Dear Cyrus developers,
I have reported earlier the problem to Debain bugtracker ([1]), but the
problem seems to have left without attention.
In my setup imapd causes SEGFAULT with this symptoms:
> 13:10:57 cyrus/imap[17999]: login: tanja.home [192.168.1.11] dmitry plain+TLS
> User logged in
> 13:10:57 kernel: [60608.311267] imapd[17999]: segfault at 0 ip b723049a sp
> bfe0fefc error 6 in libc-2.13.so[b71bc000+153000]
> 13:10:57 cyrus/master[2365]: process 17999 exited, signaled to death by 11
> 13:10:57 cyrus/master[2365]: service imap pid 17999 in BUSY state: terminated
> abnormally
and then due to the crash the recovery procedure takes place:
> 13:10:57 cyrus/master[18000]: about to exec /usr/lib/cyrus/bin/imapd
> 13:10:57 cyrus/imap[18000]: DBERROR db5: /var/lib/cyrus/db/__db.001: No such
> file or directory
> 13:10:57 cyrus/imap[18000]: DBERROR: dbenv->open '/var/lib/cyrus/db' failed:
> No such file or directory
> 13:10:58 cyrus/imap[18000]: DBERROR: init() on berkeley
> 13:10:58 cyrus/imap[18000]: DBERROR: reading /var/lib/cyrus/db/skipstamp,
> assuming the worst: No such file or directory
> 13:10:58 cyrus/imap[18000]: executed
> 13:10:58 cyrus/imap[18000]: skiplist: recovered /var/lib/cyrus/mailboxes.db
> (66 records, 5412 bytes) in 1 second
> 13:10:58 cyrus/imap[18000]: skiplist: recovered /var/lib/cyrus/annotations.db
> (0 records, 144 bytes) in 0 seconds
> 13:10:58 cyrus/imap[18000]: accepted connection
Here goes the stack trace and code pointer:
> (gdb) bt
> #0 0xb711549a in ?? () from /lib/i386-linux-gnu/i686/cmov/libc.so.6
> #1 0x08076278 in mboxlist_mylookup (name=<value optimized out>, typep=<value
> optimized out>, pathp=0x0,
> partp=0xbf88e398, aclp=0xbf88e39c, tid=0x0, wrlock=0) at mboxlist.c:221
> #2 0x08051272 in mlookup (tag=0x89afcb8 "5", ext_name=0x8ab3130
> "INBOX.Sent", name=0xbf88e6e5 "user.dmitry.Sent",
> flags=0x0, pathp=0x0, partp=0x0, aclp=0x0, tid=0x0) at imapd.c:412
> #3 0x08053022 in cmd_select (tag=0x89afcb8 "5", cmd=0x89afd28 "Select",
> name=0x8ab3130 "INBOX.Sent")
> at imapd.c:2619
> #4 0x08060c96 in cmdloop () at imapd.c:1462
> #5 0x080620c2 in service_main (argc=1, argv=0x89a7008, envp=0xbf891004) at
> imapd.c:691
> #6 0x0804dc3b in main (argc=3, argv=0xbf890ff4, envp=0xbf891004) at
> service.c:537
> (gdb) f 1
> #1 0x08076278 in mboxlist_mylookup (name=<value optimized out>, typep=<value
> optimized out>, pathp=0x0,
> partp=0xbf88e398, aclp=0xbf88e39c, tid=0x0, wrlock=0) at mboxlist.c:221
> 221 memcpy(aclresult, p, acllen);
> (gdb) p aclresult
> $1 = 0x0
> (gdb) p p
> $2 = 0xb4bc516a "default\tdmitry\tlrswipcda\t"
> (gdb) p acllen
> $3 = 0
> (gdb) s
> Cannot find bounds of current function
> (gdb) l
> 206 r = mboxlist_getpath(part, name, pathp);
> 207 if(r) return r;
> 208 } else {
> 209 r = mboxlist_getpath(partition, name, pathp);
> 210 if(r) return r;
> 211 }
> 212 }
> 213
> 214 /* the rest is ACL; return it if requested */
> 215 if (aclp) {
> 216 acllen = datalen - (p - data);
> 217 if (acllen >= aclresultalloced) {
> 218 aclresultalloced = acllen + 100;
> 219 aclresult = xrealloc(aclresult, aclresultalloced);
> 220 }
> 221 (!) memcpy(aclresult, p, acllen);
> 222 aclresult[acllen] = '\0';
> 223
> 224 *aclp = aclresult;
> 225 }
> 226 break;
> 227
> 228 case CYRUSDB_AGAIN:
> 229 return IMAP_AGAIN;
> 230 break;
> 231
> 232 case CYRUSDB_NOTFOUND:
> 233 return IMAP_MAILBOX_NONEXISTENT;
> 234 break;
> 235
The solution is mentioned in [1] as well as attached to this letter.
I wonder is it some corrupted data in my DB that causes the crash? At
the moment I need to patch Cyrus each time the version is updated in
Debian repository which is really annoying.
Also the latest Debian releases (2.2.13p1-15) do not SIGSEGV with patch
applied, but fail with the following message:
> cyrus/lmtpunix[30775]: verify_user(user.dmitry) failed: Unknown/invalid
> partition
I hope that somebody can help on this maillist.
[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=604468
--
With best regards,
Dmitry
Index: cyrus-imapd-2.2-2.2.13p1/imap/mboxlist.c
===================================================================
--- cyrus-imapd-2.2-2.2.13p1.orig/imap/mboxlist.c 2011-08-08
02:34:25.330006463 +0200
+++ cyrus-imapd-2.2-2.2.13p1/imap/mboxlist.c 2011-08-08 02:34:43.282002740
+0200
@@ -183,7 +183,7 @@
if (*p == ' ') p++;
q = partition;
- while (*p != ' ') { /* copy out partition name */
+ while (*p != ' ' && *p != '\t') { /* copy out partition name */
*q++ = *p++;
}
*q = '\0';
