Weird signal handling bug 221635

[Colin Watson]

I've now heard of two occurrences of
https://bugs.launchpad.net/ubuntu/+source/man-db/+bug/221635, and it's
thoroughly weird. The code in question is:

static void pipeline_sigchld (int signum)
{
        assert (signum == SIGCHLD);

        ++sigchld;

        if (!queue_sigchld) {
                int save_errno = errno;
                reap_children (0);
                errno = save_errno;
        }
}

void pipeline_install_sigchld (void)
{
        struct sigaction act;

        memset (&act, 0, sizeof act);
        act.sa_handler = &pipeline_sigchld;
        sigemptyset (&act.sa_mask);
        sigaddset (&act.sa_mask, SIGINT);
        sigaddset (&act.sa_mask, SIGTERM);
        sigaddset (&act.sa_mask, SIGHUP);
        sigaddset (&act.sa_mask, SIGCHLD);
        act.sa_flags = 0;
#ifdef SA_NOCLDSTOP
        act.sa_flags |= SA_NOCLDSTOP;
#endif
#ifdef SA_RESTART
        act.sa_flags |= SA_RESTART;
#endif
        if (sigaction (SIGCHLD, &act, NULL) == -1)
                error (FATAL, errno, _("can't install SIGCHLD handler"));
}

While I've weakened the assertion upstream for other reasons (i.e. the
assert function isn't async-signal-safe, though that wouldn't cause this
bug), and may well propose this for 8.04.1, it worries me that a signal
handler is being called with a signal number that wasn't requested by
sigaction; the consequences might be more serious elsewhere. Can anyone
see anything wrong with my code, or think of a kernel bug that might
cause this?

-- 
Colin Watson                                       [cjwatson at ubuntu.com]