[Dovecot] crash while fts searching a virtual folder

Wed May 7 08:14:08 UTC 2014

On Fri, 2 May 2014, Timo Sirainen wrote:

> On 25.4.2014, at 15.24, Matthias Rieber <ml-dovecot at zu-con.org> wrote:
>
>> searching a virtual folder crashes dovecot quite often. I'm using dovecot 2.2.12. Here's the backtrace:
>>
>> #5  0x00007fc1d6774ed9 in level_scores_add_vuids (br=0x2413ab8, level=0x1c0c2e0, vbox=0x170c950) at fts-search.c:81
>
> http://hg.dovecot.org/dovecot-2.2/rev/d63b209737be should fix this.

after a few searches I get the following crash:

[New LWP 4218]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `dovecot/imap'.
Program terminated with signal 6, Aborted.
#0  0x00007fbfff6d9425 in raise () from /lib/x86_64-linux-gnu/libc.so.6
#0  0x00007fbfff6d9425 in raise () from /lib/x86_64-linux-gnu/libc.so.6
No symbol table info available.
#1  0x00007fbfff6dcb8b in abort () from /lib/x86_64-linux-gnu/libc.so.6
No symbol table info available.
#2  0x00007fbfffacc935 in default_fatal_finish (type=<optimized out>, status=0) at failures.c:193
         backtrace = 0x1240598 "/usr/local/lib/dovecot/libdovecot.so.0(+0x6993f) [0x7fbfffacc93f] -> /usr/local/lib/dovecot/libdovecot.so.0(+0x6999e) [0x7fbfffacc99e] -> /usr/local/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7fbfffa85"...
#3  0x00007fbfffacc99e in i_internal_fatal_handler (ctx=0x7fffe578e2f0, format=<optimized out>, args=<optimized out>) at failures.c:657
         status = 0
#4  0x00007fbfffa85969 in i_panic (format=<optimized out>) at failures.c:267
         ctx = {type = LOG_TYPE_PANIC, exit_status = 0, timestamp = 0x0}
         args = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 0x7fffe578e3c0, reg_save_area = 0x7fffe578e300}}
#5  0x00007fbffea5a007 in fts_search_deserialize_add_idx (args=<optimized out>, buf=<optimized out>, idx=<optimized out>, matches=<optimized out>) at fts-search-serialize.c:63
No locals.
#6  fts_search_deserialize_add_idx (args=0x1622db0, buf=0x16a5ac8, idx=0x7fffe578e40c, matches=false) at fts-search-serialize.c:56
         data = 0x16a5b00 ""
#7  0x00007fbffea5a15c in fts_search_deserialize_add_nonmatches (args=<optimized out>, buf=0x16a5ac8) at fts-search-serialize.c:97
         idx = 0
         __FUNCTION__ = "fts_search_deserialize_add_nonmatches"
#8  0x00007fbffea5ab7f in fts_search_apply_results_level (ctx=0x134e850, args=0x1622db0, idx=0x7fffe578e46c) at fts-storage.c:277
         fctx = <optimized out>
         level = 0x16257e0
#9  0x00007fbffea5ad12 in fts_mailbox_search_next_update_seq (ctx=0x134e850) at fts-storage.c:314
         fbox = 0x12769a0
         fctx = 0x16256a0
         idx = 0
#10 0x00007fbfffddbb1c in search_more_with_mail (mail=0x16b62b0, ctx=0x134e850) at index-search.c:1509
         _ctx = 0x134e850
         box = 0x12759a0
         match = 0
         ret = -1
         imail = 0x16b62b0
         cost1 = 0
#11 search_more_with_prefetching (mail_r=<optimized out>, ctx=<optimized out>) at index-search.c:1582
         _data_stack_cur_id = 4
         ret = <optimized out>
         mail = 0x16b62b0
#12 search_more (ctx=0x134e850, mail_r=0x7fffe578e500) at index-search.c:1653
         imail = <optimized out>
         ret = 0
#13 0x00007fbfffddc1b8 in index_storage_search_next_nonblock (_ctx=0x134e850, mail_r=0x7fffe578e600, tryagain_r=0x7fffe578e60f) at index-search.c:1689
         ctx = 0x134e850
         mail = 0x62e8f0
         seq = <optimized out>
         ret = <optimized out>
#14 0x00007fbffe846106 in virtual_search_next_nonblock (ctx=0x134e850, mail_r=0x7fffe578e600, tryagain_r=0x7fffe578e60f) at virtual-search.c:150
         vctx = 0x16253c0
         ictx = 0x134e850
         seq = <optimized out>
         __FUNCTION__ = "virtual_search_next_nonblock"
#15 0x00007fbffe84601e in virtual_search_next_nonblock (ctx=0x134e850, mail_r=0x7fffe578e600, tryagain_r=0x7fffe578e60f) at virtual-search.c:148
         vctx = 0x16253c0
         ictx = 0x134e850
         seq = <optimized out>
         __FUNCTION__ = "virtual_search_next_nonblock"
