dovecot - Apr 2014 - Segfault in auth (when talked to by postfix lda)

Afternoon all.

I'm seeing a segfault in dovecot 2.2.12 (debian package 1:2.2.12-2). I
can log into dovecot fine with mutt, but the segfaults seem to occur
when postfix (2.11.0, debian package 2.11.0-1+b1) tries to deliver a
message.

This was working fine under 2.2.9 (I can downgrade to that and delivery works).

Can anyone help? Doveconf -n, and backtrace follow.


------------------------------
--8<-- doveconf -n ----------
# 2.2.12: /etc/dovecot/dovecot.conf
# OS: Linux 3.12-1-686-pae i686 Debian jessie/sid xfs
auth_debug = yes
auth_mechanisms = digest-md5 cram-md5 plain
info_log_path = /var/log/dovecot.info
lda_mailbox_autosubscribe = yes
log_path = /var/log/dovecot.log
log_timestamp = "%Y-%m-%d %H:%M:%S "
login_log_format_elements = service=%s user=<%u> session=%{session}
method=%m rip=%r lip=%l mpid=%e %c %k
mail_access_groups = mail users
mail_location = mdbox:/var/mail/%u/Mail
mail_max_userip_connections = 50
mail_plugins = " zlib stats"
mail_privileged_group = mail
mail_uid = vmail
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character
vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy
include variables body enotify environment mailbox date ihave
namespace inbox {
  inbox = yes
  location   mailbox Drafts {
    special_use = \Drafts
  }
  mailbox Junk {
    special_use = \Junk
  }
  mailbox Sent {
    special_use = \Sent
  }
  mailbox "Sent Messages" {
    special_use = \Sent
  }
  mailbox Trash {
    special_use = \Trash
  }
  prefix }
passdb {
  driver = pam
}
passdb {
  args = /etc/dovecot/passwd
  driver = passwd-file
}
plugin {
  antispam_backend = dspam
  antispam_crm_binary = /bin/false
  antispam_debug_target = syslog
  antispam_dspam_args = --client;--mode=teft;--deliver;--user;%u
  antispam_dspam_binary = /usr/bin/dspam
  antispam_pipe_program = /usr/sbin/sendmail
  antispam_pipe_tmpdir = /tmp
  antispam_signature = X-DSPAM-Signature
  antispam_signature_missing = move
  antispam_spam_pattern_ignorecase = SPAM
  antispam_trash_pattern_ignorecase = trash;Deleted *
  sieve = ~/.dovecot.sieve
  sieve_dir = ~/sieve
  stats_refresh = 30 secs
  stats_track_cmds = yes
}
postmaster_address = postmaster at darac.org.uk
protocols = " imap lmtp sieve"
service auth {
  unix_listener /var/spool/postfix/private/auth {
    group = postfix
    mode = 0660
    user = postfix
  }
  unix_listener auth-userdb {
    group = vmail
    mode = 0666
  }
}
service lmtp {
  inet_listener lmtp {
    address = 192.168.123.254
    port = 20024
  }
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    group = postfix
    mode = 0666
    user = postfix
  }
}
service managesieve-login {
  inet_listener sieve {
    port = 4190
  }
  inet_listener sieve_deprecated {
    port = 2000
  }
}
service stats {
  fifo_listener stats-mail {
    mode = 0600
    user = vmail
  }
}
ssl_cert = </etc/dovecot/mail.www.ssl-bundle.crt
ssl_key = </etc/dovecot/private/mail.www.ssl.key
userdb {
  driver = passwd
}
userdb {
  args = uid=vmail gid=vmail home=/var/mail/%u
  driver = static
}
protocol lmtp {
  mail_fsync = optimized
  mail_plugins = " zlib sieve"
}
protocol lda {
  mail_fsync = optimized
  mail_plugins = " zlib sieve"
}
protocol imap {
  mail_plugins = " zlib zlib imap_zlib antispam stats imap_stats"
}

