pgpool: Do not use signal unsafe functions in pgpool main process signa

From: Tatsuo Ishii <ishii(at)postgresql(dot)org>
To: pgpool-committers(at)lists(dot)postgresql(dot)org
Subject: pgpool: Do not use signal unsafe functions in pgpool main process signa
Date: 2026-06-23 12:48:40
Message-ID: E1wc0YR-00F5uz-1Q@gothos.postgresql.org
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgpool-committers

Do not use signal unsafe functions in pgpool main process signal handler.

The pgpool main process SIGTERM/SIGINT/SIGQUIT handler did the full
shutdown work inline: ereport() (twice),
pool_semaphore_lock(MAIN_EXIT_HANDLER_SEM), terminate_all_childrens()
with a blocking waitpid(-1, ..., 0) and more ereport() calls, kill()
of the follow-child group, and finally exit(3) which runs atexit
handlers and stdio flush. None of these are async-signal-safe (POSIX
2024 section 2.4.3 [1]). In particular, SIGTERM arriving while pgpool
is mid-ereport() / mid-palloc() / mid-semop() could crash, hang, or
corrupt heap state. Because the pgpool main process is the parent, a
crash here takes down every session and the pgpool cluster.

This commit restricts the handler to async-signal-safe calls only:
capture the signal number into a new volatile sig_atomic_t
main_exit_request, write one byte to the existing self-pipe to wake
the main loop, restore errno, and return. The actual shutdown is
performed synchronously by a new do_shutdown() function called from
the pgpol main loop at the top of every iteration (via
check_requests()) and also right after the inner pool_pause() returns,
so a signal arriving during the 2-second select() sleep is acted on
without an extra tick of latency.

do_shutdown() carries the previous body verbatim - the
non-async-safe calls (ereport, pool_semaphore_lock,
terminate_all_childrens with its blocking waitpid, exit(3)) are now
invoked from normal context where they are safe.

[1] https://pubs.opengroup.org/onlinepubs/9799919799/functions/V2_chap02.html#tag_16_04_03

Reported-by: Emond Papegaaij <emond(dot)papegaaij(at)gmail(dot)com>
Reported-by: Claude code
Author: Tatsuo Ishii <ishii(at)postgresql(dot)org>
Reviewed-by: Bo Peng <pengbo(at)sraoss(dot)co(dot)jp>
Reviewed-by: Koshino Taiki <koshino(at)sraoss(dot)co(dot)jp>
Discussion: https://www.postgresql.org/message-id/20260608.103312.126925225500634683.ishii%40postgresql.org
Backpatch-through: v4.4

Branch
------
V4_4_STABLE

Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=af96466fa8442eb76baf721cd9355c6a64b7db5e

Modified Files
--------------
src/main/pgpool_main.c | 111 ++++++++++++++++++++++++++++++++++++++++++-------
1 file changed, 95 insertions(+), 16 deletions(-)

Browse pgpool-committers by date

  From Date Subject
Next Message Tatsuo Ishii 2026-06-23 12:48:46 pgpool: Do not use signal unsafe functions in pgpool main process signa
Previous Message Tatsuo Ishii 2026-06-18 09:38:44 pgpool: Fix use-after-free of query context after a backend node shutdo