Signal handling lacks ownership and isolation across consumers, causing races and contention

[zacheryasc]

Brief Description

iceoryx2 provides several means of signal consumption but no model of ownership.

The signal subsystem is built around a single global singleton. SignalHandler
holds the disposition for every signal behind one mutex and exposes one
process-global latch (LAST_SIGNAL). The delivery handler acquires that mutex
to dispatch user callbacks, and at construction the singleton claims all
non-fatal signals.

The means of consumption are:

• Capture per call — call_and_fetch runs a callable and returns the
  signal it raised.
• Latch — termination_requested / last_signal report the most recent
  signal.
• File-descriptor reception — SignalFd / epoll deliver signals as
  pollable events.
• Callback — register runs a user callback when a signal arrives.

POSIX permits only one disposition per signal, process-wide. Routing all of the
above through one shared disposition and one shared latch gives no consumer an
isolated view of the signal it asked for; each assumes sole ownership and they
break one another. This produces four classes of defect:

• Contention — consumers collide over the shared disposition. The handler's
  mutex re-enters itself when a captured signal also has a registered callback,
  deadlocking (call_and_fetch_with_registered_handler_works, signal_test::signal_call_and_fetch_with_registered_handler_works() deadlocks in single-threaded execution #1458).
• Races — a consumer observes a signal it did not cause. call_and_fetch
  reads the process-global latch, so under concurrent signal activity it can
  return another thread's signal, or miss its own.
• Starvation — a consumer never receives its signal because another
  consumes it first. SignalFd / epoll never receive: the global handler
  swallows the signal before it reaches the fd, and nothing blocks the signal
  for the signalfd.
• Async-signal-unsafety — the handler does work that is not
  async-signal-safe: it acquires a mutex and runs arbitrary user callbacks.

Direction

Each consumer needs an isolated relationship with the signals it consumes.
Three properties are required: a signal's disposition has an explicit owner;
capture is scoped to the operation that requested it; and no lock is held on
the signal delivery path.

Acceptance

• call_and_fetch_with_registered_handler_works no longer deadlocks (signal_test::signal_call_and_fetch_with_registered_handler_works() deadlocks in single-threaded execution #1458)
• call_and_fetch returns the signal from its own call, not another
  thread's
• SignalFd / epoll receive signals sent to the process (un-ignore the two
  #[ignore] // TODO: #1458 tests)

Related

• signal_test::signal_call_and_fetch_with_registered_handler_works() deadlocks in single-threaded execution #1458 — the deadlock; an instance of the contention mode and the anchor for
  this class.
• Propagate 'EINTR' errnos as distinct errors to the user instead of hiding them in a generic 'InternalError' #1556 — propagating InterruptedBySignal as a distinct error; complementary,
  operating on the layer above signal delivery.