Panic on service(imap) during FETCH/APPEND some messages

Alessio Cecchi alessio at skye.it
Thu Jun 3 16:08:53 EEST 2021


Hi,

here another core dump for a different crash:

Jun 03 15:01:05 Panic: imap(user2 at email.com) session=<G4j1KtzD1vW5HrcI>: 
file imap-bodystructure.c: line 209 (part_write_body): assertion failed: 
(text == ((part->flags & MESSAGE_PART_FLAG_TEXT) != 0))
Jun 03 15:01:05 Error: imap(user2 at email.com) session=<G4j1KtzD1vW5HrcI>: 
Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(backtrace_append+0x42) 
[0x7ff2c4fa2ac2] -> 
/usr/lib64/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7ff2c4fa2bce] 
-> /usr/lib64/dovecot/libdovecot.so.0(+0xf3cde) [0x7ff2c4fafcde] -> 
/usr/lib64/dovecot/libdovecot.so.0(+0xf3d81) [0x7ff2c4fafd81] -> 
/usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7ff2c4f0125a] -> 
/usr/lib64/dovecot/libdovecot.so.0(imap_bodystructure_write+0x263) 
[0x7ff2c4f78a53] -> /usr/lib64/dovecot/libdovecot.so.0(+0xbcca3) 
[0x7ff2c4f78ca3] -> 
/usr/lib64/dovecot/libdovecot.so.0(imap_bodystructure_write+0x28a) 
[0x7ff2c4f78a7a] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0xc0aa7) 
[0x7ff2c5333aa7] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0xc1563) 
[0x7ff2c5334563] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0xc190e) 
[0x7ff2c533490e] -> 
/usr/lib64/dovecot/libdovecot-storage.so.0(index_mail_init_stream+0x332) 
[0x7ff2c5334d32] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x77428) 
[0x7ff2c52ea428] -> 
/usr/lib64/dovecot/libdovecot-storage.so.0(mail_get_stream_because+0x64) 
[0x7ff2c52b25a4] -> 
/usr/lib64/dovecot/libdovecot-storage.so.0(index_mail_prefetch+0x96) 
[0x7ff2c5335bc6] -> 
/usr/lib64/dovecot/libdovecot-storage.so.0(mail_prefetch+0x2e) 
[0x7ff2c52b1e4e] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0xc98cd) 
[0x7ff2c533c8cd] -> 
/usr/lib64/dovecot/libdovecot-storage.so.0(index_storage_search_next_nonblock+0x110) 
[0x7ff2c533ce30] -> 
/usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_search_next_nonblock+0x22) 
[0x7ff2c52c0aa2] -> 
/usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_search_next+0x3d) 
[0x7ff2c52c0b0d] -> dovecot/imap [user2 at email.com 95.87.183.8 UID 
fetch](+0x211dc) [0x55993e9b31dc] -> dovecot/imap [user2 at email.com 
95.87.183.8 UID fetch](imap_fetch_more+0x35) [0x55993e9b46e5] -> 
dovecot/imap [user2 at email.com 95.87.183.8 UID fetch](cmd_fetch+0x34d) 
[0x55993e9a47ed] -> dovecot/imap [user2 at email.com 95.87.183.8 UID 
fetch](command_exec+0x64) [0x55993e9b1614] -> dovecot/imap 
[user2 at email.com 95.87.183.8 UID fetch](+0x1d502) [0x55993e9af502] -> 
dovecot/imap [user2 at email.com 95.87.183.8 UID fetch](+0x1d591) 
[0x55993e9af591] -> dovecot/imap [user2 at email.com 95.87.183.8 UID 
fetch](+0x1d759) [0x55993e9af759] -> dovecot/imap [user2 at email.com 
95.87.183.8 UID fetch](client_handle_input+0x205) [0x55993e9afa15] -> 
dovecot/imap [user2 at email.com 95.87.183.8 UID fetch](client_input+0x79) 
[0x55993e9afff9] -> 
/usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x65) [0x7ff2c4fc7f45]
Jun 03 15:01:05 Fatal: imap(user2 at email.com) session=<G4j1KtzD1vW5HrcI>: 
master: service(imap): child 4356 killed with signal 6 (core dumped)


