dovecot - Apr 2011 - doveadm mailbox status 2.0.12 crashes

My gdb won't cooperate and produce a backtrace so I hope this dbx stack
trace gives sufficient clues as to why it crashed.  It happended when
I was testing a doveadm command for a user which a large collection
of mboxs:

 	# dbx doveadm
 	(dbx) run mailbox status -u user messages \*
 	... long list ...
 	igel messages=1
 	INBOX messages=231
 	doveadm(user): Panic: Trying to deinit storage before freeing its objects
 	doveadm(user): Error: Raw backtrace: 0xff1bf0e4 -> 0xff1bf34c ->
0xff2a42a0 -> 0xff29d68c -> 0xff29e494 -> 0xff2a7bc4 -> 0xff2a7e3c
-> 0x16894 -> 0x169a0 -> 0x16e18 -> 0x17234 -> 0x17304 ->
0x1c0a0 -> 0x1629c
 	signal ABRT (Abort) in __lwp_kill at 0xfefcd6ac
 	0xfefcd6ac: __lwp_kill+0x0008:  bcc,a,pt  %icc,__lwp_kill+0x18  ! 0xfefcd6bc
 	Current function is default_fatal_finish
 	dbx: warning: can't find file
"/build/dovecot-2.0.12/src/lib/failures.c"
 	(dbx) where
 	  [1] __lwp_kill(0x0, 0x6, 0x0, 0x6, 0xffbffeff, 0x0), at 0xfefcd6ac
 	  [2] raise(0x6, 0x0, 0x0, 0xfefacd88, 0xffffffff, 0x6), at 0xfef669ac
 	  [3] abort(0xff1ea980, 0x1, 0x0, 0xee4cc, 0xff0334d8, 0x0), at 0xfef42010
 	=>[4] default_fatal_finish(type = LOG_TYPE_PANIC, status = 0), line 187 in
"failures.c"
 	  [5] default_fatal_handler(ctx = 0xffbff598, format = (nil), args =
0xffbff600), line 201 in "failures.c"
 	  [6] i_panic(format = 0xff30d3b8 "Trying to deinit storage before
freeing its objects", ...), line 259 in "failures.c"
 	  [7] mail_storage_unref(_storage = 0x6b9ec), line 379 in
"mail-storage.c"
 	  [8] mail_namespace_free(ns = 0x6b9b8), line 52 in
"mail-namespace.c"
 	  [9] mail_namespaces_deinit(_namespaces = 0x66efc), line 438 in
"mail-namespace.c"
 	  [10] mail_user_deinit_base(user = 0x66ec0), line 28 in
"mail-user.c"
 	  [11] mail_user_unref(_user = 0x55450), line 140 in "mail-user.c"
 	  [12] doveadm_mail_next_user(ctx = 0x55438, input = 0x55450, error_r =
0xffbff8c4), line 221 in "doveadm-mail.c"
 	  [13] doveadm_mail_single_user(ctx = 0x55438, argv = 0xffbffc08, username =
0xffbffd1f "user", service_flags = -4196156), line 246 in
"doveadm-mail.c"
 	  [14] doveadm_mail_cmd(cmd = 0x544f0, argc = 5, argv = 0xffbffc08), line 416
in "doveadm-mail.c"
 	  [15] doveadm_mail_try_run_multi_word(cmd = 0x544f0, cmdname = 0x2ade0
"status", argc = 6, argv = 0xffbffbf8), line 457 in
"doveadm-mail.c"
 	  [16] doveadm_mail_try_run(cmd_name = 0xffbffd0d "mailbox", argc =
6, argv = 0xffbffbf8), line 480 in "doveadm-mail.c"
 	  [17] main(argc = 6, argv = 0xffbffbf8), line 183 in "doveadm.c"

Joseph Tam <jtam.home at gmail.com>

On Sat, 2011-04-16 at 02:49 -0700, Joseph Tam wrote:
> My gdb won't cooperate and produce a backtrace so I hope this dbx stack
> trace gives sufficient clues as to why it crashed.  It happended when
> I was testing a doveadm command for a user which a large collection
> of mboxs:
..
>  	# dbx doveadm
>  	(dbx) run mailbox status -u user messages \*
>  	... long list ...
>  	igel messages=1
>  	INBOX messages=231
>  	doveadm(user): Panic: Trying to deinit storage before freeing its objects
A backtrace can't really show why it crashed with this. Something wasn't
freed for some reason. Can you still reproduce this? I'd like to know of
a way to reproduce this. Maybe you can copy this problematic user's
mailboxes to a test user and keep deleting stuff until you see what
triggers it?

On Mon, 9 May 2011, Timo Sirainen wrote:
>>  	# dbx doveadm
>>  	(dbx) run mailbox status -u user messages \*
>>  	... long list ...
>>  	igel messages=1
>>  	INBOX messages=231
>>  	doveadm(user): Panic: Trying to deinit storage before freeing its
objects
>
> A backtrace can't really show why it crashed with this. Something
wasn't
> freed for some reason. Can you still reproduce this? I'd like to know
of
> a way to reproduce this. Maybe you can copy this problematic user's
> mailboxes to a test user and keep deleting stuff until you see what
> triggers it?
I started removing files as you've suggested and the minimal
condition that triggers a crash is at least one non-mbox file.

 	$ rm /var/mail/user
 	$ rm -rf ~user/mail/*
 	$ echo x >~user/mail/x

 	$ doveadm mailbox status -u user messages \*
 	doveadm(user): Error: Syncing mailbox x failed: Mailbox isn't a valid mbox
file
 	doveadm(user): Panic: Trying to deinit storage before freeing its objects
 	doveadm(user): Error: Raw backtrace: 0xff1c296c -> 0xff2a4e20 ->
 		0xff29e5cc -> 0xff2a8784 -> 0xff2a89fc -> 0x168d4 ->
 		0x169e0 -> 0x16ef4 -> 0x1745c -> 0x1cafc -> 0x1629c

Joseph Tam <jtam.home at gmail.com>