Segmentation fault in zmq::encoder_base_t

[amarpad]

Issue description

SEGV similar to https://github.com/zeromq/libzmq/issues/2674. Couldn't fully figure out the resolution of that issue, happy to comment there if it is better.

Environment

• libzmq version (commit hash if unreleased): 4.2.1-4+deb9u

• OS: debian-stretch kernel - 4.9.0-9-amd64

Minimal test code / Steps to reproduce the issue

Have been running a zmq based service for a couple of weeks and saw this crash once.

What's the actual result? (include assertion message & call stack if applicable)

SIGSEGV (gdb) bt #0 __memmove_sse2_unaligned_erms () at ../sysdeps/x86_64/multiarch/../multiarch/memmove-vec-unaligned-erms.S:416 #1 0x00007f475d2c7bc1 in __interceptor_memcpy (to=0x625000304c6a, from=0x618000800024, size=856) at ../../../../src/libsanitizer/asan/asan_interceptors.cc:436 #2 0x00007f4757275d81 in memcpy (__len=, _src=, dest=) at /usr/include/x86_64-linux-gnu/bits/string3.h:53 #3 zmq::encoder_base_tzmq::v2_encoder_t::encode (this=0x608000044520, data=0x7f474d9e7bc0, size=) at src/encoder.hpp:127 #4 0x00007f4757265e1a in zmq::stream_engine_t::out_event (this=0x61a00002a080) at src/stream_engine.cpp:400 #5 0x00007f47572361e7 in zmq::io_thread_t::in_event (this=0x6110000241c0) at src/io_thread.cpp:85 #6 0x00007f4757234a6e in zmq::epoll_t::loop (this=0x611000024080) at src/epoll.cpp:188 #7 0x00007f4757270a5c in thread_routine (arg=0x611000024100) at src/thread.cpp:100 #8 0x00007f475ce494a4 in start_thread (arg=0x7f474d9e9700) at pthread_create.c:456 #9 0x00007f47591bdd0f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97

[amarpad]

This is part of https://github.com/magma/magma, looking for guidance on what we can do to debug this issue better. It is pretty sporadic.

[amarpad]

We ran into this again. Dec 30 13:21:01 magma mme[16093]: ==16093==AddressSanitizer CHECK failed: ../../../../src/libsanitizer/asan/asan_report.cc:346 "((0 && "Address is not in memory and not in shadow?")) != (0)" (0x0, 0x0) Dec 30 13:21:01 magma mme[16093]: #0 0x7f2fe7590ebd (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xcaebd) Dec 30 13:21:01 magma mme[16093]: #1 0x7f2fe7596b13 in __sanitizer::CheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xd0b13) Dec 30 13:21:01 magma mme[16093]: #2 0x7f2fe758c1b7c (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc61b7) Dec 30 13:21:01 magma mme[16093]: #3 0x7f2fe758d118 (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc7118) Dec 30 13:21:01 magma mme[16093]: #4 0x7f2fe7590376 (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xca376) Dec 30 13:21:01 magma mme[16093]: #5 0x7f2fe7522f9d (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x5cf9d) Dec 30 13:21:01 magma mme[16093]: #6 0x7f2fe14d0d80 (/usr/lib/x86_64-linux-gnu/libzmq.so.5+0x65d80) Dec 30 13:21:01 magma mme[16093]: #7 0x7f2fe14c0e19 (/usr/lib/x86_64-linux-gnu/libzmq.so.5+0x55e19) Dec 30 13:21:01 magma mme[16093]: #8 0x7f2fe14911e6 (/usr/lib/x86_64-linux-gnu/libzmq.so.5+0x261e6) Dec 30 13:21:01 magma mme[16093]: #9 0x7f2fe148fa6d (/usr/lib/x86_64-linux-gnu/libzmq.so.5+0x24a6d) Dec 30 13:21:01 magma mme[16093]: #10 0x7f2fe14cba5b (/usr/lib/x86_64-linux-gnu/libzmq.so.5+0x60a5b) Dec 30 13:21:01 magma mme[16093]: #11 0x7f2fe70a44a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3) Dec 30 13:21:01 magma mme[16093]: #12 0x7f2fe3418d0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e) Dec 30 13:21:02 magma systemd[1]: [email protected]: Main process exited, code=exited, status=1/FAILURE

(gdb) x/i 0x60a5b 0x60a5b <thread_routine(void*)+75>: adc (%rcx),%esi (gdb) x/i 0x24a6d 0x24a6d zmq::epoll_t::loop()+253: adc %cl,0x39(%rcx) (gdb) x/i 0x261e6 0x261e6 zmq::io_thread_t::in_event()+102: add %dh,(%rcx) (gdb) x/i 0x55e19 0x55e19 zmq::stream_engine_t::out_event()+265: adc %cl,-0x7b(%rax) (gdb) x/i 0x65d80 0x65d80 <zmq::encoder_base_tzmq::v2_encoder_t::encode(unsigned char**, unsigned long)+96>: decl -0x75(%rax)

[stale[bot]]

This issue has been automatically marked as stale because it has not had activity for 365 days. It will be closed if no further activity occurs within 56 days. Thank you for your contributions.