Yes, I know this is not very informative. I've already set
ALLOW_COREDUMPS to 1 in /etc/default/dovecot and waiting for the next
fault.


% grep segfa kern.log*
kern.log.1:	Mar 17 13:27:09 mail kernel: [118616.482998] imap[31111]: segfault at 8 ip 00007efbff924cbb sp 00007fff0b333890 error 4 in libdovecot-storage.so.0.0.0[7efbff858000+145000]

% zgrep segfa kern.log*gz
kern.log.2.gz:Mar 15 01:51:07 mail kernel: [1691560.449110] imap[8329]: segfault at 8 ip 00007ff38ae2390e sp 00007ffcd3317640 error 4
kern.log.2.gz:Mar 15 01:51:07 mail kernel: [1691560.449117] imap[8380]: segfault at 8 ip 00007fea0c1c890e sp 00007ffdc7607150 error 4 in libdovecot-storage.so.0.0.0[7fea0c10d000+12c000]
kern.log.2.gz:Mar 15 01:51:07 mail kernel: [1691560.449438] imap[8371]: segfault at 8 ip 00007f4775b0490e sp 00007ffce2814cc0 error 4 in libdovecot-storage.so.0.0.0[7f4775a49000+12c000]
kern.log.2.gz:Mar 15 01:51:07 mail kernel: [1691560.461685] imap[2435]: segfault at 8 ip 00007fa8cb0ab90e sp 00007ffc4185e130 error 4 in libdovecot-storage.so.0.0.0[7fa8caff0000+12c000]
kern.log.3.gz:Mar 13 02:35:33 mail kernel: [1521426.802606] imap[11824]: segfault at 8 ip 00007fa1b95d290e sp 00007ffd935de700 error 4
kern.log.3.gz:Mar 13 02:35:33 mail kernel: [1521426.802614] imap[11827]: segfault at 8 ip 00007f1afe53490e sp 00007fffbeb753d0 error 4 in libdovecot-storage.so.0.0.0[7f1afe479000+12c000]
kern.log.3.gz:Mar 13 02:35:33 mail kernel: [1521426.802983] imap[11837]: segfault at 8 ip 00007f70b5c9b90e sp 00007ffd7f80bc80 error 4 in libdovecot-storage.so.0.0.0[7f70b5be0000+12c000]


% grep 'signal 11' mail.err*
mail.err.1:	Mar 17 13:27:09 mail dovecot: imap(sergio)<31111><lLOIej6EEN1Pht53>: Fatal: master: service(imap): child 31111 killed with signal 11 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps)

% zgrep 'signal 11' mail.err*
mail.err.1:Mar 17 13:27:09 mail dovecot: imap(sergio)<31111><lLOIej6EEN1Pht53>: Fatal: master: service(imap): child 31111 killed with signal 11 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps)
mail.err.2.gz:Mar 15 01:51:07 mail dovecot: imap(sergio): Fatal: master: service(imap): child 8371 killed with signal 11 (core dumps disabled)
mail.err.2.gz:Mar 15 01:51:07 mail dovecot: imap(sergio): Fatal: master: service(imap): child 8380 killed with signal 11 (core dumps disabled)
mail.err.2.gz:Mar 15 01:51:07 mail dovecot: imap(sergio): Fatal: master: service(imap): child 8329 killed with signal 11 (core dumps disabled)
mail.err.2.gz:Mar 15 01:51:07 mail dovecot: imap(sergio): Fatal: master: service(imap): child 2435 killed with signal 11 (core dumps disabled)
mail.err.3.gz:Mar 13 02:35:33 mail dovecot: imap(sergio): Fatal: master: service(imap): child 11827 killed with signal 11 (core dumps disabled)
mail.err.3.gz:Mar 13 02:35:33 mail dovecot: imap(sergio): Fatal: master: service(imap): child 11837 killed with signal 11 (core dumps disabled)
mail.err.3.gz:Mar 13 02:35:33 mail dovecot: imap(sergio): Fatal: master: service(imap): child 11824 killed with signal 11 (core dumps disabled)


