Mailing List Archive

Exim - 4.97.1 - SIGSEGV - continued
Hello,

In consideration of my prior messages about SIGSEGV from January 24:

OS: CloudLinux 7

Exim: 4.97.1

One of our user attempted to send a message using MS Outlook 2007
(Microsoft Office Outlook 12.0) to a large number of recipients (~500).
However, some kind of unintended loop occurred, resulting in the delivery
of the same message multiple times.

audid.log:

time->Mon Feb 5 10:50:46 2024
type=ANOM_ABEND msg=audit(1707126646.073:841524): auid=4294967295 uid=8
gid=12 ses=4294967295 pid=275431 comm="exim" reason="memory violation"
sig=11
----
time->Mon Feb 5 10:51:15 2024
type=ANOM_ABEND msg=audit(1707126675.553:841533): auid=4294967295 uid=8
gid=12 ses=4294967295 pid=275816 comm="exim" reason="memory violation"
sig=11
----
time->Mon Feb 5 10:51:31 2024
type=ANOM_ABEND msg=audit(1707126691.359:841536): auid=4294967295 uid=8
gid=12 ses=4294967295 pid=276000 comm="exim" reason="memory violation"
sig=11
----
time->Mon Feb 5 10:51:46 2024
type=ANOM_ABEND msg=audit(1707126706.055:841537): auid=4294967295 uid=8
gid=12 ses=4294967295 pid=276083 comm="exim" reason="memory violation"
sig=11
----
time->Mon Feb 5 10:52:34 2024
type=ANOM_ABEND msg=audit(1707126754.059:841548): auid=4294967295 uid=8
gid=12 ses=4294967295 pid=276473 comm="exim" reason="memory violation"
sig=11
----
time->Mon Feb 5 11:05:27 2024
type=ANOM_ABEND msg=audit(1707127527.253:841886): auid=4294967295 uid=8
gid=12 ses=4294967295 pid=285096 comm="exim" reason="memory violation"
sig=11
----
time->Mon Feb 5 11:05:54 2024
type=ANOM_ABEND msg=audit(1707127554.608:841887): auid=4294967295 uid=8
gid=12 ses=4294967295 pid=285279 comm="exim" reason="memory violation"
sig=11
----
time->Mon Feb 5 11:07:07 2024
type=ANOM_ABEND msg=audit(1707127627.452:841897): auid=4294967295 uid=8
gid=12 ses=4294967295 pid=286040 comm="exim" reason="memory violation"
sig=11
----
time->Mon Feb 5 11:08:26 2024
type=ANOM_ABEND msg=audit(1707127706.245:841921): auid=4294967295 uid=8
gid=12 ses=4294967295 pid=286828 comm="exim" reason="memory violation"
sig=11
----
time->Mon Feb 5 11:09:32 2024
type=ANOM_ABEND msg=audit(1707127772.737:841932): auid=4294967295 uid=8
gid=12 ses=4294967295 pid=287422 comm="exim" reason="memory violation"
sig=11

paniclog:

