public inbox for [email protected]
help / color / mirror / Atom feedFrom: Tatsuo Ishii <[email protected]>
To: [email protected]
Subject: pgpool: Do not use signal unsafe functions in pgpool main process signa
Date: Tue, 23 Jun 2026 12:49:03 +0000
Message-ID: <[email protected]> (raw)
Do not use signal unsafe functions in pgpool main process signal handler.
The pgpool main process SIGTERM/SIGINT/SIGQUIT handler did the full
shutdown work inline: ereport() (twice),
pool_semaphore_lock(MAIN_EXIT_HANDLER_SEM), terminate_all_childrens()
with a blocking waitpid(-1, ..., 0) and more ereport() calls, kill()
of the follow-child group, and finally exit(3) which runs atexit
handlers and stdio flush. None of these are async-signal-safe (POSIX
2024 section 2.4.3 [1]). In particular, SIGTERM arriving while pgpool
is mid-ereport() / mid-palloc() / mid-semop() could crash, hang, or
corrupt heap state. Because the pgpool main process is the parent, a
crash here takes down every session and the pgpool cluster.
This commit restricts the handler to async-signal-safe calls only:
capture the signal number into a new volatile sig_atomic_t
main_exit_request, write one byte to the existing self-pipe to wake
the main loop, restore errno, and return. The actual shutdown is
performed synchronously by a new do_shutdown() function called from
the pgpol main loop at the top of every iteration (via
check_requests()) and also right after the inner pool_pause() returns,
so a signal arriving during the 2-second select() sleep is acted on
without an extra tick of latency.
do_shutdown() carries the previous body verbatim - the
non-async-safe calls (ereport, pool_semaphore_lock,
terminate_all_childrens with its blocking waitpid, exit(3)) are now
invoked from normal context where they are safe.
[1] https://pubs.opengroup.org/onlinepubs/9799919799/functions/V2_chap02.html#tag_16_04_03
Reported-by: Emond Papegaaij <[email protected]>
Reported-by: Claude code
Author: Tatsuo Ishii <[email protected]>
Reviewed-by: Bo Peng <[email protected]>
Reviewed-by: Koshino Taiki <[email protected]>
Discussion: https://www.postgresql.org/message-id/20260608.103312.126925225500634683.ishii%40postgresql.org
Backpatch-through: v4.4
Branch
------
master
Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=5872bf0ee60092b96ed8cc7cac906922e3cb9...
Modified Files
--------------
src/main/pgpool_main.c | 111 ++++++++++++++++++++++++++++++++++++++++++-------
1 file changed, 95 insertions(+), 16 deletions(-)
view thread (5+ messages)
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: [email protected]
Cc: [email protected], [email protected]
Subject: Re: pgpool: Do not use signal unsafe functions in pgpool main process signa
In-Reply-To: <[email protected]>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox