imapd crashes with SIGSEGV in mboxlist.c:221

[Dmitry Katsubo]

Dear Cyrus developers,

Sorry for disturbing the developers on cyrus-devel again.

Can somebody in this list help me with the problem I've encountered with
Cyrus? I've spend some time tracing down the problem, debugging,
recompiling and providing finally patch. Does anybody volunteers to find
out what is the real reason of the failure?

Thanks in advance.

On 08.08.2011 5:52, Dmitry Katsubo wrote:
> Dear Cyrus developers,
> 
> I have reported earlier the problem to Debain bugtracker ([1]), but the
> problem seems to have left without attention.
> 
> In my setup imapd causes SEGFAULT with this symptoms:
> 
>> 13:10:57 cyrus/imap[17999]: login: tanja.home [192.168.1.11] dmitry plain+TLS User logged in
>> 13:10:57 kernel: [60608.311267] imapd[17999]: segfault at 0 ip b723049a sp bfe0fefc error 6 in libc-2.13.so[b71bc000+153000]
>> 13:10:57 cyrus/master[2365]: process 17999 exited, signaled to death by 11
>> 13:10:57 cyrus/master[2365]: service imap pid 17999 in BUSY state: terminated abnormally
> 
> and then due to the crash the recovery procedure takes place:
> 
>> 13:10:58 cyrus/imap[18000]: skiplist: recovered /var/lib/cyrus/mailboxes.db (66 records, 5412 bytes) in 1 second
>> 13:10:58 cyrus/imap[18000]: skiplist: recovered /var/lib/cyrus/annotations.db (0 records, 144 bytes) in 0 seconds
>> 13:10:58 cyrus/imap[18000]: accepted connection
> 
> Here goes the stack trace and code pointer:
> 
>> (gdb) bt
>> #0  0xb711549a in ?? () from /lib/i386-linux-gnu/i686/cmov/libc.so.6
>> #1  0x08076278 in mboxlist_mylookup (name=<value optimized out>, typep=<value optimized out>, pathp=0x0,
>>     partp=0xbf88e398, aclp=0xbf88e39c, tid=0x0, wrlock=0) at mboxlist.c:221
>> #2  0x08051272 in mlookup (tag=0x89afcb8 "5", ext_name=0x8ab3130 "INBOX.Sent", name=0xbf88e6e5 "user.dmitry.Sent",
>>     flags=0x0, pathp=0x0, partp=0x0, aclp=0x0, tid=0x0) at imapd.c:412
>> #3  0x08053022 in cmd_select (tag=0x89afcb8 "5", cmd=0x89afd28 "Select", name=0x8ab3130 "INBOX.Sent")
>>     at imapd.c:2619
>> #4  0x08060c96 in cmdloop () at imapd.c:1462
>> #5  0x080620c2 in service_main (argc=1, argv=0x89a7008, envp=0xbf891004) at imapd.c:691
>> #6  0x0804dc3b in main (argc=3, argv=0xbf890ff4, envp=0xbf891004) at service.c:537
>> (gdb) f 1
>> #1  0x08076278 in mboxlist_mylookup (name=<value optimized out>, typep=<value optimized out>, pathp=0x0,
>>     partp=0xbf88e398, aclp=0xbf88e39c, tid=0x0, wrlock=0) at mboxlist.c:221
>> 221                 memcpy(aclresult, p, acllen);
>> (gdb) p aclresult
>> $1 = 0x0
>> (gdb) p p
>> $2 = 0xb4bc516a "default\tdmitry\tlrswipcda\t"
>> (gdb) p acllen
>> $3 = 0
>> (gdb) s
>> Cannot find bounds of current function
>> (gdb) l
>> 206                     r = mboxlist_getpath(part, name, pathp);
>> 207                     if(r) return r;
>> 208                 } else {
>> 209                     r = mboxlist_getpath(partition, name, pathp);
>> 210                     if(r) return r;
>> 211                 }
>> 212             }
>> 213
>> 214             /* the rest is ACL; return it if requested */
>> 215             if (aclp) {
>> 216                 acllen = datalen - (p - data);
>> 217                 if (acllen >= aclresultalloced) {
>> 218                     aclresultalloced = acllen + 100;
>> 219                     aclresult = xrealloc(aclresult, aclresultalloced);
>> 220                 }
>> 221 (!)             memcpy(aclresult, p, acllen);
>> 222                 aclresult[acllen] = '\0';
>> 223
>> 224                 *aclp = aclresult;
>> 225             }
>> 226             break;
>> 227
>> 228         case CYRUSDB_AGAIN:
>> 229             return IMAP_AGAIN;
>> 230             break;
>> 231
>> 232         case CYRUSDB_NOTFOUND:
>> 233             return IMAP_MAILBOX_NONEXISTENT;
>> 234             break;
>> 235
> 
> The solution is mentioned in [1] as well as attached to this letter.
> 
> I wonder is it some corrupted data in my DB that causes the crash? At
> the moment I need to patch Cyrus each time the version is updated in
> Debian repository which is really annoying.
> 
> Also the latest Debian releases (2.2.13p1-15) do not SIGSEGV with patch
> applied, but fail with the following message:
> 
>> cyrus/lmtpunix[30775]: verify_user(user.dmitry) failed: Unknown/invalid partition
> 
> I hope that somebody can help on this maillist.
> 
> [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=604468