Re: [Dovecot] Lazyexpunge and Segmentation fault

[mail...@securitylabs.it]

Il 10/12/2009 19:28, Timo Sirainen ha scritto:

On Thu, 2009-12-10 at 11:55 +0100, mail...@securitylabs.it wrote:
   

#0  0xb7fb45c9 in lazy_expunge_mail_expunge (_mail=0x844df58) at
lazy-expunge-plugin.c:115
115 deststorage =
luser->lazy_ns[LAZY_NAMESPACE_EXPUNGE]->storage;
 

OK, this makes more sense. Looks like it was a bug in quota plugin:
http://hg.dovecot.org/dovecot-1.2/rev/5e2206e3c750

   


Hello Timo, thanks problem solved. Igor.

Re: [Dovecot] Lazyexpunge and Segmentation fault

[Timo Sirainen]

On Thu, 2009-12-10 at 11:55 +0100, mail...@securitylabs.it wrote:
> #0  0xb7fb45c9 in lazy_expunge_mail_expunge (_mail=0x844df58) at 
> lazy-expunge-plugin.c:115
> 115 deststorage = 
> luser->lazy_ns[LAZY_NAMESPACE_EXPUNGE]->storage;

OK, this makes more sense. Looks like it was a bug in quota plugin:
http://hg.dovecot.org/dovecot-1.2/rev/5e2206e3c750



signature.asc
Description: This is a digitally signed message part

Re: [Dovecot] Lazyexpunge and Segmentation fault

[mail...@securitylabs.it]

On 09/12/2009 21:03, Timo Sirainen wrote:

You still happen to have the core file? I'd like to know a few more
things:

   

#0  lazy_expunge_mail_expunge (_mail=0x9907ae8) at lazy-expunge-plugin.c:116
116 lt->expunge_box =
 

p *lt
p *deststorage
p *_mail
p *_mail.box

Anyway there's something weird going on there. It shouldn't crash on
that line. So either gcc optimizations confused gdb and it's actually
crashing elsewhere (recompiling+reinstalling the plugin without -O2
parameter would help with this),
   

Hello, I've recompiled dovecot with -O0 and here a new backtrace:

GNU gdb 6.8-debian
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 


This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i486-linux-gnu"...

warning: Can't read pathname for load map: Input/output error.
Reading symbols from /lib/i686/nosegneg/libdl.so.2...done.
Loaded symbols for /lib/i686/nosegneg/libdl.so.2
Reading symbols from /lib/i686/nosegneg/librt.so.1...done.
Loaded symbols for /lib/i686/nosegneg/librt.so.1
Reading symbols from /lib/i686/nosegneg/libc.so.6...done.
Loaded symbols for /lib/i686/nosegneg/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
Reading symbols from /lib/i686/nosegneg/libpthread.so.0...done.
Loaded symbols for /lib/i686/nosegneg/libpthread.so.0
Reading symbols from 
/usr/local/lib/dovecot/imap/lib02_lazy_expunge_plugin.so...done.

Loaded symbols for /usr/local/lib/dovecot/imap/lib02_lazy_expunge_plugin.so
Reading symbols from 
/usr/local/lib/dovecot/imap/lib10_quota_plugin.so...done.

Loaded symbols for /usr/local/lib/dovecot/imap/lib10_quota_plugin.so
Reading symbols from 
/usr/local/lib/dovecot/imap/lib11_imap_quota_plugin.so...done.

Loaded symbols for /usr/local/lib/dovecot/imap/lib11_imap_quota_plugin.so
Reading symbols from 
/usr/local/lib/dovecot/imap/lib20_mail_log_plugin.so...done.

Loaded symbols for /usr/local/lib/dovecot/imap/lib20_mail_log_plugin.so
Core was generated by `imap'.
Program terminated with signal 11, Segmentation fault.
[New process 14769]
#0  0xb7fb45c9 in lazy_expunge_mail_expunge (_mail=0x844df58) at 
lazy-expunge-plugin.c:115
115 deststorage = 
luser->lazy_ns[LAZY_NAMESPACE_EXPUNGE]->storage;

