lmtp crashes with: Panic: file mail-user.c: line 229 (mail_user_deinit): assertion failed: ((*user)->refcount == 1)

Bug #1992848 reported by Andre Nathan
22
This bug affects 4 people
Affects Status Importance Assigned to Milestone
dovecot (Ubuntu)
Fix Released
Undecided
Michał Małoszewski
Jammy
Incomplete
Undecided
Unassigned

Bug Description

Hello

We're being hit by the following error using Jammy's version of Dovecot:

Oct 13 19:21:32 imap1 dovecot: lmtp(2572154): Panic: file mail-user.c: line 229 (mail_user_deinit): assertion failed: ((*user)->refcount == 1)

This error has been reported as fixed upstream in version 2.3.18, according to https://dovecot.org/doc/NEWS:

- virtual: If mailbox opening fails, the backend mailbox is leaked and
  process crashes when client disconnects. Fixes
  Panic: file mail-user.c: line 232 (mail_user_deinit):
  assertion failed: ((*user)->refcount == 1)

The correction is simple:

--- a/src/plugins/virtual/virtual-storage.c
+++ b/src/plugins/virtual/virtual-storage.c
@@ -495,12 +495,12 @@ static int virtual_mailbox_open(struct mailbox *box)
                ret = virtual_mailboxes_open(mbox, box->flags);
                array_pop_back(&mbox->storage->open_stack);
        }
+ if (ret == 0)
+ ret = index_storage_mailbox_open(box, FALSE);
        if (ret < 0) {
                virtual_mailbox_close_internal(mbox);
                return -1;
        }
- if (index_storage_mailbox_open(box, FALSE) < 0)
- return -1;

        mbox->virtual_ext_id =
                mail_index_ext_register(mbox->box.index, "virtual", 0,

Do you think a patch could be added to the Jammy package with that fix?

Ubuntu release: Ubuntu 22.04.1 LTS
Dovecot version: 1:2.3.16+dfsg1-3ubuntu2.1

Thanks,
Andre

Related branches

summary: - Backport virtual storage panic from 2.3.18
+ Backport virtual storage panic fix from 2.3.18
Revision history for this message
Launchpad Janitor (janitor) wrote : Re: Backport virtual storage panic fix from 2.3.18

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in dovecot (Ubuntu):
status: New → Confirmed
Revision history for this message
Michał Małoszewski (michal-maloszewski99) wrote :

Hi Andre,

Thank you for your report and that you help us with reports.
Could you please provide steps to reproduce that bug?
I will take care of that from Monday.

Thank you

Changed in dovecot (Ubuntu):
assignee: nobody → Michał Małoszewski (michal-maloszewski99)
Revision history for this message
Andre Nathan (andre-digirati) wrote :

Unfortunately I don't know how to reproduce this problem. It seems to happen with some specific customer accounts, but I'm unable to reproduce the error by configuring them in Thunderbird. It's possible that it only happens for some specific IMAP client.

What I can say is that I've backported the package from Kinetic, which has Dovecot 2.3.19, and the error is fixed for me.

Revision history for this message
Michał Małoszewski (michal-maloszewski99) wrote :

Hi Andre,
If we can not identify steps to recreate and verify this case, can we count on you and your users to verify the packages as they would be serviced?
If so, we could provide a PPA with the package and once confirmed to work fine, we could prepare an SRU upload to Jammy to then have your verification again.
Do you think that you can help us in that case and provide that?

Revision history for this message
Andre Nathan (andre-digirati) wrote :

Yes, absolutely!

Revision history for this message
Michał Małoszewski (michal-maloszewski99) wrote :

Hi Andre,

I've prepared a PPA package for you. Please remember that it's only for testing purposes and not intended for anything else.
https://launchpad.net/~michal-maloszewski99/+archive/ubuntu/jammy-dovecot-ppa-1992848
Here is a link which leads to the PPA and there you have a instruction how to add this PPA to your system.
Thank you in advance for your help.

Revision history for this message
Andre Nathan (andre-digirati) wrote :

Hi Michał

Unfortunately the error remains when using the packages from your PPA. It seems that the real fix must have been introduced by some other commit in the 2.3.16-2.3.19 period.

Revision history for this message
Michał Małoszewski (michal-maloszewski99) wrote :

Hi Andre,

Thanks for your feedback. I have checked the PPA and my dsc package separately whether I missed something. Nothing is missing.
I have a question for you.
Could you please send me some logs of what happens when you bump into the issue? It'd be helpful.
In addition, please check if you did perform 'apt update' after you've added PPA to your system.
It would also help if you showed me the apt-get logs.
These are the next steps. I will try to find another fix which might be helpful, but maybe you have an extra idea what else might help here as you did at the beginning in the bug report (another commit/fix).

Revision history for this message
Andre Nathan (andre-digirati) wrote :
Download full text (7.2 KiB)

The log message is the same as the one I posted originally. There is also a backtrace, which I didn't include in the original message.

