Segfault in acl_mailbox_get_aclobj w/ dovecot

[D[r]eadlock M]

Hello,

I've being trying to play with shared mailboxes but experienced a segfault:
[New LWP 9611]
Core was generated by `dovecot/imap'.
Program terminated with signal SIGSEGV, Segmentation fault.
(gdb) bt f
#0  0x00007f5b72f429b2 in acl_mailbox_get_aclobj (box=<optimized out>) at
acl-mailbox.c:31
        abox = 0x0
#1  0x00007f5b72d30fcc in cmd_myrights (cmd=0x7f5b75c97480) at
imap-acl-plugin.c:331
        ns = <optimized out>
        box = 0x7f5b75ca4520
        mailbox = 0x7f5b75c752a8 "shared"
        orig_mailbox = 0x7f5b75c80be0 "shared"
        rights = 0x7f5b75c75108
        str = <optimized out>
#2  0x00007f5b73f2e09c in command_exec (cmd=cmd at entry=0x7f5b75c97480) at
imap-commands.c:158
        hook = 0x7f5b75c7e0f0
        ret = <optimized out>
#3  0x00007f5b73f2cfb2 in client_command_input (cmd=0x7f5b75c97480) at
imap-client.c:778
        client = 0x7f5b75c96880
        command = <optimized out>
        __FUNCTION__ = "client_command_input"
#4  0x00007f5b73f2d066 in client_command_input (cmd=0x7f5b75c97480) at
imap-client.c:839
        client = 0x7f5b75c96880
        command = <optimized out>
        __FUNCTION__ = "client_command_input"
#5  0x00007f5b73f2d39d in client_handle_next_command
(remove_io_r=<synthetic pointer>, client=0x7f5b75c96880) at
imap-client.c:877
No locals.
#6  client_handle_input (client=0x7f5b75c96880) at imap-client.c:889
        _data_stack_cur_id = 3
        remove_io = false
        handled_commands = true
        client = 0x7f5b75c96880
#7  0x00007f5b73f2d745 in client_input (client=0x7f5b75c96880) at
imap-client.c:931
        cmd = 0x9f3f2
        output = 0x7f5b75c972c0
        bytes = 95
        __FUNCTION__ = "client_input"
#8  0x00007f5b73773d0f in io_loop_call_io (io=0x7f5b75c97390) at
ioloop.c:441
        ioloop = 0x7f5b75c7d740
        t_id = 2
        __FUNCTION__ = "io_loop_call_io"
#9  0x00007f5b73774d09 in io_loop_handler_run_internal
(ioloop=ioloop at entry=0x7f5b75c7d740)
at ioloop-epoll.c:220
        ctx = 0x7f5b75c7e3d0
        io = <optimized out>
        tv = {tv_sec = 1799, tv_usec = 999014}
        events_count = <optimized out>
        msecs = <optimized out>
        ret = 1
        i = 0
        j = <optimized out>
        call = <optimized out>
        __FUNCTION__ = "io_loop_handler_run_internal"
#10 0x00007f5b73773d79 in io_loop_handler_run
(ioloop=ioloop at entry=0x7f5b75c7d740)
at ioloop.c:488
No locals.
#11 0x00007f5b73773df8 in io_loop_run (ioloop=0x7f5b75c7d740) at
ioloop.c:465
        __FUNCTION__ = "io_loop_run"
#12 0x00007f5b7371edc3 in master_service_run (service=0x7f5b75c7d5d0,
callback=<optimized out>) at master-service.c:566
No locals.
#13 0x00007f5b73f21254 in main (argc=1, argv=0x7f5b75c7d390) at main.c:400
        set_roots = {0x7f5b74145980 <imap_setting_parser_info>, 0x0}
        login_set = {auth_socket_path = 0x7f5b75c75048 "\001",
postlogin_socket_path = 0x0, postlogin_timeout_secs = 60, callback =
0x7f5b73f371f0 <login_client_connected>, failure_callback = 0x7f5b73f36ed0
<login_client_failed>,
          request_auth_token = 1}
        service_flags = <optimized out>
        storage_service_flags = <optimized out>
        username = 0x0
        c = <optimized out>


It happens when my client (mutt) tries to enter the shared/ folder. A
filtered strace shows (note the 7 seconds between write and read, presumely
the command sent by mutt):
8704  00:40:51.420843
open("/var/vmail/domain.tld/marc/Maildir/.Sent/dovecot-acl", O_RDONLY) = -1
ENOENT (No such file or directory)
8704  00:40:51.420978
stat("/var/vmail/domain.tld/marc/Maildir/dovecot-acl", 0x7fffc618dcb0) = -1
ENOENT (No such file or directory)
8704  00:40:51.421100 open("/var/vmail/domain.tld/shared-mailboxes",
O_RDONLY) = 4
8704  00:40:51.421800 openat(AT_FDCWD,
"/var/vmail/domain.tld/marc/Maildir",
O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 12
8704  00:40:51.422217 write(7, "* LIST (\\HasNoChildren \\Sent) \"/\"
Sent\r\n* LIST (\\Noselect \\HasNoChildren) \"/\" shared\r\n* LIST
(\\HasNoChildren) \"/\" INBOX\r\na0005 OK List completed.\r\n", 147) = 147
8704  00:40:58.235762 <... read resumed> "a0006 MYRIGHTS
\"shared\"\r\na0007 STATUS \"Drafts\" (MESSAGES)\r\na0008 SELECT
\"shared\"\r\n", 8137) = 82

I admit I've played a little with directories in /var/vmail/ and got a few
'permission denied' but I think I fixed them correctly (move
/var/mail/domain.tld/marc into .../Maildir, who ended being root:root)

To finish, my dovecot -n:
# 2.2.13: /etc/dovecot/dovecot.conf
# OS: Linux 3.16.0-4-amd64 x86_64 Debian 8.2
mail_location = maildir:~/Maildir
mail_plugins = acl
namespace {
  location = maildir:%%h/Maildir:INDEXPVT=~/Maildir/shared/%%n
  prefix = shared/%%n/
  separator = /
  type = shared
}
namespace inbox {
  inbox = yes
  location =
  mailbox Drafts {
    special_use = \Drafts
  }
  mailbox Junk {
    special_use = \Junk
  }
  mailbox Sent {    special_use = \Sent
  }
  mailbox "Sent Messages" {
    special_use = \Sent
  }
  mailbox Trash {
    special_use = \Trash
  }
  prefix =
  separator = /
  type = private
}
passdb {
  args = scheme=SHA512-CRYPT username_format=%u /etc/dovecot/users
  driver = passwd-file
}
plugin {
  acl = vfile
  acl_shared_dict = file:/var/vmail/%d/shared-mailboxes
}
protocols = " imap lmtp"
service auth-worker {
  user = $default_internal_user
}
service auth {
  unix_listener /var/spool/postfix/private/auth {
    mode = 0666
  }
}
service lmtp {
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    group = postfix
    mode = 0666
    user = postfix
  }
}
ssl = required
ssl_cert = </etc/letsencrypt/live/domain.tld/fullchain.pem
ssl_key = </etc/letsencrypt/live/domain.tld/privkey.pem
userdb {
  args = uid=vmail gid=vmail home=/var/vmail/%d/%n
  driver = static
}
userdb {
  args = uid=vmail gid=vmail home=/var/vmail/%d/shared/%n
  driver = static
}
protocol imap {
  mail_plugins = acl imap_acl
}

Thanks,

Marc