dovecot - Apr 2013 - imap Panic: file istream-seekable.c: line 253 (i_stream_seekable_read): assertion failed: (stream->istream.v_offset + stream->pos <= sstream->write_peak)

Hi Timo,

just another crash - using 2.2.1 (c95cea6e1389).


Regards,
Pascal
-------------- next part --------------
Reading symbols from /usr/local/libexec/dovecot/imap...done.
[New LWP 15198]

warning: Can't read pathname for load map: Input/output error.
[Thread debugging using libthread_db enabled]
Using host libthread_db library
"/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `dovecot/imap'.
Program terminated with signal 6, Aborted.
#0  0x00007fea0d3a0475 in *__GI_raise (sig=<optimized out>) at
../nptl/sysdeps/unix/sysv/linux/raise.c:64
64	../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
Already logging to gdb.txt.
#0  0x00007fea0d3a0475 in *__GI_raise (sig=<optimized out>) at
../nptl/sysdeps/unix/sysv/linux/raise.c:64
        pid = <optimized out>
        selftid = <optimized out>
#1  0x00007fea0d3a36f0 in *__GI_abort () at abort.c:92
        act = {__sigaction_handler = {sa_handler = 0x7fff5fba6bd0, sa_sigaction
= 0x7fff5fba6bd0}, sa_mask = {__val = {140643224991072, 140643224986893,
140734799440880, 140643225264237, 140643227545232, 140643220802464,
140643233288192, 140643228326759, 4294967295, 206158430224, 1, 3048496, 0, 0, 0,
              140643224485888}}, sa_flags = 232077810, sa_restorer =
0x5d61393300000001}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2  0x00007fea0d772231 in default_fatal_finish (type=LOG_TYPE_PANIC, status=0)
at failures.c:191
        backtrace = 0xca4020
"/usr/local/lib/dovecot/libdovecot.so.0(+0x7a20a) [0x7fea0d77220a] ->
/usr/local/lib/dovecot/libdovecot.so.0(+0x7b535) [0x7fea0d773535] ->
/usr/local/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7fea0d772"...
#3  0x00007fea0d773535 in i_internal_fatal_handler (ctx=0x7fff5fba6d70,
format=0x7fea0d7b83a0 "file %s: line %d (%s): assertion failed: (%s)",
args=0x7fff5fba6d58) at failures.c:652
        status = 0
#4  0x00007fea0d77250d in i_panic (format=0x7fea0d7b83a0 "file %s: line %d
(%s): assertion failed: (%s)") at failures.c:263
        ctx = {type = LOG_TYPE_PANIC, exit_status = 0, timestamp = 0x0}
        args = {{gp_offset = 40, fp_offset = 48, overflow_arg_area =
0x7fff5fba6e40, reg_save_area = 0x7fff5fba6d80}}
#5  0x00007fea0d786bb8 in i_stream_seekable_read (stream=0xd658a0) at
istream-seekable.c:253
        sstream = 0xd658a0
        data = 0x7fff5fba6ea0 "\320n\272_\377\177"
        size = 14047392
        pos = 27457
        ret = 139638205298784
        __FUNCTION__ = "i_stream_seekable_read"
#6  0x00007fea0d77e866 in i_stream_read (stream=0xd65900) at istream.c:149
        _stream = 0xd658a0
        old_size = 0
        ret = 140643225038704
        __FUNCTION__ = "i_stream_read"
#7  0x00007fea0d784c6f in i_stream_limit_read (stream=0xd39d00) at
istream-limit.c:50
        lstream = 0xd39d00
        left = 140643225038704
        ret = 14047488
        pos = 0
        __FUNCTION__ = "i_stream_limit_read"
#8  0x00007fea0d77e866 in i_stream_read (stream=0xd39d60) at istream.c:149
        _stream = 0xd39d00
        old_size = 0
        ret = 13868288
        __FUNCTION__ = "i_stream_read"
