dovecot - May 2014 - Dovecot 2.2.13 core dumped with shared folder/acl

Hi,

after the upgrade to dovecot 2.2.13 (on Deb 6) for users that have 
enabled shared folder I found "core dumped" error in the log:


imap(webmaster at pippo.com): Fatal: master: service(imap): child 26828 
killed with signal 11 (core dumped)
[...]
imap[26828]: segfault at 160 ip 00007f76a18bca32 sp 00007fff5ecc13b0 
error 4 in lib01_acl_plugin.so[7f76a18af000+13000]

These error happens "random", when users configure subscription for 
shared folders or browse shared folders.


Here "bt full":

#0  0x00007f76a18bca32 in acl_mailbox_get_aclobj (box=<value optimized 
out>) at acl-mailbox.c:29
No locals.
#1  0x00007f76a16ad1e3 in cmd_myrights (cmd=0x1211cd0) at 
imap-acl-plugin.c:331
         ns = <value optimized out>
         box = 0x12051f0
         mailbox = 0x11732a8 "shared"
         orig_mailbox = 0x1214690 "shared"
         rights = <value optimized out>
         str = <value optimized out>
#2  0x000000000041813d in command_exec (cmd=0x1211cd0) at 
imap-commands.c:158
         hook = 0x117c0e0
         ret = <value optimized out>
#3  0x0000000000417240 in client_command_input (cmd=0x1211cd0) at 
imap-client.c:778
         client = 0x12110d0
         command = <value optimized out>
         __FUNCTION__ = "client_command_input"
#4  0x000000000041732d in client_command_input (cmd=0x1211cd0) at 
imap-client.c:839
         client = 0x12110d0
         command = 0x0
         __FUNCTION__ = "client_command_input"
#5  0x00000000004175ad in client_handle_next_command (client=0x12110d0) 
at imap-client.c:877
No locals.
#6  client_handle_input (client=0x12110d0) at imap-client.c:889
         _data_stack_cur_id = 3
         ret = 96
         remove_io = <value optimized out>
         handled_commands = false
         __FUNCTION__ = "client_handle_input"
#7  0x000000000041792f in client_input (client=0x12110d0) at 
imap-client.c:931
         cmd = <value optimized out>
         output = 0x1211b10
         bytes = <value optimized out>
         __FUNCTION__ = "client_input"
#8  0x00007f76a24c98ce in io_loop_call_io (io=0x1211be0) at 
ioloop.c:441
         ioloop = 0x117b730
         t_id = 2
         __FUNCTION__ = "io_loop_call_io"
#9  0x00007f76a24caa4f in io_loop_handler_run_internal (ioloop=<value 
optimized out>) at ioloop-epoll.c:220
         ctx = 0x117c3c0
         event = 0x117d230
         list = 0x1197a60
         io = 0x10
---Type <return> to continue, or q <return> to quit---
         tv = {tv_sec = 59, tv_usec = 999046}
         msecs = <value optimized out>
         ret = 1
         i = 0
         call = false
         __FUNCTION__ = "io_loop_handler_run_internal"
#10 0x00007f76a24c9959 in io_loop_handler_run (ioloop=0x10) at 
ioloop.c:488
No locals.
#11 0x00007f76a24c99e8 in io_loop_run (ioloop=0x117b730) at 
ioloop.c:465
         __FUNCTION__ = "io_loop_run"
#12 0x00007f76a2476ef3 in master_service_run (service=0x117b5c0, 
callback=0x28) at master-service.c:566
No locals.
#13 0x0000000000420eb7 in main (argc=1, argv=0x117b390) at main.c:400
         set_roots = {0x428e20, 0x0}
         login_set = {auth_socket_path = 0x1173050 "\210\060\027\001",
postlogin_socket_path = 0x0, postlogin_timeout_secs = 60,
           callback = 0x4210b0 <login_client_connected>, 
failure_callback = 0x421050 <login_client_failed>, request_auth_token = 
1}
         service_flags = <value optimized out>
         storage_service_flags = MAIL_STORAGE_SERVICE_FLAG_DISALLOW_ROOT
         username = 0x0
         c = <value optimized out>

Here is my configuration:

