Double free happening in ZMQ 4.3.4 version, causing reaper and IO thread crashes when system goes down

[shivteja14]

Double free happening in ZMQ 4.3.4 version, causing reaper and IO thread crashes when system goes down

Thread 1:

#10 <> in zmq::yqueue_t<zmq::msg_t, 256>::yqueue_t (<>, __in_chrg=) at src/yqueue.hpp:81
#11 zmq::ypipe_t<zmq::msg_t, 256>::ypipe_t (<>, in_chrg=) at src/ypipe.hpp:46
#12 zmq::ypipe_t<zmq::msg_t, 256>::~ypipe_t (<>, in_chrg=) at src/ypipe.hpp:46
#13 <> in zmq::pipe_t::process_pipe_term_ack (<>) at src/pipe.cpp:398
#14 <> in zmq::socket_base_t::process_commands (<>, timeout=timeout@entry=0, throttle=throttle@entry=false) at src/socket_base.cpp:1505
#15 <> in zmq::socket_base_t::in_event() () at src/socket_base.cpp:1687
#16 <> in zmq::epoll_t::loop () at src/epoll.cpp:206
#17 <> in thread_routine () at src/thread.cpp:402

Thread 2:

#5 <> in zmq::session_base_t::pipe_terminated (, pipe=) at src/session_base.cpp:298
#6 <> in zmq::pipe_t::process_pipe_term_ack () at src/pipe.cpp:372
#7 <> in zmq::io_thread_t::in_event () at src/io_thread.cpp:91
#8 <> in zmq::epoll_t::loop () at src/epoll.cpp:206
#9 <> in thread_routine () at src/thread.cpp:402

Thread 2 frees up the memory, and thread 1 doesn't clean up and double free. Kindly help out.

[prostoAlexandr]

@shivteja14 Any luck in fixing the problem? Looks like I have the same behavior on version 4.3.5.

Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x00007ff2cedd4484 in ?? () from /lib64/libc.so.6
[Current thread is 1 (Thread 0x7ff2cde9a6c0 (LWP 8033))]
(gdb) bt
#0 <> in ?? () from /lib64/libc.so.6
#1 <> in ?? () from /lib64/libc.so.6
#2 <> in ?? () from /lib64/libc.so.6
#3 <> in free () from /lib64/libc.so.6
#4 <> in zmq::ypipe_t<zmq::msg_t, 256>::~ypipe_t() () from /usr/lib64/libzmq.so.5
#5 <> in zmq::pipe_t::process_pipe_term_ack() () from /usr/lib64/libzmq.so.5
#6 <> in zmq::io_thread_t::in_event() () from /usr/lib64/libzmq.so.5
#7 <> in zmq::epoll_t::loop() () from /usr/lib64/libzmq.so.5