Hi.  I noticed the following in my log recently.  Any ideas?

Jan  6 14:55:54 uggla kernel: [145284.855936] imap[18530]: segfault at 8 ip 000055c38b20f97c sp 00007ffe4baaaa40 error 4 in imap[55c38b1f7000+24000]
Jan  6 14:55:54 uggla kernel: [145284.855945] Code: 5d 41 5c 41 5d e9 2b ca fe ff 0f 1f 40 00 45 89 ec 48 89 df 48 39 eb 75 bd 48 8b 45 00 48 8d 35 da f4 00 00 41 bc ff ff ff ff <48> 8b 78 08 e8 8b 77 ff ff 48 83 c4 08 44 89 e0 5b 5d 41 5c 41 5d
Jan  6 14:55:54 uggla dovecot: imap(simon)<18530><7bj6fTy4vsof0Co6>: Fatal: master: service(imap): child 18530 killed with signal 11 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps)

The 1:2.3.4.1-5+deb10u5 packages were installed on 2021-01-04:

2021-01-04 22:34:01 status installed dovecot-imapd:amd64 1:2.3.4.1-5+deb10u5

The machine was restarted minutes after that, so on 2021-01-06 (segfault
log output above) it should have be running then-current packages.

I'm not able to use ALLOW_COREDUMPS=1 to make sure I get core dumps in
the future, but I'll report that separately.

/Simon

It seems from #980444 that you've got coredumps working.  Can you
provide a stack trace for this?

noah

tis 2021-01-19 klockan 10:58 -0800 skrev Noah Meyerhans:

No it happened randomly and I cannot reproduce it.  The server is
working fine for day-to-day use, so this is not causing any problem but
I wanted to report it anyway in case others are seeing the same thing
or if is a security-related problem.

I have enabled core dumps and also rawlogs now, so I will be able to
provide more information if this happens again.  As you can see, I was
logged into my own account (from what appears to be one of my usual
IPs), so I doubt it is someone attacking the server unauthorized.

/Simon

Dear Maintainer,
I tried to have a look at the kernel message and if I could
retrieve some more information with the help of the dbgsym
package, like described in [1].


And I came up with the following location:

     at 0x55555557997c: file imap-notify.c, line 305.

    0x0000555555579976 <imap_client_notify_more+166>:    41 bc ff ff ff ff       mov    $0xffffffff,%r12d
***0x000055555557997c <imap_client_notify_more+172>:    48 8b 78 08             mov    0x8(%rax),%rdi
    0x0000555555579980 <imap_client_notify_more+176>:    e8 8b 77 ff ff          callq  0x555555571110 <client_send_line>

This would match the "at 8" and the "ip ...97c" from the kernel output.

And would lead to this source location [2].

A "blame" from the github page shows this commit fixing
a crash [3], which might be what happened here too.


Kind regards,
Bernhard

[1] https://wiki.debian.org/InterpretingKernelOutputAtProcessCrash

[2] https://sources.debian.org/src/dovecot/1:2.3.4.1-5+deb10u6/src/imap/imap-notify.c/#L305
     (From the deb10u6 because deb10u5 is not there any more.)

[3] https://github.com/dovecot/core/commit/49daa901338a7b4749a48f0b34e199e2f6644f67

On Tue, 19 Jan 2021 09:28:58 +0100 Simon Josefsson <simon@josefsson.org> wrote:> Package: dovecot-imapd
 > Version: 1:2.3.4.1-5+deb10u5
 >
 > Hi.  I noticed the following in my log recently.  Any ideas?
 >
 > Jan  6 14:55:54 uggla kernel: [145284.855936] imap[18530]: segfault at 8 ip 000055c38b20f97c sp 00007ffe4baaaa40 error 4 in imap[55c38b1f7000+24000]
 > Jan  6 14:55:54 uggla kernel: [145284.855945] Code: 5d 41 5c 41 5d e9 2b ca fe ff 0f 1f 40 00 45 89 ec 48 89 df 48 39 eb 75 bd 48 8b 45 00 48 8d 35 da f4 00 00 41 bc ff ff ff ff <48> 8b 78 08 e8 8b 77 ff ff 48 83 c4 08 44 89 e0 5b 5d 41 5c 41 5d
 > Jan  6 14:55:54 uggla dovecot: imap(simon)<18530><7bj6fTy4vsof0Co6>: Fatal: master: service(imap): child 18530 killed with signal 11 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps)
Same here if found on my console, today:

[2592106.354939] imap[27643]: segfault at 8 ip 000056014e2b297c sp 00007ffee6f53280 error 4 in imap[56014e29a000+24000]
[2592106.354958] Code: 5d 41 5c 41 5d e9 2b ca fe ff 0f 1f 40 00 45 89 ec 48 89 df 48 39 eb 75 bd 48 8b 45 00 48 8d 35 da f4 00 00 41 bc ff ff ff ff <48> 8b 78 08 e8 8b 77 ff ff 48 83 c4 08 44 89 e0 5b 5d 41 5c 41 5d

 > The 1:2.3.4.1-5+deb10u5 packages were installed on 2021-01-04:
Mine is:
[2592106.354939] imap[27643]: segfault at 8 ip 000056014e2b297c sp 00007ffee6f53280 error 4 in imap[56014e29a000+24000]
[2592106.354958] Code: 5d 41 5c 41 5d e9 2b ca fe ff 0f 1f 40 00 45 89 ec 48 89 df 48 39 eb 75 bd 48 8b 45 00 48 8d 35 da f4 00 00 41 bc ff ff ff ff <48> 8b 78 08 e8 8b 77 ff ff 48 83 c4 08 44 89 e0 5b 5d 41 5c 41 5d

The second line matches with the message above.

Now I set ALLOW_COREDUMPS=1 to get coredump next time, hopefully.

Cheers,
Pierre