Don't run atexit callbacks in quickdie signal handlers.

exit() is not async-signal safe. Even if the libc implementation is, 3rd
party libraries might have installed unsafe atexit() callbacks. After
receiving SIGQUIT, we really just want to exit as quickly as possible, so
we don't really want to run the atexit() callbacks anyway.

The original report by Jimmy Yih was a self-deadlock in startup_die().
However, this patch doesn't address that scenario; the signal handling
while waiting for the startup packet is more complicated. But at least this
alleviates similar problems in the SIGQUIT handlers, like that reported
by Asim R P later in the same thread.

Backpatch to 9.3 (all supported versions).

Discussion: https://www.postgresql.org/message-id/CAOMx_OAuRUHiAuCg2YgicZLzPVv5d9_H4KrL_OFsFP%3DVPekigA%40mail.gmail.com

diff --git a/src/backend/postmaster/bgworker.c b/src/backend/postmaster/bgworker.c
index f651bb49b158134d6086b9074d90cbdd67298271..d2b695e1462cfafb09b776a2f88737b8e2ab74e3 100644 (file)
--- a/src/backend/postmaster/bgworker.c
+++ b/src/backend/postmaster/bgworker.c
@@ -644,28 +644,21 @@ SanityCheckBackgroundWorker(BackgroundWorker *worker, int elevel)
 static void
 bgworker_quickdie(SIGNAL_ARGS)
 {
-       sigaddset(&BlockSig, SIGQUIT);  /* prevent nested calls */
-       PG_SETMASK(&BlockSig);
-
-       /*
-        * We DO NOT want to run proc_exit() callbacks -- we're here because
-        * shared memory may be corrupted, so we don't want to try to clean up our
-        * transaction.  Just nail the windows shut and get out of town.  Now that
-        * there's an atexit callback to prevent third-party code from breaking
-        * things by calling exit() directly, we have to reset the callbacks
-        * explicitly to make this work as intended.
-        */
-       on_exit_reset();
-
        /*
-        * Note we do exit(2) not exit(0).  This is to force the postmaster into a
-        * system reset cycle if some idiot DBA sends a manual SIGQUIT to a random
+        * We DO NOT want to run proc_exit() or atexit() callbacks -- we're here
+        * because shared memory may be corrupted, so we don't want to try to
+        * clean up our transaction.  Just nail the windows shut and get out of
+        * town.  The callbacks wouldn't be safe to run from a signal handler,
+        * anyway.
+        *
+        * Note we do _exit(2) not _exit(0).  This is to force the postmaster into
+        * a system reset cycle if someone sends a manual SIGQUIT to a random
         * backend.  This is necessary precisely because we don't clean up our
         * shared memory state.  (The "dead man switch" mechanism in pmsignal.c
         * should ensure the postmaster sees this as a crash, too, but no harm in
         * being doubly sure.)
         */
-       exit(2);
+       _exit(2);
 }
 
 /*

diff --git a/src/backend/postmaster/bgwriter.c b/src/backend/postmaster/bgwriter.c
index 960d3de2040e73b3a66ccf5a2ae6aa63a9ea40ff..b1e9bb2c537b86d6c5c2837d095889e9acab69c9 100644 (file)
--- a/src/backend/postmaster/bgwriter.c
+++ b/src/backend/postmaster/bgwriter.c
@@ -399,27 +399,21 @@ BackgroundWriterMain(void)
 static void
 bg_quickdie(SIGNAL_ARGS)
 {
-       PG_SETMASK(&BlockSig);
-
        /*
-        * We DO NOT want to run proc_exit() callbacks -- we're here because
-        * shared memory may be corrupted, so we don't want to try to clean up our
-        * transaction.  Just nail the windows shut and get out of town.  Now that
-        * there's an atexit callback to prevent third-party code from breaking
-        * things by calling exit() directly, we have to reset the callbacks
-        * explicitly to make this work as intended.
-        */
-       on_exit_reset();
-
-       /*
-        * Note we do exit(2) not exit(0).  This is to force the postmaster into a
-        * system reset cycle if some idiot DBA sends a manual SIGQUIT to a random
+        * We DO NOT want to run proc_exit() or atexit() callbacks -- we're here
+        * because shared memory may be corrupted, so we don't want to try to
+        * clean up our transaction.  Just nail the windows shut and get out of
+        * town.  The callbacks wouldn't be safe to run from a signal handler,
+        * anyway.
+        *
+        * Note we do _exit(2) not _exit(0).  This is to force the postmaster into
+        * a system reset cycle if someone sends a manual SIGQUIT to a random
         * backend.  This is necessary precisely because we don't clean up our
         * shared memory state.  (The "dead man switch" mechanism in pmsignal.c
         * should ensure the postmaster sees this as a crash, too, but no harm in
         * being doubly sure.)
         */
-       exit(2);
+       _exit(2);
 }
 
 /* SIGHUP: set flag to re-read config file at next convenient time */

diff --git a/src/backend/postmaster/checkpointer.c b/src/backend/postmaster/checkpointer.c
index de1b22d04558fc938225eea011d6b66e63e69df7..1a033093c5384a3469ae0d7ec0dfa25a1b52d172 100644 (file)
--- a/src/backend/postmaster/checkpointer.c
+++ b/src/backend/postmaster/checkpointer.c
@@ -813,27 +813,21 @@ IsCheckpointOnSchedule(double progress)
 static void
 chkpt_quickdie(SIGNAL_ARGS)
 {
-       PG_SETMASK(&BlockSig);
-
        /*
-        * We DO NOT want to run proc_exit() callbacks -- we're here because
-        * shared memory may be corrupted, so we don't want to try to clean up our
-        * transaction.  Just nail the windows shut and get out of town.  Now that
-        * there's an atexit callback to prevent third-party code from breaking
-        * things by calling exit() directly, we have to reset the callbacks
-        * explicitly to make this work as intended.
-        */
-       on_exit_reset();
-
-       /*
-        * Note we do exit(2) not exit(0).  This is to force the postmaster into a
-        * system reset cycle if some idiot DBA sends a manual SIGQUIT to a random
+        * We DO NOT want to run proc_exit() or atexit() callbacks -- we're here
+        * because shared memory may be corrupted, so we don't want to try to
+        * clean up our transaction.  Just nail the windows shut and get out of
+        * town.  The callbacks wouldn't be safe to run from a signal handler,
+        * anyway.
+        *
+        * Note we do _exit(2) not _exit(0).  This is to force the postmaster into
+        * a system reset cycle if someone sends a manual SIGQUIT to a random
         * backend.  This is necessary precisely because we don't clean up our
         * shared memory state.  (The "dead man switch" mechanism in pmsignal.c
         * should ensure the postmaster sees this as a crash, too, but no harm in
         * being doubly sure.)
         */
-       exit(2);
+       _exit(2);
 }
 
 /* SIGHUP: set flag to re-read config file at next convenient time */

diff --git a/src/backend/postmaster/startup.c b/src/backend/postmaster/startup.c
index 38300527a548920ac81f1949978f02145f0c2f68..2926211e35da7a4f47da084837377fe83b411c74 100644 (file)
--- a/src/backend/postmaster/startup.c
+++ b/src/backend/postmaster/startup.c
@@ -69,27 +69,21 @@ static void StartupProcSigHupHandler(SIGNAL_ARGS);
 static void
 startupproc_quickdie(SIGNAL_ARGS)
 {
-       PG_SETMASK(&BlockSig);
-
-       /*
-        * We DO NOT want to run proc_exit() callbacks -- we're here because
-        * shared memory may be corrupted, so we don't want to try to clean up our
-        * transaction.  Just nail the windows shut and get out of town.  Now that
-        * there's an atexit callback to prevent third-party code from breaking
-        * things by calling exit() directly, we have to reset the callbacks
-        * explicitly to make this work as intended.
-        */
-       on_exit_reset();
-
        /*
-        * Note we do exit(2) not exit(0).  This is to force the postmaster into a
-        * system reset cycle if some idiot DBA sends a manual SIGQUIT to a random
+        * We DO NOT want to run proc_exit() or atexit() callbacks -- we're here
+        * because shared memory may be corrupted, so we don't want to try to
+        * clean up our transaction.  Just nail the windows shut and get out of
+        * town.  The callbacks wouldn't be safe to run from a signal handler,
+        * anyway.
+        *
+        * Note we do _exit(2) not _exit(0).  This is to force the postmaster into
+        * a system reset cycle if someone sends a manual SIGQUIT to a random
         * backend.  This is necessary precisely because we don't clean up our
         * shared memory state.  (The "dead man switch" mechanism in pmsignal.c
         * should ensure the postmaster sees this as a crash, too, but no harm in
         * being doubly sure.)
         */
-       exit(2);
+       _exit(2);
 }
 
 

diff --git a/src/backend/postmaster/walwriter.c b/src/backend/postmaster/walwriter.c
index eceed1bf8829b9329e1a710e25f5561917e7b91f..fb66bceeedf555b8a6933d63ce8db5712ff9d591 100644 (file)
--- a/src/backend/postmaster/walwriter.c
+++ b/src/backend/postmaster/walwriter.c
@@ -309,27 +309,21 @@ WalWriterMain(void)
 static void
 wal_quickdie(SIGNAL_ARGS)
 {
-       PG_SETMASK(&BlockSig);
-
        /*
-        * We DO NOT want to run proc_exit() callbacks -- we're here because
-        * shared memory may be corrupted, so we don't want to try to clean up our
-        * transaction.  Just nail the windows shut and get out of town.  Now that
-        * there's an atexit callback to prevent third-party code from breaking
-        * things by calling exit() directly, we have to reset the callbacks
-        * explicitly to make this work as intended.
-        */
-       on_exit_reset();
-
-       /*
-        * Note we do exit(2) not exit(0).  This is to force the postmaster into a
-        * system reset cycle if some idiot DBA sends a manual SIGQUIT to a random
+        * We DO NOT want to run proc_exit() or atexit() callbacks -- we're here
+        * because shared memory may be corrupted, so we don't want to try to
+        * clean up our transaction.  Just nail the windows shut and get out of
+        * town.  The callbacks wouldn't be safe to run from a signal handler,
+        * anyway.
+        *
+        * Note we do _exit(2) not _exit(0).  This is to force the postmaster into
+        * a system reset cycle if someone sends a manual SIGQUIT to a random
         * backend.  This is necessary precisely because we don't clean up our
         * shared memory state.  (The "dead man switch" mechanism in pmsignal.c
         * should ensure the postmaster sees this as a crash, too, but no harm in
         * being doubly sure.)
         */
-       exit(2);
+       _exit(2);
 }
 
 /* SIGHUP: set flag to re-read config file at next convenient time */

diff --git a/src/backend/replication/walreceiver.c b/src/backend/replication/walreceiver.c
index 7c292d8071b9c8c45bb9bb9bafe71d1970ad2abd..6f4b3538ac4b0f6d01a9b91f6608be9812c739c7 100644 (file)
--- a/src/backend/replication/walreceiver.c
+++ b/src/backend/replication/walreceiver.c
@@ -854,27 +854,21 @@ WalRcvShutdownHandler(SIGNAL_ARGS)
 static void
 WalRcvQuickDieHandler(SIGNAL_ARGS)
 {
-       PG_SETMASK(&BlockSig);
-
        /*
-        * We DO NOT want to run proc_exit() callbacks -- we're here because
-        * shared memory may be corrupted, so we don't want to try to clean up our
-        * transaction.  Just nail the windows shut and get out of town.  Now that
-        * there's an atexit callback to prevent third-party code from breaking
-        * things by calling exit() directly, we have to reset the callbacks
-        * explicitly to make this work as intended.
-        */
-       on_exit_reset();
-
-       /*
-        * Note we do exit(2) not exit(0).  This is to force the postmaster into a
-        * system reset cycle if some idiot DBA sends a manual SIGQUIT to a random
-        * backend.  This is necessary precisely because we don't clean up our
-        * shared memory state.  (The "dead man switch" mechanism in pmsignal.c
-        * should ensure the postmaster sees this as a crash, too, but no harm in
-        * being doubly sure.)
+        * We DO NOT want to run proc_exit() or atexit() callbacks -- we're here
+        * because shared memory may be corrupted, so we don't want to try to
+        * clean up our transaction.  Just nail the windows shut and get out of
+        * town.  The callbacks wouldn't be safe to run from a signal handler,
+        * anyway.
+        *
+        * Note we use _exit(2) not _exit(0).  This is to force the postmaster
+        * into a system reset cycle if someone sends a manual SIGQUIT to a
+        * random backend.  This is necessary precisely because we don't clean up
+        * our shared memory state.  (The "dead man switch" mechanism in
+        * pmsignal.c should ensure the postmaster sees this as a crash, too, but
+        * no harm in being doubly sure.)
         */
-       exit(2);
+       _exit(2);
 }
 
 /*

diff --git a/src/backend/tcop/postgres.c b/src/backend/tcop/postgres.c
index f4133953beb0062312b1554a82b53659ac9e58a0..07b956553a7c02942423dc146a824de61e98f84b 100644 (file)
--- a/src/backend/tcop/postgres.c
+++ b/src/backend/tcop/postgres.c
@@ -2616,6 +2616,16 @@ quickdie(SIGNAL_ARGS)
                whereToSendOutput = DestNone;
 
        /*
+        * Notify the client before exiting, to give a clue on what happened.
+        *
+        * It's dubious to call ereport() from a signal handler.  It is certainly
+        * not async-signal safe.  But it seems better to try, than to disconnect
+        * abruptly and leave the client wondering what happened.  It's remotely
+        * possible that we crash or hang while trying to send the message, but
+        * receiving a SIGQUIT is a sign that something has already gone badly
+        * wrong, so there's not much to lose.  Assuming the postmaster is still
+        * running, it will SIGKILL us soon if we get stuck for some reason.
+        *
         * Ideally this should be ereport(FATAL), but then we'd not get control
         * back...
         */
@@ -2630,24 +2640,20 @@ quickdie(SIGNAL_ARGS)
                                         " database and repeat your command.")));
 
        /*
-        * We DO NOT want to run proc_exit() callbacks -- we're here because
-        * shared memory may be corrupted, so we don't want to try to clean up our
-        * transaction.  Just nail the windows shut and get out of town.  Now that
-        * there's an atexit callback to prevent third-party code from breaking
-        * things by calling exit() directly, we have to reset the callbacks
-        * explicitly to make this work as intended.
-        */
-       on_exit_reset();
-
-       /*
-        * Note we do exit(2) not exit(0).  This is to force the postmaster into a
-        * system reset cycle if some idiot DBA sends a manual SIGQUIT to a random
+        * We DO NOT want to run proc_exit() or atexit() callbacks -- we're here
+        * because shared memory may be corrupted, so we don't want to try to
+        * clean up our transaction.  Just nail the windows shut and get out of
+        * town.  The callbacks wouldn't be safe to run from a signal handler,
+        * anyway.
+        *
+        * Note we do _exit(2) not _exit(0).  This is to force the postmaster into
+        * a system reset cycle if someone sends a manual SIGQUIT to a random
         * backend.  This is necessary precisely because we don't clean up our
         * shared memory state.  (The "dead man switch" mechanism in pmsignal.c
         * should ensure the postmaster sees this as a crash, too, but no harm in
         * being doubly sure.)
         */
-       exit(2);
+       _exit(2);
 }
 
 /*