dovecot - Feb 2014 - Segmentation fault in libdovecot-storage.so

Hi all!
Is there any news for this problem?
How can I be of help?
Currently this issue is very critical for me. I get about 10-15 segfault 
per minute...

Thanks
Francesco

On 10/02/2014 11:58, Francesco Fiore wrote:
> Hi,
> I obtain continuosly segmentation fault of processes pop3 and imap, with
> version 2.2.10.
> This is the error for the pop3 process (but for imap is is the same):
>
> 2014-02-10 11:06:22 pop3(xxxxxxx at yyyyyyyy.zz): Fatal: master:
> service(pop3): child 23804 killed with signal 11 (core dumped)
>
> This is the kernel log:
>
> Feb 10 11:06:22 pecpop5 kernel: pop3[23804]: segfault at 7fa42a3f4070 ip
> 00007fa41ff849cd sp 00007fff78dedfa0 error 4 in
> libdovecot-storage.so.0.0.0[7fa41fefa000+d9000]
>
> -------------------------------------------------------
> # /opt/dovecot-2.2.10/sbin/dovecot --version
> 2.2.10
> -------------------------------------------------------
> # cat /etc/redhat-release
> CentOS release 6.4 (Final)
> -------------------------------------------------------
> # uname -r
> 2.6.32-358.23.2.el6.x86_64
> -------------------------------------------------------
> Filesystem: NFS
> -------------------------------------------------------
> # /opt/dovecot-2.2.10/sbin/dovecot -n
> # 2.2.10: /opt/dovecot-2.2.10/etc/dovecot/dovecot.conf
> # OS: Linux 2.6.32-358.23.2.el6.x86_64 x86_64 CentOS release 6.4 (Final)
> auth_debug = yes
> auth_master_user_separator = *
> auth_username_format > default_vsz_limit = 512 M
> disable_plaintext_auth = no
> dotlock_use_excl = no
> first_valid_gid = 101
> first_valid_uid = 102
> imap_id_send > import_environment = TZ
> info_log_path = /var/log/dovecot.log
> log_path = /var/log/dovecot.log
> log_timestamp = "%Y-%m-%d %H:%M:%S "
> mail_fsync = always
> mail_gid = 101
> mail_location = maildir:%h/Maildir
> mail_max_userip_connections = 50
> mail_nfs_index = yes
> mail_nfs_storage = yes
> mail_plugins = quota expire fts fts_lucene mail_log notify
> mail_uid = 102
> maildir_broken_filename_sizes = yes
> managesieve_notify_capability = mailto
> managesieve_sieve_capability = fileinto reject envelope
> encoded-character vacation subaddress comparator-i;ascii-numeric
> relational regex imap4flags copy include variables body enotify
> environment mailbox date ihave
> mbox_write_locks = fcntl
> mmap_disable = yes
> namespace inbox {
>    inbox = yes
>    location >    mailbox Drafts {
>      special_use = \Drafts
>    }
>    mailbox Junk {
>      special_use = \Junk
>    }
>    mailbox Sent {
>      special_use = \Sent
>    }
>    mailbox "Sent Messages" {
>      special_use = \Sent
>    }
>    mailbox Trash {
>      special_use = \Trash
>    }
>    prefix = INBOX.
>    separator = .
