cyr_expire SIGSEGV

Hi!

I've a cyrus-imapd-2.3.7-7 built from the src.rpm at invoca.ch running on FC5.

I use the "delayed expunge" feature.

My cyrus.conf therefor has
delprune cmd="cyr_expire -E 3 -X 2" at=0400

Most of the time cyr_expire runs it crashes with SIGBUS or SIGSEGV.

It also crashes if I start it manually after it crashed during the night.
Doing a strace and "reconstruct -r"ing the user last accessed makes
cyr_expire happy again at least for this users mailboxes.

I've activated coredumps and the backtrace always shows:
#0 0x0804e6f0 in cyrus_mutex_free ()
#1 0x08053213 in cyrus_mutex_free ()
#2 0x0804cb50 in expire ()
#3 0x0805a955 in mboxlist_findall ()
#4 0x0808ef0e in mboxlist_findall ()
#5 0x08057fc2 in mboxlist_findall ()
#6 0x0804cfa7 in expire ()
#7 0x004554e4 in __libc_start_main () from /lib/libc.so.6
#8 0x0804c6f1 in ?? ()

The last lines from strace shows write access to the quota file
stat64("/",
{st_mode=S_IFREG|0600, st_size=736, }) = 0
mmap2(NULL, 736, PRT_READ, MAP_SHARED, 9, 0) = 0xb66ba000
lseek(9, 736, SEEK_SET) = 736
open("/",
RDWR|CREAT|TRUNC, 0666) = 12
time(NULL) = 1169137631
write(10, "\0\0\0\357\0\0\0\0\0\0\0\t\0\0\0`\0\0\0P\0\0\0\0E\ 257?", 96) = 96
_llseek(10, 0, [0], SEEK_SET) = 0
read(10, "\0\0\0\357\0\0\0\0\0\0\0\t\0\0\0`\0\0\0P\0\0\0\0E\ 257?", 4096) = 96
_llseek(10, 96, [96], SEEK_SET) = 0
open("/", RDWR) = 13
fcntl64(13, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=0}) = 0
fstat64(13, {st_mode=S_IFREG|0600, st_size=16, }) = 0
stat64("/", {st_mode=S_IFREG|0600, st_size=16,
}) = 0
fstat64(13, {st_mode=S_IFREG|0600, st_size=16, }) = 0
mmap2(NULL, 16, PRT_READ, MAP_SHARED, 13, 0) = 0xb66b9000
munmap(0xb66b9000, 16) = 0
unlink("/") = -1 ENENT (No such file or
directory)
open("/", RDWR|CREAT|TRUNC, 0666) = 14
fcntl64(14, F_SETLKW, {type=F_WRLCK, whence=SEEK_SET, start=0, len=0}) = 0
lseek(14, 0, SEEK_SET) = 0
write(14, "30244719\n512000\n", 16) = 16
ftruncate(14, 16) = 0
fsync(14) = 0
fstat64(14, {st_mode=S_IFREG|0600, st_size=16, }) = 0
rename("/",
"/") = 0
fcntl64(14, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=0}) = 0
close(14) = 0
fcntl64(13, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=0}) = 0
close(13) = 0
fstat64(12, {st_mode=S_IFREG|0600, st_size=0, }) = 0
mmap2(NULL, 4096, PRT_READ|PRT_WRITE, MAP_PRIVATE|MAP_ANNYMUS, -1, 0) =
0xb66b9000
time(NULL) = 1169137631
SIGSEGV (Segmentation fault) @ 0 (0)
killed by SIGSEGV (core dumped)

Any ideas?

Regards, Wolfgang Breyha



--
Wolfgang Breyha <wbreyha (AT) gmx (DOT) net| http://www.blafasel.at/
Vienna University Computer Center | Austria


Cyrus Home Page: http://cyrusimap.web.cmu.edu/
Cyrus Wiki/FAQ:
List Archives/Info:

Hi again!

