From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4) Gecko/20030701

Description of problem:
This problem was first noticed in a real-world test while benchmarking
mail delivery through exim.  The following requirements must be met for
the problem occur:

- Non-NPTL-enabled kernel.  For example, vanilla 2.4.21 (not Red Hat
  patched kernels).

- glibc 2.3.2.  2.3.1 does not exhibit the problem.

- Program must be compiled with -lpthread.

Attached is the example program which can be compiled with:

        gcc -o signal-crash-example signal-crash-example.c -lpthread

When the problem occurs, the process exits with a Segmentation Fault. 
The test program should produce this in under a second.

strace seems to help the problem occur, and shows this trace:

rt_sigaction(SIGCHLD, {0x804bb68, [CHLD], SA_RESTORER|SA_RESTART, 0x804d8c8},
{SIG_DFL}, 8) = 0
--- SIGCHLD (Child exited) @ 0 (0) ---
--- SIGSEGV (Segmentation fault) @ 0 (0) ---
+++ killed by SIGSEGV +++

Compiled with -g3, GDB shows this backtrace:

Starting program: /root/signal-crash-example 
[New Thread 16384 (LWP 25497)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 16384 (LWP 25497)]
0x00000000 in ?? ()
(gdb) bt
#0  0x00000000 in ?? ()
#1  0x400294be in __pthread_sighandler () from /lib/i686/libpthread.so.0
#2  <signal handler called>
#3  0x4009652f in __libc_sigaction () from /lib/i686/libc.so.6
#4  0x40026a8a in sigaction () from /lib/i686/libpthread.so.0
#5  0x40096631 in sigaction () from /lib/i686/libc.so.6
#6  0x400963e3 in ssignal () from /lib/i686/libc.so.6
#7  0x08048567 in main (argc=1, argv=0xbfffee24) at signal-crash-example.c:34
#8  0x40083a07 in __libc_start_main () from /lib/i686/libc.so.6

Is it trying to jump to 0x00000000?  That definitely won't work...

Here is the sample signal-crash-example.c code which reproduces the problem:

#include <sys/types.h>
#include <sys/wait.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <signal.h>

void signalhandler(int sig)
{
}

int main(int argc, char *argv[])
{
        pid_t pid;
        int i;

        while (1) {
                for (i = 0; i < 100; i++){
                        if ((pid = fork()) == -1) {
                                perror("Fork error");
                                exit(1);
                        }
                        if (pid == 0) {
                                usleep(100000);
                                signal(SIGCHLD, SIG_DFL);
                                exit(0);
                        }
                }
                usleep(100000);
                for (i = 0; i < 10000; i++){
                        signal(SIGCHLD, SIG_DFL);
                        signal(SIGCHLD, signalhandler);
                        signal(SIGCHLD, SIG_DFL);
                        signal(SIGCHLD, signalhandler);
                }
                while (wait(NULL) != -1)
                        ;
        }
}


Version-Release number of selected component (if applicable):
glibc-2.3.2-27.9

How reproducible:
Always

Steps to Reproduce:
1. compile the sample code above with pthread flag
2. execute binary
3.
    

Actual Results:  Segmentation fault (core dumped)

Additional info:

This was also tested on RedHat 8