[Dovecot] Segfault in dovecot-lda when resolver is unavailable
Hi list!
Recently I noticed that dovecot-lda throws segfault when resolver is unavailable and with imapc configured.
$ cat /etc/resolv.conf search . nameserver 127.0.0.1
backtrace:
# gdb -q /usr/libexec/dovecot/dovecot-lda
'core-1398282784-8-11-!usr!libexec!dovecot!dovecot-lda-8805'
[...]
Core was generated by `/usr/libexec/dovecot/deliver -d marcin@mejor.pl'.
Program terminated with signal 11, Segmentation fault.
#0 0x000002b612afaf72 in _int_free (av=0x2b612e215c0
# doveconf -n # 2.2.12: /etc/dovecot/dovecot.conf # OS: Linux 3.13.8-hardened x86_64 Gentoo Base System release 2.2 auth_cache_size = 1 k auth_master_user_separator = * auth_mechanisms = login digest-md5 cram-md5 plain deliver_log_format = msgid=%m: from=%f: phys=%p: virt=%w %$ dict { quota = pgsql:/etc/dovecot/dovecot-dict-sql.conf.ext } first_valid_uid = 8 last_valid_uid = 8 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_attachment_dir = /dane/domeny/zalaczniki mail_attachment_min_size = 10000 k mail_cache_min_mail_count = 20 mail_gid = mail mail_log_prefix = "%s(%u) <%{session}>: " mail_plugins = quota notify mail_log stats zlib mail_privileged_group = mail mail_uid = mail maildir_stat_dirs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy inc$ ude variables body enotify environment mailbox date ihave mdbox_preallocate_space = yes mdbox_rotate_interval = 60 days mdbox_rotate_size = 50 M namespace inbox { inbox = yes list = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = . subscriptions = yes } passdb { args = /etc/dovecot/.master.user driver = passwd-file master = yes pass = yes } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { quota = dict:User quota::proxy::quota sieve = ~/.dovecot.sieve sieve_dir = ~/sieve stats_command_min_time = 1 mins stats_domain_min_time = 12 hours stats_ip_min_time = 12 hours stats_memory_limit = 1M stats_refresh = 30 s stats_session_min_time = 15 mins stats_track_cmds = yes stats_user_min_time = 1 hours zlib_save = bz2 zlib_save_level = 2 } postmaster_address = postmaster@mejor.pl protocols = imap pop3 sieve service auth { unix_listener auth-userdb { group = mail mode = 0660 user = root } } service dict { unix_listener dict { user = mail } } service stats { fifo_listener stats-mail { mode = 0600 user = mail } } ssl_cert =
Thanks, Marcin
On 24.4.2014, at 0.15, Marcin Mirosław marcin@mejor.pl wrote:
Recently I noticed that dovecot-lda throws segfault when resolver is unavailable and with imapc configured.
I can't easily reproduce this.
#0 0x000002b612afaf72 in _int_free (av=0x2b612e215c0
, p=0x1b23bfabe0, have_lock=0) at malloc.c:3903 #1 0x000002b612e96a4e in buffer_free (_buf=_buf@entry=0x1b23bfa948) at buffer.c:144 #2 0x000002b612ebeca8 in array_free_i (array=0x1b23bfa948) at array.h:108 #3 priorityq_deinit (_pq=_pq@entry=0x1b23bfabb0) at priorityq.c:38 #4 0x000002b612eafa57 in io_loop_destroy (_ioloop=_ioloop@entry=0x395a4da91d0) at ioloop.c:495
This also looks like some kind of memory corruption, which isn't good. Can you try this with valgrind?
valgrind /usr/libexec/dovecot/deliver -d marcin@mejor.pl
W dniu 05.05.2014 15:14, Timo Sirainen pisze:
Hi Timo, hi all!
On 24.4.2014, at 0.15, Marcin Mirosław marcin@mejor.pl wrote:
Recently I noticed that dovecot-lda throws segfault when resolver is unavailable and with imapc configured.
I can't easily reproduce this.
#0 0x000002b612afaf72 in _int_free (av=0x2b612e215c0
, p=0x1b23bfabe0, have_lock=0) at malloc.c:3903 #1 0x000002b612e96a4e in buffer_free (_buf=_buf@entry=0x1b23bfa948) at buffer.c:144 #2 0x000002b612ebeca8 in array_free_i (array=0x1b23bfa948) at array.h:108 #3 priorityq_deinit (_pq=_pq@entry=0x1b23bfabb0) at priorityq.c:38 #4 0x000002b612eafa57 in io_loop_destroy (_ioloop=_ioloop@entry=0x395a4da91d0) at ioloop.c:495 This also looks like some kind of memory corruption, which isn't good. Can you try this with valgrind?
valgrind /usr/libexec/dovecot/deliver -d marcin@mejor.pl
# valgrind /usr/libexec/dovecot/deliver -d marcin@mejor.pl
gcc version 4.7.3 (Gentoo Hardened 4.7.3-r1 p1.4, pie-0.5.5)
Thanks, Marcin
participants (2)
-
Marcin Mirosław
-
Timo Sirainen