>    subscriptions = yes
>    type = private
> }
> passdb {
>    args = /opt/dovecot-2.2.10/etc/dovecot/passwd.masterusers
>    driver = passwd-file
>    master = yes
> }
> passdb {
>    args = /opt/dovecot-2.2.10/etc/dovecot/dovecot-ldap.conf
>    driver = ldap
> }
> passdb {
>    args = /opt/dovecot-2.2.10/etc/dovecot/dovecot-ldap-multiuser.conf
>    driver = ldap
>    master = yes
> }
> plugin {
>    fts = lucene
>    fts_lucene >    mail_log_events = delete undelete expunge copy
mailbox_delete
> mailbox_rename
>    mail_log_fields = uid box msgid size
>    quota = maildir
>    quota_rule2 = INBOX.Trash:storage=+100M
> }
> protocols = imap pop3
> service anvil {
>    client_limit = 3000
> }
> service auth {
>    client_limit = 4096
>    unix_listener auth-userdb {
>      mode = 0600
>    }
> }
> service imap-login {
>    inet_listener imap {
>      address = 10.11.47.49
>      port = 143
>    }
>    inet_listener imaps {
>      address = 10.11.47.49
>      port = 993
>      ssl = yes
>    }
>    process_limit = 2500
>    process_min_avail = 5
> }
> service imap {
>    drop_priv_before_exec = yes
>    process_limit = 2500
>    process_min_avail = 5
> }
> service managesieve-login {
>    inet_listener sieve {
>      port = 4190
>    }
>    process_min_avail = 0
>    service_count = 1
>    vsz_limit = 64 M
> }
> service managesieve {
>    drop_priv_before_exec = yes
>    process_limit = 1024
> }
> service pop3-login {
>    inet_listener pop3 {
>      address = 10.11.47.49
>      port = 110
>    }
>    inet_listener pop3s {
>      address = 10.11.47.49
>      port = 995
>      ssl = yes
>    }
>    process_limit = 300
>    process_min_avail = 5
> }
> service pop3 {
>    drop_priv_before_exec = yes
>    process_limit = 300
>    process_min_avail = 5
> }
> ssl_cert = </opt/dovecot-2.2.10/certs/imapd.pem
> ssl_key = </opt/dovecot-2.2.10/certs/imapd.pem
> userdb {
>    args = /opt/dovecot-2.2.10/etc/dovecot/dovecot-ldap.conf
>    driver = ldap
> }
> protocol lmtp {
>    mail_plugins = quota expire fts fts_lucene mail_log notify sieve
> }
> protocol lda {
>    mail_plugins = quota expire fts fts_lucene mail_log notify sieve
> }
> protocol imap {
>    mail_plugins = quota imap_quota mail_log notify
> }
> protocol pop3 {
>    mail_plugins = quota mail_log notify
>    pop3_uidl_format = UID%u-%v
> }
>
> -------------------------------------------------------
> (gdb) bt full
> #0  0x00007f351537e9cd in mail_cache_header_fields_read (cache=0xf16740)
> at mail-cache-fields.c:369
>          field_hdr = 0x7f35157ed040
>          field = {name = 0x0, idx = 0, type >
MAIL_CACHE_FIELD_FIXED_SIZE, field_size = 0, decision >
MAIL_CACHE_DECISION_NO, last_used = 0}
>          last_used = 0x7f35157ed04c
>          sizes = 0x7f35217ed04c
>          types = 0x7f352d7ed04c <Address 0x7f352d7ed04c out of
bounds>
>          decisions = 0x7f35307ed04c <Address 0x7f35307ed04c out of 
> bounds>
>          p = 0x7f35337ed04c <Address 0x7f35337ed04c out of bounds>
>          names = <value optimized out>
>          end = 0x7f355e7ed040 <Address 0x7f355e7ed040 out of bounds>
>          orig_key = 0x7f35155e8715 "I\211\303L\213L$0L\213D$(H\213|$
>
H\213t$\030H\213T$\020H\213L$\bH\213\004$H\203\304HA\377\343ffffff.\017\037\204"
>
>          fidx = <value optimized out>
>          new_fields_count = <value optimized out>
>          dec = <value optimized out>
>          max_drop_time = 1388530800
>          offset = 64
>          i = <value optimized out>
> #1  0x00007f351537c664 in mail_cache_open_and_verify (cache=0xf16740) at
> mail-cache.c:497
>          ret = 1
> #2  0x00007f351537fe4c in mail_cache_field_exists (view=0xf16110,
> seq=<value optimized out>, field=<value optimized out>) at
> mail-cache-lookup.c:345
>          data = <value optimized out>
>          __FUNCTION__ = "mail_cache_field_exists"
> #3  0x00007f351537ff64 in mail_cache_lookup_field (view=0xf16110,
> dest_buf=0x7fff96c80030, seq=52, field_idx=0) at mail-cache-lookup.c:413
>          field_def = <value optimized out>
>          iter = {view = 0x7f3500000001, remap_counter = 0, seq = 0, rec
> = 0x1, pos = 355448944, rec_size = 32565, offset = 2048, trans_next_idx
> = 0, stop = 0, failed = 0,
