Ignore interrupts during quickdie().

Once the administrator has called for an immediate shutdown or a backend
crash has triggered a reinitialization, no mere SIGINT or SIGTERM should
change that course.  Such derailment remains possible when the signal
arrives before quickdie() blocks signals.  That being a narrow race
affecting most PostgreSQL signal handlers in some way, leave it for
another patch.  Back-patch this to all supported versions.

diff --git a/src/backend/tcop/postgres.c b/src/backend/tcop/postgres.c
index ba895d5854ae5bcd4de8b2b7495964d3f5ddf46a..beb2cc2d7e4d97fcc0bfeefa1d850262c7072d13 100644 (file)
--- a/src/backend/tcop/postgres.c
+++ b/src/backend/tcop/postgres.c
@@ -2524,6 +2524,13 @@ quickdie(SIGNAL_ARGS)
        sigaddset(&BlockSig, SIGQUIT);          /* prevent nested calls */
        PG_SETMASK(&BlockSig);
 
+       /*
+        * Prevent interrupts while exiting; though we just blocked signals that
+        * would queue new interrupts, one may have been pending.  We don't want a
+        * quickdie() downgraded to a mere query cancel.
+        */
+       HOLD_INTERRUPTS();
+
        /*
         * If we're aborting out of client auth, don't risk trying to send
         * anything to the client; we will likely violate the protocol, not to