https://bugs.exim.org/show_bug.cgi?id=3162
Bug ID: 3162
Summary: crash on retry database lookup
Product: Exim
Version: 4.99
Hardware: x86
OS: Linux
Status: NEW
Severity: bug
Priority: medium
Component: Delivery in general
Assignee: [email protected]
Reporter: [email protected]
CC: [email protected]
This occurs on Rocky Linux 8 with DBM defaults for Exim.
We use cyrus-imapd and exim delivers to it with LMTP ...
lmtp_router:
driver = manualroute
route_list = localdom.univie.ac.at
host1.univie.ac.at:host2.univie.ac.at:host3.univie.ac.at randomize;
transport = remote_lmtp
and
remote_lmtp:
driver = smtp
protocol = lmtp
.ifdef _OPT_TRANSPORT_SMTP_MESSAGE_LINELENGTH_LIMIT
message_linelength_limit = 65536
.endif
authenticated_sender = xxxxxxxxx
tls_verify_certificates = /etc/pki/tls/cert.pem
tls_verify_hosts = host1.univie.ac.at : host2.univie.ac.at :
host3.univie.ac.at
hosts_require_auth = host1.univie.ac.at : host2.univie.ac.at :
host3.univie.ac.at
hosts_require_tls = host1.univie.ac.at : host2.univie.ac.at :
host3.univie.ac.at
hosts_try_dane =
yesterday we had something going on (have to investigate that as well) and all
three of hostX timed out and an according entry for localdom.univie.ac.at was
added to the retry DB.
Since the coredumps occured only on the one MX host which runs 4.99-RCx (the
other three are still running on 4.98.2) this could be something 4.99 specific.
The crash occurred on the forked transport Exim while running the queue.
As one of about 30 examples....
# exim -Mvl 1v6p4C-00000005DbE-30Hc
2025-10-09 13:44:17 Received from
[email protected] H=mail-lj1-x246.google.com
(mail-lj1-x246.google.com) [2a00:1450:4864:20::246] P=esmtps
X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=yes DN="/CN=smtp.gmail.com"
SNI=zidmx1.univie.ac.at K S=15615 M8S=0 DKIM=xxxx.at ARC
id=CACXRfiHe-yX7iDQ989ymDdmwYFG5O1ChOZw+V7RO+Ut=yyh...@mail.gmail.com
2025-10-09 13:44:17 [email protected] <[email protected]>
R=lmtp_router T=remote_lmtp defer (-54) DT=0s: retry time not reached for any
host for 'localdom.univie.ac.at'
2025-10-09 13:45:42 [email protected] <[email protected]>
R=lmtp_router T=remote_lmtp defer (-1) DT=0s: smtp transport process returned
non-zero status 0x008b: terminated by signal 11
And the backtrace shows:
(gdb) bt
#0 0x00007fec8c7238cf in __strcmp_avx2 () from /lib64/libc.so.6
#1 0x00000000004ce98b in tree_search (p=0xdbdbdbdbdbdbdbdb, name=0x1dfe568
"T:host2.univie.ac.at:xxx.xxx.xxx.xxx:24")
at tree.c:341
#2 0x000000000049a530 in retry_check_address (domain=0x1dca650
"localdom.univie.ac.at", host=0x1dfe020,
portstring=0x1dfe550 ":24", include_ip_address=1,
retry_host_key=0x7ffe0fd5f280, retry_message_key=0x7ffe0fd5f278)
at retry.c:187
#3 0x0000000000506a27 in smtp_transport_entry (tblock=0x1cb6c00,
addrlist=0x1dca418) at smtp.c:6028
#4 0x000000000043df26 in do_remote_deliveries (fallback=0) at deliver.c:4954
#5 0x000000000044562f in deliver_message (id=0x1c7b3b8
"1v6p4C-00000005DbE-30Hc", forced=0, give_up=0) at deliver.c:8429
#6 0x0000000000454e9a in main (argc=5, cargv=0x7ffe0fda0228) at exim.c:5180
Frame 1 "p" is obviously "inaccessible".
I still have all the coredumps and the mails are frozen in the queue. I can
provide any details, but I would prefer to not disclose some details in
bugzilla.
--
You are receiving this mail because:
You are on the CC list for the bug.
--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-dev.lists.exim.org/
## unsubscribe (doesn't require an account):
## [email protected]
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
