dovecot - Jun 2014 - dovecot 2.2.13 core dump (signal 11)

We just upgraded from 2.1.16 to 2.2.13.  One user is experiencing 
problems when using the shared namespace.  Specifically it happens when 
opening/reading a message and when deleting messages.  These functions 
work for other users.  So far, this appears to be only affecting one user.

The shared folder is a local ext4 file system and utilizes acls

# 2.2.13: /private/dovecot/etc/dovecot/dovecot.conf
doveconf: Warning: service auth { client_limit=1000 } is lower than 
required under max. load (15360)
doveconf: Warning: service anvil { client_limit=1000 } is lower than 
required under max. load (10243)
# OS: Linux 2.6.32-358.11.1.el6.x86_64 x86_64 Red Hat Enterprise Linux 
Server release 6.5 (Santiago)
default_process_limit = 5120
first_valid_uid = 100
listen = *
mail_location = mbox:~/mail:INBOX=/var/mail/%u:INDEX=/a2/imap-index/%u
mail_plugins = quota acl
namespace {
   hidden = yes
   inbox = no
   list = children
   location = maildir:/a1/dove-shared:INDEX=/a2/imap-index/dove-shared/%u
   prefix = sharedimap/
   separator = /
   type = shared
}
namespace inbox {
   inbox = yes
   location    mailbox Drafts {
     special_use = \Drafts
   }
   mailbox Junk {
     special_use = \Junk
   }
   mailbox Sent {
     special_use = \Sent
   }
   mailbox "Sent Messages" {
     special_use = \Sent
   }
   mailbox Trash {
     special_use = \Trash
   }
   prefix }
passdb {
   args = /private/dovecot/etc/dovecot/dovecot-ldap.conf.ext
   driver = ldap
}
passdb {
   args = scheme=CRYPT username_format=%u /private/dovecot/etc/passwd
   driver = passwd-file
}
plugin {
   acl = vfile
   quota = fs:INBOX:mount=/a1
   quota2 = fs:Home quota:mount=%h
}
protocols = imap lmtp
service imap-login {
   service_count = 1
}
service imap {
   process_limit = 2048
}
ssl_cert = </private/ssl/certs/mail.engr.oregonstate.edu.pem
ssl_key = </private/ssl/certs/mail.engr.oregonstate.edu.pem
userdb {
   args = /private/dovecot/etc/dovecot/dovecot-ldap.conf.ext
   driver = ldap
}
userdb {
   args = username_format=%u /private/dovecot/etc/passwd
   driver = passwd-file
}
protocol imap {
   mail_max_userip_connections = 20
}


Here's the backtrace in gdb.

Core was generated by `dovecot/imap'.
Program terminated with signal 11, Segmentation fault.
#0  acl_mailbox_right_lookup (box=0x12e6730, right_idx=7) at 
acl-mailbox.c:40
40		if (abox->skip_acl_checks)
Missing separate debuginfos, use: debuginfo-install 
glibc-2.12-1.132.el6_5.2.x86_64 sssd-client-1.9.2-129.el6.x86_64
(gdb) bt full
#0  acl_mailbox_right_lookup (box=0x12e6730, right_idx=7) at 
acl-mailbox.c:40
         abox = 0x0
         alist = <value optimized out>
         ret = <value optimized out>
#1  0x00007f4c11604d06 in acl_copy_has_rights (ctx=0x12f9810, 
mail=0x12f5030)
     at acl-mailbox.c:409
         destbox = 0x12edf90
         save_right = <value optimized out>
#2  acl_copy (ctx=0x12f9810, mail=0x12f5030) at acl-mailbox.c:430
         t = <value optimized out>
         abox = 0x12ee5f8
#3  0x00007f4c11b741ed in mailbox_copy (_ctx=<value optimized out>,
     mail=0x12f5030) at mail-storage.c:2149
         ctx = 0x12f9810
         t = 0x12f32d0
         keywords = 0x12f9b80
         pvt_flags = 0
         backend_mail = 0x12f5030
         ret = <value optimized out>
         __FUNCTION__ = "mailbox_copy"
#4  0x00007f4c11b742dd in mailbox_move (_ctx=<value optimized out>,
     mail=0x12f5030) at mail-storage.c:2170
         ctx = 0x12f9810
#5  0x000000000040c587 in fetch_and_copy (cmd=0x12e3f10, move=true)
     at cmd-copy.c:67
         search_ctx = 0x12f4db0
         src_trans = 0x12f4090
         srcset_ctx = {str = 0x12bf328, first_uid = 0, last_uid = 
4294967295}
         ret = 1
         save_ctx = 0x0
         mail = 0x12f5030
         copy_count = 1
         src_uidset = 0x12bf328
#6  cmd_copy_full (cmd=0x12e3f10, move=true) at cmd-copy.c:123
         client = 0x12e3330
         dest_storage = <value optimized out>
         destbox = 0x12edf90
         t = 0x12f32d0
         src_trans = <value optimized out>
         search_args = 0x12ecf80
         messageset = 0x12cac10 "112850,112871,112903:112905,112919"
         mailbox = 0x12cac38 "Trash"
         src_uidset = <value optimized out>
         sync_flags = 0
         imap_flags = 0
         changes = {pool = 0x12e6730, uid_validity = 19807984, 
saved_uids = {