2024-02-05 10:50:46 1rWvci-000000019eR-2FFn SIGSEGV (fault address: 0x4)
2024-02-05 10:50:46 1rWvci-000000019eR-2FFn SIGSEGV (null pointer
indirection)
2024-02-05 10:50:46 1rWvci-000000019eR-2FFn SIGSEGV (275431 handling
incoming connection from (AGNIESZKA) [x.x.x.x] I=[x.x.x.x]:25
)
2024-02-05 10:50:46 1rWvci-000000019eR-2FFn backtrace
2024-02-05 10:50:46 1rWvci-000000019eR-2FFn ---
2024-02-05 10:50:46 1rWvci-000000019eR-2FFn /usr/sbin/exim() [0x42a8de]
2024-02-05 10:50:46 1rWvci-000000019eR-2FFn /usr/sbin/exim() [0x42aa43]
2024-02-05 10:50:46 1rWvci-000000019eR-2FFn
/lib64/libpthread.so.0(+0xf630) [0x7fca94fac630]
2024-02-05 10:50:46 1rWvci-000000019eR-2FFn /usr/sbin/exim() [0x450317]
2024-02-05 10:50:46 1rWvci-000000019eR-2FFn /usr/sbin/exim() [0x46a50f]
2024-02-05 10:50:46 1rWvci-000000019eR-2FFn /usr/sbin/exim() [0x417858]
2024-02-05 10:50:46 1rWvci-000000019eR-2FFn /usr/sbin/exim() [0x431204]
2024-02-05 10:50:46 1rWvci-000000019eR-2FFn
/lib64/libc.so.6(__libc_start_main+0xf5) [0x7fca94bf1555]
2024-02-05 10:50:46 1rWvci-000000019eR-2FFn /usr/sbin/exim() [0x40b299]
2024-02-05 10:50:46 1rWvci-000000019eR-2FFn ---
2024-02-05 10:51:15 1rWvdC-000000019ke-2twK SIGSEGV (fault address: 0x4)
2024-02-05 10:51:15 1rWvdC-000000019ke-2twK SIGSEGV (null pointer
indirection)
2024-02-05 10:51:15 1rWvdC-000000019ke-2twK SIGSEGV (275816 handling
incoming connection from (AGNIESZKA) [x.x.x.x] I=[x.x.x.x]:25
)
2024-02-05 10:51:15 1rWvdC-000000019ke-2twK backtrace
2024-02-05 10:51:15 1rWvdC-000000019ke-2twK ---
2024-02-05 10:51:15 1rWvdC-000000019ke-2twK /usr/sbin/exim() [0x42a8de]
2024-02-05 10:51:15 1rWvdC-000000019ke-2twK /usr/sbin/exim() [0x42aa43]
2024-02-05 10:51:15 1rWvdC-000000019ke-2twK
/lib64/libpthread.so.0(+0xf630) [0x7fca94fac630]
2024-02-05 10:51:15 1rWvdC-000000019ke-2twK /usr/sbin/exim() [0x450317]
2024-02-05 10:51:15 1rWvdC-000000019ke-2twK /usr/sbin/exim() [0x46a50f]
2024-02-05 10:51:15 1rWvdC-000000019ke-2twK /usr/sbin/exim() [0x417858]
2024-02-05 10:51:15 1rWvdC-000000019ke-2twK /usr/sbin/exim() [0x431204]
2024-02-05 10:51:15 1rWvdC-000000019ke-2twK
/lib64/libc.so.6(__libc_start_main+0xf5) [0x7fca94bf1555]
2024-02-05 10:51:15 1rWvdC-000000019ke-2twK /usr/sbin/exim() [0x40b299]
2024-02-05 10:51:15 1rWvdC-000000019ke-2twK ---
2024-02-05 10:51:31 1rWvdS-000000019nc-2DKA SIGSEGV (fault address: 0x4)
2024-02-05 10:51:31 1rWvdS-000000019nc-2DKA SIGSEGV (null pointer
indirection)
2024-02-05 10:51:31 1rWvdS-000000019nc-2DKA SIGSEGV (276000 handling
incoming connection from (AGNIESZKA) [x.x.x.x] I=[x.x.x.x]:25
)
2024-02-05 10:51:31 1rWvdS-000000019nc-2DKA backtrace
2024-02-05 10:51:31 1rWvdS-000000019nc-2DKA ---
2024-02-05 10:51:31 1rWvdS-000000019nc-2DKA /usr/sbin/exim() [0x42a8de]
2024-02-05 10:51:31 1rWvdS-000000019nc-2DKA /usr/sbin/exim() [0x42aa43]
2024-02-05 10:51:31 1rWvdS-000000019nc-2DKA
/lib64/libpthread.so.0(+0xf630) [0x7fca94fac630]
2024-02-05 10:51:31 1rWvdS-000000019nc-2DKA /usr/sbin/exim() [0x450317]
2024-02-05 10:51:31 1rWvdS-000000019nc-2DKA /usr/sbin/exim() [0x46a50f]
2024-02-05 10:51:31 1rWvdS-000000019nc-2DKA /usr/sbin/exim() [0x417858]
2024-02-05 10:51:31 1rWvdS-000000019nc-2DKA /usr/sbin/exim() [0x431204]
2024-02-05 10:51:31 1rWvdS-000000019nc-2DKA
/lib64/libc.so.6(__libc_start_main+0xf5) [0x7fca94bf1555]
2024-02-05 10:51:31 1rWvdS-000000019nc-2DKA /usr/sbin/exim() [0x40b299]
2024-02-05 10:51:31 1rWvdS-000000019nc-2DKA ---
2024-02-05 10:51:46 1rWvdg-000000019ox-3O8a SIGSEGV (fault address: 0x4)
2024-02-05 10:51:46 1rWvdg-000000019ox-3O8a SIGSEGV (null pointer
indirection)
2024-02-05 10:51:46 1rWvdg-000000019ox-3O8a SIGSEGV (276083 handling
incoming connection from (AGNIESZKA) [x.x.x.x] I=[x.x.x.x]:25
)
2024-02-05 10:51:46 1rWvdg-000000019ox-3O8a backtrace
2024-02-05 10:51:46 1rWvdg-000000019ox-3O8a ---
2024-02-05 10:51:46 1rWvdg-000000019ox-3O8a /usr/sbin/exim() [0x42a8de]
2024-02-05 10:51:46 1rWvdg-000000019ox-3O8a /usr/sbin/exim() [0x42aa43]
2024-02-05 10:51:46 1rWvdg-000000019ox-3O8a
/lib64/libpthread.so.0(+0xf630) [0x7fca94fac630]
2024-02-05 10:51:46 1rWvdg-000000019ox-3O8a /usr/sbin/exim() [0x450317]
2024-02-05 10:51:46 1rWvdg-000000019ox-3O8a /usr/sbin/exim() [0x46a50f]
2024-02-05 10:51:46 1rWvdg-000000019ox-3O8a /usr/sbin/exim() [0x417858]
2024-02-05 10:51:46 1rWvdg-000000019ox-3O8a /usr/sbin/exim() [0x431204]
2024-02-05 10:51:46 1rWvdg-000000019ox-3O8a
/lib64/libc.so.6(__libc_start_main+0xf5) [0x7fca94bf1555]
2024-02-05 10:51:46 1rWvdg-000000019ox-3O8a /usr/sbin/exim() [0x40b299]
2024-02-05 10:51:46 1rWvdg-000000019ox-3O8a ---

debuglog:

10:50:46 Renaming spool header file:
/var/spool/exim//input/i/1rWvci-000000019eR-2FFn-H
10:50:46 275444 outbytes=8189 error=0
10:50:46 275444 flushing headers buffer
10:50:46 275444 writing data block fd=8 size=8189 timeout=300
10:50:46 275444 tls_write(0xfcf658, 8189)
10:50:46 275444 SSL_write(0x119ac20, 0xfcf658, 8189)
10:50:46 275444 outbytes=8189 error=0
10:50:46 275444 flushing headers buffer
10:50:46 275444 writing data block fd=8 size=8189 timeout=300
10:50:46 275444 tls_write(0xfcf658, 8189)
10:50:46 275444 SSL_write(0x119ac20, 0xfcf658, 8189)
10:50:46 275444 outbytes=8189 error=0
10:50:46 275444 flushing headers buffer
10:50:46 275444 writing data block fd=8 size=8189 timeout=300
10:50:46 275444 tls_write(0xfcf658, 8189)
10:50:46 275444 SSL_write(0x119ac20, 0xfcf658, 8189)
10:50:46 275444 outbytes=8189 error=0
10:50:46 275444 flushing headers buffer
10:50:46 275444 writing data block fd=8 size=8189 timeout=300
10:50:46 275444 tls_write(0xfcf658, 8189)
10:50:46 275444 SSL_write(0x119ac20, 0xfcf658, 8189)
10:50:46 Size of headers = 644
10:50:46 275444 outbytes=8189 error=0
10:50:46 275444 flushing headers buffer
10:50:46 275444 writing data block fd=8 size=8189 timeout=300
10:50:46 275444 tls_write(0xfcf658, 8189)
10:50:46 275444 SSL_write(0x119ac20, 0xfcf658, 8189)
10:50:46 275444 outbytes=8189 error=0
10:50:46 LOG: MAIN
10:50:46 <= xxx@xxx.xx.xx H=(AGNIESZKA) [x.x.x.x] I=[x.x.x.x]:25 P=esmtpa
A=login:xxx@xxx.xx.xx S=5155019 id=009d01da5818$c9a3de30$5ceb9a90$@xxx.pl
T="Test message"
10:50:46 275444 flushing headers buffer
10:50:46 275444 writing data block fd=8 size=8189 timeout=300
10:50:46 275444 tls_write(0xfcf658, 8189)
10:50:46 275444 SSL_write(0x119ac20, 0xfcf658, 8189)
10:50:46 275444 outbytes=8189 error=0
10:50:46 275444 flushing headers buffer
10:50:46 275444 writing data block fd=8 size=8189 timeout=300
10:50:46 275444 tls_write(0xfcf658, 8189)
10:50:46 275444 SSL_write(0x119ac20, 0xfcf658, 8189)
10:50:46 275444 outbytes=8189 error=0
10:50:46 LOG: MAIN PANIC
10:50:46 SIGSEGV (fault address: 0x4)
10:50:46 275444 flushing headers buffer
10:50:46 275444 writing data block fd=8 size=8189 timeout=300
10:50:46 275444 tls_write(0xfcf658, 8189)
10:50:46 LOG: MAIN PANIC
10:50:46 SIGSEGV (null pointer indirection)
10:50:46 275444 SSL_write(0x119ac20, 0xfcf658, 8189)
10:50:46 LOG: MAIN PANIC
10:50:46 SIGSEGV (275431 handling incoming connection from (AGNIESZKA)
[x.x.x.x] I=[x.x.x.x]:25
10:50:46 )
10:50:46 LOG: MAIN PANIC
10:50:46 backtrace
10:50:46 LOG: MAIN PANIC
10:50:46 ---
10:50:46 LOG: MAIN PANIC
10:50:46 /usr/sbin/exim() [0x42a8de]
10:50:46 LOG: MAIN PANIC
10:50:46 /usr/sbin/exim() [0x42aa43]
10:50:46 LOG: MAIN PANIC
10:50:46 /lib64/libpthread.so.0(+0xf630) [0x7fca94fac630]
10:50:46 LOG: MAIN PANIC
10:50:46 /usr/sbin/exim() [0x450317]
10:50:46 LOG: MAIN PANIC
10:50:46 /usr/sbin/exim() [0x46a50f]
10:50:46 LOG: MAIN PANIC
10:50:46 /usr/sbin/exim() [0x417858]
10:50:46 LOG: MAIN PANIC
10:50:46 /usr/sbin/exim() [0x431204]
10:50:46 LOG: MAIN PANIC
10:50:46 /lib64/libc.so.6(__libc_start_main+0xf5) [0x7fca94bf1555]
10:50:46 LOG: MAIN PANIC
10:50:46 /usr/sbin/exim() [0x40b299]
10:50:46 LOG: MAIN PANIC
10:50:46 ---
10:50:46 275278 outbytes=8190 error=0
10:50:46 275278 flushing headers buffer
10:50:46 275278 writing data block fd=8 size=8190 timeout=300
10:50:46 275278 tls_write(0xfcf658, 8190)


#################

10:51:15 Renaming spool header file:
/var/spool/exim//input/C/1rWvdC-000000019ke-2twK-H
10:51:15 Size of headers = 644
10:51:15 LOG: MAIN
10:51:15 <= xxx@xxx.xx.xx H=(AGNIESZKA) [x.x.x.x] I=[x.x.x.x]:25 P=esmtpa
A=login:xxx@xxx.xx.xx S=5155019 id=00a401da5818$db955fb0$92c01f10$@xxx.pl
T="Test message"
10:51:15 LOG: MAIN PANIC
10:51:15 SIGSEGV (fault address: 0x4)
10:51:15 LOG: MAIN PANIC
10:51:15 SIGSEGV (null pointer indirection)
10:51:15 LOG: MAIN PANIC
10:51:15 SIGSEGV (275816 handling incoming connection from (AGNIESZKA)
[x.x.x.x] I=[x.x.x.x]:25
10:51:15 )
10:51:15 LOG: MAIN PANIC
10:51:15 backtrace
10:51:15 LOG: MAIN PANIC
10:51:15 ---
10:51:15 LOG: MAIN PANIC
10:51:15 /usr/sbin/exim() [0x42a8de]
10:51:15 LOG: MAIN PANIC
10:51:15 /usr/sbin/exim() [0x42aa43]
10:51:15 LOG: MAIN PANIC
10:51:15 /lib64/libpthread.so.0(+0xf630) [0x7fca94fac630]
10:51:15 LOG: MAIN PANIC
10:51:15 /usr/sbin/exim() [0x450317]
10:51:15 LOG: MAIN PANIC
10:51:15 /usr/sbin/exim() [0x46a50f]
10:51:15 LOG: MAIN PANIC
10:51:15 /usr/sbin/exim() [0x417858]
10:51:15 LOG: MAIN PANIC
10:51:15 /usr/sbin/exim() [0x431204]
10:51:15 LOG: MAIN PANIC
10:51:15 /lib64/libc.so.6(__libc_start_main+0xf5) [0x7fca94bf1555]
10:51:15 LOG: MAIN PANIC
10:51:15 /usr/sbin/exim() [0x40b299]
10:51:15 LOG: MAIN PANIC
10:51:15 ---

#################


10:51:31 Renaming spool header file:
/var/spool/exim//input/S/1rWvdS-000000019nc-2DKA-H
10:51:31 Size of headers = 644
10:51:31 LOG: MAIN
10:51:31 <= xxx@xxx.xx.xx H=(AGNIESZKA) [x.x.x.x] I=[x.x.x.x]:25 P=esmtpa
A=login:xxx@xxx.xx.xx S=5155019 id=00ae01da5818$e505c170$af114450$@xxx.pl
T="Test message"
10:51:31 LOG: MAIN PANIC
10:51:31 SIGSEGV (fault address: 0x4)
10:51:31 LOG: MAIN PANIC
10:51:31 SIGSEGV (null pointer indirection)
10:51:31 LOG: MAIN PANIC
10:51:31 SIGSEGV (276000 handling incoming connection from (AGNIESZKA)
[x.x.x.x] I=[x.x.x.x]:25
10:51:31 )
10:51:31 LOG: MAIN PANIC
10:51:31 backtrace
10:51:31 LOG: MAIN PANIC
10:51:31 ---
10:51:31 LOG: MAIN PANIC
10:51:31 /usr/sbin/exim() [0x42a8de]
10:51:31 LOG: MAIN PANIC
10:51:31 /usr/sbin/exim() [0x42aa43]
10:51:31 LOG: MAIN PANIC
10:51:31 /lib64/libpthread.so.0(+0xf630) [0x7fca94fac630]
10:51:31 LOG: MAIN PANIC
10:51:31 /usr/sbin/exim() [0x450317]
10:51:31 LOG: MAIN PANIC
10:51:31 /usr/sbin/exim() [0x46a50f]
10:51:31 LOG: MAIN PANIC
10:51:31 /usr/sbin/exim() [0x417858]
10:51:31 LOG: MAIN PANIC
10:51:31 /usr/sbin/exim() [0x431204]
10:51:31 LOG: MAIN PANIC
10:51:31 /lib64/libc.so.6(__libc_start_main+0xf5) [0x7fca94bf1555]
10:51:31 LOG: MAIN PANIC
10:51:31 /usr/sbin/exim() [0x40b299]
10:51:31 LOG: MAIN PANIC
10:51:31 ---

