Re: Panic on service(imap) during FETCH/APPEND some messages

Hi,

here another core dump for a different crash:

Jun 03 15:01:05 Panic: imap(user2@email.com) session=<G4j1KtzD1vW5HrcI>: file imap-bodystructure.c: line 209 (part_write_body): assertion failed: (text == ((part->flags & MESSAGE_PART_FLAG_TEXT) != 0)) Jun 03 15:01:05 Error: imap(user2@email.com) session=<G4j1KtzD1vW5HrcI>: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7ff2c4fa2ac2] -> /usr/lib64/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7ff2c4fa2bce] -> /usr/lib64/dovecot/libdovecot.so.0(+0xf3cde) [0x7ff2c4fafcde] -> /usr/lib64/dovecot/libdovecot.so.0(+0xf3d81) [0x7ff2c4fafd81] -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7ff2c4f0125a] -> /usr/lib64/dovecot/libdovecot.so.0(imap_bodystructure_write+0x263) [0x7ff2c4f78a53] -> /usr/lib64/dovecot/libdovecot.so.0(+0xbcca3) [0x7ff2c4f78ca3] -> /usr/lib64/dovecot/libdovecot.so.0(imap_bodystructure_write+0x28a) [0x7ff2c4f78a7a] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0xc0aa7) [0x7ff2c5333aa7] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0xc1563) [0x7ff2c5334563] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0xc190e) [0x7ff2c533490e] -> /usr/lib64/dovecot/libdovecot-storage.so.0(index_mail_init_stream+0x332) [0x7ff2c5334d32] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x77428) [0x7ff2c52ea428] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_get_stream_because+0x64) [0x7ff2c52b25a4] -> /usr/lib64/dovecot/libdovecot-storage.so.0(index_mail_prefetch+0x96) [0x7ff2c5335bc6] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mail_prefetch+0x2e) [0x7ff2c52b1e4e] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0xc98cd) [0x7ff2c533c8cd] -> /usr/lib64/dovecot/libdovecot-storage.so.0(index_storage_search_next_nonblock+0x110) [0x7ff2c533ce30] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_search_next_nonblock+0x22) [0x7ff2c52c0aa2] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_search_next+0x3d) [0x7ff2c52c0b0d] -> dovecot/imap user2@email.com 95.87.183.8 UID fetch [0x55993e9b31dc] -> dovecot/imap user2@email.com 95.87.183.8 UID fetch [0x55993e9b46e5] -> dovecot/imap user2@email.com 95.87.183.8 UID fetch [0x55993e9a47ed] -> dovecot/imap user2@email.com 95.87.183.8 UID fetch [0x55993e9b1614] -> dovecot/imap user2@email.com 95.87.183.8 UID fetch [0x55993e9af502] -> dovecot/imap user2@email.com 95.87.183.8 UID fetch [0x55993e9af591] -> dovecot/imap user2@email.com 95.87.183.8 UID fetch [0x55993e9af759] -> dovecot/imap user2@email.com 95.87.183.8 UID fetch [0x55993e9afa15] -> dovecot/imap user2@email.com 95.87.183.8 UID fetch [0x55993e9afff9] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x65) [0x7ff2c4fc7f45] Jun 03 15:01:05 Fatal: imap(user2@email.com) session=<G4j1KtzD1vW5HrcI>: master: service(imap): child 4356 killed with signal 6 (core dumped)

