[Dovecot] Bug report v2.0.13 - CentOS x86_64 - NFS - mbox - Problem reproduced

[Kostas Zorbadelos]

The problem is more easily introduced than I imagined.

Included attached is an example mailbox containing just 3 mails.
Use it to make a couple of POP sessions. Make sure indexes are 
generated for it by setting appropriately  mbox_min_index_size
e.g. mbox_min_index_size = 2k

Now, in the first session just generate the indexes and quit

kzorba at enigma(1)[05:23 PM]~->telnet dovecot-dev 110
Trying <IP>...
Connected to dovecot-dev.
Escape character is '^]'.
+OK OTENET ready
user kzorba1
+OK
pass XXXXXXX
+OK Logged in.
LIST
+OK 3 messages:
1 812
2 821
3 816
.
quit
+OK Logging out.
Connection closed by foreign host.

In the second session we LIST and try to DELE a message

kzorba at enigma(1)[05:25 PM]~->telnet dovecot-dev 110
Trying <IP>...
Connected to dovecot-dev.
Escape character is '^]'.
+OK OTENET ready
user kzorba1
+OK
pass XXXXXXX
+OK Logged in.
LIST
+OK 3 messages:
1 812
2 821
3 816
.
dele 2
+OK Marked to be deleted.
quit
Connection closed by foreign host.

In the server logs we get
Aug 19 17:25:24 dovecot dovecot: master: Error: service(pop3): child 3489 killed with signal 11 (core dumped)

With the backtrace:

#0  0x00002b9ca3e93dce in istream_raw_mbox_get_start_offset (stream=0x0) at istream-raw-mbox.c:498
#1  0x00002b9ca3e97956 in mbox_mail_get_special (_mail=0x101cf7d0, field=MAIL_FETCH_GUID, value_r=0x7fff1fd69798) at mbox-mail.c:198
#2  0x00002b9ca3e47729 in mail_get_special (mail=0x101cf7d0, field=MAIL_FETCH_GUID, value_r=0x7fff1fd69798) at mail.c:188
#3  0x00002b9ca3e6d133 in index_mail_expunge (mail=0x101cf7d0) at index-mail.c:1503
#4  0x00002b9ca3e4784d in mail_expunge (mail=0x101cf7d0) at mail.c:233
#5  0x0000000000406272 in client_update_mails (client=0x101baa00) at pop3-commands.c:255
#6  0x000000000040635a in cmd_quit (client=0x101baa00, args=0x407f62 "") at pop3-commands.c:274
#7  0x000000000040774a in client_command_execute (client=0x101baa00, name=0x101960c0 "QUIT", args=0x407f62 "") at pop3-commands.c:773
#8  0x000000000040567c in client_handle_input (client=0x101baa00) at pop3-client.c:628
#9  0x0000000000405870 in client_input (client=0x101baa00) at pop3-client.c:681
#10 0x00002b9ca418af83 in io_loop_call_io (io=0x101b61d0) at ioloop.c:384
#11 0x00002b9ca418c685 in io_loop_handler_run (ioloop=0x1019e610) at ioloop-epoll.c:213
#12 0x00002b9ca418b024 in io_loop_run (ioloop=0x1019e610) at ioloop.c:405
#13 0x00002b9ca4171ca2 in master_service_run (service=0x1019e4e0, callback=0x403bab <client_connected>) at master-service.c:478
#14 0x0000000000403e14 in main (argc=1, argv=0x1019e370) at main.c:252

I guess something is wrong in the indexing code because if I disable the index creation
using an appropriate value for mbox_min_index_size everything works as expected and
mails are deleted.

In our case, all clients that leave messages on server cannot actually delete messages
from their inboxes. Clients with Thunderbird, keep getting the mails after they
delete them, customers with Outlook don't see them again, but the deleted messages
remain in the server. Needless to say that I will try to provide a patch but
it will take me far more time than any developer familiar with the code already.

Regards,

Kostas

-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: kzorba1.problem.mbox
URL: <http://dovecot.org/pipermail/dovecot/attachments/20110819/87a990b9/attachment.pl>