>            memory_appends_checked = 0, disk_appends_checked = 0}
>          field = {field_idx = 15818688, size = 0, data = 0x0, offset = 
> 52}
>          ret = <value optimized out>
> #4  0x00007f3515367999 in index_mail_cache_lookup_field (mail=0xf21910,
> buf=<value optimized out>, field_idx=<value optimized out>) at
> index-mail.c:68
>          ret = -1765278176
> #5  0x00007f35153685c5 in index_mail_get_fixed_field (mail=0xf21910,
> field=<value optimized out>, data=<value optimized out>,
data_size=4) at
> index-mail.c:130
>          field_idx = 0
>          buf = {data = 0xf21b14, used = 0, priv = {0xf21b14, 0x0, 0x4,
> 0x0, 0x0}}
>          __FUNCTION__ = "index_mail_get_fixed_field"
> #6  0x00007f3515368843 in index_mail_update_access_parts (mail=0xf21910)
> at index-mail.c:1385
>          _mail = 0xf21910
>          data = 0xf21a80
>          cache_fields = 0xf164a0
>          cache_view = 0xf16110
>          hdr = <value optimized out>
>          input = 0x7f35150a0227
> #7  0x00007f3515368a56 in index_mail_set_seq (_mail=0xf21910, seq=52,
> saving=<value optimized out>) at index-mail.c:1521
>          mail = 0xf21910
> #8  0x00007f351536e72b in search_more_with_mail (ctx=0xf1f620,
> mail_r=0x7fff96c80190) at index-search.c:1507
>          _ctx = 0xf1f620
>          box = 0xf12030
>          cost2 = <value optimized out>
>          match = <value optimized out>
>          ret = -1
>          imail = 0xf21910
>          cost1 = 0
> #9  search_more_with_prefetching (ctx=0xf1f620, mail_r=0x7fff96c80190)
> at index-search.c:1579
>          _data_stack_cur_id = 4
>          ret = <value optimized out>
>          mail = 0xf21910
>          mails = <value optimized out>
> ---Type <return> to continue, or q <return> to quit---
> #10 search_more (ctx=0xf1f620, mail_r=0x7fff96c80190) at 
> index-search.c:1650
>          imail = <value optimized out>
>          ret = -1765278176
> #11 0x00007f351536ee28 in index_storage_search_next_nonblock
> (_ctx=0xf1f620, mail_r=0xf0f9a8, tryagain_r=0x7fff96c801ff) at
> index-search.c:1674
>          ctx = 0xf1f620
>          mail = <value optimized out>
>          mailp = <value optimized out>
>          seq = <value optimized out>
>          ret = <value optimized out>
> #12 0x00007f3515348507 in mailbox_search_next_nonblock (ctx=0xf1f620,
> mail_r=0xf0f9a8, tryagain_r=<value optimized out>) at
mail-storage.c:1787
>          box = <value optimized out>
> #13 0x00007f3515348566 in mailbox_search_next (ctx=0xf1f620,
> mail_r=0xf0f9a8) at mail-storage.c:1773
>          tryagain = false
> #14 0x0000000000418a0e in imap_fetch_more_int (ctx=0xf0f948,
> cancel=false) at imap-fetch.c:479
>          state = 0xf0f998
>          client = 0xf0efb0
>          handlers = 0xf0fc78
>          count = 5
>          ret = <value optimized out>
>          __FUNCTION__ = "imap_fetch_more_int"
> #15 0x0000000000418b61 in imap_fetch_more (ctx=0xf0f948, cmd=0xf0f810)
> at imap-fetch.c:556
>          ret = <value optimized out>
>          __FUNCTION__ = "imap_fetch_more"
> #16 0x000000000040d75d in cmd_fetch (cmd=0xf0f810) at cmd-fetch.c:284
>          client = 0xf0efb0
>          ctx = 0xf0f948
>          args = 0xefaa38
>          next_arg = <value optimized out>
>          list_arg = 0x0
>          search_args = 0x0
>          qresync_args = {qresync_sample_seqset = 0xf0f7f0,
> qresync_sample_uidset = 0x7f35150ae158}
>          messageset = 0xefaba0 "52:84"
>          send_vanished = <value optimized out>
>          ret = <value optimized out>
> #17 0x0000000000416fbd in command_exec (cmd=0xf0f810) at 
> imap-commands.c:158
>          hook = 0xef80f0
>          ret = <value optimized out>
> #18 0x00000000004160e0 in client_command_input (cmd=0xf0f810) at
> imap-client.c:780
>          client = 0xf0efb0
>          command = <value optimized out>
>          __FUNCTION__ = "client_command_input"
> #19 0x00000000004161cd in client_command_input (cmd=0xf0f810) at
> imap-client.c:841
>          client = 0xf0efb0
>          command = <value optimized out>
>          __FUNCTION__ = "client_command_input"
> #20 0x000000000041644d in client_handle_next_command (client=0xf0efb0)
> at imap-client.c:879
> No locals.