[root@popimap ~]# gdb /usr/libexec/dovecot/imap /var/core/core.imap.4356 GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-120.el7 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law.  Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: http://www.gnu.org/software/gdb/bugs/... Reading symbols from /usr/libexec/dovecot/imap...Reading symbols from /usr/lib/debug/usr/libexec/dovecot/imap.debug...done. done. [New LWP 4356] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". Core was generated by `dovecot/imap [user2@email.c'. Program terminated with signal 6, Aborted. #0  0x00007ff2c4b24387 in raise () from /lib64/libc.so.6 Missing separate debuginfos, use: debuginfo-install bzip2-libs-1.0.6-13.el7.x86_64 expat-2.1.0-12.el7.x86_64 glibc-2.17-324.el7_9.x86_64 libgcc-4.8.5-44.el7.x86_64 libzstd-1.4.9-1.el7.x86_64 xz-libs-5.2.2-1.el7.x86_64 zlib-1.2.7-19.el7_9.x86_64 (gdb) bt full #0  0x00007ff2c4b24387 in raise () from /lib64/libc.so.6 No symbol table info available. #1  0x00007ff2c4b25a78 in abort () from /lib64/libc.so.6 No symbol table info available. #2  0x00007ff2c4fafc97 in default_fatal_finish (status=0, type=<optimized out>) at failures.c:459 backtrace = 0x55993f0e3678 "/usr/lib64/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7ff2c4fa2ac2] -> /usr/lib64/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7ff2c4fa2bce] -> /usr/lib64/dovecot/libdovecot.so.0(+0xf3cde) [0"... recursed = 0 #3  fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at failures.c:471 status = 0 #4  0x00007ff2c4fafd81 in i_internal_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at failures.c:866 No locals. #5  0x00007ff2c4f0125a in i_panic (format=format@entry=0x7ff2c4ff1730 "file %s: line %d (%s): assertion failed: (%s)") at failures.c:523 ctx = {type = LOG_TYPE_PANIC, exit_status = 0, timestamp = 0x0, timestamp_usecs = 0, log_prefix = 0x0, log_prefix_type_pos = 0} args = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 0x7ffccbc96b70, reg_save_area = 0x7ffccbc96ab0}} #6  0x00007ff2c4f78a53 in part_write_body (extended=true, str=0x55993f1c4378, part=0x55993f1c3ea0) at imap-bodystructure.c:209 data = 0x55993f1c4290 text = false #7  imap_bodystructure_write (part=0x55993f1c3ea0, dest=0x55993f1c4378, extended=<optimized out>) at imap-bodystructure.c:266 No locals. #8  0x00007ff2c4f78ca3 in part_write_bodystructure_siblings (part=0x55993f1c3ea0, dest=dest@entry=0x55993f1c4378, extended=true) at imap-bodystructure.c:69 No locals. #9  0x00007ff2c4f78a7a in part_write_body_multipart (part=<optimized out>, part=<optimized out>, extended=<optimized out>, str=0x55993f1c4378) at imap-bodystructure.c:122 data = 0x55993f1c3f48 #10 imap_bodystructure_write (part=<optimized out>, dest=0x55993f1c4378, extended=<optimized out>) at imap-bodystructure.c:264 No locals. #11 0x00007ff2c5333aa7 in index_mail_body_parsed_cache_bodystructure (mail=0x55993f1c31c8, field=MAIL_CACHE_FLAGS) at index-mail.c:859 _mail = 0x55993f1c31c8 data = 0x55993f1c3358 cache_field_parts = <optimized out> cache_field_body = 6 cache_field_bodystructure = <optimized out> dec = <optimized out> str = 0x55993f1c4378 bodystructure_cached = false plain_bodystructure = <optimized out> ---Type <return> to continue, or q <return> to quit--- cache_bodystructure = <optimized out> cache_body = <optimized out> __func__ = "index_mail_body_parsed_cache_bodystructure" #12 0x00007ff2c5334563 in index_mail_parse_body_finish (mail=mail@entry=0x55993f1c31c8, field=field@entry=MAIL_CACHE_FLAGS, success=success@entry=true) at