----8<---- backtrace -------

Core was generated by `dovecot/auth'.
Program terminated with signal 11, Segmentation fault.
#0  auth_fields_find_idx (fields=fields at entry=0x0, key=key at
entry=0xb84ae448 "uid",
    idx_r=idx_r at entry=0xbfc07d0c) at auth-fields.c:44
44      auth-fields.c: No such file or directory.
(gdb) bt full
#0  auth_fields_find_idx (fields=fields at entry=0x0, key=key at
entry=0xb84ae448 "uid",
    idx_r=idx_r at entry=0xbfc07d0c) at auth-fields.c:44
        i = <optimized out>
        count = <optimized out>
#1  0xb77bed33 in auth_fields_add (fields=0x0, key=key at entry=0xb84ae448
"uid",
    value=value at entry=0xb84a6312 "1120", flags=flags at
entry=(unknown: 0)) at auth-fields.c:68
        field = <optimized out>
        idx = 3091882770
        __FUNCTION__ = "auth_fields_add"
#2  0xb77bb03b in auth_request_set_userdb_field (request=request at
entry=0xb84b9218,
    name=0xb84ae448 "uid", value=0xb84a6312 "1120") at
auth-request.c:1605
        uid = <optimized out>
        gid = <optimized out>
#3  0xb77d2fb5 in userdb_template_export (tmpl=0xb84ae410,
    auth_request=auth_request at entry=0xb84b9218) at userdb-template.c:83
        table = 0xb84a6110
        str = 0xb84a5ff0
        value = <optimized out>
        i = 0
        count = 6
        __FUNCTION__ = "userdb_template_export"
#4  0xb77d230a in static_lookup_real (auth_request=auth_request at
entry=0xb84b9218,
    callback=0xb77ba9b0 <auth_request_userdb_callback>) at
userdb-static.c:32
        _module = <optimized out>
        module = <optimized out>
#5  0xb77d23ae in static_credentials_callback (result=PASSDB_RESULT_OK,
    credentials=0xb84b5bb7 "Mananozu", size=8,
auth_request=0xb84b9218) at userdb-static.c:52
        ctx = 0xb84bb860
#6  0xb77bc039 in auth_request_lookup_credentials_finish
(result=PASSDB_RESULT_OK,
    credentials=credentials at entry=0xb84b5bb7 "Mananozu", size=size
at entry=8,
    request=request at entry=0xb84b9218) at auth-request.c:820
No locals.
#7  0xb77bc136 in auth_request_lookup_credentials_callback
(result=PASSDB_RESULT_OK,
    credentials=0xb84b5bb7 "Mananozu", size=8, request=0xb84b9218) at
auth-request.c:858
        passdb = 0xb84ae248
        cache_cred = 0x0
        cache_scheme = 0xb77f1abc "\234\211\004"
        __FUNCTION__ = "auth_request_lookup_credentials_callback"
#8  0xb77cc66e in passdb_handle_credentials (result=result at
entry=PASSDB_RESULT_OK,
    password=0xb84b5bb7 "Mananozu", scheme=0xb84a5cb8
"PLAIN",
    callback=callback at entry=0xb77bc0c0
<auth_request_lookup_credentials_callback>,
    auth_request=auth_request at entry=0xb84b9218) at passdb.c:165
        credentials = 0xb84b5bb7 "Mananozu"
        size = 8
#9  0xb77ce62c in passwd_file_lookup_credentials (request=0xb84b9218,
    callback=0xb77bc0c0 <auth_request_lookup_credentials_callback>) at
passdb-passwd-file.c:106
        _module = <optimized out>
        module = <optimized out>
        pu = <optimized out>
        crypted_pass = 0xb84b5bb7 "Mananozu"
        scheme = 0xb84a5cb8 "PLAIN"
#10 0xb77bc317 in auth_request_lookup_credentials (request=request at
entry=0xb84b9218,
    scheme=0xb84b9450 "", callback=0xb77d2320
<static_credentials_callback>) at auth-request.c:907
        passdb = 0xb84ae248
        cache_key = <optimized out>
        cache_cred = 0x0
        cache_scheme = 0xb77f1abc "\234\211\004"
        result = -1216406852
        __FUNCTION__ = "auth_request_lookup_credentials"
#11 0xb77bc0b4 in auth_request_lookup_credentials_finish (
    result=PASSDB_RESULT_SCHEME_NOT_AVAILABLE,
    credentials=credentials at entry=0xb774f693 <uchar_nul> "",
size=size at entry=0,
    request=request at entry=0xb84b9218) at auth-request.c:802
No locals.
#12 0xb77bc136 in auth_request_lookup_credentials_callback (
    result=result at entry=PASSDB_RESULT_SCHEME_NOT_AVAILABLE,
credentials=0xb774f693 <uchar_nul> "",
    size=size at entry=0, request=request at entry=0xb84b9218) at
auth-request.c:858
        passdb = 0xb84ae180
        cache_cred = 0xb84b93b8 "\001"
        cache_scheme = 0x0
        __FUNCTION__ = "auth_request_lookup_credentials_callback"
#13 0xb77bc396 in auth_request_lookup_credentials (request=request at
entry=0xb84b9218,
    scheme=scheme at entry=0xb77dd7bd "",
    callback=callback at entry=0xb77d2320 <static_credentials_callback>)
at auth-request.c:900
        passdb = 0xb84ae180
        cache_key = <optimized out>
        cache_cred = 0x1 <Address 0x1 out of bounds>
        cache_scheme = 0xb7780e78 "x\r\r"
        result = -1217270382
        __FUNCTION__ = "auth_request_lookup_credentials"
#14 0xb77d253c in static_lookup (auth_request=0xb84b9218,
    callback=0xb77ba9b0 <auth_request_userdb_callback>) at
userdb-static.c:100
        ctx = 0xb84bb860
        callback = 0xb77ba9b0 <auth_request_userdb_callback>
        auth_request = 0xb84b9218
        _module = <optimized out>
        module = <optimized out>
#15 0xb77bae3b in auth_request_lookup_user (request=request at entry=0xb84b9218,
    callback=0xb77b5c80 <user_callback>) at auth-request.c:1141
        userdb = 0xb84ae3e8
        cache_key = <optimized out>
#16 0xb77bac6d in auth_request_userdb_callback (result=<optimized out>,
    result at entry=USERDB_RESULT_USER_UNKNOWN, request=<optimized out>)
at auth-request.c:1062
        userdb = <optimized out>
        next_userdb = 0xb84ae3c8
        result_rule = <optimized out>
        userdb_continue = <optimized out>
#17 0xb77d091c in user_callback (reply=<optimized out>,
context=0xb84b9218) at userdb-blocking.c:46
        request = 0xb84b9218
        result = USERDB_RESULT_USER_UNKNOWN
        args = 0xb84b9863 ""
#18 0xb77c1caf in auth_worker_request_handle (request=0xb84b93b8,
request=0xb84b93b8,
    line=0xb84b985a "NOTFOUND\t", conn=<optimized out>) at
auth-worker-server.c:281
No locals.
#19 worker_input (conn=0xb84b9600) at auth-worker-server.c:376
        line = 0xb84b9859 "\tNOTFOUND\t"
        id_str = <optimized out>
        id = 1
#20 0xb7726928 in io_loop_call_io (io=0xb84b97f0) at ioloop.c:388
        ioloop = 0xb84ad4d0
        t_id = 2
#21 0xb77278be in io_loop_handler_run (ioloop=ioloop at entry=0xb84ad4d0) at
ioloop-epoll.c:220
        ctx = 0xb84b2538
        list = 0xb84b9820
        io = <optimized out>
        tv = {tv_sec = 0, tv_usec = 996120}
        events_count = <optimized out>
        msecs = <optimized out>
        ret = 1
        i = 0
        j = 0
        call = <optimized out>
        __FUNCTION__ = "io_loop_handler_run"
#22 0xb7726458 in io_loop_run (ioloop=0xb84ad4d0) at ioloop.c:412
        __FUNCTION__ = "io_loop_run"
#23 0xb76ce8c8 in master_service_run (service=0xb84ad400, callback=0xb77c6010
<client_connected>)
    at master-service.c:566
No locals.
#24 0xb77b2fae in main (argc=1, argv=0xb84ad1d8) at main.c:393
        c = <optimized out>

