Fix persistent stream context lifetime during shutdown

[morrisonlevi]

This problem sounds like something only a fuzzer or AI would find, but actually it's from a customer crash.

The reproducer creates a persistent stream during rshutdown and crashes during mshutdown when freeing streams, specifically when trying to access the stream context. The stream context was created in rshutdown and uses request-scoped memory, which is why it's a bad access in mshutdown.

I fix it in this patch by adding a check in php_stream_context_free which loop over all the resources in EG(persistent_list) and removes the context from any streams which still use the context we're freeing. We do this only if the executor is in shutdown e.g. EG(flags) & EG_FLAGS_IN_RESOURCE_SHUTDOWN, so we're not doing this during a request, only at the end of a request. Doing it only in shutdown should mitigate performance concerns. After a bit of discussion with Bob, I'm trying a simpler patch which handles it in PRSHUTDOWN. As far as I can tell, it doesn't leak. The danger I see is there's a period between zend_destroy_rsrc_list and when this prshutdown handler runs that the stream context is a dangling pointer. In practice, that mostly seems to be other extensions' prshutdown handlers.

This is my best attempt at fixing it as someone who knows little about streams. Maybe someone who knows more can find a better patch, as hopefully the reproducer is reliable across machines too.

Targeting PHP 8.4.

[bwoebi]

Suggested change

	$GLOBALS['late_context_address'] = 'tcp://' . stream_socket_get_name($server, false);
	$late_context_address = 'tcp://' . stream_socket_get_name($server, false);

Not sure what $GLOBALS does here?

[morrisonlevi]

It's just making it available so that the other user can use it. I guess it could use global $late_context_address instead?

[bwoebi]

I think the whole problem boils down to forget_persistent_resource_id_numbers() being called too early (= module rshutdown).

This simply should be called after zend_close_rsrc_list() and then there's nothing which could put anything back onto EG(persistent_list). Instead of at module rshutdown, which runs before.

I.e. simply moving the call should fix the issue alltogether.

[morrisonlevi]

Bob, I've updated for a simpler implementation which just nulls it in PRSHUTDOWN. Please take a look!