#################

10:51:46 Renaming spool header file:
/var/spool/exim//input/g/1rWvdg-000000019ox-3O8a-H
10:51:46 Size of headers = 644
10:51:46 LOG: MAIN
10:51:46 <= xxx@xxx.xx.xx H=(AGNIESZKA) [x.x.x.x] I=[x.x.x.x]:25 P=esmtpa
A=login:xxx@xxx.xx.x S=5155112 id=00b501da5818$ed8c5f70$c8a51e50$@xxx.pl
T="Test message"
10:51:46 LOG: MAIN PANIC
10:51:46 SIGSEGV (fault address: 0x4)
10:51:46 LOG: MAIN PANIC
10:51:46 SIGSEGV (null pointer indirection)
10:51:46 LOG: MAIN PANIC
10:51:46 SIGSEGV (276083 handling incoming connection from (AGNIESZKA)
[x.x.x.x] I=[x.x.x.x]:25
10:51:46 )
10:51:46 LOG: MAIN PANIC
10:51:46 backtrace
10:51:46 LOG: MAIN PANIC
10:51:46 ---
10:51:46 LOG: MAIN PANIC
10:51:46 /usr/sbin/exim() [0x42a8de]
10:51:46 LOG: MAIN PANIC
10:51:46 /usr/sbin/exim() [0x42aa43]
10:51:46 LOG: MAIN PANIC
10:51:46 /lib64/libpthread.so.0(+0xf630) [0x7fca94fac630]
10:51:46 LOG: MAIN PANIC
10:51:46 /usr/sbin/exim() [0x450317]
10:51:46 LOG: MAIN PANIC
10:51:46 /usr/sbin/exim() [0x46a50f]
10:51:46 LOG: MAIN PANIC
10:51:46 /usr/sbin/exim() [0x417858]
10:51:46 LOG: MAIN PANIC
10:51:46 /usr/sbin/exim() [0x431204]
10:51:46 LOG: MAIN PANIC
10:51:46 /lib64/libc.so.6(__libc_start_main+0xf5) [0x7fca94bf1555]
10:51:46 LOG: MAIN PANIC
10:51:46 /usr/sbin/exim() [0x40b299]
10:51:46 LOG: MAIN PANIC
10:51:46 ---
10:51:46 275718 outbytes=8190 error=0
10:51:46 275718 flushing headers buffer
10:51:46 275718 writing data block fd=8 size=8190 timeout=300

and so on...

Any tips on how to solve this?

Thank you,
Mateusz

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
Re: Exim - 4.97.1 - SIGSEGV - continued [ In reply to ]
On 2/6/24 08:55, Mateusz Krawczyk via Exim-users wrote:
> 10:50:46 275444 flushing headers buffer
> 10:50:46 275444 writing data block fd=8 size=8189 timeout=300
> 10:50:46 275444 tls_write(0xfcf658, 8189)
> 10:50:46 275444 SSL_write(0x119ac20, 0xfcf658, 8189)
> 10:50:46 275444 outbytes=8189 error=0
> 10:50:46 LOG: MAIN PANIC
> 10:50:46 SIGSEGV (fault address: 0x4)
> 10:50:46 275444 flushing headers buffer
> 10:50:46 275444 writing data block fd=8 size=8189 timeout=300
> 10:50:46 275444 tls_write(0xfcf658, 8189)
> 10:50:46 LOG: MAIN PANIC
> 10:50:46 SIGSEGV (null pointer indirection)
> 10:50:46 275444 SSL_write(0x119ac20, 0xfcf658, 8189)
> 10:50:46 LOG: MAIN PANIC
> 10:50:46 SIGSEGV (275431 handling incoming connection from (AGNIESZKA)
> [x.x.x.x] I=[x.x.x.x]:25
> 10:50:46 )

There seems to be two processes mixed up, here. One is writing a message
out, which implies a transport process running the smtp transport
(and, wow, that message seems to have a large amount of headers content).

