AW: doveadm search segfault Dovecot 2.2.22

21 Sep 2020


      Hey,
i am now a bit deeper into dovecot debugging with gdb and have a full bt now, with debugging infos.
Is there a patch that resolve this Problem in dovecot 2.2.22-1ubuntu2.13 for ubuntu 16?
Here the bt:
(gdb) bt full
#0  0x00007ffff73cf3f3 in array_count_i (array=0x555555810d38) at ../../src/lib/array.h:155
No locals.
#1  message_part_finish (ctx=ctx@entry=0x555555810ce0) at message-parser.c:227
    __FUNCTION__ = "message_part_finish"
#2  0x00007ffff73d132c in message_parser_parse_next_block (ctx=0x555555810ce0, block_r=block_r@entry=0x7fffffffdc40) at message-parser.c:1244
    ret = &lt;optimized out>

    eof = false

    full = false

    __FUNCTION__ = "message_parser_parse_next_block"
#3  0x00007ffff73d2218 in message_search_msg_real (error_r=0x7fffffffdca0, parts=<optimized out>, input=0x5555558159c0, ctx=0x55555580a870)
at message-search.c:217

    new_parts = 0x7fffffffdd50

    ret = &lt;optimized out>

    parser_ctx = 0x555555810ce0

    raw_block = {part = 0x55555580cc50, hdr = 0x0, data = 0x0, size = 0}
#4  message_search_msg (ctx=ctx@entry=0x55555580a870, input=0x5555558159c0, parts=<optimized out>, error_r=error_r@entry=0x7fffffffdca0)
at message-search.c:244

    _data_stack_cur_id = 6

    error = &lt;optimized out>

    ret = 1
#5  0x00007ffff7705c2f in search_body (arg=0x5555557ec948, ctx=0x7fffffffdd30) at index-search.c:649
    msg_search_ctx = 0x55555580a870

    error = 0x7fffffffdd40 "0ˀUUU"

    ret = &lt;optimized out>

    __FUNCTION__ = "search_body"
#6  0x00007ffff7690345 in mail_search_args_foreach (args=0x5555557ec948, args@entry=0x5555557ec8b0, callback=callback@entry=0x7ffff7705ba0 <search_body>,
context=context@entry=0x7fffffffdd30) at mail-search.c:440

    result = 1
#7  0x00007ffff7705870 in search_arg_match_text (ctx=0x55555580c0a0, args=0x5555557ec8b0) at index-search.c:779
    hdr_parser_flags = MESSAGE_HEADER_PARSER_FLAG_CLEAN_ONELINE

    real_mail = 0x55555580c320

    headers = &lt;optimized out>

    hdr_ctx = {index_ctx = 0x55555580c0a0, imail = 0x55555580c320, args = 0x5555557ec8b0, decoded_block = {part = 0x0, hdr = 0x0, data = 0x0,

        size = 0}, decoded_block_set = false, hdr = 0x55555580a7e0, parse_headers = 0, custom_header = 0, threading = 0}

    body_ctx = {index_ctx = 0x55555580c0a0, input = 0x5555558159c0, part = 0x55555580cb30}

    have_headers = true

    have_body = true

    ret = &lt;optimized out>

    imail = 0x55555580c320

    input = 0x5555558159c0

    headers_ctx = 0x0

    failed = false
#8  search_match_once (ctx=0x55555580c0a0) at index-search.c:1329
    ctx = 0x55555580c0a0

    ret = &lt;optimized out>
#9  0x00007ffff77078c1 in search_match_next (ctx=0x55555580c0a0) at index-search.c:1434
    _data_stack_cur_id = 5

    i = 2

    n = 3

    ret = &lt;optimized out>
#10 search_more_with_mail (mail=0x55555580c320, ctx=0x55555580c0a0) at index-search.c:1547
    _data_stack_cur_id = 4