(I'm not sure how much more info is needed; let me know if more...)

thank you

Tom Lieuallen

This problem is now affecting more than just that one user.  The 2nd (at 
least) victim is myself, so this problem is now more urgent.

Any thoughts on this?  Should I start familiarizing myself with source 
code, or just downgrade to 2.1.16 again?  I hate going backward. :-(

thank you

Tom L

On 6/18/14, 11:01 PM, Tom Lieuallen wrote:
> We just upgraded from 2.1.16 to 2.2.13.  One user is experiencing
> problems when using the shared namespace.  Specifically it happens when
> opening/reading a message and when deleting messages.  These functions
> work for other users.  So far, this appears to be only affecting one user.
>
> The shared folder is a local ext4 file system and utilizes acls
>
> # 2.2.13: /private/dovecot/etc/dovecot/dovecot.conf
> doveconf: Warning: service auth { client_limit=1000 } is lower than
> required under max. load (15360)
> doveconf: Warning: service anvil { client_limit=1000 } is lower than
> required under max. load (10243)
> # OS: Linux 2.6.32-358.11.1.el6.x86_64 x86_64 Red Hat Enterprise Linux
> Server release 6.5 (Santiago)
> default_process_limit = 5120
> first_valid_uid = 100
> listen = *
> mail_location = mbox:~/mail:INBOX=/var/mail/%u:INDEX=/a2/imap-index/%u
> mail_plugins = quota acl
> namespace {
>    hidden = yes
>    inbox = no
>    list = children
>    location = maildir:/a1/dove-shared:INDEX=/a2/imap-index/dove-shared/%u
>    prefix = sharedimap/
>    separator = /
>    type = shared
> }
> namespace inbox {
>    inbox = yes
>    location >    mailbox Drafts {
>      special_use = \Drafts
>    }
>    mailbox Junk {
>      special_use = \Junk
>    }
>    mailbox Sent {
>      special_use = \Sent
>    }
>    mailbox "Sent Messages" {
>      special_use = \Sent
>    }
>    mailbox Trash {
>      special_use = \Trash
>    }
>    prefix > }
> passdb {
>    args = /private/dovecot/etc/dovecot/dovecot-ldap.conf.ext
>    driver = ldap
> }
> passdb {
>    args = scheme=CRYPT username_format=%u /private/dovecot/etc/passwd
>    driver = passwd-file
> }
> plugin {
>    acl = vfile
>    quota = fs:INBOX:mount=/a1
>    quota2 = fs:Home quota:mount=%h
> }
> protocols = imap lmtp
> service imap-login {
>    service_count = 1
> }
> service imap {
>    process_limit = 2048
> }
> ssl_cert = </private/ssl/certs/mail.engr.oregonstate.edu.pem
> ssl_key = </private/ssl/certs/mail.engr.oregonstate.edu.pem
> userdb {
>    args = /private/dovecot/etc/dovecot/dovecot-ldap.conf.ext
>    driver = ldap
> }
> userdb {
>    args = username_format=%u /private/dovecot/etc/passwd
>    driver = passwd-file
> }
> protocol imap {
>    mail_max_userip_connections = 20
> }
>
>
> Here's the backtrace in gdb.
>
> Core was generated by `dovecot/imap'.