> #21 client_handle_input (client=0xf0efb0) at imap-client.c:891
>          _data_stack_cur_id = 3
>          ret = false
>          remove_io = false
>          handled_commands = false
>          __FUNCTION__ = "client_handle_input"
> #22 0x00000000004167bf in client_input (client=0xf0efb0) at
> imap-client.c:933
>          cmd = <value optimized out>
>          output = 0xf08100
> ---Type <return> to continue, or q <return> to quit---
>          bytes = 77
>          __FUNCTION__ = "client_input"
> #23 0x00007f351509b336 in io_loop_call_io (io=0xf081d0) at ioloop.c:388
>          ioloop = 0xef7720
>          t_id = 2
> #24 0x00007f351509c3a7 in io_loop_handler_run (ioloop=<value optimized
> out>) at ioloop-epoll.c:220
>          ctx = 0xef83d0
>          events = <value optimized out>
>          event = 0xef9230
>          list = 0xef9e00
>          io = <value optimized out>
>          tv = {tv_sec = 1799, tv_usec = 999407}
>          msecs = <value optimized out>
>          ret = 1
>          i = <value optimized out>
>          call = <value optimized out>
>          __FUNCTION__ = "io_loop_handler_run"
> #25 0x00007f351509b2a8 in io_loop_run (ioloop=0xef7720) at ioloop.c:412
>          __FUNCTION__ = "io_loop_run"
> #26 0x00007f3515049f73 in master_service_run (service=0xef75b0,
> callback=<value optimized out>) at master-service.c:566
> No locals.
> #27 0x000000000041fd07 in main (argc=1, argv=0xef7390) at main.c:400
>          set_roots = {0x427c60, 0x0}
>          login_set = {auth_socket_path = 0xeef060 "\210\360",
> <incomplete sequence \356>, postlogin_socket_path = 0x0,
> postlogin_timeout_secs = 60,
>            callback = 0x41ff00 <login_client_connected>,
> failure_callback = 0x41fea0 <login_client_failed>, request_auth_token
> = 1}
>          service_flags = <value optimized out>
>          storage_service_flags = <value optimized out>
>          username = <value optimized out>
>          c = <value optimized out>
>
> Thanks
> Francesco

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 13 Feb 2014, Francesco Fiore wrote:
> Is there any news for this problem?
read the other threads about the issue and find the patch in the 2.2.11 
thread.

- -- 
Steffen Kaiser
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQEVAwUBUvyfF3D1/YhP6VMHAQIeDQf7BTMO9RzoL21mS06n56j1nRT2HbSYNsXx
IZ1AWRK2D0ZrZcaHUwadrOaENqeeU4gBJNj633ZXrvpzObyO++rS3fycD3i0gw+V
LSaa1IaAwb8fBfYkE8Nx997SJPS2fhd0f50ks8+Qf9k3yRal+MCOkBIIm+Wz4+lM
0BoYrInmpIP8qCZ27Dm2u1/Z6Apla8ZxlFEUdaiL4ryVFYN1GlfuYEVTuaBn1n5T
By8VLPtKWRuujQ+eyx6ZTQzF6EqDvqbgJhGwRI2OQZnLgNoxI0PByOrhzhsGcYbq
akooWof0XBAI3NYhhve18uj5+xy5vOUjXM1JKoqKhcQVR2NRY+mrNg==FIv/
-----END PGP SIGNATURE-----