#9  0x00007fea0d77ebf9 in i_stream_read_copy_from_parent (istream=0xd39f00) at
istream.c:193
        stream = 0xd39ea0
        pos = 0
        ret = 13868288
        __FUNCTION__ = "i_stream_read_copy_from_parent"
#10 0x00007fea0daa1b67 in i_stream_mail_read (stream=0xd39ea0) at
istream-mail.c:67
        mstream = 0xd39ea0
        size = 13868384
        ret = 13254133
#11 0x00007fea0d77e866 in i_stream_read (stream=0xd39f00) at istream.c:149
        _stream = 0xd39ea0
        old_size = 0
        ret = 140643221218978
        __FUNCTION__ = "i_stream_read"
#12 0x00007fea0d782fc9 in i_stream_crlf_read_common (cstream=0xd5e440) at
istream-crlf.c:22
        stream = 0xd5e440
        size = 0
        avail = 13254247
        ret = 0
        __FUNCTION__ = "i_stream_crlf_read_common"
#13 0x00007fea0d7830d1 in i_stream_crlf_read_crlf (stream=0xd5e440) at
istream-crlf.c:46
        cstream = 0xd5e440
        data = 0xd39ea0 "\002"
        ptr = 0xd39ea0 "\002"
        src = 0x7fffffffffff <Address 0x7fffffffffff out of bounds>
        src_end = 0xd39f00 "Ak"
        dest = 0xd39f00 "Ak"
        dest_end = 0x0
        size = 0
        copy_len = 27457
        ret = 140734799442160
        __FUNCTION__ = "i_stream_crlf_read_crlf"
#14 0x00007fea0d77e866 in i_stream_read (stream=0xd5e4a0) at istream.c:149
        _stream = 0xd5e440
        old_size = 0
        ret = 140643225038704
        __FUNCTION__ = "i_stream_read"
#15 0x00007fea0d784c6f in i_stream_limit_read (stream=0xd5e5e0) at
istream-limit.c:50
        lstream = 0xd5e5e0
        left = 140643225038704
        ret = 14017696
        pos = 0
        __FUNCTION__ = "i_stream_limit_read"
#16 0x00007fea0d77e866 in i_stream_read (stream=0xd5e640) at istream.c:149
        _stream = 0xd5e5e0
        old_size = 0
        ret = -6697839139754035552
        __FUNCTION__ = "i_stream_read"
#17 0x00007fea0d77f75b in i_stream_read_data (stream=0xd5e640,
data_r=0x7fff5fba7258, size_r=0x7fff5fba7268, threshold=8191) at istream.c:479
        ret = 0
        read_more = false
        __FUNCTION__ = "i_stream_read_data"
#18 0x00007fea0d796ce1 in io_stream_copy (outstream=0xccda68, instream=0xd5e640,
block_size=8192) at ostream.c:326
        start_offset = 0
        iov = {iov_base = 0x7fff5fba7290, iov_len = 0}
        data = 0x0
        ret = 0
#19 0x00007fea0d797101 in o_stream_default_send_istream (outstream=0xccd9e0,
instream=0xd5e640) at ostream.c:468
No locals.
#20 0x00007fea0d796b4f in o_stream_send_istream (outstream=0xccda68,
instream=0xd5e640) at ostream.c:287
        _outstream = 0xccd9e0
        ret = 0
        __FUNCTION__ = "o_stream_send_istream"
#21 0x000000000041db0f in fetch_stream_continue (ctx=0xcc94b0) at
imap-fetch-body.c:90
        state = 0xcc9500
        ret = 13835120
#22 0x000000000041df49 in fetch_body_msgpart (ctx=0xcc94b0, mail=0xd39530,
body=0xd31b70) at imap-fetch-body.c:184
        result = {input = 0xd5e640, size = 285, size_field = 0,
binary_decoded_input_has_nuls = false}
        str = 0xca3be0
#23 0x000000000041c880 in imap_fetch_more_int (ctx=0xcc94b0, cancel=false) at
imap-fetch.c:504
        h = 0xcc98d0
        _data_stack_cur_id = 4
        state = 0xcc9500
        client = 0xcc8760