(gdb) bt full
#0  0xb7fb45c9 in lazy_expunge_mail_expunge (_mail=0x844df58) at 
lazy-expunge-plugin.c:115

luser = (struct lazy_expunge_mail_user *) 0x841c060
lt = (struct lazy_expunge_transaction *) 0x844de28
deststorage = (struct mail_storage *) 0x844de40
#1  0x080c658f in mail_expunge (mail=0x844df58) at mail.c:207
p = (struct mail_private *) 0x844df58
#2  0x0806c294 in imap_expunge (box=0x8423538, next_search_arg=0x0) at 
imap-expunge.c:35

ctx = (struct mail_search_context *) 0x844de40
t = (struct mailbox_transaction_context *) 0x844ca58
mail = (struct mail *) 0x844df58
search_args = (struct mail_search_args *) 0x0
expunges = false
#3  0x0806267e in cmd_expunge_finish (cmd=0x841e4d0, search_args=0x0) at 
cmd-expunge.c:27

client = (struct client *) 0x841e250
#4  0x0806283f in cmd_expunge (cmd=0x841e4d0) at cmd-expunge.c:78
No locals.
#5  0x0806a3c7 in client_command_input (cmd=0x841e4d0) at client.c:612
client = (struct client *) 0x841e250
command = (struct command *) 0x2
__PRETTY_FUNCTION__ = "client_command_input"
#6  0x0806a5f3 in client_command_input (cmd=0x841e4d0) at client.c:661
client = (struct client *) 0x841e250
command = (struct command *) 0x841a6a0
__PRETTY_FUNCTION__ = "client_command_input"
#7  0x0806a6fe in client_handle_next_command (client=0x841e250, 
remove_io_r=0xbfb94035) at client.c:702

size = 11
#8  0x0806a783 in client_handle_input (client=0x841e250) at client.c:714
_data_stack_cur_id = 3
ret = 65
remove_io = false
handled_commands = false
__PRETTY_FUNCTION__ = "client_handle_input"
#9  0x0806a8e1 in client_input (client=0x841e250) at client.c:753
cmd = (struct client_command_context *) 0xb7f2af78
output = (struct ostream *) 0x841e404
bytes = 11
__PRETTY_FUNCTION__ = "client_input"
#10 0x08124721 in io_loop_handler_run (ioloop=0x84199b0) at 
ioloop-epoll.c:208

ctx = (struct ioloop_handler_context *) 0x8419ab8
events = (struct epoll_event *) 0x8419af8
event = (const struct epoll_event *) 0x8419af8
list = (struct io_list *) 0x841c228
io = (struct io_file *) 0x841e460
tv = {tv_sec = 1799, tv_usec = 999144}
events_count = 3
t_id = 2
msecs = 180
ret = 1
i = 0
j = 0
call = true
#11 0x081239d8 in io_loop_run (ioloop=0x84199b0) at ioloop.

Re: [Dovecot] Lazyexpunge and Segmentation fault

[Timo Sirainen]

On Mon, 2009-11-30 at 19:52 +0100, mail...@securitylabs.it wrote:
> > strace is almost useless for figuring out why program crashes. Could you 
> > get gdb backtrace? See http://dovecot.org/bugreport.html
> >   
> Hello, Timo here gdb backtrace:

You still happen to have the core file? I'd like to know a few more
things:

> #0  lazy_expunge_mail_expunge (_mail=0x9907ae8) at lazy-expunge-plugin.c:116
> 116 lt->expunge_box = 

p *lt
p *deststorage
p *_mail
p *_mail.box

Anyway there's something weird going on there. It shouldn't crash on
that line. So either gcc optimizations confused gdb and it's actually
crashing elsewhere (recompiling+reinstalling the plugin without -O2
parameter would help with this), or there is some memory corruption
which is probably going to be tricky to find without valgrind.



signature.asc
Description: This is a digitally signed message part

Re: [Dovecot] Lazyexpunge and Segmentation fault

[mail...@securitylabs.it]

Timo Sirainen ha scritto:

On Nov 30, 2009, at 9:25 AM, mail...@securitylabs.it wrote:

  

Now every time I try to expunge a mailbox dovecot crash. Here the strace:



strace is almost useless for figuring out why program crashes. Could you get 
gdb backtrace? See http://dovecot.org/bugreport.html
  

Hello, Timo here gdb backtrace:

GNU gdb 6.8-debian
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 


This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i486-linux-gnu"...

warning: Can't read pathname for load map: Input/output error.
Reading symbols from /lib/i686/nosegneg/libdl.so.2...done.
Loaded symbols for /lib/i686/nosegneg/libdl.so.2
Reading symbols from /lib/i686/nosegneg/librt.so.1...done.
Loaded symbols for /lib/i686/nosegneg/librt.so.1
Reading symbols from /lib/i686/nosegneg/libc.so.6...done.
Loaded symbols for /lib/i686/nosegneg/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
Reading symbols from /lib/i686/nosegneg/libpthread.so.0...done.
Loaded symbols for /lib/i686/nosegneg/libpthread.so.0
Reading symbols from 
/usr/local/lib/dovecot/imap/lib02_lazy_expunge_plugin.so...done.

