[Dovecot] core dump in mail_cache_header_fields_read()
We're seeing a core dump for a user connecting from IPHONE. The user mail are in NFS mount.
# dovecot --version 2.2.12
# doveconf -n # 2.2.12: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.4 auth_cache_negative_ttl = 0 auth_cache_size = 20 M auth_verbose = yes default_client_limit = 4000 default_process_limit = 1000 default_vsz_limit = 2 G director_mail_servers = <server_ip_address> disable_plaintext_auth = no first_valid_uid = 100 imap_client_workarounds = tb-extra-mailbox-sep delay-newmail tb-lsub-flags log_timestamp = "%Y-%m-%d %H:%M:%S " mail_fsync = always mail_nfs_index = yes mail_nfs_storage = yes mail_plugins = " quota" mbox_dotlock_change_timeout = 1 mins mbox_lock_timeout = 1 mins mmap_disable = yes namespace inbox { hidden = no inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / type = private } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { quota = fs:Disk quota } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh protocols = " imap pop3" service auth-worker { user = root } service auth { user = $default_internal_user } service imap-login { client_limit = 2000 process_min_avail = 4 service_count = 1 } service imap-postlogin { executable = script-login /usr/local/dovecot-scripts/imap.sh user = root } service imap { executable = imap imap-postlogin process_limit = 4096 } service pop3-login { client_limit = 2000 service_count = 1 } service pop3-postlogin { executable = script-login /usr/local/dovecot-scripts/ipop3.sh user = root } service pop3 { executable = pop3 pop3-postlogin process_limit = 2048 } ssl_ca = </etc/dovecot/mailhost-ca.crt ssl_cert = </etc/dovecot/mailhost.crt ssl_key = </etc/dovecot/mailhost.key userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_ssl = yes protocol imap { mail_max_userip_connections = 1000 mail_plugins = " quota imap_quota" } protocol pop3 { mail_max_userip_connections = 1000 }
# gdb /usr/lib/dovecot/imap ./5040 GNU gdb (GDB) 7.4.1-debian Copyright (C) 2012 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/lib/dovecot/imap...Reading symbols from /usr/lib/debug/usr/lib/dovecot/imap...done. done. [New LWP 5040]
warning: Can't read pathname for load map: Input/output error. [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Core was generated by `dovecot/imap imap-postlogin'. Program terminated with signal 11, Segmentation fault. #0 0x00007fca22f0ca85 in mail_cache_header_fields_read (cache=cache@entry=0x7fca24a04f70) at mail-cache-fields.c:369 369 for (p = names; p != end && *p != '\0'; p++) ; (gdb) bt full #0 0x00007fca22f0ca85 in mail_cache_header_fields_read (cache=cache@entry=0x7fca24a04f70) at mail-cache-fields.c:369 field_hdr = 0x7fca21d37010 field = {name = 0x0, idx = 0, type = MAIL_CACHE_FIELD_FIXED_SIZE, field_size = 0, decision = MAIL_CACHE_DECISION_NO, last_used = 0} last_used = 0x7fca21d3701c sizes = 0x7fca79d3701c types = 0x7fcad1d3701c <Address 0x7fcad1d3701c out of bounds> decisions = 0x7fcae7d3701c <Address 0x7fcae7d3701c out of bounds> p = 0x7fcafdd3701c <Address 0x7fcafdd3701c out of bounds> names = 0x7fcafdd3701c <Address 0x7fcafdd3701c out of bounds> end = 0x7fcb1dd47010 <Address 0x7fcb1dd47010 out of bounds> orig_key = 0x48800 <Address 0x48800 out of bounds> orig_value = 0x8000 fidx = <optimized out> new_fields_count = <optimized out> dec = <optimized out> max_drop_time = 0 offset = 23204 i = <optimized out> #1 0x00007fca22f0a4d6 in mail_cache_open_and_verify (cache=0x7fca24a04f70) at mail-cache.c:497 ret = <optimized out> #2 0x00007fca22f0c905 in