| From: | Tatsuo Ishii <ishii(at)postgresql(dot)org> |
|---|---|
| To: | pgpool-committers(at)lists(dot)postgresql(dot)org |
| Subject: | pgpool: Do not use signal unsafe functions in pgpool main process signa |
| Date: | 2026-06-23 12:49:03 |
| Message-ID: | E1wc0Yn-00F60M-33@gothos.postgresql.org |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgpool-committers |
Do not use signal unsafe functions in pgpool main process signal handler.
The pgpool main process SIGTERM/SIGINT/SIGQUIT handler did the full
shutdown work inline: ereport() (twice),
pool_semaphore_lock(MAIN_EXIT_HANDLER_SEM), terminate_all_childrens()
with a blocking waitpid(-1, ..., 0) and more ereport() calls, kill()
of the follow-child group, and finally exit(3) which runs atexit
handlers and stdio flush. None of these are async-signal-safe (POSIX
2024 section 2.4.3 [1]). In particular, SIGTERM arriving while pgpool
is mid-ereport() / mid-palloc() / mid-semop() could crash, hang, or
corrupt heap state. Because the pgpool main process is the parent, a
crash here takes down every session and the pgpool cluster.
This commit restricts the handler to async-signal-safe calls only:
capture the signal number into a new volatile sig_atomic_t
main_exit_request, write one byte to the existing self-pipe to wake
the main loop, restore errno, and return. The actual shutdown is
performed synchronously by a new do_shutdown() function called from
the pgpol main loop at the top of every iteration (via
check_requests()) and also right after the inner pool_pause() returns,
so a signal arriving during the 2-second select() sleep is acted on
without an extra tick of latency.
do_shutdown() carries the previous body verbatim - the
non-async-safe calls (ereport, pool_semaphore_lock,
terminate_all_childrens with its blocking waitpid, exit(3)) are now
invoked from normal context where they are safe.
[1] https://pubs.opengroup.org/onlinepubs/9799919799/functions/V2_chap02.html#tag_16_04_03
Reported-by: Emond Papegaaij <emond(dot)papegaaij(at)gmail(dot)com>
Reported-by: Claude code
Author: Tatsuo Ishii <ishii(at)postgresql(dot)org>
Reviewed-by: Bo Peng <pengbo(at)sraoss(dot)co(dot)jp>
Reviewed-by: Koshino Taiki <koshino(at)sraoss(dot)co(dot)jp>
Discussion: https://www.postgresql.org/message-id/20260608.103312.126925225500634683.ishii%40postgresql.org
Backpatch-through: v4.4
Branch
------
master
Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=5872bf0ee60092b96ed8cc7cac906922e3cb9094
Modified Files
--------------
src/main/pgpool_main.c | 111 ++++++++++++++++++++++++++++++++++++++++++-------
1 file changed, 95 insertions(+), 16 deletions(-)
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Tatsuo Ishii | 2026-06-25 01:13:46 | pgpool: Test: use wait_for_pgpool_startup instead of sleep. |
| Previous Message | Tatsuo Ishii | 2026-06-23 12:48:57 | pgpool: Do not use signal unsafe functions in pgpool main process signa |