% s dovecot -n
# 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.5.4 ()
doveconf: Warning: service auth { client_limit=1000 } is lower than required under max. load (1324)
doveconf: Warning: service anvil { client_limit=1000 } is lower than required under max. load (1227)
# OS: Linux 4.9.0-8-amd64 x86_64 Debian 9.8 ext4
# Hostname: mail.outerface.net
auth_verbose = yes
lda_mailbox_autocreate = yes
lda_mailbox_autosubscribe = yes
lmtp_rcpt_check_quota = yes
lmtp_save_to_detail_mailbox = yes
mail_home = /var/mail/%u
mail_location = sdbox:/var/mail/%u
mail_plugins = quota fts virtual
mail_privileged_group = mail
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext spamtest spamtestplus
namespace {
  location = virtual:~/mailboxes/virtual
  prefix = virtual/
  separator = /
}
namespace inbox {
  inbox = yes
  location =
  mailbox Drafts {
    special_use = \Drafts
  }
  mailbox Junk {
    special_use = \Junk
  }
  mailbox Sent {
    special_use = \Sent
  }
  mailbox "Sent Messages" {
    special_use = \Sent
  }
  mailbox Spam {
    special_use = \Junk
  }
  mailbox Trash {
    special_use = \Trash
  }
  prefix =
}
passdb {
  args = /etc/dovecot/dovecot-ldap.conf.ext
  driver = ldap
}
plugin {
  fts_autoindex = yes
  quota = count:User quota
  quota_grace = 10%%
  quota_rule = *:storage=2G
  quota_vsizes = yes
  sieve = file:~/sieve;active=~/.dovecot.sieve
  sieve_extensions = +spamtest +spamtestplus
  sieve_global = /etc/dovecot/sieve/
  sieve_spamtest_max_value = 120
  sieve_spamtest_status_header = X-Spam_score_int
  sieve_spamtest_status_type = score
}
protocols = " imap lmtp sieve"
service auth-worker {
  user = $default_internal_user
}
service auth {
  unix_listener auth-client {
    mode = 0666
    user = mail
  }
}
service imap-login {
  inet_listener imaps {
    port = 0
  }
  process_limit = 1024
  service_count = 1
  vsz_limit = 64 M
}
service imap {
  process_limit = 1024
}
ssl = required
ssl_cert = </etc/ssl/localcerts/outerface.net-cert.pem
ssl_cipher_list = ECDHE-ECDSA-AES256-GCM-SHA384
ssl_client_ca_dir = /etc/ssl/certs
ssl_key = # hidden, use -P to show it
ssl_min_protocol = TLSv1.2
userdb {
  driver = prefetch
}
userdb {
  args = /etc/dovecot/dovecot-ldap.conf.ext
  driver = ldap
}
protocol lmtp {
  mail_fsync = optimized
  mail_plugins = quota fts virtual sieve
}
protocol lda {
  mail_fsync = optimized
}
protocol imap {
  mail_max_userip_connections = 128
  mail_plugins = quota fts virtual imap_zlib quota
}

Dear Maintainer,
tried to get some more information out of the
kernel segfault line, until a backtrace or core
gets delivered...

For the lines with "ip .............90e" I guess
it could be related to these functions:

  array_append_array_i
  mailbox_uidset_change
  mail_search_arg_init

It might be that we hit following line with
dest_array or src_array containing a null pointer.

  array.h:193          i_assert(dest_array->element_size == src_array->element_size);

Then we would get such a segfault instead
of the assert message.
But sure, the problem behind needs more context.

Kind regards,
Bernhard

Hi!  On May 18, 19 and 24 I saw repeated crashes that looked similar to
the ones reported here before.  Syslog content and one backtrace below.
I haven't seen the problem since then.  I don't know what kind of device
this was.  Note that the connection was authenticated correctly.

/Simon

root@uggla:~# coredumpctl info 30625
           PID: 30625 (imap)
           UID: 115 (dovmail)
           GID: 122 (dovmail)
        Signal: 11 (SEGV)
     Timestamp: Mon 2021-05-24 19:14:30 UTC (2 weeks 0 days ago)
  Command Line: dovecot/imap postlogin
    Executable: /usr/lib/dovecot/imap
 Control Group: /system.slice/dovecot.service
          Unit: dovecot.service
         Slice: system.slice
       Boot ID: 246f0c28fe2d43e5ab7d0df6fadb97e9
    Machine ID: 91d76afe2fc543e49fa0c766b415c23c
      Hostname: uggla
       Storage: /var/lib/systemd/coredump/core.imap.115.246f0c28fe2d43e5ab7d0df6fadb97e9.30625.1621883670000000.lz4
       Message: Process 30625 (imap) of user 115 dumped core.

