[exim-dev] [Bug 2274] exim 4.91: segfault ... error 4 in libc-2.17.so

[admin--- via Exim-dev]

https://bugs.exim.org/show_bug.cgi?id=2274

--- Comment #13 from Alex  ---
Hello Phil,

Directadmin manages Exim the following way:

1. at a moment of installation of a new server a pre-compiled package is
installed from DA's repository, it's called da_exim for CentOS.

2. then all updates and upgrades are done with a help of custombuild script,
which compiles Exim from sources.

Here what we have:

[root@server ccpp-2018-05-15-15:38:54-18615]# exim -bV
Exim version 4.91 #8 built 12-May-2018 09:25:36
Copyright (c) University of Cambridge, 1995 - 2018
(c) The Exim Maintainers and contributors in ACKNOWLEDGMENTS file, 2007 - 2018
Berkeley DB: Berkeley DB 5.3.21: (May 11, 2012)
Support for: crypteq IPv6 Perl OpenSSL move_frozen_messages Content_Scanning
DKIM DNSSEC Event OCSP PRDR SPF TCP_Fast_Open Experimental_SRS
Lookups (built-in): lsearch wildlsearch nwildlsearch iplsearch cdb dbm dbmjz
dbmnz dnsdb
Authenticators: cram_md5 dovecot plaintext spa
Routers: accept dnslookup ipliteral manualroute queryprogram redirect
Transports: appendfile/maildir/mailstore/mbx autoreply lmtp pipe smtp
Malware: f-protd f-prot6d drweb aveserver fsecure kavdaemon sophie clamd mksd
avast sock cmdline
Fixed never_users: 0
Configure owner: 0:0
Size of off_t: 8
2018-05-19 07:00:14 cwd=/var/spool/abrt/ccpp-2018-05-15-15:38:54-18615 2 args:
exim -bV
Configuration file is /etc/exim.conf


[root@server ccpp-2018-05-15-15:38:54-18615]# rpm -q da_exim
da_exim-4.89.1-1.x86_64
[root@server ccpp-2018-05-15-15:38:54-18615]#


The recent segfault:

May 19 02:44:11 server kernel: exim[2707]: segfault at 0 ip 7f6213f31cbf sp
7fff70c274e8 error 4 in libc-2.17.so[7f6213e97000+1c3000];


I will check what else I can provide you with.

Regards,
Alex.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-- 
## List details at https://lists.exim.org/mailman/listinfo/exim-dev Exim 
details at http://www.exim.org/ ##

[exim-dev] [Bug 2274] exim 4.91: segfault ... error 4 in libc-2.17.so

[admin--- via Exim-dev]

https://bugs.exim.org/show_bug.cgi?id=2274

Phil Pennock  changed:

   What|Removed |Added

 CC||p...@exim.org

--- Comment #12 from Phil Pennock  ---
The abort server referenced in the crash details has nothing at the claimed
URL, and it's three days later, so I would really expect
https://retrace.fedoraproject.org/faf/reports/bthash/8fe5b7ec11a15288157804580a2f41dd3fe868d9
to have something if it were ever going to work.  So there's nothing there to
trace.

As far as I can tell, Direct Admin is mostly restricted to those with license
keys, which makes it hard to tell what's going on.  I've tried seeing how far I
could get in a Docker image, but (1) you're running Centos 7.5.1804, which is
newer than the latest Centos available on Docker Hub; and (2) the DirectAdmin
files mirror I'm looking at does not have packages for "7.5".  Meanwhile the
crash report doesn't say which version of the package, installed for what
architecture, is in use.

So at this point we've got a third-party build of Exim, built for unknown OS
release, being run on a different OS release, and we have crashes telling us
that the death is inside libc, but no stack traces and no way to sanely figure
out which version of Exim it was.

The bug-report claims that it's Exim 4.91 segfaulting, but the crash report
says that it's Exim from the package "da_exim-4.89.1-1".

What sort of system is this, where things are failing?  Is this running in
production somewhere, in this state?

We have from the dump a rather poor backtrace which can't tell us much without
the binary:

:,   "frames":
:  [ {   "address": 139775044603071
:,   "build_id": "cb4b7554d1adbef2f001142dd6f0a5139fc9aa69"
:,   "build_id_offset": 634047
:,   "function_name": "__strncpy_sse2_unaligned"
:,   "file_name": "/usr/lib64/libc-2.17.so"
:}
:  , {   "address": 4352528
:,   "build_id": "bae74c686ca4940655bfcf0c4667e94956fa977b"
:,   "build_id_offset": 158224
:,   "function_name": "main"
:,   "file_name": "/usr/sbin/exim"
:} ]

Okay.  So somewhere directly in main() there's a call to strncpy; there's no
indication of if Exim was compiled such as to optimize away intermediate
frames, for example.  The only _direct_ call to strncp (via Ustrncpy macro) is
when debug-logging, and the initial_cwd is copied into the big-buffer.

Perhaps if os_getcwd() fails?  Could it be that the spam-checker has chdir()'d
to a directory which it unlinks, but calls Exim from inside, so that Exim's
os_getcwd() fails?

Other than that wild shot in the dark, there's really too little here to chase
this any further.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-- 
## List details at https://lists.exim.org/mailman/listinfo/exim-dev Exim 
details at http://www.exim.org/ ##

[exim-dev] [Bug 2274] exim 4.91: segfault ... error 4 in libc-2.17.so

[admin--- via Exim-dev]

https://bugs.exim.org/show_bug.cgi?id=2274

--- Comment #11 from Alex  ---
So in this case I need to start a gdb session and feed the process of
`/usr/sbin/exim -oMr spam-scanned -bS` with an email which caused the crash. If
this is the case... we don't have the email unfortunately.

As mentioned earlier we have never managed to repeat a crash manually.

Or do I miss anything?

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-- 
## List details at https://lists.exim.org/mailman/listinfo/exim-dev Exim 
details at http://www.exim.org/ ##

[exim-dev] [Bug 2274] exim 4.91: segfault ... error 4 in libc-2.17.so

[admin--- via Exim-dev]

https://bugs.exim.org/show_bug.cgi?id=2274

--- Comment #10 from Jeremy Harris  ---
Something else; that doesn't include a stack trace

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-- 
## List details at https://lists.exim.org/mailman/listinfo/exim-dev Exim 
details at http://www.exim.org/ ##

[exim-dev] [Bug 2274] exim 4.91: segfault ... error 4 in libc-2.17.so

[admin--- via Exim-dev]

https://bugs.exim.org/show_bug.cgi?id=2274

--- Comment #9 from Alex  ---
Do you mean the one that attached as an attachment 1086? Or something else
different?

Regards,
Alex.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-- 
## List details at https://lists.exim.org/mailman/listinfo/exim-dev Exim 
details at http://www.exim.org/ ##

[exim-dev] [Bug 2274] exim 4.91: segfault ... error 4 in libc-2.17.so

[admin--- via Exim-dev]

https://bugs.exim.org/show_bug.cgi?id=2274

--- Comment #8 from Jeremy Harris  ---
Unhelpful.  We need the stack trace.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-- 
## List details at https://lists.exim.org/mailman/listinfo/exim-dev Exim 
details at http://www.exim.org/ ##