    _ctx = 0x55555580c0a0

    box = 0x5555557fc530

    match = -1

    ret = -1

    imail = 0x55555580c320

    cost1 = 3218534
#11 search_more_with_prefetching (mail_r=0x7fffffffde90, ctx=0x55555580c0a0) at index-search.c:1628
---Type <return> to continue, or q <return> to quit---
    _data_stack_cur_id = 3

    count = &lt;optimized out>

    ret = &lt;optimized out>

    mail = 0x55555580c320
#12 search_more (ctx=ctx@entry=0x55555580c0a0, mail_r=mail_r@entry=0x7fffffffde90) at index-search.c:1700
    imail = &lt;optimized out>

    ret = &lt;optimized out>
#13 0x00007ffff7707fc4 in index_storage_search_next_nonblock (_ctx=0x55555580c0a0, mail_r=0x7fffffffdf58, tryagain_r=0x7fffffffdf07) at index-search.c:1728
    mail = 0x5555557e4ce0

    seq = 0

    ret = &lt;optimized out>
#14 0x00007ffff7696ba2 in mailbox_search_next_nonblock (ctx=0x55555580c0a0, mail_r=0x7fffffffdf58, tryagain_r=<optimized out>) at mail-storage.c:1784
    box = &lt;optimized out>
#15 0x00007ffff7696c0f in mailbox_search_next (ctx=0x55555580c0a0, mail_r=mail_r@entry=0x7fffffffdf58) at mail-storage.c:1769
    tryagain = false
#16 0x00005555555809d2 in doveadm_mail_iter_next (iter=<optimized out>, mail_r=mail_r@entry=0x7fffffffdf58) at doveadm-mail-iter.c:154
No locals.
#17 0x00005555555839dd in cmd_search_box (info=<optimized out>, ctx=0x5555557e9800) at doveadm-mail-search.c:36
    iter = 0x5555557fbb60

    box = &lt;optimized out>

    ret = 0

    mail = 0x0

    metadata = {guid = "\242\n\337\066\322|c_\330\004\000\000\303B(\247", virtual_size = 0, physical_size = 0, first_save_date = 0, cache_fields = 0x0,

      precache_fields = (unknown: 0), backend_ns_prefix = 0x0, backend_ns_type = (unknown: 0)}

    guid_str = 0x5555557da3f0 "a20adf36d27c635fd8040000c34228a7"
#18 cmd_search_run (ctx=0x5555557e9800, user=<optimized out>) at doveadm-mail-search.c:61
    _data_stack_cur_id = 2

    iter = 0x5555557f3ed0

    info = &lt;optimized out>

    ret = &lt;optimized out>
#19 0x000055555557acef in doveadm_mail_next_user (ctx=ctx@entry=0x5555557e9800, cctx=cctx@entry=0x7fffffffe0f0, error_r=error_r@entry=0x7fffffffe0e8)
at doveadm-mail.c:400

    input = {module = 0x0, service = 0x5555555afc11 "doveadm", username = 0x5555557d8360 "m056e04b", session_id = 0x0, session_id_prefix = 0x0,

      local_ip = {family = 0, u = {ip6 = {__in6_u = {__u6_addr8 = '\000' &lt;repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0,

                0, 0, 0}}}, ip4 = {s_addr = 0}}}, remote_ip = {family = 0, u = {ip6 = {__in6_u = {__u6_addr8 = '\000' &lt;repeats 15 times>,

              __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, ip4 = {s_addr = 0}}}, local_port = 0, remote_port = 0,

      userdb_fields = 0x0, flags_override_add = (unknown: 0), flags_override_remove = (unknown: 0), no_userdb_lookup = 0}

    error = 0x12830 &lt;error: Cannot access memory at address 0x12830>

    ip = &lt;optimized out>

    ret = &lt;optimized out>

    __FUNCTION__ = "doveadm_mail_next_user"
#20 0x000055555557b78d in doveadm_mail_single_user (ctx=ctx@entry=0x5555557e9800, cctx=cctx@entry=0x7fffffffe0f0, error_r=error_r@entry=0x7fffffffe0e8)
at doveadm-mail.c:431

    __FUNCTION__ = "doveadm_mail_single_user"
#21 0x000055555557b876 in doveadm_mail_cmd_exec (ctx=ctx@entry=0x5555557e9800, wildcard_user=wildcard_user@entry=0x0) at doveadm-mail.c:594
    cctx = {cmd = 0x0, argc = 0, argv = 0x0, username = 0x5555557d8360 "m056e04b", cli = false, local_ip = {family = 0, u = {ip6 = {__in6_u = {