index-mail.c:1203 parser_input = 0x0 mail_set = 0x55993f111eb8 error = 0x0 ret = <optimized out> __func__ = "index_mail_parse_body_finish" #13 0x00007ff2c533490e in index_mail_parse_body (mail=mail@entry=0x55993f1c31c8, field=field@entry=MAIL_CACHE_FLAGS) at index-mail.c:1278 data = 0x55993f1c3358 old_offset = 2148 ret = 0 __func__ = "index_mail_parse_body" #14 0x00007ff2c5334d32 in index_mail_init_stream (mail=mail@entry=0x55993f1c31c8, hdr_size=hdr_size@entry=0x0, body_size=body_size@entry=0x0, stream_r=stream_r@entry=0x7ffccbc96e00) at index-mail.c:1376 _mail = 0x55993f1c31c8 data = 0x55993f1c3358 input = <optimized out> has_nuls = false body_size_from_stream = false ret = <optimized out> want_attachment_kw = true #15 0x00007ff2c52ea428 in maildir_mail_get_stream (_mail=0x55993f1c31c8, get_body=<optimized out>, hdr_size=0x0, body_size=0x0, stream_r=0x7ffccbc96e00) at maildir-mail.c:622 mail = 0x55993f1c31c8 mbox = <optimized out> data = 0x55993f1c3358 deleted = <optimized out> #16 0x00007ff2c52b25a4 in mail_get_stream_because (mail=mail@entry=0x55993f1c31c8, hdr_size=hdr_size@entry=0x0, body_size=body_size@entry=0x0, reason=reason@entry=0x7ff2c538c690 "prefetch", stream_r=stream_r@entry=0x7ffccbc96e00) at mail.c:282 _data_stack_cur_id = 5 p = 0x55993f1c31c8 ret = <optimized out> __func__ = "mail_get_stream_because" #17 0x00007ff2c5335bc6 in index_mail_prefetch (_mail=0x55993f1c31c8) at index-mail.c:2103 mail = 0x55993f1c31c8 storage = <optimized out> input = 0x1 ---Type <return> to continue, or q <return> to quit--- len = <optimized out> fd = <optimized out> #18 0x00007ff2c52b1e4e in mail_prefetch (mail=mail@entry=0x55993f1c31c8) at mail.c:75 _data_stack_cur_id = 4 p = 0x55993f1c31c8 ret = <optimized out> #19 0x00007ff2c533c8cd in search_more_with_prefetching (mail_r=<optimized out>, ctx=<optimized out>) at index-search.c:1726 count = <optimized out> ret = 1 mail = 0x55993f1c31c8 mails = <optimized out> #20 search_more (ctx=ctx@entry=0x55993f1446f0, mail_r=mail_r@entry=0x7ffccbc96ef0) at index-search.c:1788 imail = <optimized out> ret = <optimized out> #21 0x00007ff2c533ce30 in index_storage_search_next_nonblock (_ctx=0x55993f1446f0, mail_r=0x55993f11b5a0, tryagain_r=0x7ffccbc96f57) at index-search.c:1816 mail = 0x7ffc0000007c seq = 21913 ret = <optimized out> #22 0x00007ff2c52c0aa2 in mailbox_search_next_nonblock (ctx=<optimized out>, mail_r=<optimized out>, tryagain_r=<optimized out>) at mail-storage.c:2290 box = <optimized out> #23 0x00007ff2c52c0b0d in mailbox_search_next (ctx=<optimized out>, mail_r=<optimized out>) at mail-storage.c:2275 tryagain = false #24 0x000055993e9b31dc in imap_fetch_more_int (ctx=ctx@entry=0x55993f11b538, cancel=false) at imap-fetch.c:536 state = 0x55993f11b590 client = 0x55993f1160e8 handlers = 0x55993f142ed0 count = <optimized out> ret = <optimized out> __func__ = "imap_fetch_more_int" #25 0x000055993e9b46e5 in imap_fetch_more (ctx=0x55993f11b538, cmd=cmd@entry=0x55993f11b358) at imap-fetch.c:617 ret = <optimized out> __func__ = "imap_fetch_more" #26 0x000055993e9a47ed in cmd_fetch (cmd=0x55993f11b358) at cmd-fetch.c:337 client = 0x55993f1160e8 ctx = 0x55993f11b538 args = 0x55993f135a68 next_arg = <optimized