[root at popimap ~]# gdb /usr/libexec/dovecot/imap /var/core/core.imap.4356
GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-120.el7
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/libexec/dovecot/imap...Reading symbols from 
/usr/lib/debug/usr/libexec/dovecot/imap.debug...done.
done.
[New LWP 4356]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `dovecot/imap [user2 at email.c'.
Program terminated with signal 6, Aborted.
#0  0x00007ff2c4b24387 in raise () from /lib64/libc.so.6
Missing separate debuginfos, use: debuginfo-install 
bzip2-libs-1.0.6-13.el7.x86_64 expat-2.1.0-12.el7.x86_64 
glibc-2.17-324.el7_9.x86_64 libgcc-4.8.5-44.el7.x86_64 
libzstd-1.4.9-1.el7.x86_64 xz-libs-5.2.2-1.el7.x86_64 
zlib-1.2.7-19.el7_9.x86_64
(gdb) bt full
#0  0x00007ff2c4b24387 in raise () from /lib64/libc.so.6
No symbol table info available.
#1  0x00007ff2c4b25a78 in abort () from /lib64/libc.so.6
No symbol table info available.
#2  0x00007ff2c4fafc97 in default_fatal_finish (status=0, 
type=<optimized out>) at failures.c:459
         backtrace = 0x55993f0e3678 
"/usr/lib64/dovecot/libdovecot.so.0(backtrace_append+0x42) 
[0x7ff2c4fa2ac2] -> 
/usr/lib64/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7ff2c4fa2bce] 
-> /usr/lib64/dovecot/libdovecot.so.0(+0xf3cde) [0"...
         recursed = 0
#3  fatal_handler_real (ctx=<optimized out>, format=<optimized out>, 
args=<optimized out>) at failures.c:471
         status = 0
#4  0x00007ff2c4fafd81 in i_internal_fatal_handler (ctx=<optimized out>, 
format=<optimized out>, args=<optimized out>)
     at failures.c:866
No locals.
#5  0x00007ff2c4f0125a in i_panic (format=format at entry=0x7ff2c4ff1730 
"file %s: line %d (%s): assertion failed: (%s)")
     at failures.c:523
         ctx = {type = LOG_TYPE_PANIC, exit_status = 0, timestamp = 0x0, 
timestamp_usecs = 0, log_prefix = 0x0,
           log_prefix_type_pos = 0}
         args = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 
0x7ffccbc96b70, reg_save_area = 0x7ffccbc96ab0}}
#6  0x00007ff2c4f78a53 in part_write_body (extended=true, 
str=0x55993f1c4378, part=0x55993f1c3ea0) at imap-bodystructure.c:209
         data = 0x55993f1c4290
         text = false
#7  imap_bodystructure_write (part=0x55993f1c3ea0, dest=0x55993f1c4378, 
extended=<optimized out>) at imap-bodystructure.c:266
No locals.
#8  0x00007ff2c4f78ca3 in part_write_bodystructure_siblings 
(part=0x55993f1c3ea0, dest=dest at entry=0x55993f1c4378, extended=true)
     at imap-bodystructure.c:69
No locals.
#9  0x00007ff2c4f78a7a in part_write_body_multipart (part=<optimized 
out>, part=<optimized out>, extended=<optimized out>,
     str=0x55993f1c4378) at imap-bodystructure.c:122
         data = 0x55993f1c3f48
#10 imap_bodystructure_write (part=<optimized out>, dest=0x55993f1c4378, 
extended=<optimized out>) at imap-bodystructure.c:264
No locals.
#11 0x00007ff2c5333aa7 in index_mail_body_parsed_cache_bodystructure 
(mail=0x55993f1c31c8, field=MAIL_CACHE_FLAGS)
     at index-mail.c:859
         _mail = 0x55993f1c31c8
         data = 0x55993f1c3358
         cache_field_parts = <optimized out>
         cache_field_body = 6
         cache_field_bodystructure = <optimized out>
         dec = <optimized out>
         str = 0x55993f1c4378
         bodystructure_cached = false
         plain_bodystructure = <optimized out>
---Type <return> to continue, or q <return> to quit---
         cache_bodystructure = <optimized out>
         cache_body = <optimized out>
         __func__ = "index_mail_body_parsed_cache_bodystructure"
#12 0x00007ff2c5334563 in index_mail_parse_body_finish 
(mail=mail at entry=0x55993f1c31c8, field=field at entry=MAIL_CACHE_FLAGS,
     success=success at entry=true) at index-mail.c:1203
         parser_input = 0x0
         mail_set = 0x55993f111eb8
         error = 0x0
         ret = <optimized out>
         __func__ = "index_mail_parse_body_finish"
#13 0x00007ff2c533490e in index_mail_parse_body 
(mail=mail at entry=0x55993f1c31c8, field=field at entry=MAIL_CACHE_FLAGS)
     at index-mail.c:1278
