Crash on opening mailbox

Ladislav Laska
Sun, 21 Aug 2016 10:59:40 -0000

Hi!

dovecot -n and backtrace are both attached in my original email, due to their
size. Did the attachments not arrive?

The relevant log does not contain much more than the trace, but here it is:

Aug 21 12:58:28 ibex dovecot: imap-login: Login: user=<krakonos>,
method=PLAIN,
rip=77.48.73.189, lip=78.108.107.19, mpid=17785, TLS,
session=<Q5igz5I66sxNMEm9>
Aug 21 12:58:28 ibex dovecot: imap(krakonos): Debug: Effective uid=1000,
gid=100, home=/home/krakonos
Aug 21 12:58:28 ibex dovecot: imap(krakonos): Debug: Namespace inbox:
type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes
location=mbox:~/.mbox
Aug 21 12:58:28 ibex dovecot: imap(krakonos): Debug: mbox: INBOX defaulted to
/home/krakonos/.mbox/inbox
Aug 21 12:58:28 ibex dovecot: imap(krakonos): Debug: fs:
root=/home/krakonos/.mbox, index=, indexpvt=, control=,
inbox=/home/krakonos/.mbox/inbox, altAug 21 12:58:29 ibex dovecot:
imap(krakonos): Panic: file
../../../src/lib/array.h: line 219 (array_idx_i): assertion failed: (idx *
array->element_size < array->buffer->used)
Aug 21 12:58:29 ibex dovecot: imap(krakonos): Error: Raw backtrace:
/usr/lib64/dovecot/libdovecot.so.0(+0x8d91e) [0x7fa68fb6a91e] ->
/usr/lib64/dovecot/libdovecot.so.0(+0x8da0a) [0x7fa68fb6aa0a] ->
/usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7fa68fb08fce] ->
/usr/lib64/dovecot/libdovecot-storage.so.0(+0x79e56) [0x7fa68fe6ae56] ->
/usr/lib64/dovecot/libdovecot-storage.so.0(index_mail_get_first_header+0xd6)
[0x7fa68fe6b2a6] ->
/usr/lib64/dovecot/libdovecot-storage.so.0(mail_get_first_header+0x3d)
[0x7fa68fe1e93d] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x8de70)
[0x7fa68fe7ee70] -> /usr/lib64/dovecot/libdovecot-storage.so.0(+0x8e062)
[0x7fa68fe7f062] -> /usr/lib64/dovecot/libdovecot.so.0(i_stream_read+0x53)
[0x7fa68fb74e03] ->
/usr/lib64/dovecot/libdovecot.so.0(i_stream_read_data+0x3d)
[0x7fa68fb7583d] ->
/usr/lib64/dovecot/libdovecot.so.0(message_parse_header_next+0x72)
[0x7fa68fb56042] -> /usr/lib64/dovecot/libdovecot.so.0(+0x736c1)
[0x7fa68fb506c1] -> /usr/lib64/dovecot/libdovecot.so.0(i_stream_read+0x53)
[0x7fa68fb74e03] ->
/usr/lib64/dovecot/libdovecot.so.0(i_stream_read_data+0x3d)
[0x7fa68fb7583d] ->
/usr/lib64/dovecot/libdovecot.so.0(message_parse_header_next+0x72)
[0x7fa68fb56042] -> /usr/lib64/dovecot/libdovecot.so.0(+0x736c1)
[0x7fa68fb506c1] -> /usr/lib64/dovecot/libdovecot.so.0(i_stream_read+0x53)
[0x7fa68fb74e03] ->
/usr/lib64/dovecot/libdovecot.so.0(i_stream_read_data+0x3d)
[0x7fa68fb7583d] ->
/usr/lib64/dovecot/libdovecot.so.0(message_get_header_size+0x74)
[0x7fa68fb59d64] ->
/usr/lib64/dovecot/libdovecot-storage.so.0(imap_msgpart_open+0x317)
[0x7fa68fea7ff7] -> dovecot/imap() [0x41d4ae] -> dovecot/imap() [0x41b9fc]
->
dovecot/imap(imap_fetch_more+0x3a) [0x41ca0a] ->
dovecot/imap(cmd_fetch+0x32c)
[0x40f57c] -> dovecot/imap(command_exec+0x9c) [0x41a29c] -> dovecot/imap()
[0x418772] -> dovecot/imap() [0x418800] ->
dovecot/imap(client_handle_input+0x175) [0x418b95]
Aug 21 12:58:29 ibex dovecot: imap(krakonos): Fatal: master: service(imap):
child 17785 killed with signal 6 (core dumped)


On Sat, Aug 20, 2016 at 01:25:01AM +0300, Aki Tuomi
wrote:
>
> > On August 19, 2016 at 10:00 PM Ladislav Laska <laska at
kam.mff.cuni.cz> wrote:
> >
> >
> > Hi!
> >
> > I'm currently experiencing a crash of dovecot 2.2.25 on Gentoo,
upon opening
> > mailbox. The crash only triggers on opening inbox, other mailboxes
seem to
> > work fine. It happens every time, and can be reproduced on request. I
also
> > briefly tried 2.2.19, and it behaves the same.
> >
> > The bug seems to be triggered by some mail, as I encountered it
previously
> > and fixed by removing some spam. I guess it might be malformed header
of
> > some kind.  I can open the mailbox locally using mutt, but fail to do
so
> > remotely (using mutt or K-9 mail on android). Unforunately, I
haven't been
> > able to isolate the specific mail, as when I create a new mailbox,
dovecot
> > refuses to open it:
> >
> > [CANNOT] Mailbox isn't a valid mbox file (0.000 + 0.000 secs).
> >
> > I'm not really sure what's going on and will investigate
further once I find
> > some time to do so.
> >
> > I also experienced a similar problem on opening a specific mail, but
it's
> > much harder to reproduce and I currently don't have an example.
The crash
> > looks very similar, and only happens on first attempt to open a
specific
> > mail, it always works later on.
> >
> > I'm attaching a stack trace and dovecot -n. I'm also willing
to send the
> > binary and core dump, but not publicly, as I'm not eager to share
whatever's
> > inside with the whole world.
> >
> > Other than what I mentioned, I'm running pretty standard setup,
with postfix
> > on Gentoo x86_64, ext4 fs, quota and disk space is plentiful. The
delivery
> > agent is dovecot itself, in postfix/main.cf I have:
> >
> > mailbox_command = /usr/libexec/dovecot/deliver
> >
> > I'm using sieve script to file my mail, but the problem manifested
even
> > before when I was still using procmail to deliver my mail (I migrated
> > because I had doubts about procmail and dovecot lock cooperation)
> >
> > I'll keep my mailbox corrupted for a few more days, and access the
mail only
> > locally, hoping to test a potential fix. Let me know if you need any
more
> > info/experimentation. Also, if you know a good way to find the mail
that
> > causes the trouble out of the core, let me know, I'd be glad to
forward it
> > for testing.
> >
> > Thanks and I hope we can find (and fix) the problem!
> >
> > -- S pozdravem Ladislav L?ska
> > <laska at kam.mff.cuni.cz>
> > Katedra Aplikovan? Matematiky, MFF UK               tel.: +420 739 464
167
>
> Hi!
>
> Please provide
>
> doveconf -n
>
> relevant log files (or at least anything you care to share)
>
> gdb /path/to/binary /path/to/core
> bt full
>
> ---
> Aki Tuomi
> Dovecot Oy

--
S pozdravem Ladislav L?ska                          <laska at
kam.mff.cuni.cz>
Katedra Aplikovan? Matematiky, MFF UK               tel.: +420 739 464 167