              __u6_addr8 = '\000' &lt;repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, ip4 = {s_addr = 0}}},

      remote_ip = {family = 0, u = {ip6 = {__in6_u = {__u6_addr8 = '\000' &lt;repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0,

                0, 0, 0}}}, ip4 = {s_addr = 0}}}, local_port = 0, remote_port = 0}

    ret = &lt;optimized out>

    error = 0x7ffff73dc07d &lt;buffer_alloc+45> "\200K0\001H\211C\020H\211k H\211\003H\203\304\b[]\303\017\037D"
#22 0x000055555557c5b6 in doveadm_cmd_ver2_to_mail_cmd_wrapper (cctx=0x7fffffffe320) at doveadm-mail.c:1010
    mctx = 0x5555557e9800

    wildcard_user = &lt;optimized out>

    fieldstr = 0x5555557df41b "Hallo"

    i = &lt;optimized out>

    mail_cmd = {alloc = 0x555555583890 &lt;cmd_search_alloc>, name = 0x5555555b1e54 "search",

      usage_args = 0x5555555b1e88 "[-u &lt;user>|-A] [-S &lt;socket_path>] &lt;search query>"}
#23 0x000055555558a165 in doveadm_cmd_run_ver2 (argc=argc@entry=7, argv=argv@entry=0x5555557df3a0, cctx=cctx@entry=0x7fffffffe320) at doveadm-cmd.c:519
---Type <return> to continue, or q <return> to quit---quit
Quit
(gdb) quit
Von: rudolf@padaru.de <rudolf@padaru.de>
Gesendet: Donnerstag, 17. September 2020 17:28
An: 'Dovecot Mailing List' <dovecot@dovecot.org>
Betreff: doveadm search segfault Dovecot 2.2.22
Good Evening,
i have a serius problem by usung the search function via imap or via doveadm.
If i run this command:
doveadm search -u <user> mailbox INBOX text 'Hello'
I receive this line in my maillog:
dovecot: imap(<user>): Fatal: master: service(imap): child 7472 killed with signal 11 (core dumped)
in my /var/log/apport.log i can see this:
ERROR: apport (pid 17785) Thu Sep 17 17:19:01 2020: called for pid 17777, signal 11, core limit 0, dump mode 1
ERROR: apport (pid 17785) Thu Sep 17 17:19:01 2020: executable: /usr/bin/doveadm (command line "doveadm search -u <user> mailbox INBOX text Hello")
ERROR: apport (pid 17785) Thu Sep 17 17:19:01 2020: is_closing_session(): no DBUS_SESSION_BUS_ADDRESS in environment
ERROR: apport (pid 17785) Thu Sep 17 17:19:01 2020: this executable already crashed 2 times, ignoring
A ‘gdb $(cat ExecutablePath) CoreDump‘ from the unpackes dumpe show this:
GNU gdb (Ubuntu 7.11.1-0ubuntu1~16.5) 7.11.1
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/bin/doveadm...(no debugging symbols found)...done.
[New LWP 1441]
Core was generated by `doveadm search -u <user> mailbox INBOX text Hello'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007fb4da1f83f3 in ?? () from /usr/lib/dovecot/libdovecot.so.0
A doveconf -n show this output:
# 2.2.22 (fe789d2): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.4.13 (7b14904)
# OS: Linux 4.15.0-117-generic x86_64 Ubuntu 16.04.7 LTS
auth_mechanisms = plain login
auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@üÜöÖäÄ
auth_worker_max_count = 60
disable_plaintext_auth = no
imap_capability = +XLIST
imap_logout_format = in=%i out=%o del=%{deleted} fetched_mails=%{fetch_hdr_count}
lda_mailbox_autocreate = yes
lda_mailbox_autosubscribe = yes
lock_method = flock
login_greeting = <myServer> mailserver ready.
login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c
mail_cache_min_mail_count = 30
mail_location = auto:
mail_max_userip_connections = 30
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader imapflags notify vnd.dovecot.pipe vnd.dovecot.filter vnd.dovecot.execute
mbox_read_locks = dotlock
mbox_very_dirty_syncs = yes
mdbox_rotate_size = 250 M
namespace inbox {
inbox = yes
location =
mailbox Archiv {
auto = no