         data = 0x55993f1c3358
         old_offset = 2148
         ret = 0
         __func__ = "index_mail_parse_body"
#14 0x00007ff2c5334d32 in index_mail_init_stream 
(mail=mail at entry=0x55993f1c31c8, hdr_size=hdr_size at entry=0x0,
     body_size=body_size at entry=0x0, 
stream_r=stream_r at entry=0x7ffccbc96e00) at index-mail.c:1376
         _mail = 0x55993f1c31c8
         data = 0x55993f1c3358
         input = <optimized out>
         has_nuls = false
         body_size_from_stream = false
         ret = <optimized out>
         want_attachment_kw = true
#15 0x00007ff2c52ea428 in maildir_mail_get_stream (_mail=0x55993f1c31c8, 
get_body=<optimized out>, hdr_size=0x0, body_size=0x0,
     stream_r=0x7ffccbc96e00) at maildir-mail.c:622
         mail = 0x55993f1c31c8
         mbox = <optimized out>
         data = 0x55993f1c3358
         deleted = <optimized out>
#16 0x00007ff2c52b25a4 in mail_get_stream_because 
(mail=mail at entry=0x55993f1c31c8, hdr_size=hdr_size at entry=0x0,
     body_size=body_size at entry=0x0, reason=reason at entry=0x7ff2c538c690 
"prefetch", stream_r=stream_r at entry=0x7ffccbc96e00)
     at mail.c:282
         _data_stack_cur_id = 5
         p = 0x55993f1c31c8
         ret = <optimized out>
         __func__ = "mail_get_stream_because"
#17 0x00007ff2c5335bc6 in index_mail_prefetch (_mail=0x55993f1c31c8) at 
index-mail.c:2103
         mail = 0x55993f1c31c8
         storage = <optimized out>
         input = 0x1
---Type <return> to continue, or q <return> to quit---
         len = <optimized out>
         fd = <optimized out>
#18 0x00007ff2c52b1e4e in mail_prefetch (mail=mail at entry=0x55993f1c31c8) 
at mail.c:75
         _data_stack_cur_id = 4
         p = 0x55993f1c31c8
         ret = <optimized out>
#19 0x00007ff2c533c8cd in search_more_with_prefetching 
(mail_r=<optimized out>, ctx=<optimized out>) at index-search.c:1726
         count = <optimized out>
         ret = 1
         mail = 0x55993f1c31c8
         mails = <optimized out>
#20 search_more (ctx=ctx at entry=0x55993f1446f0, 
mail_r=mail_r at entry=0x7ffccbc96ef0) at index-search.c:1788
         imail = <optimized out>
         ret = <optimized out>
#21 0x00007ff2c533ce30 in index_storage_search_next_nonblock 
(_ctx=0x55993f1446f0, mail_r=0x55993f11b5a0,
     tryagain_r=0x7ffccbc96f57) at index-search.c:1816
         mail = 0x7ffc0000007c
         seq = 21913
         ret = <optimized out>
#22 0x00007ff2c52c0aa2 in mailbox_search_next_nonblock (ctx=<optimized 
out>, mail_r=<optimized out>, tryagain_r=<optimized out>)
     at mail-storage.c:2290
         box = <optimized out>
#23 0x00007ff2c52c0b0d in mailbox_search_next (ctx=<optimized out>, 
mail_r=<optimized out>) at mail-storage.c:2275
         tryagain = false
#24 0x000055993e9b31dc in imap_fetch_more_int 
(ctx=ctx at entry=0x55993f11b538, cancel=false) at imap-fetch.c:536
         state = 0x55993f11b590
         client = 0x55993f1160e8
         handlers = 0x55993f142ed0
         count = <optimized out>
         ret = <optimized out>
         __func__ = "imap_fetch_more_int"
#25 0x000055993e9b46e5 in imap_fetch_more (ctx=0x55993f11b538, 
cmd=cmd at entry=0x55993f11b358) at imap-fetch.c:617
         ret = <optimized out>
         __func__ = "imap_fetch_more"
#26 0x000055993e9a47ed in cmd_fetch (cmd=0x55993f11b358) at cmd-fetch.c:337
         client = 0x55993f1160e8
         ctx = 0x55993f11b538
         args = 0x55993f135a68
         next_arg = <optimized out>
         list_arg = 0x7ffccbc9708f
         search_args = 0x0
         qresync_args = {qresync_sample_seqset = 0x55993f0e3308, 
qresync_sample_uidset = 0x7ff2c4ffdaff}
---Type <return> to continue, or q <return> to quit---
         messageset = 0x55993f135bd8 "7238"
         send_vanished = <optimized out>
         ret = <optimized out>
#27 0x000055993e9b1614 in command_exec (cmd=0x55993f11b358) at 
imap-commands.c:201
         hook = 0x55993f0ee630
         finished = <optimized out>
         __func__ = "command_exec"
#28 0x000055993e9af502 in client_command_input (cmd=0x55993f11b358) at 
