[PATCH] unblock and unignore SIGPIPE

From: Patrick Reynolds <patrick.reynolds@github.com>
Date: Aug 15, 2014, 05:29 UTC
Message-ID: <1408080565-33234-1-git-send-email-patrick.reynolds@github.com>

Blocked and ignored signals -- but not caught signals -- are inherited across exec. Some callers with sloppy signal-handling behavior can call git with SIGPIPE blocked or ignored, even non-deterministically. When SIGPIPE is blocked or ignored, several git commands can run indefinitely, ignoring EPIPE returns from write() calls, even when the process that called them has gone away. Our specific case involved a pipe of git diff-tree output to a script that reads a limited amount of diff data.

In an ideal world, git would never be called with SIGPIPE blocked or ignored. But in the real world, several real potential callers, including Perl, Apache, and Unicorn, sometimes spawn subprocesses with SIGPIPE ignored. It is easier and more productive to harden git against this mistake than to clean it up in every potential parent process.

Signed-off-by: Patrick Reynolds <patrick.reynolds@github.com>
---
 cache.h            |  1 +
 git.c              |  5 +++++
 setup.c            | 11 +++++++++++
 t/t0012-sigpipe.sh | 27 +++++++++++++++++++++++++++
 4 files changed, 44 insertions(+)
 create mode 100755 t/t0012-sigpipe.sh

diff --git a/cache.h b/cache.h
index fcb511d..0a89fc1 100644
--- a/cache.h
+++ b/cache.h
@@ -463,6 +463,7 @@ extern int set_git_dir_init(const char *git_dir, const char *real_git_dir, int);
 extern int init_db(const char *template_dir, unsigned int flags);
 
 extern void sanitize_stdfds(void);
+extern void sanitize_signals(void);
 extern int daemonize(void);
 
 #define alloc_nr(x) (((x)+16)*3/2)
diff --git a/git.c b/git.c
index 9c49519..d6b221b 100644
--- a/git.c
+++ b/git.c
@@ -611,6 +611,11 @@ int main(int argc, char **av)
 	 */
 	sanitize_stdfds();
 
+	/*
+	 * Make sure we aren't ignoring or blocking SIGPIPE.
+	 */
+	sanitize_signals();
+
 	git_setup_gettext();
 
 	trace_command_performance(argv);
diff --git a/setup.c b/setup.c
index 0a22f8b..7aa4b01 100644
--- a/setup.c
+++ b/setup.c
@@ -865,3 +865,14 @@ int daemonize(void)
 	return 0;
 #endif
 }
+
+/* un-ignore and un-block SIGPIPE */
+void sanitize_signals(void)
+{
+	sigset_t unblock;
+
+	sigemptyset(&unblock);
+	sigaddset(&unblock, SIGPIPE);
+	sigprocmask(SIG_UNBLOCK, &unblock, NULL);
+	signal(SIGPIPE, SIG_DFL);
+}
diff --git a/t/t0012-sigpipe.sh b/t/t0012-sigpipe.sh
new file mode 100755
index 0000000..213cde3
--- /dev/null
+++ b/t/t0012-sigpipe.sh
@@ -0,0 +1,27 @@
+#!/bin/sh
+
+test_description='check handling of SIGPIPE'
+. ./test-lib.sh
+
+test_expect_success 'create blob' '
+	test-genrandom foo 16384 >file &&
+	git add file
+'
+
+large_git () {
+	for i in $(test_seq 1 100); do
+		git diff --staged --binary || return $?
+	done
+}
+
+test_expect_success 'git dies with SIGPIPE' '
+	OUT=$( ((large_git; echo $? 1>&3) | true) 3>&1 )
+	test "$OUT" -eq 141
+'
+
+test_expect_success 'git dies with SIGPIPE even if parent ignores it' '
+	OUT=$( ((trap "" PIPE; large_git; echo $? 1>&3) | true) 3>&1 )
+	test "$OUT" -eq 141
+'
+
+test_done

-- 
2.0.1