special_use =
}
mailbox Drafts {
auto = no

special_use =
}
mailbox Junk {
auto = no

special_use =
}
mailbox Sent {
auto = no

special_use =
}
mailbox "Sent Messages" {
special_use = \Sent
}
mailbox Trash {
auto = no

special_use =
}
prefix =
}
passdb {
args = /etc/dovecot/conf.d/zDovecot-sql.conf.ext
driver = sql
}
plugin {
sieve = ~/sieve/.dovecot.sieve
sieve_after = ~/sieve_after/.dovecot_after.sieve
sieve_before = ~/sieve_before/.dovecot_before.sieve
sieve_dir = ~/sieve
sieve_execute_bin_dir = /usr/local/bin/
sieve_execute_input_eol = lf
sieve_extensions = +notify +imapflags +vnd.dovecot.pipe +vnd.dovecot.filter +vnd.dovecot.execute +editheader -reject
sieve_filter_bin_dir = /usr/local/bin/
sieve_filter_input_eol = lf
sieve_global_dir = /etc/dovecot/sieve/
sieve_max_redirects = 25
sieve_pipe_bin_dir = /usr/local/bin/
sieve_pipe_input_eol = lf
sieve_plugins = sieve_extprograms
sieve_redirect_envelope_from = recipient
zlib_save = gz
zlib_save_level = 6
}
protocols = imap pop3 sieve
service auth-worker {
idle_kill = 1 mins
}
service auth {
idle_kill = 1 mins
unix_listener /var/spool/postfix/private/auth {
group = postfix

mode = 0660

user = postfix
}
user = root
}
service imap-login {
executable = /usr/lib/dovecot/imap-login
process_min_avail = 4
service_count = 0
user = dovecot
}
service imap {
process_limit = 1024
}
service managesieve-login {
inet_listener sieve {
port = 4190
}
service_count = 0
user = dovecot
}
service managesieve {
process_limit = 1024
user = dovecot
}
service pop3-login {
executable = /usr/lib/dovecot/pop3-login
process_min_avail = 4
service_count = 0
user = dovecot
}
service pop3 {
executable = /usr/lib/dovecot/pop3
process_limit = 1024
}
shutdown_clients = no
ssl_ca = </etc/apache2/zertifikate/*.<myServer>.pem
ssl_cert = </etc/apache2/zertifikate/*.<myServer>.pem
ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:!DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
ssl_dh_parameters_length = 2048
ssl_key = </etc/apache2/zertifikate/*.<myServer>.pem
ssl_prefer_server_ciphers = yes
ssl_protocols = !SSLv3
userdb {
args = /etc/dovecot/conf.d/zDovecot-sql.conf.ext
driver = sql
}
verbose_proctitle = yes
protocol lda {
mail_plugins = " sieve zlib"
rejection_reason = Your message to <%t> was automatically discarded:%n%r
}
protocol imap {
imap_client_workarounds = delay-newmail
mail_plugins = " mail_log notify zlib"
ssl = yes
}
protocol pop3 {
mail_plugins = zlib
pop3_client_workarounds = oe-ns-eoh outlook-no-nuls
pop3_no_flag_updates = no
pop3_uidl_format = %08Xu%08Xv
ssl = yes
}
What surprises me is that this problem only occurs with a text search in the inbox, I search in other mailboxes or only in the header this problem does not occur.
Can anyone give me a tip on how I can solve this problem without upgrading to 2.33?
Mit freundlichen Grüßen
Yours sincerely
<https://padaru.de/>
Pascal Rudolf | Geschäftsführer
PADARU-IT | Bielebohstraße 10 | 02736  Beiersdorf
@:  <mailto:rudolf@padaru.de> rudolf@padaru.de | www: <http://padaru.de/>  padaru.de
mobil: +49 (0) 17 772 595 32

rudolf＠padaru.de

Aki Tuomi

tags

participants (2)