public inbox for [email protected]help / color / mirror / Atom feed
pgpool: Do not use signal unsafe functions in pgpool main process signa 5+ messages / 1 participants [nested] [flat]
* pgpool: Do not use signal unsafe functions in pgpool main process signa @ 2026-06-23 12:48 Tatsuo Ishii <[email protected]> 0 siblings, 0 replies; 5+ messages in thread From: Tatsuo Ishii @ 2026-06-23 12:48 UTC (permalink / raw) To: [email protected] Do not use signal unsafe functions in pgpool main process signal handler. The pgpool main process SIGTERM/SIGINT/SIGQUIT handler did the full shutdown work inline: ereport() (twice), pool_semaphore_lock(MAIN_EXIT_HANDLER_SEM), terminate_all_childrens() with a blocking waitpid(-1, ..., 0) and more ereport() calls, kill() of the follow-child group, and finally exit(3) which runs atexit handlers and stdio flush. None of these are async-signal-safe (POSIX 2024 section 2.4.3 [1]). In particular, SIGTERM arriving while pgpool is mid-ereport() / mid-palloc() / mid-semop() could crash, hang, or corrupt heap state. Because the pgpool main process is the parent, a crash here takes down every session and the pgpool cluster. This commit restricts the handler to async-signal-safe calls only: capture the signal number into a new volatile sig_atomic_t main_exit_request, write one byte to the existing self-pipe to wake the main loop, restore errno, and return. The actual shutdown is performed synchronously by a new do_shutdown() function called from the pgpol main loop at the top of every iteration (via check_requests()) and also right after the inner pool_pause() returns, so a signal arriving during the 2-second select() sleep is acted on without an extra tick of latency. do_shutdown() carries the previous body verbatim - the non-async-safe calls (ereport, pool_semaphore_lock, terminate_all_childrens with its blocking waitpid, exit(3)) are now invoked from normal context where they are safe. [1] https://pubs.opengroup.org/onlinepubs/9799919799/functions/V2_chap02.html#tag_16_04_03 Reported-by: Emond Papegaaij <[email protected]> Reported-by: Claude code Author: Tatsuo Ishii <[email protected]> Reviewed-by: Bo Peng <[email protected]> Reviewed-by: Koshino Taiki <[email protected]> Discussion: https://www.postgresql.org/message-id/20260608.103312.126925225500634683.ishii%40postgresql.org Backpatch-through: v4.4 Branch ------ V4_4_STABLE Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=af96466fa8442eb76baf721cd9355c6a64b7d... Modified Files -------------- src/main/pgpool_main.c | 111 ++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 95 insertions(+), 16 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgpool: Do not use signal unsafe functions in pgpool main process signa @ 2026-06-23 12:48 Tatsuo Ishii <[email protected]> 0 siblings, 0 replies; 5+ messages in thread From: Tatsuo Ishii @ 2026-06-23 12:48 UTC (permalink / raw) To: [email protected] Do not use signal unsafe functions in pgpool main process signal handler. The pgpool main process SIGTERM/SIGINT/SIGQUIT handler did the full shutdown work inline: ereport() (twice), pool_semaphore_lock(MAIN_EXIT_HANDLER_SEM), terminate_all_childrens() with a blocking waitpid(-1, ..., 0) and more ereport() calls, kill() of the follow-child group, and finally exit(3) which runs atexit handlers and stdio flush. None of these are async-signal-safe (POSIX 2024 section 2.4.3 [1]). In particular, SIGTERM arriving while pgpool is mid-ereport() / mid-palloc() / mid-semop() could crash, hang, or corrupt heap state. Because the pgpool main process is the parent, a crash here takes down every session and the pgpool cluster. This commit restricts the handler to async-signal-safe calls only: capture the signal number into a new volatile sig_atomic_t main_exit_request, write one byte to the existing self-pipe to wake the main loop, restore errno, and return. The actual shutdown is performed synchronously by a new do_shutdown() function called from the pgpol main loop at the top of every iteration (via check_requests()) and also right after the inner pool_pause() returns, so a signal arriving during the 2-second select() sleep is acted on without an extra tick of latency. do_shutdown() carries the previous body verbatim - the non-async-safe calls (ereport, pool_semaphore_lock, terminate_all_childrens with its blocking waitpid, exit(3)) are now invoked from normal context where they are safe. [1] https://pubs.opengroup.org/onlinepubs/9799919799/functions/V2_chap02.html#tag_16_04_03 