dd_library_loader: prevent ddtrace zend ext shutdown run AFTER ddtrace is dlclose()d

cataphract · cataphract · commit 36abf37ddccc · 2026-03-26T14:21:31.000Z
diff --git a/loader/dd_library_loader.c b/loader/dd_library_loader.c
@@ -998,15 +998,24 @@ static int ddloader_zend_extension_startup(zend_extension *ext) {
 
 static void ddloader_zend_extension_shutdown(zend_extension *ext) {
     UNUSED(ext);
-    /* Close injected extension handles first (ddtrace.so, ddappsec.so, etc.),
-     * then libddtrace_php.so which they may depend on. */
     for (unsigned int i = 0; i < sizeof(ddloader_injected_ext_config) / sizeof(ddloader_injected_ext_config[0]); ++i) {
-        if (ddloader_injected_ext_config[i].so_handle) {
-            DL_UNLOAD(ddloader_injected_ext_config[i].so_handle);
-            ddloader_injected_ext_config[i].so_handle = NULL;
+        // Set the handle on the zend_extension so that zend_extension_dtor()
+        // will call DL_UNLOAD after this shutdown callback runs. Zend extension
+        // shutdown callbacks are run in the same order (not reverse) as they
+        // were loaded. So the callbacks for ddtrace/appsec/profiling will run
+        // AFTER this callback.
+        injected_ext *ext_config = &ddloader_injected_ext_config[i];
+        if (ext_config->so_handle) {
+            zend_extension *zend_ext = zend_get_extension(ext_config->ext_name);
+            if (zend_ext) {
+                zend_ext->handle = ext_config->so_handle;
+            }
+            ext_config->so_handle = NULL;
         }
     }
+
     if (libddtrace_php_handle) {
+        // This still won't unload it
         DL_UNLOAD(libddtrace_php_handle);
         libddtrace_php_handle = NULL;
     }
diff --git a/loader/php_dd_library_loader.h b/loader/php_dd_library_loader.h
@@ -63,7 +63,7 @@ typedef struct _injected_ext {
     const zend_function_entry *orig_module_functions;
     int module_number;
     char *version;
-    void *so_handle; // dlopen handle of the loaded .so; closed in ddloader_zend_extension_shutdown
+    void *so_handle; // dlopen handle of the loaded .so
 
     // phpinfo data
     bool injection_success;
