#1152832 Segmentation fault in Perl_csighandler3 when used XS with threads (i.e. pango/fontcon)

#1152832#5
Date:
2026-11-01 20:13:52 UTC
From:
To:
Hi,

I don't understand the gory details, but I think the analysis comes from a
trustworthy side and I'm forwarding it to get some visibility. I'm not
sure it's directly backportable to stable either. Maybe there is a
stable release branch for Perl 5.40 somewhere?

There is an old opensource project called nfsen
(https://github.com/phaag/nfsen) that is a framework around analysing
netflow traffic data. It is a webfrontend written in PHP with a backend
written in Perl. For a few years there have been reports about
occasional crashes in a perl-based daemon on various distributions,
including Debian. There have been wild speculations about the reasons,
including hardware defects, attacks and cosmic rays.

I have personally been affected since at least Bookworm. For
trixie it looks like this.

[679698.819796] [pango] fontcon[11953]: segfault at 4ac ip 000055618d88e978 sp 00007f84010be838 error 4 in perl[ae978,55618d824000+1ae000] likely on CPU 27 (core 5, socket 1)
[915797.786633] [pango] fontcon[4158978]: segfault at 4ac ip 0000560f5914a978 sp 00007fe93e0cf838 error 4 in perl[ae978,560f590e0000+1ae000] likely on CPU 7 (core 3, socket 1)

There has recently been a bug report on that on the rather new Github
issue tracker (it used to be one of the few projects based on sf.net)
that solicited a response from the author, pointing towards an upstream
bug in perl that has been "recently" (as in: not yet in Debian stable)
fixed.

https://github.com/phaag/nfsen/issues/51#issuecomment-5729766748

| Thanks for your additional report.
|
| This appears to be a known Perl 5.40 issue rather than an nfsen bug.
|
| The analysis reveals: The crash occurs in Perl_csighandler3() when a
| signal is delivered to a native thread created by Pango ([pango]
| fontcon); that thread has no Perl interpreter context, resulting in the
| characteristic NULL dereference at address 0x4ac.
|
| The issue is documented upstream as Perl GH #22487 and is fixed in Perl
| 5.42, where such signals are redirected to the Perl main thread. Debian
| Trixie, Ubuntu 26.04 and RHEL 10 all currently ship affected Perl 5.40.x
| versions. Until the distributions backport the upstream fix, there is
| unfortunately little that can reasonably be fixed inside nfsen itself.

The upstream issue he is referencing to is
https://github.com/Perl/perl5/issues/22487 .

Bernhard