Reported-by: Emond Papegaaij <[email protected]> Reported-by: Claude code Author: Tatsuo Ishii <[email protected]> Reviewed-by: Bo Peng <[email protected]> Reviewed-by: Koshino Taiki <[email protected]> Discussion: https://www.postgresql.org/message-id/20260608.103312.126925225500634683.ishii%40postgresql.org Backpatch-through: v4.4 Branch ------ V4_5_STABLE Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=8e0a9b9a489737ad10eeddf0bf6cd4df9551d... Modified Files -------------- src/main/pgpool_main.c | 111 ++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 95 insertions(+), 16 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgpool: Do not use signal unsafe functions in pgpool main process signa @ 2026-06-23 12:48 Tatsuo Ishii <[email protected]> 0 siblings, 0 replies; 5+ messages in thread From: Tatsuo Ishii @ 2026-06-23 12:48 UTC (permalink / raw) To: [email protected] Do not use signal unsafe functions in pgpool main process signal handler. The pgpool main process SIGTERM/SIGINT/SIGQUIT handler did the full shutdown work inline: ereport() (twice), pool_semaphore_lock(MAIN_EXIT_HANDLER_SEM), terminate_all_childrens() with a blocking waitpid(-1, ..., 0) and more ereport() calls, kill() of the follow-child group, and finally exit(3) which runs atexit handlers and stdio flush. None of these are async-signal-safe (POSIX 2024 section 2.4.3 [1]). In particular, SIGTERM arriving while pgpool is mid-ereport() / mid-palloc() / mid-semop() could crash, hang, or corrupt heap state. Because the pgpool main process is the parent, a crash here takes down every session and the pgpool cluster. This commit restricts the handler to async-signal-safe calls only: capture the signal number into a new volatile sig_atomic_t main_exit_request, write one byte to the existing self-pipe to wake the main loop, restore errno, and return. The actual shutdown is performed synchronously by a new do_shutdown() function called from the pgpol main loop at the top of every iteration (via check_requests()) and also right after the inner pool_pause() returns, so a signal arriving during the 2-second select() sleep is acted on without an extra tick of latency. do_shutdown() carries the previous body verbatim - the non-async-safe calls (ereport, pool_semaphore_lock, terminate_all_childrens with its blocking waitpid, exit(3)) are now invoked from normal context where they are safe. [1] https://pubs.opengroup.org/onlinepubs/9799919799/functions/V2_chap02.html#tag_16_04_03 Reported-by: Emond Papegaaij <[email protected]> Reported-by: Claude code Author: Tatsuo Ishii <[email protected]> Reviewed-by: Bo Peng <[email protected]> Reviewed-by: Koshino Taiki <[email protected]> Discussion: https://www.postgresql.org/message-id/20260608.103312.126925225500634683.ishii%40postgresql.org Backpatch-through: v4.4 Branch ------ V4_6_STABLE Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=103a8af7164dc5e37fb35cd6428baa2d62bb4... Modified Files -------------- src/main/pgpool_main.c | 111 ++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 95 insertions(+), 16 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgpool: Do not use signal unsafe functions in pgpool main process signa @ 2026-06-23 12:48 Tatsuo Ishii <[email protected]> 0 siblings, 0 replies; 5+ messages in thread From: Tatsuo Ishii @ 2026-06-23 12:48 UTC (permalink / raw) To: [email protected] Do not use signal unsafe functions in pgpool main process signal handler. The pgpool main process SIGTERM/SIGINT/SIGQUIT handler did the full shutdown work inline: ereport() (twice), pool_semaphore_lock(MAIN_EXIT_HANDLER_SEM), terminate_all_childrens() with a blocking waitpid(-1, ..., 0) and more ereport() calls, kill() of the follow-child group, and finally exit(3) which runs atexit handlers and stdio flush. None of these are async-signal-safe (POSIX 2024 section 2.4.3 [1]). In particular, SIGTERM arriving while pgpool is mid-ereport() / mid-palloc() / mid-semop() could crash, hang, or corrupt heap state. Because the pgpool main process is the parent, a crash here takes down every session and the pgpool cluster. This commit restricts the handler to async-signal-safe calls only: capture the signal number into a new volatile sig_atomic_t main_exit_request, write one byte to the existing self-pipe to wake the main loop, restore errno, and return. The actual shutdown is performed synchronously by a new do_shutdown() function called