I compiled a cyr_expire with debug symbols the backtrace looks like:
#0 process_records (mailbox=0xbfb1786c, newindex=0x9558f68,
index_base=0xb66f9000 <Address 0xb66f9000 out of bounds>, exists=65,
deleted=0x9559158, numdeleted=0xbfb14794, quotadeleted=0xbfb14768,
numansweredflag=0xbfb14790, numdeletedflag=0xbfb1478c,
numflaggedflag=0xbfb14788, newcache=0x9558e00,
, expunge_fd=-1, last_offset=0,
decideproc=0x804cc10 <expire_cb>, deciderock=0xbfb184e4, expunge_flags=2)
at mailbox.c:1932
1932 cacheitem = CACHE_ITEM_NEXT(cacheitem);
#1 0x080532d3 in mailbox_expunge (mailbox=0xbfb1786c, decideproc=0x804cc10
<expire_cb>, deciderock=0xbfb184e4, flags=Variable "flags" is not
available.) at mailbox.c:2308
#2 0x0804cb50 in expire (name=0xbfb17d9d "user.mxxxxxxxxxx.Trash",
matchlen=22, maycreate=1, rock=0xbfb184e4) at cyr_expire.c:224
#3 0x0805aa15 in find_cb (rockp=0xbfb18070, key=0xb69881b4 <Address
0xb69881b4 out of bounds>, keylen=22, data=0xb69881d0 <Address 0xb69881d0
out of bounds>, datalen=34) at mboxlist.c:2035
#4 0x0808efce in myforeach (db=0x9558240, prefix=0xbfb180b2 "*", prefixlen=0,
goodp=0x805b480 <find_p>, cb=0x805a880 <find_cb>, rock=0xbfb18070,
tid=0x0) at cyrusdb_skiplist.c:989
#5 0x08058082 in mboxlist_findall (namespace=0x0, pattern=0xbfb18510 "*",
isadmin=1, userid=0x0, auth_state=0x0, proc=0x804c7d0 <expire>,
rock=0xbfb184e4) at mboxlist.c:2227
#6 0x0804cfa7 in main (argc=6, argv=Cannot access memory at address 0x4

It seems that cyr_expire only crashes on folders that where "touched" by
ipurge before.

I've
purgetrash cmd="ipurge -fX -d 31 userTrash" at=0200
purgejunk cmd="ipurge -fX -d 60 userJunk" at=0300
running before cyr_expire (at=0400)

Every time I look into a folder which causes cyr_expire to coredump I find eg
-rw 1 cyrus mail 4 Jan 23 02:00 cyrus.cache
-rw 1 cyrus mail 124 Jan 23 13:31 cyrus.cache.NEW
a cyrus.cache.NEW file that is larger then the old one.

Putting a debug printf in the loop
for (cache_ent = 0; cache_ent < NUM_CACHE_FIELDS; cache_ent++) {
cacheitem = CACHE_ITEM_NEXT(cacheitem);
}
shows that cache_ent always is 0 if the crash occures, so it seems that
cacheitembegin = cacheitem = mailbox->cache_base + cache_offset;
is invalid at that moment.

Regards, Wolfgang Breyha
--
Wolfgang Breyha <wbreyha (AT) gmx (DOT) net| http://www.blafasel.at/
Vienna University Computer Center | Austria



Cyrus Home Page: http://cyrusimap.web.cmu.edu/
Cyrus Wiki/FAQ:
List Archives/Info:

Wolfgang Breyha wrote, on 23.01.2007 13:44:
It seems that cyr_expire only crashes on folders that where "touched" by
ipurge before.

I was able to reproduce that.

I deleted some messages via IMAP in Trash folder. I "EXPUNGE"d the folder.

After that I had
-rw 1 cyrus mail 1529752 24. Jan 14:21 cyrus.cache
-rw 1 cyrus mail 576 24. Jan 14:23 cyrus.expunge
-rw 1 cyrus mail 183 11. Jun 2006 cyrus.header
-rw 1 cyrus mail 142096 24. Jan 14:23 cyrus.index

Then a started "ipurge -fX -d 31 user.xxxx.Trash". ipurge removed _no_
message. But the databases looked like
-rw 1 cyrus mail 1525368 24. Jan 14:24 cyrus.cache
-rw 1 cyrus mail 576 24. Jan 14:23 cyrus.expunge
-rw 1 cyrus mail 183 11. Jun 2006 cyrus.header
-rw 1 cyrus mail 142096 24. Jan 14:24 cyrus.index

It seems that ipurge removes info from cyrus.cache needed by cyr_expire later,
because after these steps cyr_expire crashes exactly when working on this folder.

Regards, Wolfgang Breyha
--
Wolfgang Breyha <wbreyha (AT) gmx (DOT) net| http://www.blafasel.at/
Vienna University Computer Center | Austria


Cyrus Home Page: http://cyrusimap.web.cmu.edu/
Cyrus Wiki/FAQ:
List Archives/Info: