dovecot - Feb 2012 - [Dovecot 2.1] imap service crash when using some clients

Hello Pascal,

I've just tested rc6 and get almost the same results.
imap still crashes, but Horde still works. I forgot to mention that this
is on FreeBSD 8 using gcc 4.6 and LTO.
And contrary to what I said in my initial email, it doesn't seem to be
ACL plugin related. imap crashes even if it's not in the plugins list.

Here is the backtrace:
# gdb /usr/libexec/dovecot/imap /path/to/core

Core was generated by `imap'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /usr/lib/dovecot/libdovecot-storage.so.0...(no
debugging symbols found)...done.
Loaded symbols for /usr/lib/dovecot/libdovecot-storage.so.0
Reading symbols from /usr/lib/dovecot/libdovecot.so.0...(no debugging
symbols found)...done.
Loaded symbols for /usr/lib/dovecot/libdovecot.so.0
Reading symbols from /lib/libc.so.7...(no debugging symbols found)...done.
Loaded symbols for /lib/libc.so.7
Reading symbols from /usr/lib/librt.so.1...(no debugging symbols
found)...done.
Loaded symbols for /usr/lib/librt.so.1
Reading symbols from /usr/lib/dovecot/lib01_acl_plugin.so...(no
debugging symbols found)...done.
Loaded symbols for /usr/lib/dovecot/lib01_acl_plugin.so
Reading symbols from /usr/lib/dovecot/lib02_imap_acl_plugin.so...(no
debugging symbols found)...done.
Loaded symbols for /usr/lib/dovecot/lib02_imap_acl_plugin.so
Reading symbols from /usr/lib/dovecot/lib10_quota_plugin.so...(no
debugging symbols found)...done.
Loaded symbols for /usr/lib/dovecot/lib10_quota_plugin.so
Reading symbols from /usr/lib/dovecot/lib11_imap_quota_plugin.so...(no
debugging symbols found)...done.
Loaded symbols for /usr/lib/dovecot/lib11_imap_quota_plugin.so
Reading symbols from /usr/lib/dovecot/lib11_trash_plugin.so...(no
debugging symbols found)...done.
Loaded symbols for /usr/lib/dovecot/lib11_trash_plugin.so
Reading symbols from /usr/lib/dovecot/lib20_autocreate_plugin.so...(no
debugging symbols found)...done.
Loaded symbols for /usr/lib/dovecot/lib20_autocreate_plugin.so
Reading symbols from /usr/lib/dovecot/lib20_fts_plugin.so...(no
debugging symbols found)...done.
Loaded symbols for /usr/lib/dovecot/lib20_fts_plugin.so
Reading symbols from /usr/lib/dovecot/lib20_zlib_plugin.so...(no
debugging symbols found)...done.
Loaded symbols for /usr/lib/dovecot/lib20_zlib_plugin.so
Reading symbols from /lib/libz.so.5...(no debugging symbols found)...done.
Loaded symbols for /lib/libz.so.5
Reading symbols from /usr/lib/libbz2.so.4...(no debugging symbols
found)...done.
Loaded symbols for /usr/lib/libbz2.so.4
Reading symbols from /usr/lib/dovecot/lib21_fts_squat_plugin.so...(no
debugging symbols found)...done.
Loaded symbols for /usr/lib/dovecot/lib21_fts_squat_plugin.so
Reading symbols from /usr/lib/dovecot/lib30_imap_zlib_plugin.so...(no
debugging symbols found)...done.
Loaded symbols for /usr/lib/dovecot/lib30_imap_zlib_plugin.so
Reading symbols from /usr/lib/dovecot/lib90_antispam_plugin.so...(no
debugging symbols found)...done.
Loaded symbols for /usr/lib/dovecot/lib90_antispam_plugin.so
Reading symbols from /libexec/ld-elf.so.1...(no debugging symbols
found)...done.
Loaded symbols for /libexec/ld-elf.so.1
#0  0x00000000105c64e7 in imap_match () from
/usr/lib/dovecot/libdovecot.so.0
(gdb) bt full
#0  0x00000000105c64e7 in imap_match () from
/usr/lib/dovecot/libdovecot.so.0
No symbol table info available.
#1  0x00000000104b4bf6 in mailbox_list_iter_next () from
/usr/lib/dovecot/libdovecot-storage.so.0
No symbol table info available.
#2  0x0000000000416b99 in cmd_list_continue.6853 ()
No symbol table info available.
#3  0x000000000042166d in cmd_list_full ()
No symbol table info available.
#4  0x0000000000000000 in ?? ()
No symbol table info available.
#5  0x8080808080808080 in ?? ()
No symbol table info available.
#6  0x0000000000000004 in ?? ()
No symbol table info available.
#7  0x0000000010a3f1a8 in ?? ()
No symbol table info available.
#8  0x0000000010aa4390 in ?? ()
No symbol table info available.
#9  0x0000000010a3f174 in ?? ()
No symbol table info available.
#10 0x00007fffffffe9a0 in ?? ()
No symbol table info available.
#11 0x0000000010596e4f in p_strdup () from /usr/lib/dovecot/libdovecot.so.0
No symbol table info available.
#12 0x0000000010a22200 in ?? ()
No symbol table info available.
#13 0x0000000010aa4458 in ?? ()
No symbol table info available.
#14 0x0000000010aa4340 in ?? ()
No symbol table info available.
#15 0x0000000010aa4498 in ?? ()
No symbol table info available.
#16 0x0000000110a3f040 in ?? ()
No symbol table info available.
#17 0x0000000010a3f128 in ?? ()
No symbol table info available.
#18 0x0000000010a3e840 in ?? ()
No symbol table info available.
#19 0x0000000010a3f040 in ?? ()
No symbol table info available.
#20 0x0000000010a22200 in ?? ()
No symbol table info available.
#21 0x0000000000000001 in ?? ()
No symbol table info available.
#22 0x0000000010a22200 in ?? ()
No symbol table info available.
#23 0x0000000000000000 in ?? ()
No symbol table info available.
#24 0x000000000041d320 in client_command_input.12433 ()
No symbol table info available.
#25 0x00000000004203ca in client_handle_input ()
No symbol table info available.
#26 0x0000000010a574e0 in ?? ()
No symbol table info available.
#27 0x00000000105ae219 in i_stream_read () from
/usr/lib/dovecot/libdovecot.so.0
No symbol table info available.
#28 0x000000000041d13f in client_input ()
No symbol table info available.
#29 0x00000000105ce276 in io_loop_call_io () from
/usr/lib/dovecot/libdovecot.so.0
No symbol table info available.
#30 0x00000000105c9ea3 in io_loop_handler_run () from
/usr/lib/dovecot/libdovecot.so.0
No symbol table info available.
#31 0x00000000105c9f78 in io_loop_run () from
/usr/lib/dovecot/libdovecot.so.0
No symbol table info available.
#32 0x00000000105c9fb3 in master_service_run () from
/usr/lib/dovecot/libdovecot.so.0
No symbol table info available.
#33 0x00000000004158bb in main ()
No symbol table info available.