imap-client.c:1204
         client = 0x55993f1160e8
         command = <optimized out>
         tag = 0x7ff2c4fe8115 <p_strdup+69> "[]A\\\303f\017\037D"
         name = 0x55993f135e40 "\250_\023?\231U"
         ret = <optimized out>
         __func__ = "client_command_input"
#29 0x000055993e9af591 in client_command_input 
(cmd=cmd at entry=0x55993f11b358) at imap-client.c:1271
         client = 0x55993f1160e8
         command = <optimized out>
         tag = 0x7ff2c4f7be42 <imap_parser_read_next_atom+162> 
"H\205\333I\211E"
         name = 0x55993f135bd0 "fetch"
         ret = <optimized out>
         __func__ = "client_command_input"
#30 0x000055993e9af759 in client_command_input (cmd=0x55993f11b358) at 
imap-client.c:1238
         client = 0x55993f1160e8
         command = <optimized out>
         tag = 0x55993f135bc0 "6"
         name = 0x55993f135bc8 "UID"
         ret = <optimized out>
         __func__ = "client_command_input"
#31 0x000055993e9afa15 in client_handle_next_command 
(remove_io_r=<synthetic pointer>, client=0x55993f1160e8) at 
imap-client.c:1313
No locals.
#32 client_handle_input (client=client at entry=0x55993f1160e8) at 
imap-client.c:1327
         _data_stack_cur_id = 3
         remove_io = false
         handled_commands = false
         __func__ = "client_handle_input"
#33 0x000055993e9afff9 in client_input (client=0x55993f1160e8) at 
imap-client.c:1371
         cmd = 0x55993f10e700
         output = 0x55993f11b1b0
         bytes = 48
         __func__ = "client_input"
#34 0x00007ff2c4fc7f45 in io_loop_call_io (io=0x55993f135980) at 
ioloop.c:714
         ioloop = 0x55993f0ec030
---Type <return> to continue, or q <return> to quit---
         t_id = 2
         __func__ = "io_loop_call_io"
#35 0x00007ff2c4fc98fb in io_loop_handler_run_internal 
(ioloop=ioloop at entry=0x55993f0ec030) at ioloop-epoll.c:222
         ctx = 0x55993f0eccb0
         events = <optimized out>
         list = 0x55993f0f7290
         io = <optimized out>
         tv = {tv_sec = 1799, tv_usec = 999034}
         events_count = <optimized out>
         msecs = <optimized out>
         ret = 1
         i = 0
         call = <optimized out>
         __func__ = "io_loop_handler_run_internal"
#36 0x00007ff2c4fc8049 in io_loop_handler_run 
(ioloop=ioloop at entry=0x55993f0ec030) at ioloop.c:766
         __func__ = "io_loop_handler_run"
#37 0x00007ff2c4fc8288 in io_loop_run (ioloop=0x55993f0ec030) at 
ioloop.c:739
         __func__ = "io_loop_run"
#38 0x00007ff2c4f32bb3 in master_service_run (service=0x55993f0ebe90, 
callback=callback at entry=0x55993e9be220 <client_connected>)
     at master-service.c:853
No locals.
#39 0x000055993e9a1202 in main (argc=2, argv=0x55993f0ebb90) at main.c:546
         set_roots = {0x7ff2c52670c0 <smtp_submit_setting_parser_info>, 
0x55993ebd05e0 <imap_setting_parser_info>, 0x0}
         login_set = {auth_socket_path = 0x55993f0e34d8 "", 
postlogin_socket_path = 0x55993f0e3508 "", postlogin_timeout_secs = 60,
           callback = 0x55993e9bec20 <login_client_connected>, 
failure_callback = 0x55993e9be330 <login_client_failed>,
           request_auth_token = true}
         service_flags = <optimized out>
         storage_service_flags = <optimized out>
         username = 0x0
         auth_socket_path = <optimized out>
         c = <optimized out>
         error = 0x38000000380 <Address 0x38000000380 out of bounds>
(gdb)

Let me knok if you need more details.
Thanks

Il 01/06/21 07:24, Aki Tuomi ha scritto:
> Hi!
>
> Any chance you could collect coredumps for these and posting output of
>
> gdb /usr/lib/dovecot/imap /path/to/core
> bt full
>
> systemd-coredump can be used for this, and https://www.dovecot.org/bugreport-mail contains hints how to get core dumps otherwise.

-- 
Alessio Cecchi
Postmaster @ http://www.qboxmail.it
https://www.linkedin.com/in/alessice

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://dovecot.org/pipermail/dovecot/attachments/20210603/37b65b74/attachment-0001.html>


More information about the dovecot mailing list