dovecot - Apr 2014 - Segfault in dovecot-lda when resolver is unavailable

Hi list!

Recently I noticed that dovecot-lda throws segfault when resolver is
unavailable and with imapc configured.

$ cat /etc/resolv.conf
search .
nameserver 127.0.0.1

backtrace:
# gdb -q /usr/libexec/dovecot/dovecot-lda
'core-1398282784-8-11-!usr!libexec!dovecot!dovecot-lda-8805'
[...]
Core was generated by `/usr/libexec/dovecot/deliver -d marcin at mejor.pl'.
Program terminated with signal 11, Segmentation fault.
#0  0x000002b612afaf72 in _int_free (av=0x2b612e215c0 <main_arena>,
p=0x1b23bfabe0, have_lock=0) at malloc.c:3903
3903          unlink(p, bck, fwd);
(gdb) bt
#0  0x000002b612afaf72 in _int_free (av=0x2b612e215c0 <main_arena>,
p=0x1b23bfabe0, have_lock=0) at malloc.c:3903
#1  0x000002b612e96a4e in buffer_free (_buf=_buf at entry=0x1b23bfa948) at
buffer.c:144
#2  0x000002b612ebeca8 in array_free_i (array=0x1b23bfa948) at array.h:108
#3  priorityq_deinit (_pq=_pq at entry=0x1b23bfabb0) at priorityq.c:38
#4  0x000002b612eafa57 in io_loop_destroy
(_ioloop=_ioloop at entry=0x395a4da91d0) at ioloop.c:495
#5  0x000002b61306f225 in imapc_client_run_post (client=<optimized out>)
at imapc-client.c:175
#6  imapc_client_run (client=0x1b23bda930) at imapc-client.c:181
#7  0x000002b613067158 in imapc_list_try_get_root_sep
(list=0x1b23bd7b60, sep_r=sep_r at entry=0x395a4da9247 "") at
imapc-list.c:297
#8  0x000002b6130671ae in imapc_list_get_hierarchy_sep (_list=<optimized
out>) at imapc-list.c:310
#9  0x000002b613065d9f in imapc_list_get_fs_name (list=0x1b23bd7b60,
name=0x0) at imapc-list.c:396
#10 0x000002b613066031 in imapc_list_get_path (_list=0x1b23bd7b60,
name=0x0, type=MAILBOX_LIST_PATH_TYPE_MAILBOX, path_r=0x395a4da9338) at
imapc-list.c:437
#11 0x000002b613089785 in mailbox_list_get_root_path (list=<optimized
out>, type=type at entry=MAILBOX_LIST_PATH_TYPE_MAILBOX,
    path_r=path_r at entry=0x395a4da9338) at mailbox-list.c:1276
#12 0x000002b612ff8eb5 in quota_add_user_namespace (quota=0x1b23bcea80,
ns=0x1b23bd7a10) at quota.c:745
#13 0x000002b61300073a in quota_mailbox_list_created (list=0x1b23bfd9c0)
at quota-storage.c:590
#14 0x000002b613084581 in hook_mailbox_list_created
(list=list at entry=0x1b23bfd9c0) at mail-storage-hooks.c:328
#15 0x000002b61308836f in mailbox_list_create
(driver=driver at entry=0x2b6130e677b "maildir++", ns=0x1b23bd7a10,
set=set at entry=0x395a4da94a0,
    flags=<optimized out>, list_r=list_r at entry=0x1b23bd7d60,
error_r=error_r at entry=0x395a4da9498) at mailbox-list.c:210
#16 0x000002b613065cf6 in imapc_list_get_fs
