Does POSIX specify that only one signal can interrupt pselect?

Question

The POSIX pselect function take a signal mask argument. The signal mask is "atomically" set as the current mask before execution of the function begins, and is restored as the function returns.

This allows an otherwise masked signal to be unmasked while the function executes, and masked again when the function returns. It's guaranteed^* that if a signal unmasked in this way is caught, the pselect function will be interrupted by the signal and (unless the signal action is specified with the SA_RESTART flag) will return an EINTR error.

(*: or is it? the language in the document linked above would seem to allow that a signal being received between when pselect unblocked due to seeing a file readiness or timeout and when it replaced the signal mask with the original would not necessarily cause EINTR, since EINTR is required if "The function was interrupted while blocked ..." - however, that ultimately doesn't affect this question).

My question is: supposing that two separate signals are temporarily unmasked during pselect execution, is it possible that both signals will be caught before the pselect function returns and the previous signal mask is restored - or is there some kind of guarantee that only one signal will be caught in this case (leaving the other one pending)? (For purposes of the question, suppose that SA_RESTART is not set for the signal action, and that all signals were specified to be masked during execution of the signal handler when it was established via sigaction).

I can find nothing which suggests that only one signal may be processed, but I may have missed something, and I am writing some code for which this would be a very useful guarantee. I'd be interested to know if POSIX itself makes any guarantee, and also if different OSes provide such a guarantee independently.

Answer 1

No, but it also doesn’t specify that multiple signals can or must. Since it is unspecified, it is best to follow the general rule, which allows all pending unmasked signals to be processed. If you attempt to strictly depend upon this, you are likely on a bad path because the timing of asynchronous events is difficult to predict.

In general, it would be very difficult to make an implementation that imposed an ‘only one' restriction because the os runtime would have to leave one or more signals pending but unmasked until some unspecified point. Remember that the signal handler which runs when pselect is interrupted could do a siglongjmp rather than returning, so the kernel would have to keep a complicated, possibly unbounded data structure to track which signal mask to enforce.

Below is a modified version of your test program. In this one, each event emits a string via write() so there are no buffering problems. The program sets its “main” environment to mask SIGUSR1, SIGUSR2; but while pselect is running, it permits SIGUSR1, SIGUSR2, SIGTERM. The program forks, with the parent (default:) sitting in a loop invoking pselect(), then outputting ‘.’ after it completes. The child sits in a loop, delivering SIGUSR1, SIGUSR2 to the parent, then sleeping for a bit. It outputs ‘^’ after delivering the signals. The handler emits a prefix “(1” or “(2” for SIGUSR1, SIGUSR2 resp; then sleeps for a bit, and outputs “)” to indicate the sleep has completed.

The output I see on macos (10.12.6, but I doubt it matters much) is: ^(2)(1).^(2)(1).^(2)(1).^(2)(1).Terminated: 15 which indicates that the signal handler for each of SIGUSR1 and SIGUSR2 are being run for every invocation of pselect(). This is what I would expect; as it is designed to not admit a window of uncertainty as would be the case with bracketting select() with sigprocmasks().

#include <stdio.h>
#include <signal.h>
#include <sys/select.h>
#include <unistd.h>

void handle(int signo)
{
    char s[2];
    s[0] = '(';
    s[1] = signo == SIGUSR1? '1' : '2';
    write(1, s, 2);
    sleep(1);
    write(1, ")", 1);
}

int main(int argc, char **argv)
{
  sigset_t mask;
  sigemptyset(&mask);
  sigaddset(&mask, SIGUSR1);
  sigaddset(&mask, SIGUSR2);
  sigprocmask(SIG_SETMASK, &mask, NULL);

  sigfillset(&mask);
  sigdelset(&mask, SIGUSR1);
  sigdelset(&mask, SIGUSR2);
  sigdelset(&mask, SIGTERM);
  signal(SIGUSR1, handle);
  signal(SIGUSR2, handle);
  pid_t t = fork();
  switch (t) {
  default:
    while (1) {
            /* no USR1, USR2 */
            pselect(0, NULL, NULL, NULL, NULL, &mask);
            /* no USR1, USR2 */
            write(1, ".", 1);
    }
    break;
  case 0:
    t = getppid();
    for (int i = 0; i < 4; i++) {
        kill(t, SIGUSR1);
        kill(t, SIGUSR2);
        write(1, "^", 1);
        sleep(5);
    }
    kill(t, SIGTERM);
    break;
  case -1:
    perror("fork\n");
  }
  return 0;
}