out> list_arg = 0x7ffccbc9708f search_args = 0x0 qresync_args = {qresync_sample_seqset = 0x55993f0e3308, qresync_sample_uidset = 0x7ff2c4ffdaff} ---Type <return> to continue, or q <return> to quit--- messageset = 0x55993f135bd8 "7238" send_vanished = <optimized out> ret = <optimized out> #27 0x000055993e9b1614 in command_exec (cmd=0x55993f11b358) at imap-commands.c:201 hook = 0x55993f0ee630 finished = <optimized out> __func__ = "command_exec" #28 0x000055993e9af502 in client_command_input (cmd=0x55993f11b358) at imap-client.c:1204 client = 0x55993f1160e8 command = <optimized out> tag = 0x7ff2c4fe8115 "[]A\\\303f\017\037D" name = 0x55993f135e40 "\250_\023?\231U" ret = <optimized out> __func__ = "client_command_input" #29 0x000055993e9af591 in client_command_input (cmd=cmd@entry=0x55993f11b358) at imap-client.c:1271 client = 0x55993f1160e8 command = <optimized out> tag = 0x7ff2c4f7be42 "H\205\333I\211E" name = 0x55993f135bd0 "fetch" ret = <optimized out> __func__ = "client_command_input" #30 0x000055993e9af759 in client_command_input (cmd=0x55993f11b358) at imap-client.c:1238 client = 0x55993f1160e8 command = <optimized out> tag = 0x55993f135bc0 "6" name = 0x55993f135bc8 "UID" ret = <optimized out> __func__ = "client_command_input" #31 0x000055993e9afa15 in client_handle_next_command (remove_io_r=<synthetic pointer>, client=0x55993f1160e8) at imap-client.c:1313 No locals. #32 client_handle_input (client=client@entry=0x55993f1160e8) at imap-client.c:1327 _data_stack_cur_id = 3 remove_io = false handled_commands = false __func__ = "client_handle_input" #33 0x000055993e9afff9 in client_input (client=0x55993f1160e8) at imap-client.c:1371 cmd = 0x55993f10e700 output = 0x55993f11b1b0 bytes = 48 __func__ = "client_input" #34 0x00007ff2c4fc7f45 in io_loop_call_io (io=0x55993f135980) at ioloop.c:714 ioloop = 0x55993f0ec030 ---Type <return> to continue, or q <return> to quit--- t_id = 2 __func__ = "io_loop_call_io" #35 0x00007ff2c4fc98fb in io_loop_handler_run_internal (ioloop=ioloop@entry=0x55993f0ec030) at ioloop-epoll.c:222 ctx = 0x55993f0eccb0 events = <optimized out> list = 0x55993f0f7290 io = <optimized out> tv = {tv_sec = 1799, tv_usec = 999034} events_count = <optimized out> msecs = <optimized out> ret = 1 i = 0 call = <optimized out> __func__ = "io_loop_handler_run_internal" #36 0x00007ff2c4fc8049 in io_loop_handler_run (ioloop=ioloop@entry=0x55993f0ec030) at ioloop.c:766 __func__ = "io_loop_handler_run" #37 0x00007ff2c4fc8288 in io_loop_run (ioloop=0x55993f0ec030) at ioloop.c:739 __func__ = "io_loop_run" #38 0x00007ff2c4f32bb3 in master_service_run (service=0x55993f0ebe90, callback=callback@entry=0x55993e9be220 ) at master-service.c:853 No locals. #39 0x000055993e9a1202 in main (argc=2, argv=0x55993f0ebb90) at main.c:546 set_roots = {0x7ff2c52670c0 , 0x55993ebd05e0 , 0x0} login_set = {auth_socket_path = 0x55993f0e34d8 "", postlogin_socket_path = 0x55993f0e3508 "", postlogin_timeout_secs = 60, callback = 0x55993e9bec20 , failure_callback = 0x55993e9be330 , request_auth_token = true} service_flags = <optimized out> storage_service_flags = <optimized out> username = 0x0 auth_socket_path = <optimized out> c = <optimized out> error = 0x38000000380