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL:
<http://dovecot.org/pipermail/dovecot/attachments/20140425/a4ecb54d/attachment.sig>

On 25.4.2014, at 17.53, Darac Marjal <mailinglist at darac.org.uk> wrote:
> I'm seeing a segfault in dovecot 2.2.12 (debian package 1:2.2.12-2). I
> can log into dovecot fine with mutt, but the segfaults seem to occur
> when postfix (2.11.0, debian package 2.11.0-1+b1) tries to deliver a
> message.
..
> #0  auth_fields_find_idx (fields=fields at entry=0x0, key=key at
entry=0xb84ae448 "uid",
>    idx_r=idx_r at entry=0xbfc07d0c) at auth-fields.c:44
>        i = <optimized out>
>        count = <optimized out>
> #1  0xb77bed33 in auth_fields_add (fields=0x0, key=key at entry=0xb84ae448
"uid",
>    value=value at entry=0xb84a6312 "1120", flags=flags at
entry=(unknown: 0)) at auth-fields.c:68
>        field = <optimized out>
>        idx = 3091882770
>        __FUNCTION__ = "auth_fields_add"
> #2  0xb77bb03b in auth_request_set_userdb_field (request=request at
entry=0xb84b9218,
>    name=0xb84ae448 "uid", value=0xb84a6312 "1120") at
auth-request.c:1605
>        uid = <optimized out>
>        gid = <optimized out>
> #3  0xb77d2fb5 in userdb_template_export (tmpl=0xb84ae410,
>    auth_request=auth_request at entry=0xb84b9218) at userdb-template.c:83
Fixed: http://hg.dovecot.org/dovecot-2.2/rev/e84555e6eb59