from the pgpol main loop at the top of every iteration (via check_requests()) and also right after the inner pool_pause() returns, so a signal arriving during the 2-second select() sleep is acted on without an extra tick of latency. do_shutdown() carries the previous body verbatim - the non-async-safe calls (ereport, pool_semaphore_lock, terminate_all_childrens with its blocking waitpid, exit(3)) are now invoked from normal context where they are safe. [1] https://pubs.opengroup.org/onlinepubs/9799919799/functions/V2_chap02.html#tag_16_04_03 Reported-by: Emond Papegaaij <[email protected]> Reported-by: Claude code Author: Tatsuo Ishii <[email protected]> Reviewed-by: Bo Peng <[email protected]> Reviewed-by: Koshino Taiki <[email protected]> Discussion: https://www.postgresql.org/message-id/20260608.103312.126925225500634683.ishii%40postgresql.org Backpatch-through: v4.4 Branch ------ V4_7_STABLE Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=3ff98c1e4ce29b84dc8fb7e5888ac48e8b862... Modified Files -------------- src/main/pgpool_main.c | 111 ++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 95 insertions(+), 16 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgpool: Do not use signal unsafe functions in pgpool main process signa @ 2026-06-23 12:49 Tatsuo Ishii <[email protected]> 0 siblings, 0 replies; 5+ messages in thread From: Tatsuo Ishii @ 2026-06-23 12:49 UTC (permalink / raw) To: [email protected] Do not use signal unsafe functions in pgpool main process signal handler. The pgpool main process SIGTERM/SIGINT/SIGQUIT handler did the full shutdown work inline: ereport() (twice), pool_semaphore_lock(MAIN_EXIT_HANDLER_SEM), terminate_all_childrens() with a blocking waitpid(-1, ..., 0) and more ereport() calls, kill() of the follow-child group, and finally exit(3) which runs atexit handlers and stdio flush. None of these are async-signal-safe (POSIX 2024 section 2.4.3 [1]). In particular, SIGTERM arriving while pgpool is mid-ereport() / mid-palloc() / mid-semop() could crash, hang, or corrupt heap state. Because the pgpool main process is the parent, a crash here takes down every session and the pgpool cluster. This commit restricts the handler to async-signal-safe calls only: capture the signal number into a new volatile sig_atomic_t main_exit_request, write one byte to the existing self-pipe to wake the main loop, restore errno, and return. The actual shutdown is performed synchronously by a new do_shutdown() function called from the pgpol main loop at the top of every iteration (via check_requests()) and also right after the inner pool_pause() returns, so a signal arriving during the 2-second select() sleep is acted on without an extra tick of latency. do_shutdown() carries the previous body verbatim - the non-async-safe calls (ereport, pool_semaphore_lock, terminate_all_childrens with its blocking waitpid, exit(3)) are now invoked from normal context where they are safe. [1] https://pubs.opengroup.org/onlinepubs/9799919799/functions/V2_chap02.html#tag_16_04_03 Reported-by: Emond Papegaaij <[email protected]> Reported-by: Claude code Author: Tatsuo Ishii <[email protected]> Reviewed-by: Bo Peng <[email protected]> Reviewed-by: Koshino Taiki <[email protected]> Discussion: https://www.postgresql.org/message-id/20260608.103312.126925225500634683.ishii%40postgresql.org Backpatch-through: v4.4 Branch ------ master Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=5872bf0ee60092b96ed8cc7cac906922e3cb9... Modified Files -------------- src/main/pgpool_main.c | 111 ++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 95 insertions(+), 16 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
end of thread, other threads:[~2026-06-23 12:49 UTC | newest] Thread overview: 5+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2026-06-23 12:48 pgpool: Do not use signal unsafe functions in pgpool main process signa Tatsuo Ishii <[email protected]> 2026-06-23 12:48 pgpool: Do not use signal unsafe functions in pgpool main process signa Tatsuo Ishii <[email protected]> 2026-06-23 12:48 pgpool: Do not use signal unsafe functions in pgpool main process signa Tatsuo Ishii <[email protected]> 2026-06-23 12:48 pgpool: Do not use signal unsafe functions in pgpool main process signa Tatsuo Ishii <[email protected]> 2026-06-23 12:49 pgpool: Do not use signal unsafe functions in pgpool main process signa Tatsuo Ishii <[email protected]>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox