7564400    # valid zval ptr (value to copy)                                                                                                                                                                                                                                                     
  x27 = 0x0000fb1ae73140c0    # VM register file (valid ptr, contents all scrambled)                                                                                                                                                                                                                               
  x28 = 0x0000fb1af1a23d20    # opline pointer                                                                                                                                                                                                                                                                     
  pauth_dmask = 0x7f000000000000                                                                                                                                                                                                                                                                                   
  pauth_cmask = 0x7f000000000000                                                                                                                                                                                                                                                                                   

Backtrace:

  #0  ZEND_SEND_VAL_SPEC_TMPVAR_UNUSED_HANDLER  (zend_vm_execute.h:19207)                                                                                                                                                                                                                                          
  #1  execute_ex                                  (zend_vm_execute.h:53144)                                                                                                                                                                                                                                        
  #2  zend_call_function                          (zend_execute_API.c:1010)                                                                                                                                                                                                                                        
  #3  swoole::PHPCoroutine::main_func             (swoole_coroutine.cc:773)                                                                                                                                                                                                                                        
  #4  swoole::coroutine::Context::context_func    (context.cc:149)                                                                                                                                                                                                                                                 
  #5  swoole_make_fcontext                        (make_arm64_aapcs_elf_gas.S:75)                                                                                                                                                                                                                                  
      ← corrupt stack                                                                                                                                                                                                                                                                                              

x27 memory region (32 quadwords) — all scrambled:

  +0x00: 0x2018cff25960d207                                                                                                                                                                                                                                                                                        
  +0x08: 0x73c45d2945c31925   ← same PAC-signed value as x2!                                                                                                                                                                                                                                                       
  +0x10: 0x86689b4c90d53d6c                                                                                                                                                                                                                                                                                        
  +0x18: 0x87e49cc7bc6961f6                                                                                                                                                                                                                                                                                        
  ...all entries have high bits set, look like ciphertext...                                                                                                                                                                                                                                                       

────────────────────────────────────────────────────────────────────────────────

Crash #2 — ivr04 (PID 3882002)

Signal: SIGSEGV (11)
Faulting instruction: ldr x19, [x1, x0] at execute_ex+14580 (CACHED_PTR access)

Register state:

  x0  = 0x0000000000000000    # offset = 0                                                                                                                                                                                                                                                                         
  x1  = 0xc101ec0100808e10    # ← PAC-SIGNED                                                                                                                                                                                                                                                                       
  x2  = 0x0000000000000000                                                                                                                                                                                                                                                                                         
  x27 = 0x0000f4193069d0c0    # valid ptr                                                                                                                                                                                                                                                                          
  x28 = 0x0000f4193c023cc0    # valid opline                                                                                                                                                                                                                                                                       

Backtrace:

  #0  ZEND_INIT_FCALL_SPEC_CONST_HANDLER  (zend_vm_execute.h:4170)                                                                                                                                                                                                                                                 
  #1  execute_ex(ex=0x0)                   ← execute_data is NULL (severe corruption)                                                                                                                                                                                                                              
  #2  zend_call_function                   (zend_execute_API.c:1010)                                                                                                                                                                                                                                               
  #3  swoole::PHPCoroutine::main_func      (swoole_coroutine.cc:773)                                                                                                                                                                                                                                               
  #4  swoole::coroutine::Context::context_func (context.cc:149)                                                                                                                                                                                                                                                    
  #5  swoole_make_fcontext                 (make_arm64_aapcs_elf_gas.S:75)                                                                                                                                                                                                                                         
      ← corrupt stack                                                                                                                                                                                                                                                                                              

────────────────────────────────────────────────────────────────────────────────

Root Cause

1. ARM Neoverse-N1 has PAC enabled — the kernel signs certain pointers automatically (e.g., in signal frames). The core dumps contain .reg-aarch-pauth sections with valid pauth_dmask/pauth_cmask = 0x7f000000000000, proving PAC is active.

2. swoole_jump_fcontext saves/restores registers raw — it uses stp x19, x20, [sp] / ldp x19, x20, [sp] with no PAC-aware handling. When a register holds a PAC-signed pointer at yield time, it is restored with the PAC signature intact.

3. PHP VM uses these registers as data pointers — execute_ex loads zval pointers from the saved register file (x27 region). Any PAC-signed value used as a memory address → invalid virtual address → SIGSEGV.

4. The corruption propagates — one PAC-signed register gets stored into the VM register file during save, then loaded as a data pointer during resume. The PHP VM dereferences the garbage pointer and crashes.