#16 0x00007fbfffdb5ac7 in mailbox_search_next_nonblock (ctx=0x134e850, mail_r=0x7fffe578e600, tryagain_r=<optimized out>) at mail-storage.c:1796
         box = <optimized out>
#17 0x000000000041c6e7 in cmd_search_more (cmd=0x1273180) at imap-search.c:443
         ctx = 0x12732a0
         opts = SEARCH_RETURN_ALL
         mail = 0x0
         sync_flags = <optimized out>
         end_time = {tv_sec = 23813664, tv_usec = 1024}
         range = 0x6
         count = <optimized out>
         id = <optimized out>
         id_min = 0
         id_max = 0
         ok_reply = <optimized out>
         time_msecs = <optimized out>
         tryagain = <optimized out>
         lost_data = <optimized out>
         __FUNCTION__ = "cmd_search_more"
#18 0x000000000041cb69 in imap_search_start (ctx=0x12732a0, sargs=<optimized out>, sort_program=<optimized out>) at imap-search.c:610
         cmd = 0x1273180
         __FUNCTION__ = "imap_search_start"
#19 0x0000000000412f49 in cmd_sort (cmd=0x1273180) at cmd-sort.c:141
         ctx = 0x12732a0
         sargs = 0x1622ce0
         sort_program = {MAIL_SORT_DATE, MAIL_SORT_END, 4289657586, 32703, 17, MAIL_SORT_END, MAIL_SORT_SUBJECT, 48, 3849906112, 32767, 3849905904, 32767}
         args = 0x124bad8
         list_args = 0x124bc18
         charset = 0x124bd70 "US-ASCII"
         ret = <optimized out>
#20 0x000000000041732d in command_exec (cmd=0x1273180) at imap-commands.c:158
         hook = 0x12490f0
         ret = <optimized out>
#21 0x00000000004163c0 in client_command_input (cmd=0x1273180) at imap-client.c:778
         client = 0x1272620
         command = <optimized out>
         __FUNCTION__ = "client_command_input"
#22 0x00000000004164a5 in client_command_input (cmd=0x1273180) at imap-client.c:839
         client = 0x1272620
         command = <optimized out>
         __FUNCTION__ = "client_command_input"
#23 0x000000000041674d in client_handle_next_command (remove_io_r=<synthetic pointer>, client=0x1272620) at imap-client.c:877
No locals.
#24 client_handle_input (client=0x1272620) at imap-client.c:889
         _data_stack_cur_id = 3
         ret = 64
         remove_io = false
         handled_commands = false
         __FUNCTION__ = "client_handle_input"
#25 0x0000000000416ac2 in client_input (client=0x1272620) at imap-client.c:931
         cmd = <optimized out>
         output = 0x1273040
         bytes = 51
         __FUNCTION__ = "client_input"
#26 0x00007fbfffadd93e in io_loop_call_io (io=0x12701e0) at ioloop.c:441
         ioloop = 0x1248730
         t_id = 2
         __FUNCTION__ = "io_loop_call_io"
#27 0x00007fbfffade95f in io_loop_handler_run_internal (ioloop=<optimized out>) at ioloop-epoll.c:220
         ctx = 0x12493d0
         events = 0x0
         event = 0x124a240
         list = 0x124ae30
         io = <optimized out>
         tv = {tv_sec = 1799, tv_usec = 998979}
         events_count = <optimized out>
         msecs = <optimized out>
         ret = 1
         i = <optimized out>
         call = <optimized out>
         __FUNCTION__ = "io_loop_handler_run_internal"
#28 0x00007fbfffadd9c9 in io_loop_handler_run (ioloop=0x1248730) at ioloop.c:488
No locals.
#29 0x00007fbfffadda48 in io_loop_run (ioloop=0x1248730) at ioloop.c:465
         __FUNCTION__ = "io_loop_run"
#30 0x00007fbfffa8ad83 in master_service_run (service=0x12485c0, callback=<optimized out>) at master-service.c:566
No locals.
#31 0x000000000040af58 in main (argc=1, argv=0x1248390) at main.c:400
         set_roots = {0x4278a0, 0x0}
         login_set = {auth_socket_path = 0x1240058 "", postlogin_socket_path = 0x0, postlogin_timeout_secs = 60, callback = 0x41fb50 <login_client_connected>, failure_callback = 0x41f860 <login_client_failed>, request_auth_token = 1}
         service_flags = <optimized out>
         storage_service_flags = <optimized out>
         username = <optimized out>
         c = <optimized out>

When I delete the dovecot.index* files I can search again for a few times.

Matthias