        handlers = 0xcc97e0
        count = 7
        ret = 1
        __FUNCTION__ = "imap_fetch_more_int"
#24 0x000000000041cab9 in imap_fetch_more (ctx=0xcc94b0, cmd=0xcc9340) at
imap-fetch.c:556
        ret = 0
        __FUNCTION__ = "imap_fetch_more"
#25 0x000000000040f046 in cmd_fetch (cmd=0xcc9340) at cmd-fetch.c:279
        client = 0xcc8760
        ctx = 0xcc94b0
        args = 0xcaeac8
        next_arg = 0xcaeb28
        list_arg = 0xcc9428
        search_args = 0x0
        qresync_args = {qresync_sample_seqset = 0x1, qresync_sample_uidset =
0x10}
        messageset = 0xcaec30 "1796"
        send_vanished = false
        ret = 1
#26 0x000000000041a03e in command_exec (cmd=0xcc9340) at imap-commands.c:156
        hook = 0xcacda0
        ret = false
#27 0x0000000000418f7a in client_command_input (cmd=0xcc9340) at
imap-client.c:775
        client = 0xcc8760
        command = 0x7fff5fba7500
        __FUNCTION__ = "client_command_input"
#28 0x000000000041927a in client_command_input (cmd=0xcc9340) at
imap-client.c:836
        client = 0xcc8760
        command = 0xcacab8
        __FUNCTION__ = "client_command_input"
#29 0x000000000041939a in client_handle_next_command (client=0xcc8760,
remove_io_r=0x7fff5fba758d) at imap-client.c:874
No locals.
#30 0x000000000041941a in client_handle_input (client=0xcc8760) at
imap-client.c:886
        _data_stack_cur_id = 3
        ret = false
        remove_io = false
        handled_commands = false
        __FUNCTION__ = "client_handle_input"
#31 0x00000000004195ad in client_input (client=0xcc8760) at imap-client.c:928
        cmd = 0xcbd480
        output = 0xccda68
        bytes = 133
        __FUNCTION__ = "client_input"
#32 0x00007fea0d7895f5 in io_loop_call_io (io=0xcc9240) at ioloop.c:387
        ioloop = 0xcab720
        t_id = 2
#33 0x00007fea0d78b255 in io_loop_handler_run (ioloop=0xcab720) at
ioloop-epoll.c:215
        ctx = 0xcabaa0
        events = 0xcabb10
        event = 0xcabb10
        list = 0xcc9290
        io = 0xcc9240
        tv = {tv_sec = 4, tv_usec = 839927}
        events_count = 6
        msecs = 4840
        ret = 1
        i = 0
        j = 0
        call = true
        __FUNCTION__ = "io_loop_handler_run"
#34 0x00007fea0d789698 in io_loop_run (ioloop=0xcab720) at ioloop.c:406
No locals.
#35 0x00007fea0d72109e in master_service_run (service=0xcab5b0,
callback=0x426133 <client_connected>) at master-service.c:560
No locals.
#36 0x000000000042644c in main (argc=1, argv=0xcab390) at main.c:400
        set_roots = {0x42f520, 0x0}
        login_set = {auth_socket_path = 0xca3050 "8",
postlogin_socket_path = 0x0, postlogin_timeout_secs = 60, callback = 0x425ef7
<login_client_connected>, failure_callback = 0x4260bf
<login_client_failed>, request_auth_token = 1}
        service_flags = MASTER_SERVICE_FLAG_KEEP_CONFIG_OPEN
        storage_service_flags = MAIL_STORAGE_SERVICE_FLAG_DISALLOW_ROOT
        username = 0x0
        c = -1
No core file now.

On 23.4.2013, at 14.47, Pascal Volk <user+dovecot at
localhost.localdomain.org> wrote:
> just another crash - using 2.2.1 (c95cea6e1389).
Fixed: http://hg.dovecot.org/dovecot-2.2/rev/2784b88a4260

(This started happening only after yesterday's zlib change.)