Dear All,

I think I've hit a bug after migrating our mail server to the newest version of dovecot (version 2.2.15). When I try to list all imap folders for one user the imap process crashes. The listing to a specific folder (ex. INBOX) works fine, only the "*" crashes.

Client side:

[root@mb log]# telnet 127.0.0.1 143 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'.

• OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN] __mb__ ready a login soumplis MYPASS a OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS SPECIAL-USE BINARY MOVE NOTIFY] Logged in a list "" "*" Connection closed by foreign host.

Server Log:

Nov 13 13:53:57 mb00 dovecot: imap-login: Login: user=<soumplis>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=60544, secured, session=<pXzTKrwH0wB/AAAB> Nov 13 13:53:59 mb00 dovecot: imap(soumplis): Panic: file buffer.c: line 309 (buffer_set_used_size): assertion failed: (used_size <= buf->alloc) Nov 13 13:53:59 mb00 dovecot: imap(soumplis): Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0x7466e) [0x7f06237f466e] -> /usr/lib64/dovecot/libdovecot.so.0(+0x7474e) [0x7f06237f474e] -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7f06237a4aa6] -> /usr/lib64/dovecot/libdovecot.so.0(+0x71172) [0x7f06237f1172] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_list_index_iter_next+0x16c) [0x7f0623afca0c] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x987df) [0x7f0623b007df] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_list_iter_next+0x2a0) [0x7f0623b01460] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x99fb1) [0x7f0623b01fb1] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x987df) [0x7f0623b007df] -> /usr/lib64/dovecot/libdovecot-storage.so.0(mailbox_list_iter_next+0x40e) [0x7f0623b015ce] -> dovecot/imap soumplis 127.0.0.1 list [0x7f0623fbed59] -> dovecot/imap soumplis 127.0.0.1 list [0x7f0623fbf5e8] -> dovecot/imap soumplis 127.0.0.1 list [0x7f0623fc724c] -> dovecot/imap soumplis 127.0.0.1 list [0x7f0623fc60ff] -> dovecot/imap soumplis 127.0.0.1 list [0x7f0623fc6191] -> dovecot/imap soumplis 127.0.0.1 list [0x7f0623fc64ed] -> dovecot/imap soumplis 127.0.0.1 list [0x7f0623fc68b5] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x4c) [0x7f06238067fc] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0xcb) [0x7f062380782b] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x9) [0x7f0623806869] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f06238068e8] -> /usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f06237aa0a3] -> dovecot/imap soumplis 127.0.0.1 list [0x7f0623fba4f4] -> /lib64/libc.so.6(__libc_start_main+0xf5) [0x7f06233e0af5] -> dovecot/imap soumplis 127.0.0.1 list [0x7f0623fba661] Nov 13 13:53:59 mb00 dovecot: imap(soumplis): Fatal: master: service(imap): child 60544 killed with signal 6 (core dumps disabled)

Our current configuration:

# 2.2.15: /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-123.8.1.el7.x86_64 x86_64 CentOS Linux release 7.0.1406 (Core) xfs auth_cache_negative_ttl = 0 auth_cache_size = 128 M auth_username_chars = auth_username_format = %Ln deliver_log_format = msgid=%m: Subject=%s, From=%f, Physical Size=%p, Virtual Size=%w, %$ disable_plaintext_auth = no imap_client_workarounds = delay-newmail tb-extra-mailbox-sep tb-lsub-flags login_greeting = __mb__ ready mail_attachment_dir = /SILO/attachments mail_attachment_fs = sis posix:mode=660 mail_cache_min_mail_count = 10 mail_gid = mailuser mail_home = /SILO/homes/%Ln mail_location = mdbox:/SILO/mailboxes/%Ln/mdbox:INDEX=/SILO/indexes/%Ln mail_plugins = " zlib" mail_uid = mailuser mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave duplicate mbox_write_locks = fcntl mdbox_preallocate_space = yes mdbox_rotate_interval = 1 days mdbox_rotate_size = 64 M namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox "Report NO Spam" { auto = subscribe } mailbox "Report Spam" { auto = subscribe } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes } passdb { args = /etc/dovecot/conf.d/dovecot-ldap.conf.ext driver = ldap } passdb { driver = pam } plugin { acl_anyone = allow acl_shared_dict = file:/var/lib/dovecot/shared-mailboxes sieve = /SILO/sieves/%Ln/dovecot.sieve sieve_dir = /SILO/sieves/%Ln/ sieve_global_dir = /SILO/sieves } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_enable_last = yes pop3_fast_size_lookups = yes pop3_lock_session = yes pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s %u pop3_reuse_xuidl = yes pop3_save_uidl = yes protocols = imap pop3 lmtp sieve service imap { process_limit = 4192 vsz_limit = 1 G } service lmtp { inet_listener lmtp { port = 24 } process_min_avail = 5 } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } service_count = 1 } ssl_ca = /etc/pki/tls/certs/chain-pem ssl_cert = </etc/pki/tls/certs/cert-pem ssl_key = </etc/pki/tls/private/mb.key ssl_prefer_server_ciphers = yes syslog_facility = local3 userdb { args = /etc/dovecot/conf.d/dovecot-ldap-userdb.conf.ext driver = ldap } userdb { driver = passwd } verbose_proctitle = yes protocol lmtp { info_log_path = /var/log/dovecot-lmtp.log mail_plugins = " zlib sieve" } protocol imap { mail_max_userip_connections = 64 } protocol sieve { managesieve_implementation_string = Dovecot Pigeonhole managesieve_logout_format = bytes=%i/%o managesieve_max_line_length = 65536 }

I have also tried with strace of the process to pinpoint the problem by first listing INBOX and then *. It seems that it crashes while opening dovecot.list.index

read(7, "a list \"\" \"INBOX\"\r\n", 8162) = 19 brk(0) = 0x7fb688573000 brk(0x7fb688594000) = 0x7fb688594000 stat("/SILO/mailboxes/soumplis/Maildir/cur", {st_mode=S_IFDIR|0700, st_size=274432, ...}) = 0 brk(0) = 0x7fb688594000 brk(0) = 0x7fb688594000 brk(0x7fb688593000) = 0x7fb688593000 brk(0) = 0x7fb688593000 stat("/SILO/mailboxes/soumplis/Maildir", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 open("/SILO/mailboxes/soumplis/Maildir/dovecot.list.index.log", O_RDWR|O_APPEND) = 4 fstat(4, {st_mode=S_IFREG|0600, st_size=17440, ...}) = 0 pread(4, "\1\2(\0#1ZTv\0\0\0u\0\0\0000\200\0\0\267\210dT\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0", 40, 0) = 40 open("/SILO/mailboxes/soumplis/Maildir/dovecot.list.index", O_RDWR) = 12 fstat(12, {st_mode=S_IFREG|0600, st_size=4424, ...}) = 0 pread(12, "\7\3x\0\30\5\0\0P\0\0\0\1\0\0\0#1ZT\0\0\0\0#1ZT.\0\0\0'\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0u\0\

read(7, "a list \"\" \"*\"\r\n", 8143) = 15 stat("/SILO/mailboxes/soumplis/Maildir/cur", {st_mode=S_IFDIR|0700, st_size=274432, ...}) = 0 stat("/SILO/mailboxes/soumplis/Maildir/dovecot.list.index.log", {st_mode=S_IFREG|0600, st_size=17440, ...}) = 0 fstat(4, {st_mode=S_IFREG|0600, st_size=17440, ...}) = 0 fstat(4, {st_mode=S_IFREG|0600, st_size=17440, ...}) = 0 write(2, "\1\01059391 prefix=imap(soumplis): \n", 32) = 32 write(2, "\1\00659391 file buffer.c: line 309 (buffer_set_used_size): assertion failed: (used_size <= buf->alloc)\n", 100) = 100

Any help will be greatly appreciated!

-- Alexandros Soumplis Systems Engineer (M.Sc, RHCE, VCP, SCSA)

National Documentation Center / N.H.R.F. Information Systems Department 48, Vas. Constantinou Av. 116 35 Athens, Greece phone: +30 210 7273984 fax: +30 210 7252223 email:soumplis@ekt.gr http://www.ekt.gr