[PATCH] Defer SIGCHLD trap handler when waitchld is called from within signal handler

[siddhesh]

Configuration Information [Automatically generated, do not change]:
Machine: x86_64
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS:  -DPROGRAM='bash' -DCONF_HOSTTYPE='x86_64' 
-DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='x86_64-redhat-linux-gnu' 
-DCONF_VENDOR='redhat' -DLOCALEDIR='/usr/share/locale' -DPACKAGE='bash' -DSHELL 
-DHAVE_CONFIG_H   -I.  -I. -I./include -I./lib  -D_GNU_SOURCE -DRECYCLES_PIDS  
-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector 
--param=ssp-buffer-size=4  -m64 -mtune=generic
uname output: Linux localhost 3.1.6-1.fc16.x86_64 #1 SMP Wed Dec 21 22:41:17 
UTC 2011 x86_64 x86_64 x86_64 GNU/Linux
Machine Type: x86_64-redhat-linux-gnu

Bash Version: 4.2
Patch Level: 20
Release Status: release

Description:
        When a SIGCHLD is received in job control mode and a handler
        for the signal is installed, bash calls the trap handler
        within the signal handler itself. This is unsafe because the
        trap handler function run_sigchld_trap() uses the glibc malloc
        functions quite extensively (within the function itself and
        also the function it calls, i.e.  parse_and_execute() ). This
        results in a deadlock and sometimes even a segmentation fault
        due to memory corruption.

Repeat-By:
        $ cat > foo.sh
        #!/bin/sh
        
        check_stop_child_trap() {
                echo "child died!"
        }
        
        do_something() {
                while true; do
                        true &
                done
        }
        
        trap check_stop_child_trap SIGCHLD
        do_something &
        do_something
        
        ^d
        
        $ bash
        $ . foo.sh

        ------------------

        The above may either hang or result in a segmentation fault.

Fix:

The patch below fixes this by deferring execution of the trap handler
by adding it to pending_sigs.

diff -pruN bash-4.1/jobs.c bash-4.1.patched/jobs.c
--- bash-4.1/jobs.c     2009-11-30 03:42:05.000000000 +0530
+++ bash-4.1.patched/jobs.c     2012-03-06 16:44:15.706595703 +0530
@@ -3037,6 +3037,7 @@ waitchld (wpid, block)
   PROCESS *child;
   pid_t pid;
   int call_set_current, last_stopped_job, job, children_exited, waitpid_flags;
+  int called_from_sighand = sigchld;
   static int wcontinued = WCONTINUED;  /* run-time fix for glibc problem */
 
   call_set_current = children_exited = 0;
@@ -3161,7 +3162,17 @@ waitchld (wpid, block)
          longjmp (wait_intr_buf, 1);
        }
 
-      run_sigchld_trap (children_exited);
+      /* Queue up the trap handler if we're called directly from within the
+         signal handler. */
+      if (called_from_sighand)
+       {
+         int i = children_exited;
+         interrupt_immediately = 0;
+         while (i--)
+           trap_handler (SIGCHLD);
+       }
+      else
+       run_sigchld_trap (children_exited);
     }
 
   /* We have successfully recorded the useful information about this process