Bug when using METADATA and ACLs

[Sergio Talens-Oliag]

Hi,

I'm trying to use the current version of dovecot as the IMAP server for Kolab
and things seem to be working more or less OK, but while working on it I've
found a dovecot bug that can probably be fixed quickly by someone familiar
with the code.

I've found the problem using shared folders, but it is related to ACLs and
METADATA.

The problem appears when a user only has the 'l' (lookup) permission on a
folder and later tries to get METADATA from all his or her folders; a sample
session to ilustrate the problem:

  A1 GETACL "foo"
  * ACL foo admin akxeilprwtscd -admin "" sto at iti.es lrwstipekxacd
  A1 OK Getacl completed.
  A2 SETACL "foo" sto at iti.es l
  A2 OK Setacl complete.
  A3 GETACL "foo"
  * ACL foo admin akxeilprwtscd -admin "" sto at iti.es al
  A3 OK Getacl completed.
  A4 GETMETADATA "foo" (/private/vendor/kolab/folder-type /shared/vendor/kolab/folder-type)
  A4 NO [NOPERM] Permission denied
  A5 GETMETADATA "*" (/private/vendor/kolab/folder-type /shared/vendor/kolab/folder-type)
  
  <CORE DUMPED>

The dovecot.log messages are:

  Feb 05 13:59:12 imap(sto at iti.es): Panic: file imap-client.c: line 636 (client_command_free): assertion failed: (client->output_cmd_lock == NULL)
  Feb 05 13:59:12 imap(sto at iti.es): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0x756cf) [0x7f55ab3da6cf] -> /usr/lib/dovecot/libdovecot.so.0(+0x7572e) [0x7f55ab3da72e] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f55ab38c575] -> dovecot/imap [sto at iti.es 127.0.0.1 GETMETADATA](+0x18c9e) [0x7f55abba5c9e] -> dovecot/imap [sto at iti.es 127.0.0.1 GETMETADATA](+0x18e9a) [0x7f55abba5e9a] -> dovecot/imap [sto at iti.es 127.0.0.1 GETMETADATA](+0x18ef4) [0x7f55abba5ef4] -> dovecot/imap [sto at iti.es 127.0.0.1 GETMETADATA](client_handle_input+0x115) [0x7f55abba61e5] -> dovecot/imap [sto at iti.es 127.0.0.1 GETMETADATA](client_input+0x75) [0x7f55abba65b5] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x5b) [0x7f55ab3ec51b] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0xbb) [0x7f55ab3ed59b] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x9) [0x7f55ab3ec5a9] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f55ab3ec628] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f55ab391a43] -> dovecot/imap [sto at iti.es 127.0.0.1 GETMETADATA](main+0x2b7) [0x7f55abb9a717] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xfd) [0x7f55aaff7ead] -> dovecot/imap [sto at iti.es 127.0.0.1 GETMETADATA](+0xd889) [0x7f55abb9a889]
  Feb 05 13:59:12 imap(sto at iti.es): Fatal: master: service(imap): child 32404 killed with signal 6 (core dumped)

And the gdb output is (my binary has no debug symbols, so I guess it is not
really useful):

  (gdb) bt full
  #0  0x00007f55ab00b165 in raise () from /lib/x86_64-linux-gnu/libc.so.6
  No symbol table info available.
  #1  0x00007f55ab00e3e0 in abort () from /lib/x86_64-linux-gnu/libc.so.6
  No symbol table info available.
  #2  0x00007f55ab3da6c5 in ?? () from /usr/lib/dovecot/libdovecot.so.0
  No symbol table info available.
  #3  0x00007f55ab3da72e in ?? () from /usr/lib/dovecot/libdovecot.so.0
  No symbol table info available.
  #4  0x00007f55ab38c575 in i_panic () from /usr/lib/dovecot/libdovecot.so.0
  No symbol table info available.
  #5  0x00007f55abba5c9e in client_command_free ()
  No symbol table info available.
  #6  0x00007f55abba5e9a in ?? ()
  No symbol table info available.
  #7  0x00007f55abba5ef4 in ?? ()
  No symbol table info available.
  #8  0x00007f55abba61e5 in client_handle_input ()
  No symbol table info available.
  #9  0x00007f55abba65b5 in client_input ()
  No symbol table info available.
  #10 0x00007f55ab3ec51b in io_loop_call_io () from
  /usr/lib/dovecot/libdovecot.so.0
  No symbol table info available.
  #11 0x00007f55ab3ed59b in io_loop_handler_run_internal () from
  /usr/lib/dovecot/libdovecot.so.0
  No symbol table info available.
  #12 0x00007f55ab3ec5a9 in io_loop_handler_run () from
  /usr/lib/dovecot/libdovecot.so.0
  No symbol table info available.
  #13 0x00007f55ab3ec628 in io_loop_run () from
  /usr/lib/dovecot/libdovecot.so.0
  No symbol table info available.
  #14 0x00007f55ab391a43 in master_service_run () from
  /usr/lib/dovecot/libdovecot.so.0
  No symbol table info available.
  #15 0x00007f55abb9a717 in main ()
  No symbol table info available.

If someone can look into it I will be grateful; of course if more info is
needed I'm available to help as much as I can.

Thanks in advance,

  Sergio.

-- 
Sergio Talens-Oliag <sto at iti.es>               <http://www.iti.es/>
Key fingerprint = FF77 A16B 9D09 FC7B 6656 CFAD 261D E19A 578A 36F2