[Dovecot] Segfault in dovecot-lda when resolver is unavailable
Hi list!
Recently I noticed that dovecot-lda throws segfault when resolver is unavailable and with imapc configured.
$ cat /etc/resolv.conf search . nameserver 127.0.0.1
backtrace: # gdb -q /usr/libexec/dovecot/dovecot-lda 'core-1398282784-8-11-!usr!libexec!dovecot!dovecot-lda-8805' [...] Core was generated by `/usr/libexec/dovecot/deliver -d marcin@mejor.pl'. Program terminated with signal 11, Segmentation fault. #0 0x000002b612afaf72 in _int_free (av=0x2b612e215c0 <main_arena>, p=0x1b23bfabe0, have_lock=0) at malloc.c:3903 3903 unlink(p, bck, fwd); (gdb) bt #0 0x000002b612afaf72 in _int_free (av=0x2b612e215c0 <main_arena>, p=0x1b23bfabe0, have_lock=0) at malloc.c:3903 #1 0x000002b612e96a4e in buffer_free (_buf=_buf@entry=0x1b23bfa948) at buffer.c:144 #2 0x000002b612ebeca8 in array_free_i (array=0x1b23bfa948) at array.h:108 #3 priorityq_deinit (_pq=_pq@entry=0x1b23bfabb0) at priorityq.c:38 #4 0x000002b612eafa57 in io_loop_destroy (_ioloop=_ioloop@entry=0x395a4da91d0) at ioloop.c:495 #5 0x000002b61306f225 in imapc_client_run_post (client=<optimized out>) at imapc-client.c:175 #6 imapc_client_run (client=0x1b23bda930) at imapc-client.c:181 #7 0x000002b613067158 in imapc_list_try_get_root_sep (list=0x1b23bd7b60, sep_r=sep_r@entry=0x395a4da9247 "") at imapc-list.c:297 #8 0x000002b6130671ae in imapc_list_get_hierarchy_sep (_list=<optimized out>) at imapc-list.c:310 #9 0x000002b613065d9f in imapc_list_get_fs_name (list=0x1b23bd7b60, name=0x0) at imapc-list.c:396 #10 0x000002b613066031 in imapc_list_get_path (_list=0x1b23bd7b60, name=0x0, type=MAILBOX_LIST_PATH_TYPE_MAILBOX, path_r=0x395a4da9338) at imapc-list.c:437 #11 0x000002b613089785 in mailbox_list_get_root_path (list=<optimized out>, type=type@entry=MAILBOX_LIST_PATH_TYPE_MAILBOX, path_r=path_r@entry=0x395a4da9338) at mailbox-list.c:1276 #12 0x000002b612ff8eb5 in quota_add_user_namespace (quota=0x1b23bcea80, ns=0x1b23bd7a10) at quota.c:745 #13 0x000002b61300073a in quota_mailbox_list_created (list=0x1b23bfd9c0) at quota-storage.c:590 #14 0x000002b613084581 in hook_mailbox_list_created (list=list@entry=0x1b23bfd9c0) at mail-storage-hooks.c:328 #15 0x000002b61308836f in mailbox_list_create (driver=driver@entry=0x2b6130e677b "maildir++", ns=0x1b23bd7a10, set=set@entry=0x395a4da94a0, flags=<optimized out>, list_r=list_r@entry=0x1b23bd7d60, error_r=error_r@entry=0x395a4da9498) at mailbox-list.c:210 #16 0x000002b613065cf6 in imapc_list_get_fs (list=list@entry=0x1b23bd7b60) at imapc-list.c:379 #17 0x000002b61306601e in imapc_list_get_path (_list=0x1b23bd7b60, name=0x0, type=MAILBOX_LIST_PATH_TYPE_MAILBOX, path_r=0x395a4da9588) at imapc-list.c:433 #18 0x000002b613089785 in mailbox_list_get_root_path (list=<optimized out>, type=type@entry=MAILBOX_LIST_PATH_TYPE_MAILBOX, path_r=path_r@entry=0x395a4da9588) at mailbox-list.c:1276 #19 0x000002b612ff8eb5 in quota_add_user_namespace (quota=0x1b23bcea80, ns=0x1b23bd7a10) at quota.c:745 #20 0x000002b61300073a in