Hi Devs,
yesterday I had to SEGV from imap processes (2.4.5) which dumped core. The backtraces were similar:
#0 0x00007fdb234556b4 in fts_search_merge_scores_or (dest=0x7ffde96b1720, src=0x7ffde96b1680) at ./src/plugins/fts/fts-search.c:274 274 src_map[srci].uid < src2_map[src2i].uid) { (gdb) bt #0 0x00007fdb234556b4 in fts_search_merge_scores_or (dest=0x7ffde96b1720, src=0x7ffde96b1680) at ./src/plugins/fts/fts-search.c:274 #1 fts_search_merge_scores_level (fctx=fctx@entry=0x55ce3f2347d0, args=0x55ce3f2fad10, idx=idx@entry=0x7ffde96b182c, and_args=false, scores=scores@entry=0x7ffde96b1720) at ./src/plugins/fts/fts-search.c:329 #2 0x00007fdb234555fa in fts_search_merge_scores_level (fctx=fctx@entry=0x55ce3f2347d0, args=0x55ce3f2fa878, idx=idx@entry=0x7ffde96b182c, and_args=true, scores=scores@entry=0x7ffde96b17c0) at ./src/plugins/fts/fts-search.c:322 #3 0x00007fdb234555fa in fts_search_merge_scores_level (fctx=fctx@entry=0x55ce3f2347d0, args=0x55ce3f22d458, idx=idx@entry=0x7ffde96b182c, and_args=and_args@entry=true, scores=0x55ce3f2ffb68) at ./src/plugins/fts/fts-search.c:322 #4 0x00007fdb2345b2ee in fts_search_merge_scores (fctx=0x55ce3f2347d0) at ./src/plugins/fts/fts-search.c:337 #5 fts_search_try_lookup (fctx=0x55ce3f2347d0) at ./src/plugins/fts/fts-search.c:404 #6 fts_search_lookup (fctx=fctx@entry=0x55ce3f2347d0) at ./src/plugins/fts/fts-search.c:414 #7 0x00007fdb2345bc25 in fts_mailbox_search_init (t=<optimized out>, args=0x55ce3f22cd28, sort_program=<optimized out>, wanted_fields=0, wanted_headers=<optimized out>) at ./src/plugins/fts/fts-storage.c:213 #8 0x00007fdb266b7d99 in mailbox_search_init (t=0x55ce3f322fb0, args=args@entry=0x55ce3f22cd28, sort_program=sort_program@entry=0x0, wanted_fields=wanted_fields@entry=0, wanted_headers=wanted_headers@entry=0x0) at ../lib-storage/mail-storage.c:2988 #9 0x000055ce070d746c in imap_search_start (ctx=0x55ce3f1cb568, sargs=0x55ce3f22cd28, sort_program=0x0) at ./src/imap/imap-search.c:538 #10 0x000055ce070c3702 in cmd_search (cmd=0x55ce3f1cb1a8) at ./src/imap/cmd-search.c:54 #11 0x000055ce070c8394 in command_exec (cmd=cmd@entry=0x55ce3f1cb1a8) at ./src/imap/imap-commands.c:208 #12 0x000055ce070cec20 in client_command_input (cmd=<optimized out>, cmd@entry=0x55ce3f1cb1a8) at ./src/imap/imap-client.c:1359 #13 0x000055ce070cecb6 in client_command_input (cmd=<optimized out>, cmd@entry=0x55ce3f1cb1a8) at ./src/imap/imap-client.c:1429 #14 0x000055ce070cef4d in client_command_input (cmd=<optimized out>) at ./src/imap/imap-client.c:1393 #15 0x000055ce070cf135 in client_handle_next_command (client=0x55ce3f1c9788, remove_io_r=<synthetic pointer>) at ./src/imap/imap-client.c:1471 #16 client_handle_input (client=client@entry=0x55ce3f1c9788) at ./src/imap/imap-client.c:1485 #17 0x000055ce070cf527 in client_input (client=0x55ce3f1c9788) at ./src/imap/imap-client.c:1529 #18 0x00007fdb26379cdb in io_loop_call_io (io=0x55ce3f1cb960) at ../lib/ioloop.c:749 #19 0x00007fdb2637bb1b in io_loop_handler_run_internal (ioloop=ioloop@entry=0x55ce3f19b5c0) at ../lib/ioloop-epoll.c:222 #20 0x00007fdb2637bbe4 in io_loop_handler_run (ioloop=ioloop@entry=0x55ce3f19b5c0) at ../lib/ioloop.c:803 #21 0x00007fdb2637bde8 in io_loop_run (ioloop=0x55ce3f19b5c0) at ../lib/ioloop.c:774 #22 0x00007fdb262c34be in master_service_run (service=0x55ce3f19ad10, callback=callback@entry=0x55ce070d3e30 <client_connected>) at ../lib-master/master-service.c:1280 #23 0x000055ce070ba036 in main (argc=<optimized out>, argv=<optimized out>) at ./src/imap/main.c:588
in both cases the SEGV was caused by illegal access to src_map[srci]:
(gdb) print src_map[srci] Cannot access memory at address 0x7fdb23091000
I can provide the coredumps to you (but not public) if you are interested.
Best,
Patrick Cernko <errror@errror.org>