(list=list at entry=0x1b23bd7b60) at imapc-list.c:379
#17 0x000002b61306601e in imapc_list_get_path (_list=0x1b23bd7b60,
name=0x0, type=MAILBOX_LIST_PATH_TYPE_MAILBOX, path_r=0x395a4da9588) at
imapc-list.c:433
#18 0x000002b613089785 in mailbox_list_get_root_path (list=<optimized
out>, type=type at entry=MAILBOX_LIST_PATH_TYPE_MAILBOX,
    path_r=path_r at entry=0x395a4da9588) at mailbox-list.c:1276
#19 0x000002b612ff8eb5 in quota_add_user_namespace (quota=0x1b23bcea80,
ns=0x1b23bd7a10) at quota.c:745
#20 0x000002b61300073a in quota_mailbox_list_created (list=0x1b23bd7b60)
at quota-storage.c:590
#21 0x000002b613084581 in hook_mailbox_list_created
(list=list at entry=0x1b23bd7b60) at mail-storage-hooks.c:328
#22 0x000002b61308836f in mailbox_list_create
(driver=driver at entry=0x2b6130e6d1b "imapc", ns=ns at
entry=0x1b23bd7a10,
set=set at entry=0x395a4da9720,
    flags=<optimized out>, list_r=list_r at entry=0x395a4da9708,
error_r=error_r at entry=0x395a4da9810) at mailbox-list.c:210
#23 0x000002b61307f500 in mail_storage_create_full
(ns=ns at entry=0x1b23bd7a10, driver=<optimized out>, driver at entry=0x0,
data=<optimized out>,
    flags=flags at entry=(unknown: 0),
storage_r=storage_r at entry=0x395a4da97c0,
error_r=error_r at entry=0x395a4da9810) at mail-storage.c:356
#24 0x000002b61307f7cc in mail_storage_create (ns=ns at entry=0x1b23bd7a10,
driver=driver at entry=0x0, flags=flags at entry=(unknown: 0),
    error_r=error_r at entry=0x395a4da9810) at mail-storage.c:407
#25 0x000002b613077a48 in namespace_add (user=user at entry=0x1b23bcf7e0,
ns_set=0x1b23bd0db8, unexpanded_ns_set=0x1b23bcff30,
    mail_set=mail_set at entry=0x1b23bd07e8, ns_p=ns_p at entry=0x1b23bd3b00,
error_r=error_r at entry=0x395a4da9950) at mail-namespace.c:170
#26 0x000002b613078aaf in mail_namespaces_init (user=0x1b23bcf7e0,
error_r=error_r at entry=0x395a4da9950) at mail-namespace.c:344
#27 0x000002b6130901bf in mail_storage_service_init_post
(error_r=0x395a4da9950, mail_user_r=0x395a4da9b18, priv=0x395a4da9960,
user=0x1b23bbde50,
    ctx=<optimized out>) at mail-storage-service.c:685
#28 mail_storage_service_next (ctx=ctx at entry=0x1b23bbd4f0,
user=0x1b23bbde50, mail_user_r=mail_user_r at entry=0x395a4da9b18) at
mail-storage-service.c:1223
#29 0x000002b6130904b5 in mail_storage_service_lookup_next
(ctx=0x1b23bbd4f0, input=input at entry=0x395a4da9b80,
user_r=user_r at entry=0x395a4da9a70,
    mail_user_r=mail_user_r at entry=0x395a4da9b18,
error_r=error_r at entry=0x395a4da9a60) at mail-storage-service.c:1258
#30 0x0000001b22341ccb in main (argc=3, argv=0x1b23bbb060) at main.c:412


