[zeromq-dev] router crash in pipe.cpp

[Suryanathan P]

Hello,

A router disconnect asserts in zmq::pipe_t::terminate. The assertion
appears to happen when pipe_t::state is invalid. I saw all assignments of
pipe_t::state and they are all valid. I ran valgrind with memcheck and it
appears the pipe_t pointer held in zmq::socket_base_t is invalid.

The pipe appears to be freed by pipe_t::process_pipe_term_ack

#0  zmq::pipe_t::process_pipe_term_ack (this=0x7fe14401ec10) at
src/pipe.cpp:353
#1  0x00007fe1692ac0ac in zmq::socket_base_t::process_commands
(this=0x7fe1440042d0, timeout_=timeout_ at entry=0,
throttle_=throttle_ at entry=false)
at src/socket_base.cpp:1020
#2  0x00007fe1692ac2d3 in zmq::socket_base_t::getsockopt
(this=0x7fe1440042d0, option_=<optimized out>, optval_=0x7fe12295ca44,
optvallen_=0x7fe12295ca48) at src/socket_base.cpp:328
#3  0x00007fe1692c5098 in zmq_poll (items_=0x7fe1440184e0, nitems_=8,
timeout_=-1) at src/zmq.cpp:776
#4  0x000000000077ac23 in zmq::poll (items_=0x7fe1440184e0, nitems_=8,
timeout_=-1) at /usr/include/zmq.hpp:132

After the return from zmq::poll, the zmq::socket_base_t::endpoints still
has an entry for the pipe:

(gdb) p ((zmq::socket_base_t*)s->routerIn->ptr)->endpoints
$8 = std::multimap with 2 elements = {["tcp://172.17.21.101:5558"] = {first
= 0x7fe144014270, second = 0x7fe144036180}, ["tcp://192.168.20.67:5558"] =
{first = 0x7fe14401e7d0, second = 0x7fe14401ec10}}

The second endpoint in the multimap has 0x7fe14401ec10 as the pipe which
was freed previously.

I may have to spend more time on understanding what is happening here.
Please let me know if you see something obvious or if it is a known bug.

zmq version is: 4.1.4
router socket options set: ZMQ_ROUTER_MANDATORY=1, ZMQ_IDENTITY=<uuid>,
ZMQ_ROUTER_HANDOVER=1

If it matters, both the endpoints point to the same remote peer and
ZMQ_ROUTER_HANDOVER may be closing the socket? Connect order is
192.168.20.67:5558 followed by 172.17.21.101:5558.

Thank you.

Regards,
Suryanathan P
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.zeromq.org/pipermail/zeromq-dev/attachments/20160324/57a352e7/attachment.htm>