The buggy code

jump_arm64_aapcs_elf_gas.S saves and restores x19-x30 with raw stp/ldp:

  // Save (yield)                                                                                                                                                                                                                                                                                                  
  stp  d8,  d9,  [sp, #-0xb0]!                                                                                                                                                                                                                                                                                     
  stp  x19, x20, [sp, #0x40]                                                                                                                                                                                                                                                                                       
  stp  x21, x22, [sp, #0x50]                                                                                                                                                                                                                                                                                       
  ...                                                                                                                                                                                                                                                                                                              
  stp  x29, x30, [sp, #0x90]                                                                                                                                                                                                                                                                                       
                                                                                                                                                                                                                                                                                                                   
  // Restore (resume)                                                                                                                                                                                                                                                                                              
  ldp  x19, x20, [sp, #0x40]                                                                                                                                                                                                                                                                                       
  ldp  x21, x22, [sp, #0x50]                                                                                                                                                                                                                                                                                       
  ...                                                                                                                                                                                                                                                                                                              
  ldp  x29, x30, [sp, #0x90]                                                                                                                                                                                                                                                                                       
  ldp  d8,  d9,  [sp], #0xb0                                                                                                                                                                                                                                                                                       
                                                                                                                                                                                                                                                                                                                   
  // Jump to coroutine                                                                                                                                                                                                                                                                                             
  ldr  x4, [sp, #0xa0]                                                                                                                                                                                                                                                                                             
  ret  x4           // ← x4 may be PAC-signed, causing auth fault or wrong target                                                                                                                                                                                                                                  

No PAC stripping anywhere — no xpaclri, xpaci, autiasp, or paciasp in the entire file.

Suggested fix

The ldp restore block should strip PAC from data pointer registers before the coroutine resumes:

  // After restoring x19-x28 data registers:                                                                                                                                                                                                                                                                       
  ldp  x19, x20, [sp, #0x40]   // existing                                                                                                                                                                                                                                                                         
  ldp  x21, x22, [sp, #0x50]   // existing                                                                                                                                                                                                                                                                         
  ldp  x23, x24, [sp, #0x60]   // existing                                                                                                                                                                                                                                                                         
  ldp  x25, x26, [sp, #0x70]   // existing                                                                                                                                                                                                                                                                         
  ldp  x27, x28, [sp, #0x80]   // existing                                                                                                                                                                                                                                                                         
                                                                                                                                                                                                                                                                                                                   
  // NEW: strip PAC from all GP data registers (ARMv8.3-A+)                                                                                                                                                                                                                                                        
  // This is a no-op on CPUs without PAC. On PAC-enabled CPUs,                                                                                                                                                                                                                                                     
  // it clears bits [54:47] of x0-x30, turning signed pointers                                                                                                                                                                                                                                                     
  // back into valid virtual addresses.                                                                                                                                                                                                                                                                            
  xpaclri                                                                                                                                                                                                                                                                                                          
                                                                                                                                                                                                                                                                                                                   
  // Continue with LR/SP restore and jump...                                                                                                                                                                                                                                                                       
  ldp  x29, x30, [sp, #0x90]                                                                                                                                                                                                                                                                                       

And for the jump target:

  ldr  x4, [sp, #0xa0]                                                                                                                                                                                                                                                                                             
  // Strip PAC from jump target (safer than just `ret x4` on PAC systems)                                                                                                                                                                                                                                          
  xpaci x4                                                                                                                                                                                                                                                                                                         
  br   x4                                                                                                                                                                                                                                                                                                          

[smathersDT]

ive changed my logger from having something like this:

          flock($fp, LOCK_EX | LOCK_NB);                                                                                                                                                                                                                                                                           
          fputs($fp, $data);                                                                                                                                                                                                                                                                                       
          fflush($fp);                                                                                                                                                                                                                                                                                             
          flock($fp, LOCK_UN);      

to

      $result = Swoole\Coroutine\System::writeFile(
        self::PATH, $data, FILE_APPEND | LOCK_EX
      );

i loose the efficiency of an always open file every batch to using swooles open -> write -> close

2 full business days no errors

[NathanFreeman]

I have synchronized the Boost.Context support for PAC. see #6104

[smathersDT]

i did get another crash today on 1 worker. looks like the crashes have slowed since my logger change

i plan to try the new swoole version soon, 6.2.2

[NathanFreeman]

You can try the 6.2 branch — I've already merged it in.

[smathersDT]

thank you, i will try this

[smathersDT]

i guess i didn't have to wait long for a crash, one happened last night. even with the fix above

ill turn core dumps on again here and investigate

[NathanFreeman]

I have submitted an issue to the Boost.Context repository for consultation. Based on my current understanding, Boost.Context may only support the BTI (Branch Target Indicator) feature on aarch64, while the PAC (Pointer Authentication) feature does not yet appear to have official support.