dovecot - Jan 2007 - Quota crashing w/ gdb backtrace

Hi,

I'm still running into consistent crashing when moving files between
folders when dirsize quotas are enabled.  This is running Dovecot1.0rc19.

Please let me know if I'm posting this to the wrong list.

Here is the gdb backtrace:

#0  0x377fc in mbox_file_seek (mbox=0xc8560, view=0xc94c0, seq=1,
    deleted_r=0xffbef157) at mbox-file.c:167
167             if (data == NULL) {
(gdb) bt
#0  0x377fc in mbox_file_seek (mbox=0xc8560, view=0xc94c0, seq=1,
    deleted_r=0xffbef157) at mbox-file.c:167
#1  0x39684 in mbox_mail_seek (mail=0xc73a8) at mbox-mail.c:69
#2  0x398f0 in mbox_mail_get_physical_size (_mail=0xc73a8) at mbox-mail.c:163
#3  0x6b880 in mail_get_physical_size (mail=0xc73a8) at mail.c:75
#4  0x7f933a74 in quota_default_try_alloc (ctx=0xc9a58, mail=0xc73a8,
    too_large_r=0xffbef397) at quota.c:434
#5  0x7f933654 in quota_try_alloc (ctx=0x0, mail=0xc73a8,
    too_large_r=0xffbef397) at quota.c:301
#6  0x7f9370c8 in quota_check (t=0xc57f0, mail=0xc73a8) at quota-storage.c:120
#7  0x7f9374d0 in quota_save_finish (ctx=0xc7790, dest_mail=0xc73a8)
    at quota-storage.c:222
#8  0x6cb64 in mailbox_save_finish (_ctx=0xffbef504, dest_mail=0xc73a8)
    at mail-storage.c:538
#9  0x6ba2c in mail_storage_copy (t=0xc57f0, mail=0xc5c00, flags=MAIL_SEEN,
    keywords=0x0, dest_mail=0xc73a8) at mail-copy.c:38
#10 0x7f9371e4 in quota_copy (t=0xc57f0, mail=0xc5c00, flags=MAIL_SEEN,
    keywords=0x0, dest_mail=0x0) at quota-storage.c:148
#11 0x6cbbc in mailbox_copy (t=0xc57f0, mail=0xc5c00, flags=MAIL_SEEN,
    keywords=0x0, dest_mail=0x0) at mail-storage.c:553
#12 0x1e6b0 in fetch_and_copy (t=0xc57f0, srcbox=0xc57f0, search_args=0x8)
    at cmd-copy.c:34
#13 0x1e804 in cmd_copy (cmd=0xba6c4) at cmd-copy.c:95
#14 0x21eec in cmd_uid (cmd=0xba6c4) at cmd-uid.c:19
#15 0x22ab8 in client_handle_input (cmd=0xba6c4) at client.c:331
#16 0x22a3c in client_handle_input (cmd=0xba6c4) at client.c:388
#17 0x22bb0 in _client_input (context=0xba680) at client.c:428
#18 0x80e88 in io_loop_handler_run (ioloop=0xb7de8) at ioloop-poll.c:199
#19 0x80794 in io_loop_run (ioloop=0xb7de8) at ioloop.c:281
#20 0x2b3d0 in main (argc=0, argv=0xffbefa7c, envp=0xffbefa8c) at main.c:280

The "data" variable defined as:

(gdb) print data
$1 = (void *) 0xd9354

(gdb) print &data
$3 = (void **) 0xffbef0dc

I've noticed that the copy (during a move) *does* complete correctly.
However, the original files never gets deleted, so I assume that this
crash is occuring during the deletion in the original folder.

--
Dean Brooks
dean at iglou.com

On Wed, Jan 31, 2007 at 11:32:02AM -0500, Dean Brooks wrote:
> I'm still running into consistent crashing when moving files between
> folders when dirsize quotas are enabled.  This is running Dovecot1.0rc19.
> 
> Please let me know if I'm posting this to the wrong list.
Ok, turning off GCC '-O2' optimization made this crash go away.  If I
had to venture a guess, it must be related to the "const" definition
of the "data" variable and its modification by reference.  Who knows.

Still, this might be a concern for other people.

Regards,

Dean Brooks
dean at iglou.com

On Wed, 2007-01-31 at 11:32 -0500, Dean Brooks wrote:
> #0  0x377fc in mbox_file_seek (mbox=0xc8560, view=0xc94c0, seq=1,
>     deleted_r=0xffbef157) at mbox-file.c:167
> 167             if (data == NULL) {
..
> (gdb) print data
> $1 = (void *) 0xd9354
Are you using some non-x86 CPU? It appears to crash because it's
dereferencing data as 64bit integer, but the data isn't 64bit aligned in
the memory. I thought I had already fixed all these problems..

Could you try http://dovecot.org/tools/idxview.c, run it against the
mailbox's dovecot.index file and show me the headers that it outputs?

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL:
<http://dovecot.org/pipermail/dovecot/attachments/20070202/f18d6c03/attachment.bin>