Hi there,

I see this with `doveadm batch`:

    # doveadm batch -A : kick
    Segmentation fault

Syslog says:

    ... doveadm[26542]: segfault at 0 ip (null) sp 00007fff8fd322e8 error 14 in doveadm[5635f51f0000+7e000]


Cheers,

  sphakka

Dear Maintainer,
I could reproduce this crash in a minimal stretch amd64 VM
with just dovecot-core installed and default configuration.

That command crashes also in a similar VM with current
buster/testing version.

Kind regards,
Bernhard


(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x000055dfefbe3f1c in doveadm_mail_cmd_init (cmd=cmd@entry=0x7ffe8dfe1ab0, set=0x55dff0e09178) at doveadm-mail.c:540
#2  0x000055dfefbe561b in cmd_batch_add (argv=<optimized out>, argc=<optimized out>, batchctx=0x55dff0e19250) at doveadm-mail-batch.c:78
#3  cmd_batch_preinit (_ctx=0x55dff0e19250) at doveadm-mail-batch.c:126
#4  0x000055dfefbe3b15 in doveadm_mail_cmd_exec (ctx=ctx@entry=0x55dff0e19250, cctx=cctx@entry=0x7ffe8dfe1ba0, wildcard_user=wildcard_user@entry=0x0) at doveadm-mail.c:575
#5  0x000055dfefbe44ea in doveadm_mail_cmd (argv=<optimized out>, argc=4, cmd=0x55dff0e17a10) at doveadm-mail.c:693
#6  doveadm_mail_try_run (cmd_name=<optimized out>, argc=<optimized out>, argv=<optimized out>) at doveadm-mail.c:766
#7  0x000055dfefbd3d6a in main (argc=<optimized out>, argv=<optimized out>) at doveadm.c:381

(gdb) directory /home/benutzer/dovecot-core/orig/dovecot-2.2.27/src/doveadm
Source directories searched: /home/benutzer/dovecot-core/orig/dovecot-2.2.27/src/doveadm:$cdir:$cwd
(gdb) up
#1  0x000055dfefbe3f1c in doveadm_mail_cmd_init (cmd=cmd@entry=0x7ffe8dfe1ab0, set=0x55dff0e09178) at doveadm-mail.c:540
540             ctx = cmd->alloc();
(gdb) print cmd
$1 = (const struct doveadm_mail_cmd *) 0x7ffe8dfe1ab0
(gdb) print *cmd
$2 = {alloc = 0x0, name = 0x55dfefc19130 "kick", usage_args = 0x55dfefc19af8 "[-a <anvil socket path>] <user mask>[|]<ip/bits>"}

Dear Maintainer,
I could reproduce this crash in a minimal stretch amd64 VM
with just dovecot-core installed and default configuration.

That command crashes also in a similar VM with current
buster/testing version.

Kind regards,
Bernhard


(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x000055dfefbe3f1c in doveadm_mail_cmd_init (cmd=cmd@entry=0x7ffe8dfe1ab0, set=0x55dff0e09178) at doveadm-mail.c:540
#2  0x000055dfefbe561b in cmd_batch_add (argv=<optimized out>, argc=<optimized out>, batchctx=0x55dff0e19250) at doveadm-mail-batch.c:78
#3  cmd_batch_preinit (_ctx=0x55dff0e19250) at doveadm-mail-batch.c:126
#4  0x000055dfefbe3b15 in doveadm_mail_cmd_exec (ctx=ctx@entry=0x55dff0e19250, cctx=cctx@entry=0x7ffe8dfe1ba0, wildcard_user=wildcard_user@entry=0x0) at doveadm-mail.c:575
#5  0x000055dfefbe44ea in doveadm_mail_cmd (argv=<optimized out>, argc=4, cmd=0x55dff0e17a10) at doveadm-mail.c:693
#6  doveadm_mail_try_run (cmd_name=<optimized out>, argc=<optimized out>, argv=<optimized out>) at doveadm-mail.c:766
#7  0x000055dfefbd3d6a in main (argc=<optimized out>, argv=<optimized out>) at doveadm.c:381

(gdb) directory /home/benutzer/dovecot-core/orig/dovecot-2.2.27/src/doveadm
Source directories searched: /home/benutzer/dovecot-core/orig/dovecot-2.2.27/src/doveadm:$cdir:$cwd
(gdb) up
#1  0x000055dfefbe3f1c in doveadm_mail_cmd_init (cmd=cmd@entry=0x7ffe8dfe1ab0, set=0x55dff0e09178) at doveadm-mail.c:540
540             ctx = cmd->alloc();
(gdb) print cmd
$1 = (const struct doveadm_mail_cmd *) 0x7ffe8dfe1ab0
(gdb) print *cmd
$2 = {alloc = 0x0, name = 0x55dfefc19130 "kick", usage_args = 0x55dfefc19af8 "[-a <anvil socket path>] <user mask>[|]<ip/bits>"}

Hi,

Thanks to both of you for the information. I have forwarded this bug
upstream, it looks like `batch` is set up to work primarily with
"version 1" doveadm commands, converting "version 2" commands to 1 under
the hood. Apparently `kick` is lacking an allocation function that would
allow it to work as a "version 1" command, causing a null pointer
dereference on the way there.

Regards,
Apollon

Hi,

Thanks to both of you for the information. I have forwarded this bug
upstream, it looks like `batch` is set up to work primarily with
"version 1" doveadm commands, converting "version 2" commands to 1 under
the hood. Apparently `kick` is lacking an allocation function that would
allow it to work as a "version 1" command, causing a null pointer
dereference on the way there.

Regards,
Apollon