Date: Sat, 7 Dec 2024 19:46:14 -0800
From: Noah Misch <noah@leadboat.com>
To: pgsql-hackers@postgresql.org
Cc: nathandbossart@gmail.com
Subject: Fix early elog(FATAL)
Message-ID: <20241208034614.45.nmisch@google.com>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="rDBHi9GJqjyeXEPS"
Content-Disposition: inline
User-Agent: Mutt/2.2.12 (2023-09-09)
Archived-At: 
 <https://www.postgresql.org/message-id/20241208034614.45.nmisch%40google.com>
Precedence: bulk


--rDBHi9GJqjyeXEPS
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

main() says:

	/*
	 * Fire up essential subsystems: error and memory management
	 *
	 * Code after this point is allowed to use elog/ereport, though
	 * localization of messages may not work right away, and messages won't go
	 * anywhere but stderr until GUC settings get loaded.
	 */
	MemoryContextInit();

However, appending elog(ERROR, "whoops") breaks like:

$ initdb -D discard_me
FATAL:  whoops
PANIC:  proc_exit() called in child process
no data was returned by command ""/home/nm/sw/nopath/pghead/bin/postgres" -V"
child process was terminated by signal 6: Aborted

So does the ereport(FATAL) in ClosePostmasterPorts().  The "called in child
process" check (added in commit 97550c0 of 2023-10) reads MyProcPid, which we
set later.  Three ways to fix this:

1. Call InitProcessGlobals() earlier.  This could also reduce the total call
   sites from 3 to 2 (main() and post-fork).

2. Move MyProcPid init out of InitProcessGlobals(), to main() and post-fork.
   This has less to go wrong in back branches.  While probably irrelevant,
   this avoids calling pg_prng_strong_seed() in processes that will exit after
   help() or GucInfoMain().

3. Revert 97550c0, as commit 3b00fdb anticipated.

I don't think the choice matters much, so here is (2).

--rDBHi9GJqjyeXEPS
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="early-elog-v1.patch"

Author:     Noah Misch <noah@leadboat.com>
Commit:     Noah Misch <noah@leadboat.com>

    Fix elog(FATAL) before PostmasterMain() or just after fork().
    
    Since commit 97550c0711972a9856b5db751539bbaf2f88884c, these failed with
    "PANIC:  proc_exit() called in child process" due to uninitialized or
    stale MyProcPid.  That was reachable if close() failed in
    ClosePostmasterPorts() or setlocale(category, "C") failed, both
    unlikely.  Back-patch to v13 (all supported versions).
    
    Reviewed by FIXME.
    
    Discussion: https://postgr.es/m/FIXME

diff --git a/src/backend/main/main.c b/src/backend/main/main.c
index 3acb46b..e286810 100644
--- a/src/backend/main/main.c
+++ b/src/backend/main/main.c
@@ -109,6 +109,7 @@ main(int argc, char *argv[])
 	 * localization of messages may not work right away, and messages won't go
 	 * anywhere but stderr until GUC settings get loaded.
 	 */
+	MyProcPid = getpid();
 	MemoryContextInit();
 
 	/*
diff --git a/src/backend/postmaster/fork_process.c b/src/backend/postmaster/fork_process.c
index 5e42a74..b3010e3 100644
--- a/src/backend/postmaster/fork_process.c
+++ b/src/backend/postmaster/fork_process.c
@@ -19,6 +19,7 @@
 #include <unistd.h>
 
 #include "libpq/pqsignal.h"
+#include "miscadmin.h"
 #include "postmaster/fork_process.h"
 
 #ifndef WIN32
@@ -66,6 +67,7 @@ fork_process(void)
 	if (result == 0)
 	{
 		/* fork succeeded, in child */
+		MyProcPid = getpid();
 #ifdef LINUX_PROFILE
 		setitimer(ITIMER_PROF, &prof_itimer, NULL);
 #endif
diff --git a/src/backend/postmaster/postmaster.c b/src/backend/postmaster/postmaster.c
index ce00f40..f0f9c66 100644
--- a/src/backend/postmaster/postmaster.c
+++ b/src/backend/postmaster/postmaster.c
@@ -1899,14 +1899,13 @@ ClosePostmasterPorts(bool am_syslogger)
 
 
 /*
- * InitProcessGlobals -- set MyProcPid, MyStartTime[stamp], random seeds
+ * InitProcessGlobals -- set MyStartTime[stamp], random seeds
  *
  * Called early in the postmaster and every backend.
  */
 void
 InitProcessGlobals(void)
 {
-	MyProcPid = getpid();
 	MyStartTimestamp = GetCurrentTimestamp();
 	MyStartTime = timestamptz_to_time_t(MyStartTimestamp);
 
diff --git a/src/port/pqsignal.c b/src/port/pqsignal.c
index 6ca2d4e..bdaa9f1 100644
--- a/src/port/pqsignal.c
+++ b/src/port/pqsignal.c
@@ -74,8 +74,7 @@ static volatile pqsigfunc pqsignal_handlers[PG_NSIG];
 /*
  * Except when called with SIG_IGN or SIG_DFL, pqsignal() sets up this function
  * as the handler for all signals.  This wrapper handler function checks that
- * it is called within a process that the server knows about (i.e., any process
- * that has called InitProcessGlobals(), such as a client backend), and not a
+ * it is called within a process that knew to maintain MyProcPid, and not a
  * child process forked by system(3), etc.  This check ensures that such child
  * processes do not modify shared memory, which is often detrimental.  If the
  * check succeeds, the function originally provided to pqsignal() is called.

--rDBHi9GJqjyeXEPS--