                Stack trace of thread 30625:
                #0  0x00007f2957682bd0 mail_set_critical (libdovecot-storage.so.0)
                #1  0x00007f29576add65 maildir_transaction_save_commit_pre (libdovecot-storage.so.0)
                #2  0x00007f295770783b n/a (libdovecot-storage.so.0)
                #3  0x00007f2957721f30 mail_index_transaction_commit_full (libdovecot-storage.so.0)
                #4  0x00007f2957707d91 index_transaction_commit (libdovecot-storage.so.0)
                #5  0x00007f29576e4277 n/a (libdovecot-storage.so.0)
                #6  0x00007f295768506b mailbox_transaction_commit_get_changes (libdovecot-storage.so.0)
                #7  0x000055f4f315aaaf n/a (imap)
                #8  0x000055f4f3167dc0 command_exec (imap)
                #9  0x000055f4f31663f2 n/a (imap)
                #10 0x000055f4f3166494 n/a (imap)
                #11 0x000055f4f3166845 client_handle_input (imap)
                #12 0x000055f4f3166d6e client_input (imap)
                #13 0x00007f295758cbef io_loop_call_io (libdovecot.so.0)
                #14 0x00007f295758e1e6 io_loop_handler_run_internal (libdovecot.so.0)
                #15 0x00007f295758cc8c io_loop_handler_run (libdovecot.so.0)
                #16 0x00007f295758cdf0 io_loop_run (libdovecot.so.0)
                #17 0x00007f295750d123 master_service_run (libdovecot.so.0)
                #18 0x000055f4f3158bf5 main (imap)
                #19 0x00007f29572f709b __libc_start_main (libc.so.6)
                #20 0x000055f4f3158d8a _start (imap)

May 24 17:57:10 uggla dovecot: imap-login: Login: user=<simon>, method=CRAM-MD5, rip=2001:9b1:41ac:ff00:60cf:be83:d196:9c4f, lip=2001:9b1:8633::107, mpid=30625, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
...
May 24 19:14:30 uggla kernel: [295182.948459] show_signal_msg: 2 callbacks suppressed
May 24 19:14:30 uggla kernel: [295182.948467] imap[30625]: segfault at 20 ip 00007f2957682bd0 sp 00007fff90234bd0 error 4 in libdovecot-storage.so.0.0.0[7f2957660000+d1000]
May 24 19:14:30 uggla kernel: [295182.948481] Code: 00 00 48 89 44 24 18 48 8d 44 24 30 c7 44 24 14 30 00 00 00 48 89 44 24 20 e8 bc 44 fe ff 48 8d 74 24 10 48 89 ef 89 44 24 0c <f6> 43 20 02 74 4a e8 d5 2d fe ff 48 8b 3b 48 8d \
35 22 04 0b 00 48
May 24 19:14:30 uggla systemd[1]: Created slice system-systemd\x2dcoredump.slice.
May 24 19:14:30 uggla systemd[1]: Started Process Core Dump (PID 20806/UID 0).
May 24 19:14:30 uggla dovecot: imap(simon)<30625><caN/IxfDEpAgAQmxQaz/AGDPvoPRlpxP>: Fatal: master: service(imap): child 30625 killed with signal 11 (core dumped)
May 24 19:14:30 uggla systemd-coredump[20807]: Process 30625 (imap) of user 115 dumped core.#012#012Stack trace of thread 30625:#012#0  0x00007f2957682bd0 mail_set_critical (libdovecot-storage.so.0)#012#1  0x00007f29576add65 mai\
ldir_transaction_save_commit_pre (libdovecot-storage.so.0)#012#2  0x00007f295770783b n/a (libdovecot-storage.so.0)#012#3  0x00007f2957721f30 mail_index_transaction_commit_full (libdovecot-storage.so.0)#012#4  0x00007f2957707d91 \
index_transaction_commit (libdovecot-storage.so.0)#012#5  0x00007f29576e4277 n/a (libdovecot-storage.so.0)#012#6  0x00007f295768506b mailbox_transaction_commit_get_changes (libdovecot-storage.so.0)#012#7  0x000055f4f315aaaf n/a \
(imap)#012#8  0x000055f4f3167dc0 command_exec (imap)#012#9  0x000055f4f31663f2 n/a (imap)#012#10 0x000055f4f3166494 n/a (imap)#012#11 0x000055f4f3166845 client_handle_input (imap)#012#12 0x000055f4f3166d6e client_input (imap)#01\
2#13 0x00007f295758cbef io_loop_call_io (libdovecot.so.0)#012#14 0x00007f295758e1e6 io_loop_handler_run_internal (libdovecot.so.0)#012#15 0x00007f295758cc8c io_loop_handler_run (libdovecot.so.0)#012#16 0x00007f295758cdf0 io_loop\
_run (libdovecot.so.0)#012#17 0x00007f295750d123 master_service_run (libdovecot.so.0)#012#18 0x000055f4f3158bf5 main (imap)#012#19 0x00007f29572f709b __libc_start_main (libc.so.6)#012#20 0x000055f4f3158d8a _start (imap)
May 24 19:14:30 uggla systemd[1]: systemd-coredump@0-20806-0.service: Succeeded.