Oct 21 14:04:05 imap1 dovecot: lmtp(1797565): Panic: file mail-user.c: line 229 (mail_user_deinit): assertion failed: ((*user)->refcount == 1)
Oct 21 14:04:05 imap1 dovecot: lmtp(1797565): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x46) [0x7f655cc53d76] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x22) [0x7f655cc53e92] -> /usr/lib/dovecot/libdovecot.so.0(+0x109c6b) [0x7f655cc60c6b] -> /usr/lib/dovecot/libdovecot.so.0(+0x109d07) [0x7f655cc60d07] -> /usr/lib/dovecot/libdovecot.so.0(+0x5cf53) [0x7f655cbb3f53] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x483c5) [0x7f655cd753c5] -> dovecot/lmtp [10.20.32.185 DATA](lmtp_local_data+0x3e6) [0x564ff3232996] -> dovecot/lmtp [10.20.32.185 DATA](client_default_cmd_data+0x191) [0x564ff32314c1] -> dovecot/lmtp [10.20.32.185 DATA](cmd_data_continue+0x180) [0x564ff3231250] -> /usr/lib/dovecot/libdovecot.so.0(+0x7c656) [0x7f655cbd3656] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x6d) [0x7f655cc76f1d] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x13a) [0x7f655cc7861a] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x54) [0x7f655cc76fc4] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7f655cc77180] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x17) [0x7f655cbe96d7] -> dovecot/lmtp [10.20.32.185 DATA](main+0x225) [0x564ff322fec5] -> /lib/x86_64-linux-gnu/libc.so.6(+0x29d90) [0x7f655c951d90] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x80) [0x7f655c951e40] -> dovecot/lmtp [10.20.32.185 DATA](_start+0x25) [0x564ff322ffc5]

These are the dpkg logs. I have installed the packages manually because due to network policy reasons the Dovecot server cannot access external repositories.

2022-10-21 12:47:32 upgrade dovecot-core:amd64 1:2.3.19.1+dfsg1-2ubuntu2 1:2.3.16+dfsg1-3ubuntu2.2~ppa1
2022-10-21 12:47:32 status half-configured dovecot-core:amd64 1:2.3.19.1+dfsg1-2ubuntu2
2022-10-21 12:47:32 status unpacked dovecot-core:amd64 1:2.3.19.1+dfsg1-2ubuntu2
2022-10-21 12:47:32 status half-installed dovecot-core:amd64 1:2.3.19.1+dfsg1-2ubuntu2
2022-10-21 12:47:32 status triggers-pending man-db:amd64 2.10.2-1
2022-10-21 12:47:32 status unpacked dovecot-core:amd64 1:2.3.16+dfsg1-3ubuntu2.2~ppa1
2022-10-21 12:47:32 upgrade dovecot-imapd:amd64 1:2.3.19.1+dfsg1-2ubuntu2 1:2.3.16+dfsg1-3ubuntu2.2~ppa1
2022-10-21 12:47:32 status half-configured dovecot-imapd:amd64 1:2.3.19.1+dfsg1-2ubuntu2
2022-10-21 12:47:32 status unpacked dovecot-imapd:amd64 1:2.3.19.1+dfsg1-2ubuntu2
2022-10-21 12:47:32 status half-installed dovecot-imapd:amd64 1:2.3.19.1+dfsg1-2ubuntu2
2022-10-21 12:47:32 status triggers-pending ufw:all 0.36.1-4build1
2022-10-21 12:47:32 status unpacked dovecot-imapd:amd64 1:2.3.16+dfsg1-3ubuntu2.2~ppa1
2022-10-21 12:47:32 upgrade dovecot-lmtpd:amd64 1:2.3.19.1+dfsg1-2ubuntu2 1:2.3.16+dfsg1-3ubuntu2.2~ppa1
2022-10-21 12:47:32 status half-configured dovecot-lmtpd:amd64 1:2.3.19.1+dfsg1-2ubuntu2
2022-10-21 12:47:32 status unpacked dovecot-lmtpd:amd64 1:2.3.19.1+dfsg1-2ubuntu2
2022-10-21 12:47:...

Read more...

Revision history for this message
Robie Basak (racb) wrote (last edit ):

I've marked this Fix Released as Kinetic is on 2.3.19 so this is presumably fixed there, and have opened a task for Jammy to track that the bug needs fixing on Jammy.

summary: - Backport virtual storage panic fix from 2.3.18
+ lmtp crashes with: Panic: file mail-user.c: line 229 (mail_user_deinit):
+ assertion failed: ((*user)->refcount == 1)
Changed in dovecot (Ubuntu):
status: Confirmed → Fix Released
Changed in dovecot (Ubuntu Jammy):
status: New → Triaged
Revision history for this message
Robie Basak (racb) wrote :

Thank you for the details. I think there must be another upstream change that we need to cherry-pick then? We'd be happy to pull it into Jammy for you, but we need some help please, starting with identifying the specific fix. Unfortunately we need to rely on you for this please since we don't know how to reproduce the issue.

Bryce Harrington (bryce)
Changed in dovecot (Ubuntu Jammy):
status: Triaged → Incomplete
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.