[kairosci]

Fixes #25403.

Adds an optional rekey_memory argument to all three pcntl fork functions, preserving re-keying by default and all other child initialization. Documents the shared-key trade-off and adds regression coverage. Local tests were not run as requested.

[kairosci]

cc @bukka @arnaud-lb @devnexen

[devnexen]

as far as this approach goes, it seems valid however it might be possible to do differently I ll try to have a deeper look this week end.

[devnexen]

So, I was thinking about something like this

diff --git a/Zend/zend_alloc.c b/Zend/zend_alloc.c
index 2b52babc98e..b29875c77f0 100644
--- a/Zend/zend_alloc.c
+++ b/Zend/zend_alloc.c
@@ -2270,22 +2270,7 @@ ZEND_API void zend_mm_refresh_key_child(zend_mm_heap *heap)

        zend_mm_init_key(heap);

-       /* Update shadow pointers with new key */
-       for (uint32_t i = 0; i < ZEND_MM_BINS; i++) {
-               zend_mm_free_slot *slot = heap->free_slot[i];
-               if (!slot) {
-                       continue;
-               }
-               zend_mm_free_slot *next;
-               while ((next = slot->next_free_slot)) {
-                       zend_mm_free_slot **shadow_addr = ZEND_MM_FREE_SLOT_PTR_SHADOW_ADDR(slot, i);
-                       if (UNEXPECTED(next != zend_mm_decode_free_slot_key(old_key, shadow_addr, *shadow_addr))) {
-                               zend_mm_panic("zend_mm_heap corrupted");
-                       }
-                       zend_mm_set_next_free_slot(heap, i, slot, next);
-                       slot = next;
-               }
-       }
+       memset(heap->free_slot, 0, sizeof(heap->free_slot));

        zend_mm_rekey_cached_chunks(heap, old_key);

but the noticeable trade-off is lost of visibility of these inherited holes, can't be reused ...

[kairosci]

@devnexen I believe I fixed everything, could you take another look at it? Thanks

[devnexen]

I find that the rekey_memory name is misleading ; whether it s true or not, zend_mm_init_key() is called.

[kairosci]

There is nothing to change; the child already clears inherited free lists instead of re-keying them.

[devnexen]

The free lists are not re-keyed, true, but the child still gets a new key either way and the cached chunks are still re-keyed. So rekey_memory: false reads as "the child keeps the parent's key", which is what the first version of this PR did and not what it does now;

[kairosci]

I’ve renamed it to rekey_free_lists. When false, the child still gets a new key; it just skips the inherited free lists.