dovecot 2.2.13 core dump (signal 11)

[Tom Lieuallen]

We just upgraded from 2.1.16 to 2.2.13.  One user is experiencing 
problems when using the shared namespace.  Specifically it happens when 
opening/reading a message and when deleting messages.  These functions 
work for other users.  So far, this appears to be only affecting one user.

The shared folder is a local ext4 file system and utilizes acls

# 2.2.13: /private/dovecot/etc/dovecot/dovecot.conf
doveconf: Warning: service auth { client_limit=1000 } is lower than 
required under max. load (15360)
doveconf: Warning: service anvil { client_limit=1000 } is lower than 
required under max. load (10243)
# OS: Linux 2.6.32-358.11.1.el6.x86_64 x86_64 Red Hat Enterprise Linux 
Server release 6.5 (Santiago)
default_process_limit = 5120
first_valid_uid = 100
listen = *
mail_location = mbox:~/mail:INBOX=/var/mail/%u:INDEX=/a2/imap-index/%u
mail_plugins = quota acl
namespace {
   hidden = yes
   inbox = no
   list = children
   location = maildir:/a1/dove-shared:INDEX=/a2/imap-index/dove-shared/%u
   prefix = sharedimap/
   separator = /
   type = shared
}
namespace inbox {
   inbox = yes
   location =
   mailbox Drafts {
     special_use = \Drafts
   }
   mailbox Junk {
     special_use = \Junk
   }
   mailbox Sent {
     special_use = \Sent
   }
   mailbox "Sent Messages" {
     special_use = \Sent
   }
   mailbox Trash {
     special_use = \Trash
   }
   prefix =
}
passdb {
   args = /private/dovecot/etc/dovecot/dovecot-ldap.conf.ext
   driver = ldap
}
passdb {
   args = scheme=CRYPT username_format=%u /private/dovecot/etc/passwd
   driver = passwd-file
}
plugin {
   acl = vfile
   quota = fs:INBOX:mount=/a1
   quota2 = fs:Home quota:mount=%h
}
protocols = imap lmtp
service imap-login {
   service_count = 1
}
service imap {
   process_limit = 2048
}
ssl_cert = </private/ssl/certs/mail.engr.oregonstate.edu.pem
ssl_key = </private/ssl/certs/mail.engr.oregonstate.edu.pem
userdb {
   args = /private/dovecot/etc/dovecot/dovecot-ldap.conf.ext
   driver = ldap
}
userdb {
   args = username_format=%u /private/dovecot/etc/passwd
   driver = passwd-file
}
protocol imap {
   mail_max_userip_connections = 20
}


Here's the backtrace in gdb.

Core was generated by `dovecot/imap'.
Program terminated with signal 11, Segmentation fault.
#0  acl_mailbox_right_lookup (box=0x12e6730, right_idx=7) at 
acl-mailbox.c:40
40		if (abox->skip_acl_checks)
Missing separate debuginfos, use: debuginfo-install 
glibc-2.12-1.132.el6_5.2.x86_64 sssd-client-1.9.2-129.el6.x86_64
(gdb) bt full
#0  acl_mailbox_right_lookup (box=0x12e6730, right_idx=7) at 
acl-mailbox.c:40
         abox = 0x0
         alist = <value optimized out>
         ret = <value optimized out>
#1  0x00007f4c11604d06 in acl_copy_has_rights (ctx=0x12f9810, 
mail=0x12f5030)
     at acl-mailbox.c:409
         destbox = 0x12edf90
         save_right = <value optimized out>
#2  acl_copy (ctx=0x12f9810, mail=0x12f5030) at acl-mailbox.c:430
         t = <value optimized out>
         abox = 0x12ee5f8
#3  0x00007f4c11b741ed in mailbox_copy (_ctx=<value optimized out>,
     mail=0x12f5030) at mail-storage.c:2149
         ctx = 0x12f9810
         t = 0x12f32d0
         keywords = 0x12f9b80
         pvt_flags = 0
         backend_mail = 0x12f5030
         ret = <value optimized out>
         __FUNCTION__ = "mailbox_copy"
#4  0x00007f4c11b742dd in mailbox_move (_ctx=<value optimized out>,
     mail=0x12f5030) at mail-storage.c:2170
         ctx = 0x12f9810
#5  0x000000000040c587 in fetch_and_copy (cmd=0x12e3f10, move=true)
     at cmd-copy.c:67
         search_ctx = 0x12f4db0
         src_trans = 0x12f4090
         srcset_ctx = {str = 0x12bf328, first_uid = 0, last_uid = 
4294967295}
         ret = 1
         save_ctx = 0x0
         mail = 0x12f5030
         copy_count = 1
         src_uidset = 0x12bf328
#6  cmd_copy_full (cmd=0x12e3f10, move=true) at cmd-copy.c:123
         client = 0x12e3330
         dest_storage = <value optimized out>
         destbox = 0x12edf90
         t = 0x12f32d0
         src_trans = <value optimized out>
         search_args = 0x12ecf80
         messageset = 0x12cac10 "112850,112871,112903:112905,112919"
         mailbox = 0x12cac38 "Trash"
         src_uidset = <value optimized out>
         sync_flags = 0
         imap_flags = 0
         changes = {pool = 0x12e6730, uid_validity = 19807984, 
saved_uids = {


(I'm not sure how much more info is needed; let me know if more...)

thank you

Tom Lieuallen