> Program terminated with signal 11, Segmentation fault.
> #0  acl_mailbox_right_lookup (box=0x12e6730, right_idx=7) at
> acl-mailbox.c:40
> 40        if (abox->skip_acl_checks)
> Missing separate debuginfos, use: debuginfo-install
> glibc-2.12-1.132.el6_5.2.x86_64 sssd-client-1.9.2-129.el6.x86_64
> (gdb) bt full
> #0  acl_mailbox_right_lookup (box=0x12e6730, right_idx=7) at
> acl-mailbox.c:40
>          abox = 0x0
>          alist = <value optimized out>
>          ret = <value optimized out>
> #1  0x00007f4c11604d06 in acl_copy_has_rights (ctx=0x12f9810,
> mail=0x12f5030)
>      at acl-mailbox.c:409
>          destbox = 0x12edf90
>          save_right = <value optimized out>
> #2  acl_copy (ctx=0x12f9810, mail=0x12f5030) at acl-mailbox.c:430
>          t = <value optimized out>
>          abox = 0x12ee5f8
> #3  0x00007f4c11b741ed in mailbox_copy (_ctx=<value optimized out>,
>      mail=0x12f5030) at mail-storage.c:2149
>          ctx = 0x12f9810
>          t = 0x12f32d0
>          keywords = 0x12f9b80
>          pvt_flags = 0
>          backend_mail = 0x12f5030
>          ret = <value optimized out>
>          __FUNCTION__ = "mailbox_copy"
> #4  0x00007f4c11b742dd in mailbox_move (_ctx=<value optimized out>,
>      mail=0x12f5030) at mail-storage.c:2170
>          ctx = 0x12f9810
> #5  0x000000000040c587 in fetch_and_copy (cmd=0x12e3f10, move=true)
>      at cmd-copy.c:67
>          search_ctx = 0x12f4db0
>          src_trans = 0x12f4090
>          srcset_ctx = {str = 0x12bf328, first_uid = 0, last_uid >
4294967295}
>          ret = 1
>          save_ctx = 0x0
>          mail = 0x12f5030
>          copy_count = 1
>          src_uidset = 0x12bf328
> #6  cmd_copy_full (cmd=0x12e3f10, move=true) at cmd-copy.c:123
>          client = 0x12e3330
>          dest_storage = <value optimized out>
>          destbox = 0x12edf90
>          t = 0x12f32d0
>          src_trans = <value optimized out>
>          search_args = 0x12ecf80
>          messageset = 0x12cac10
"112850,112871,112903:112905,112919"
>          mailbox = 0x12cac38 "Trash"
>          src_uidset = <value optimized out>
>          sync_flags = 0
>          imap_flags = 0
>          changes = {pool = 0x12e6730, uid_validity = 19807984,
> saved_uids = {
>
>
> (I'm not sure how much more info is needed; let me know if more...)
>
> thank you
>
> Tom Lieuallen

On 19.6.2014, at 9.01, Tom Lieuallen <toml at engr.orst.edu> wrote:
> namespace {
>  hidden = yes
>  inbox = no
>  list = children
>  location = maildir:/a1/dove-shared:INDEX=/a2/imap-index/dove-shared/%u
>  prefix = sharedimap/
>  separator = /
>  type = shared
> }
type=shared namespaces are meant for mailboxes that users share among each
others. Use type=public for this. That should fix the crash. It's also fixed
in hg.