Regards,

Olivier
> On 01/18/2012 02:03 AM interfaSys s?rl wrote:
> >/ Hello,
> />/ 
> />/ I've just noticed that when Horde is connecting to Dovecot 2.1,
it
> />/ crashes the imap service if Dovecot is configured to use the ACL
plugin.
> />/ I'm not sure what's so special about the command Horde
sends, but it
> />/ shouldn't make Dovecot crash. Everything is fine when using
Thunderbird.
> />/ 
> />/ Here is the message in Dovecot's logs
> />/ "Fatal: master: service(imap): child 89974 killed with signal
11 (core
> />/ not dumped)"
> />/ 
> />/ The message says that the core is not dumped, even though I did add
> />/ drop_priv_before_exec=yes to my config file.
> /
> dovecot stop
> ulimit -c unlimited
> dovecot
>
> Now connect with Horde and let it crash.
>
> >/ I've tried connecting to the pid using gdb, but the process just
hangs
> />/ as soon as I'm connected.
> />/ 
> /
> continue
> [wait for the crash]
> bt full
> detach
> quit
>
>
> Regards,
> Pascal

On 13.2.2012, at 2.02, interfaSys s?rl wrote:
> #0  0x00000000105c64e7 in imap_match () from
> /usr/lib/dovecot/libdovecot.so.0
> No symbol table info available.
> #1  0x00000000104b4bf6 in mailbox_list_iter_next () from
> /usr/lib/dovecot/libdovecot-storage.so.0
> No symbol table info available.
> #2  0x0000000000416b99 in cmd_list_continue.6853 ()
> No symbol table info available.
> #3  0x000000000042166d in cmd_list_full ()
This crash looks interesting, but unfortunately the libraries are stripped of
debug symbols so I can't really guess why it would crash here. By default
Dovecot includes them, so you must have stripped them yourself. Can you get
another backtrace with debug symbols enabled?

Or alternatively can you look at what IMAP command Horde sends that crashes
Dovecot? http://wiki2.dovecot.org/Debugging/Rawlog shows one way of recording
the IMAP traffic.

Yep, works perfectly now. Thank you for fixing it :)


On 16 February 2012 18:04:30, Timo Sirainen wrote:
> OK, this should fix it: http://hg.dovecot.org/dovecot-2.1/rev/ff117a044e20
>
>