Bug 59798 - Apache crashes with child process exited with status 3221226356
Summary: Apache crashes with child process exited with status 3221226356
Status: NEW
Alias: None
Product: Apache httpd-2
Classification: Unclassified
Component: mod_ssl (show other bugs)
Version: 2.4.25
Hardware: PC All
: P2 critical with 1 vote (vote)
Target Milestone: ---
Assignee: Apache HTTPD Bugs Mailing List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-07-05 03:17 UTC by oldbucsfan
Modified: 2019-03-19 11:06 UTC (History)
1 user (show)



Attachments
Fix crash when shm_cleanup() called twice with same handles (686 bytes, patch)
2018-07-10 19:28 UTC, Chuck Hunley
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description oldbucsfan 2016-07-05 03:17:05 UTC
Apache crashes and I get the following error in the apache log:
AH00428: Parent: child process 780 exited with status 3221226356 -- Restarting.

Backtrace:
***********************
*  EXCEPTION DETAILS  *
***********************

DetailID = 1
	Count:    2
	Exception #:  0XC0000008
	Stack:        
		ntdll!KiRaiseUserExceptionDispatcher+0x3a
		KERNELBASE!CloseHandle+0x1b
		libapr_1!apr_shm_size_get+0x27d
		libapr_1!apr_shm_destroy+0x12
		mod_socache_shmcb+0x161c
		mod_ssl!ssl_run_proxy_post_handshake+0x8d12
		mod_ssl!ssl_run_pre_handshake+0x3d97
		libapr_1!apr_pool_clear+0x6e
		httpd!OPENSSL_Applink+0xcef
		httpd!OPENSSL_Applink+0x1f98
		KERNEL32!BaseThreadInitThunk+0x22
		ntdll!RtlUserThreadStart+0x34

Any ideas? Thanks!
Comment 1 oldbucsfan 2016-08-19 16:31:28 UTC
I tried again with php7 and continued to get the error when hitting https. Used abs.exe to test it and almost always get the error within 3 tests of 1000 requests. Usually get it in the first few hundred when hitting a wordpress site over SSL. Get it when all plugins are disabled. Get it hitting a website not using wordpress at all. Tried it with all extensions disabled except mysqli (needed to load the website). In other words, I can't seem to use Apache 2.4 with SSL and PHP 7. Tried basically totally simplifying the config files to the simplest form. Tried totally replacing the installs. The only thing that solves the error is using PHP 5.
Comment 2 oldbucsfan 2017-01-12 16:10:02 UTC
This test script will cause an error after 1000s of tries via abs.exe, but will not cause the same error when attempted via ab.exe.

-----------------------
$wrappers = stream_get_wrappers();
print_r($wrappers);
$wrappers_re = '(' . join('|', $wrappers) . ')';
print($wrappers_re);
-----------------------

In other words, this appears to be an issue involving one of the extensions in Apache that handles the https protocol.
Comment 3 Techiq 2018-05-07 23:58:56 UTC
Apache crashes and I get the following error in the apache log:
AH00428: Parent: child process 780 exited with status 3221226356 -- Restarting.

Backtrace:
***********************
*  EXCEPTION DETAILS  *
***********************

DetailID = 1
	Count:    2
	Exception #:  0XC0000008
	Stack:        
		ntdll!KiRaiseUserExceptionDispatcher+0x3a
		KERNELBASE!CloseHandle+0x1b
		libapr_1!apr_shm_size_get+0x27d
		libapr_1!apr_shm_destroy+0x12
		mod_socache_shmcb+0x161c
		mod_ssl!ssl_run_proxy_post_handshake+0x8d12
		mod_ssl!ssl_run_pre_handshake+0x3d97
		libapr_1!apr_pool_clear+0x6e
		httpd!OPENSSL_Applink+0xcef
		httpd!OPENSSL_Applink+0x1f98
		KERNEL32!BaseThreadInitThunk+0x22
		ntdll!RtlUserThreadStart+0x34

Any ideas? Thanks!
Comment 4 Chuck Hunley 2018-07-10 19:28:40 UTC
Created attachment 36022 [details]
Fix crash when shm_cleanup() called twice with same handles

shm_cleanup() can be called twice with same handle.  The second call to CloseHandle() causes a crash.
Comment 5 Chuck Hunley 2018-07-10 19:32:53 UTC
I've seen crash/exception as well.  Although I see it when the httpd.exe process is being shutdown.  The exception is due to CloseHandle() being called twice with the same handle to file mapping.  https://github.com/apache/httpd/blob/trunk/modules/cache/mod_socache_shmcb.c creates a file memory mapping and https://github.com/apache/apr/blob/trunk/shmem/win32/shm.c actually creates the physical mapping with the OS and registers a cleanup handler.  When the mapping is to be cleaned up both mod_socache_shmcb.c(socache_shmcb_destroy) and shm.c(shm_cleanup via apr_pool_clear) attempt to close the same handle. I've attached a simple fix based on the "trunk" branch to shm.c/shm_cleanup to NULL the handles after they have been closed.  This seems to have eliminated the crash I've been seeing and is based on similar cleanup handling in mmap/win32/mmap.c. However, I would think some coordination between mod_socache_shmcb.c and apr_pools.c would be necessary as well.

A might be more appropriate to redirect this to Product: APR or Product: Apache-httpd-2 with Component: mod_socache_(dbm|dc|memcache|shmcb)
Comment 6 Michael Schlenker 2019-03-19 10:52:33 UTC
The root cause for this might be a duplicate to https://bz.apache.org/bugzilla/show_bug.cgi?id=41847.
Comment 7 Michael Schlenker 2019-03-19 11:06:16 UTC
See https://bz.apache.org/bugzilla/show_bug.cgi?id=63271 for a patch to apr that might help too.