quota_mailbox_list_created (list=0x1b23bd7b60) at quota-storage.c:590 #21 0x000002b613084581 in hook_mailbox_list_created (list=list@entry=0x1b23bd7b60) at mail-storage-hooks.c:328 #22 0x000002b61308836f in mailbox_list_create (driver=driver@entry=0x2b6130e6d1b "imapc", ns=ns@entry=0x1b23bd7a10, set=set@entry=0x395a4da9720, flags=<optimized out>, list_r=list_r@entry=0x395a4da9708, error_r=error_r@entry=0x395a4da9810) at mailbox-list.c:210 #23 0x000002b61307f500 in mail_storage_create_full (ns=ns@entry=0x1b23bd7a10, driver=<optimized out>, driver@entry=0x0, data=<optimized out>, flags=flags@entry=(unknown: 0), storage_r=storage_r@entry=0x395a4da97c0, error_r=error_r@entry=0x395a4da9810) at mail-storage.c:356 #24 0x000002b61307f7cc in mail_storage_create (ns=ns@entry=0x1b23bd7a10, driver=driver@entry=0x0, flags=flags@entry=(unknown: 0), error_r=error_r@entry=0x395a4da9810) at mail-storage.c:407 #25 0x000002b613077a48 in namespace_add (user=user@entry=0x1b23bcf7e0, ns_set=0x1b23bd0db8, unexpanded_ns_set=0x1b23bcff30, mail_set=mail_set@entry=0x1b23bd07e8, ns_p=ns_p@entry=0x1b23bd3b00, error_r=error_r@entry=0x395a4da9950) at mail-namespace.c:170 #26 0x000002b613078aaf in mail_namespaces_init (user=0x1b23bcf7e0, error_r=error_r@entry=0x395a4da9950) at mail-namespace.c:344 #27 0x000002b6130901bf in mail_storage_service_init_post (error_r=0x395a4da9950, mail_user_r=0x395a4da9b18, priv=0x395a4da9960, user=0x1b23bbde50, ctx=<optimized out>) at mail-storage-service.c:685 #28 mail_storage_service_next (ctx=ctx@entry=0x1b23bbd4f0, user=0x1b23bbde50, mail_user_r=mail_user_r@entry=0x395a4da9b18) at mail-storage-service.c:1223 #29 0x000002b6130904b5 in mail_storage_service_lookup_next (ctx=0x1b23bbd4f0, input=input@entry=0x395a4da9b80, user_r=user_r@entry=0x395a4da9a70, mail_user_r=mail_user_r@entry=0x395a4da9b18, error_r=error_r@entry=0x395a4da9a60) at mail-storage-service.c:1258 #30 0x0000001b22341ccb in main (argc=3, argv=0x1b23bbb060) at main.c:412
# doveconf -n # 2.2.12: /etc/dovecot/dovecot.conf # OS: Linux 3.13.8-hardened x86_64 Gentoo Base System release 2.2 auth_cache_size = 1 k auth_master_user_separator = * auth_mechanisms = login digest-md5 cram-md5 plain deliver_log_format = msgid=%m: from=%f: phys=%p: virt=%w %$ dict { quota = pgsql:/etc/dovecot/dovecot-dict-sql.conf.ext } first_valid_uid = 8 last_valid_uid = 8 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_attachment_dir = /dane/domeny/zalaczniki mail_attachment_min_size = 10000 k mail_cache_min_mail_count = 20 mail_gid = mail mail_log_prefix = "%s(%u) <%{session}>: " mail_plugins = quota notify mail_log stats zlib mail_privileged_group = mail mail_uid = mail maildir_stat_dirs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy inc$ ude variables body enotify environment mailbox date ihave mdbox_preallocate_space = yes mdbox_rotate_interval = 60 days mdbox_rotate_size = 50 M namespace inbox { inbox = yes list = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = . subscriptions = yes } passdb { args = /etc/dovecot/.master.user driver = passwd-file master = yes pass = yes } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { quota = dict:User quota::proxy::quota sieve = ~/.dovecot.sieve sieve_dir = ~/sieve stats_command_min_time = 1 mins stats_domain_min_time = 12 hours stats_ip_min_time = 12 hours stats_memory_limit = 1M stats_refresh = 30 s stats_session_min_time = 15 mins stats_track_cmds = yes stats_user_min_time = 1 hours zlib_save = bz2 zlib_save_level = 2 } postmaster_address = postmaster@mejor.pl protocols = imap pop3 sieve service auth { unix_listener auth-userdb { group = mail mode = 0660 user = root } } service dict { unix_listener dict { user = mail } } service stats { fifo_listener stats-mail { mode = 0600 user = mail } } ssl_cert = </etc/ssl/gwiazdka.mejor.pl.pem ssl_key = </etc/ssl/gwiazdka.mejor.pl.pem userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } verbose_proctitle = yes protocol lda { mail_plugins = quota notify mail_log stats zlib sieve } protocol imap { mail_max_userip_connections = 25 mail_plugins = quota notify mail_log stats zlib imap_quota imap_stats imap_zlib }
Thanks, Marcin
On 24.4.2014, at 0.15, Marcin Mirosław <marcin@mejor.pl> wrote:
Recently I noticed that dovecot-lda throws segfault when resolver is unavailable and with imapc configured.
I can't easily reproduce this.
#0 0x000002b612afaf72 in _int_free (av=0x2b612e215c0 <main_arena>, p=0x1b23bfabe0, have_lock=0) at malloc.c:3903 #1 0x000002b612e96a4e in buffer_free (_buf=_buf@entry=0x1b23bfa948) at buffer.c:144 #2 0x000002b612ebeca8 in array_free_i (array=0x1b23bfa948) at array.h:108 #3 priorityq_deinit (_pq=_pq@entry=0x1b23bfabb0) at priorityq.c:38 #4 0x000002b612eafa57 in io_loop_destroy (_ioloop=_ioloop@entry=0x395a4da91d0) at ioloop.c:495
This also looks like some kind of memory corruption, which isn't good. Can you try this with valgrind?
valgrind /usr/libexec/dovecot/deliver -d marcin@mejor.pl
W dniu 05.05.2014 15:14, Timo Sirainen pisze:
Hi Timo, hi all!
On 24.4.2014, at 0.15, Marcin Mirosław <marcin@mejor.pl> wrote:
Recently I noticed that dovecot-lda throws segfault when resolver is unavailable and with imapc configured.
I can't easily reproduce this.
#0 0x000002b612afaf72 in _int_free (av=0x2b612e215c0 <main_arena>, p=0x1b23bfabe0, have_lock=0) at malloc.c:3903 #1 0x000002b612e96a4e in buffer_free (_buf=_buf@entry=0x1b23bfa948) at buffer.c:144 #2 0x000002b612ebeca8 in array_free_i (array=0x1b23bfa948) at array.h:108 #3 priorityq_deinit (_pq=_pq@entry=0x1b23bfabb0) at priorityq.c:38 #4 0x000002b612eafa57 in io_loop_destroy (_ioloop=_ioloop@entry=0x395a4da91d0) at ioloop.c:495
This also looks like some kind of memory corruption, which isn't good. Can you try this with valgrind?
valgrind /usr/libexec/dovecot/deliver -d marcin@mejor.pl
# valgrind /usr/libexec/dovecot/deliver -d marcin@mejor.pl </dev/null (output is attached to email)
gcc version 4.7.3 (Gentoo Hardened 4.7.3-r1 p1.4, pie-0.5.5)
Thanks, Marcin
participants (2)
-
Marcin Mirosław
-
Timo Sirainen