Loaded symbols for /usr/local/lib/dovecot/imap/lib02_lazy_expunge_plugin.so
Reading symbols from 
/usr/local/lib/dovecot/imap/lib10_quota_plugin.so...done.

Loaded symbols for /usr/local/lib/dovecot/imap/lib10_quota_plugin.so
Reading symbols from 
/usr/local/lib/dovecot/imap/lib11_imap_quota_plugin.so...done.

Loaded symbols for /usr/local/lib/dovecot/imap/lib11_imap_quota_plugin.so
Reading symbols from 
/usr/local/lib/dovecot/imap/lib20_mail_log_plugin.so...done.

Loaded symbols for /usr/local/lib/dovecot/imap/lib20_mail_log_plugin.so
Core was generated by `imap'.
Program terminated with signal 11, Segmentation fault.
[New process 32041]
#0  lazy_expunge_mail_expunge (_mail=0x9907ae8) at lazy-expunge-plugin.c:116
116 lt->expunge_box = 
mailbox_open_or_create(deststorage,

(gdb) bt full
#0  lazy_expunge_mail_expunge (_mail=0x9907ae8) at lazy-expunge-plugin.c:116
   lt = (struct lazy_expunge_transaction *) 0x99079b8
#1  0x08069960 in imap_expunge (box=0x98db538, next_search_arg=0x0) at 
imap-expunge.c:35

   ctx = (struct mail_search_context *) 0x99079d0
   t = (struct mailbox_transaction_context *) 0x98fea28
   mail = (struct mail *) 0x9907ae8
   search_args = (struct mail_search_args *) 0x0
   expunges = true
#2  0x08061dc8 in cmd_expunge_finish (cmd=0x98d64d0, search_args=0x0) at 
cmd-expunge.c:27

   client = (struct client *) 0x98d6250
#3  0x08067b4c in client_command_input (cmd=0x98d64d0) at client.c:612
   client = (struct client *) 0x98d6250
   command = 
   __PRETTY_FUNCTION__ = "client_command_input"
#4  0x08067be9 in client_command_input (cmd=0x98d64d0) at client.c:661
   client = (struct client *) 0x98d6250
   command = 
   __PRETTY_FUNCTION__ = "client_command_input"
#5  0x08067d5d in client_handle_input (client=0x98d6250) at client.c:702
   _data_stack_cur_id = 3
   ret = false
   remove_io = 
   handled_commands = false
   __PRETTY_FUNCTION__ = "client_handle_input"
#6  0x080686bf in client_input (client=0x98d6250) at client.c:753
   cmd = 
   output = (struct ostream *) 0x98d6404
   bytes = 
   __PRETTY_FUNCTION__ = "client_input"
#7  0x080fb8c0 in io_loop_handler_run (ioloop=0x98d19b0) at 
ioloop-epoll.c:208

   ctx = (struct ioloop_handler_context *) 0x98d1ab8
   event = (const struct epoll_event *) 0x98d1af8
   list = (struct io_list *) 0x98d4228
   io = (struct io_file *) 0x98d6460
   tv = {tv_sec = 1799, tv_usec = 999278}
   t_id = 2
   msecs = 
   ret = 1
   i = 0
   j = 0
   call = 
#8  0x080fad30 in io_loop_run (ioloop=0x98d19b0) at ioloop.c:335
No locals.
#9  0x0807119a in main (argc=Cannot access memory at address 0xc
) at main.c:327
No locals.




Did you migrate to Dovecot from another server? Sounds anyway like TB is configured to 
have "INBOX." namespace prefix or something like that. Or possibly it's caching 
wrong hierarchy separator and you need to recreate the account in TB.
  

With a different version of TB on another computer this does not happen, 
tomorrow I will try to recreate the account on the problematic TB.

Thanks, Igor

Re: [Dovecot] Lazyexpunge and Segmentation fault

[Timo Sirainen]

On Nov 30, 2009, at 9:25 AM, mail...@securitylabs.it wrote:

> Now every time I try to expunge a mailbox dovecot crash. Here the strace:

strace is almost useless for figuring out why program crashes. Could you get 
gdb backtrace? See http://dovecot.org/bugreport.html

> Another trouble I have is that now every time i select (with Thunderbird) a 
> special folder (like "Sent", "Drafts") I receive this error:
> 
> "The current command did not succeed. Tha mail server responded:Character not 
> allowed in mailbox name: '.' "
> 
> I've never configured namespace before, so I suspect a misconfiguration but I 
> can't figure out.

Did you migrate to Dovecot from another server? Sounds anyway like TB is 
configured to have "INBOX." namespace prefix or something like that. Or 
possibly it's caching wrong hierarchy separator and you need to recreate the 
account in TB.