mail_cache_register_get_list (cache=0x7fca24a04f70, pool=0x7fca249d7480, count_r=count_r@entry=0x7fff0c4c7aec) at mail-cache-fields.c:194 list = <optimized out> i = <optimized out> #3 0x00007fca22ef93b3 in index_mail_parse_header_register_all_wanted (mail=0x7fca24a14ce0) at index-mail-headers.c:169 _mail = 0x7fca24a14ce0 all_cache_fields = <optimized out> i = <optimized out> count = <optimized out> #4 index_mail_parse_header_init (mail=mail@entry=0x7fca24a14ce0, headers=headers@entry=0x0) at index-mail-headers.c:230 _data_stack_cur_id = 4 data = 0x7fca24a14e50 match = 0x7fca24a05e00 "\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377a" i = <optimized out> field_idx = <optimized out> match_count = <optimized out> __FUNCTION__ = "index_mail_parse_header_init" #5 0x00007fca22ef9d08 in index_mail_cache_parse_init (_mail=0x7fca24a14ce0, input=0x7fca24a1b178, input@entry=0x7fca24a1b738) at index-mail-headers.c:376 mail = 0x7fca24a14ce0 input2 = 0x7fca24a24ef8 __FUNCTION__ = "index_mail_cache_parse_init" #6 0x00007fca22eb4202 in mbox_save_get_input_stream (input=0x7fca24a1ab88, ctx=0x7fca24a14930) at mbox-save.c:421 filter = 0x0 ---Type <return> to continue, or q <return> to quit---
On 23.4.2014, at 21.43, Wesley Huang <huang@utsc.utoronto.ca> wrote:
We're seeing a core dump for a user connecting from IPHONE. The user mail are in NFS mount.
Program terminated with signal 11, Segmentation fault. #0 0x00007fca22f0ca85 in mail_cache_header_fields_read (cache=cache@entry=0x7fca24a04f70) at mail-cache-fields.c:369 369 for (p = names; p != end && *p != '\0'; p++) ;
Looks like a corrupted dovecot.index.cache file. This should replace the crash with just an error message and cache recreation:
Hi Timo,
Thanks. Let me port in the bug fix and test it. FYI, previously when the problem occurred, I deleted the dovecot index and let dovecot regenerate the index, but it didn't help.
Cheers,
Wesley
On 14-05-02 05:13 AM, Timo Sirainen wrote:
On 23.4.2014, at 21.43, Wesley Huang <huang@utsc.utoronto.ca> wrote:
We're seeing a core dump for a user connecting from IPHONE. The user mail are in NFS mount.
Program terminated with signal 11, Segmentation fault. #0 0x00007fca22f0ca85 in mail_cache_header_fields_read (cache=cache@entry=0x7fca24a04f70) at mail-cache-fields.c:369 369 for (p = names; p != end && *p != '\0'; p++) ; Looks like a corrupted dovecot.index.cache file. This should replace the crash with just an error message and cache recreation:
Hi Timo,
The patch works. With the error log we identified a corrupted cache file for the Trash folder (not the cache file for the inbox we previously suspected). After having this cache removed, we don't see the error any more.
Thanks again!
Cheers,
Wesley
On 14-05-02 12:03 PM, Wesley Huang wrote:
Hi Timo,
Thanks. Let me port in the bug fix and test it. FYI, previously when the problem occurred, I deleted the dovecot index and let dovecot regenerate the index, but it didn't help.
Cheers,
Wesley
On 14-05-02 05:13 AM, Timo Sirainen wrote:
On 23.4.2014, at 21.43, Wesley Huang <huang@utsc.utoronto.ca> wrote:
We're seeing a core dump for a user connecting from IPHONE. The user mail are in NFS mount.
Program terminated with signal 11, Segmentation fault. #0 0x00007fca22f0ca85 in mail_cache_header_fields_read (cache=cache@entry=0x7fca24a04f70) at mail-cache-fields.c:369 369 for (p = names; p != end && *p != '\0'; p++) ; Looks like a corrupted dovecot.index.cache file. This should replace the crash with just an error message and cache recreation:
participants (2)
-
Timo Sirainen
-
Wesley Huang