# 2.2.13: /etc/dovecot/dovecot.conf
# OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0.9
auth_cache_negative_ttl = 10 mins
auth_cache_size = 8 M
auth_cache_ttl = 20 mins
deliver_log_format = msgid=%m, from=%f, subject="%s": %$
dict {
   acl = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext
   expire = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext
   sqlquota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext
}
disable_plaintext_auth = no
dotlock_use_excl = no
first_valid_gid = 89
first_valid_uid = 89
imap_client_workarounds = delay-newmail tb-extra-mailbox-sep 
tb-lsub-flags
imap_idle_notify_interval = 29 mins
imap_logout_format = in=%i out=%o session=<%{session}>
last_valid_gid = 89
last_valid_uid = 89
lda_mailbox_autocreate = yes
lda_mailbox_autosubscribe = yes
listen = *
mail_fsync = always
mail_location = maildir:~/Maildir
mail_nfs_index = yes
mail_nfs_storage = yes
mail_plugins = quota acl expire
maildir_very_dirty_syncs = yes
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope 
encoded-character subaddress comparator-i;ascii-numeric relational regex 
imap4flags copy include variables body enotify environment mailbox date 
ihave duplicate vnd.dovecot.duplicate
mmap_disable = yes
namespace {
   list = children
   location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u
   prefix = shared/%%n/
   separator = /
   subscriptions = no
   type = shared
}
namespace inbox {
   inbox = yes
   location    mailbox Drafts {
     auto = subscribe
     special_use = \Drafts
   }
   mailbox Sent {
     auto = subscribe
     special_use = \Sent
   }
   mailbox "Sent Messages" {
     special_use = \Sent
   }
   mailbox Spam {
     auto = subscribe
     special_use = \Junk
   }
   mailbox Trash {
     auto = subscribe
     special_use = \Trash
   }
   prefix    separator = /
}
passdb {
   args = username_format=%Ld 
/etc/dovecot/extra/alias-domains-denylogin.txt
   deny = yes
   driver = passwd-file
}
passdb {
   args = cache_key=%s%u webmail=192.168.3.15
   driver = vpopmail
}
plugin {
   acl = vfile
   acl_shared_dict = proxy::acl
   expire = Trash
   expire2 = Spam
   expire_dict = proxy::expire
   quota = maildir:UserQuota
   quota2 = dict:Quota Usage::noenforcing:proxy::sqlquota
   quota_grace = 10M
   quota_rule2 = Trash:storage=+100M
   quota_warning = storage=95%% quota-warning 95 %u
   quota_warning2 = storage=80%% quota-warning 80 %u
   sieve = ~/.dovecot.sieve
   sieve_before = /etc/dovecot/sieve/before.sieve
   sieve_dir = ~/sieve
   sieve_extensions = +vnd.dovecot.duplicate -vacation
}
pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s, 
bytes=%i/%o, session=<%{session}>
protocols = imap pop3 sieve
service auth {
   client_limit = 5500
   unix_listener auth-userdb {
     group = vchkpw
     mode = 0660
     user = vpopmail
   }
}
service dict {
   process_limit = 500
   unix_listener dict {
     group = vchkpw
     mode = 0660
     user = vpopmail
   }
}
service imap-login {
   process_min_avail = 4
   service_count = 0
}
service imap {
   process_limit = 4000
   service_count = 100
}
service managesieve-login {
   inet_listener sieve {
     port = 4190
   }
}
service pop3-login {
   service_count = 0
}
service pop3 {
   process_limit = 1023
   service_count = 100
}
service quota-warning {
   executable = script /etc/dovecot/scripts/quota-warning.sh
   unix_listener quota-warning {
     user = vpopmail
   }
   user = vpopmail
}
ssl_cert = </etc/dovecot/ssl/wildcard.pem
ssl_key = </etc/dovecot/ssl/wildcard.key
submission_host = localhost
userdb {
   args = quota_template=quota_rule=*:backend=%q
   driver = vpopmail
}
protocol lda {
   mail_location = maildir:~/Maildir:INDEX=MEMORY
   mail_plugins = quota acl expire sieve
}
protocol imap {
   mail_max_userip_connections = 15
   mail_plugins = quota acl expire imap_quota imap_acl
}
protocol sieve {
   mail_max_userip_connections = 2
}
protocol pop3 {
   mail_max_userip_connections = 5
}