# doveconf -n
# 2.2.12: /etc/dovecot/dovecot.conf
# OS: Linux 3.13.8-hardened x86_64 Gentoo Base System release 2.2
auth_cache_size = 1 k
auth_master_user_separator = *
auth_mechanisms = login digest-md5 cram-md5 plain
deliver_log_format = msgid=%m: from=%f: phys=%p: virt=%w %$
dict {
  quota = pgsql:/etc/dovecot/dovecot-dict-sql.conf.ext
}
first_valid_uid = 8
last_valid_uid = 8
lda_mailbox_autocreate = yes
lda_mailbox_autosubscribe = yes
mail_attachment_dir = /dane/domeny/zalaczniki
mail_attachment_min_size = 10000 k
mail_cache_min_mail_count = 20
mail_gid = mail
mail_log_prefix = "%s(%u) <%{session}>: "
mail_plugins = quota notify mail_log stats zlib
mail_privileged_group = mail
mail_uid = mail
maildir_stat_dirs = yes
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope
encoded-character vacation subaddress comparator-i;ascii-numeric
relational regex imap4flags copy inc$
ude variables body enotify environment mailbox date ihave
mdbox_preallocate_space = yes
mdbox_rotate_interval = 60 days
mdbox_rotate_size = 50 M
namespace inbox {
  inbox = yes
  list = yes
  location   mailbox Drafts {
    auto = subscribe
    special_use = \Drafts
  }
  mailbox Junk {
    auto = subscribe
    special_use = \Junk
  }
  mailbox Sent {
    auto = subscribe
    special_use = \Sent
  }
  mailbox "Sent Messages" {
    special_use = \Sent
  }
  mailbox Trash {
    auto = subscribe
    special_use = \Trash
  }
  prefix   separator = .
  subscriptions = yes
}
passdb {
  args = /etc/dovecot/.master.user
  driver = passwd-file
  master = yes
  pass = yes
}
passdb {
  args = /etc/dovecot/dovecot-sql.conf.ext
  driver = sql
}
plugin {
  quota = dict:User quota::proxy::quota
  sieve = ~/.dovecot.sieve
  sieve_dir = ~/sieve
  stats_command_min_time = 1 mins
  stats_domain_min_time = 12 hours
  stats_ip_min_time = 12 hours
  stats_memory_limit = 1M
  stats_refresh = 30 s
  stats_session_min_time = 15 mins
  stats_track_cmds = yes
  stats_user_min_time = 1 hours
  zlib_save = bz2
  zlib_save_level = 2
}
postmaster_address = postmaster at mejor.pl
protocols = imap pop3 sieve
service auth {
  unix_listener auth-userdb {
    group = mail
    mode = 0660
    user = root
  }
}
service dict {
  unix_listener dict {
    user = mail
  }
}
service stats {
  fifo_listener stats-mail {
    mode = 0600
    user = mail
  }
}
ssl_cert = </etc/ssl/gwiazdka.mejor.pl.pem
ssl_key = </etc/ssl/gwiazdka.mejor.pl.pem
userdb {
  driver = prefetch
}
userdb {
  args = /etc/dovecot/dovecot-sql.conf.ext
  driver = sql
}
verbose_proctitle = yes
protocol lda {
  mail_plugins = quota notify mail_log stats zlib sieve
}
protocol imap {
  mail_max_userip_connections = 25
  mail_plugins = quota notify mail_log stats zlib imap_quota imap_stats
imap_zlib
}


Thanks,
Marcin

On 24.4.2014, at 0.15, Marcin Miros?aw <marcin at mejor.pl> wrote:
> Recently I noticed that dovecot-lda throws segfault when resolver is
> unavailable and with imapc configured.
I can't easily reproduce this.
> #0  0x000002b612afaf72 in _int_free (av=0x2b612e215c0 <main_arena>,
> p=0x1b23bfabe0, have_lock=0) at malloc.c:3903
> #1  0x000002b612e96a4e in buffer_free (_buf=_buf at entry=0x1b23bfa948) at
> buffer.c:144
> #2  0x000002b612ebeca8 in array_free_i (array=0x1b23bfa948) at array.h:108
> #3  priorityq_deinit (_pq=_pq at entry=0x1b23bfabb0) at priorityq.c:38
> #4  0x000002b612eafa57 in io_loop_destroy
> (_ioloop=_ioloop at entry=0x395a4da91d0) at ioloop.c:495
This also looks like some kind of memory corruption, which isn't good. Can
you try this with valgrind?

valgrind /usr/libexec/dovecot/deliver -d marcin at mejor.pl