The other one is receiving an inbound message - note the different PID)
and SEGV'd from a null-pointer indirection. It's that one we're interested in.
Most of the debug lines for that don't seem to include a PID;
the obvious one before the SIGSEGV are

10:50:46 Renaming spool header file: /var/spool/exim//input/i/1rWvci-000000019eR-2FFn-H
10:50:46 Size of headers = 644
10:50:46 LOG: MAIN
10:50:46 <= xxx@xxx.xx.xx H=(AGNIESZKA) [x.x.x.x] I=[x.x.x.x]:25 P=esmtpa
A=login:xxx@xxx.xx.xx S=5155019 id=009d01da5818$c9a3de30$5ceb9a90$@xxx.pl
T="Test message"

That "<=" log line at least gives us a place in receive.c we know
we got as far as. We don't seem to have gotten as far as sending an SMTP
response (I'd expect a debug line for that) - sos the suspect code range
is not too long (4383 - 4521 in my working copy)


We're not getting much info from the self-produced stack backtrace;
almost certainly the compile was not including debug info ("cc -ggdb")
and may even have been stripped. A pity. Are you set up for getting
coredump files? If so, please feed one to gdb and see if it's any
better for a stack backtrace ("bt").
If not - could you?

(The "libpthread" function in the stack is interesting... perhaps that's
an artifact of handling the SIGSEGV though)


--
Cheers,
Jeremy

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
Re: Exim - 4.97.1 - SIGSEGV - continued [ In reply to ]
Thank you Jeremy for providing a thorough analysis. At present, I have
successfully persuaded the user to implement TLS and port 465 for mail
submission.
Additionally, I have activated core dumps. As soon as I get one I will try
to feed it to gdb (provided that changing the port does not bypass the
problem).

Regards,
Mateusz

wt., 6 lut 2024 o 17:58 Jeremy Harris via Exim-users <
exim-users@lists.exim.org> napisa?(a):

> On 2/6/24 08:55, Mateusz Krawczyk via Exim-users wrote:
> > 10:50:46 275444 flushing headers buffer
> > 10:50:46 275444 writing data block fd=8 size=8189 timeout=300
> > 10:50:46 275444 tls_write(0xfcf658, 8189)
> > 10:50:46 275444 SSL_write(0x119ac20, 0xfcf658, 8189)
> > 10:50:46 275444 outbytes=8189 error=0
> > 10:50:46 LOG: MAIN PANIC
> > 10:50:46 SIGSEGV (fault address: 0x4)
> > 10:50:46 275444 flushing headers buffer
> > 10:50:46 275444 writing data block fd=8 size=8189 timeout=300
> > 10:50:46 275444 tls_write(0xfcf658, 8189)
> > 10:50:46 LOG: MAIN PANIC
> > 10:50:46 SIGSEGV (null pointer indirection)
> > 10:50:46 275444 SSL_write(0x119ac20, 0xfcf658, 8189)
> > 10:50:46 LOG: MAIN PANIC
> > 10:50:46 SIGSEGV (275431 handling incoming connection from (AGNIESZKA)
> > [x.x.x.x] I=[x.x.x.x]:25
> > 10:50:46 )
>
> There seems to be two processes mixed up, here. One is writing a message
> out, which implies a transport process running the smtp transport
> (and, wow, that message seems to have a large amount of headers content).
>
> The other one is receiving an inbound message - note the different PID)
> and SEGV'd from a null-pointer indirection. It's that one we're
> interested in.
> Most of the debug lines for that don't seem to include a PID;
> the obvious one before the SIGSEGV are
>
> 10:50:46 Renaming spool header file:
> /var/spool/exim//input/i/1rWvci-000000019eR-2FFn-H
> 10:50:46 Size of headers = 644
> 10:50:46 LOG: MAIN
> 10:50:46 <= xxx@xxx.xx.xx H=(AGNIESZKA) [x.x.x.x] I=[x.x.x.x]:25
> P=esmtpa
> A=login:xxx@xxx.xx.xx S=5155019 id=009d01da5818$c9a3de30$5ceb9a90$@xxx.pl
> T="Test message"
>
> That "<=" log line at least gives us a place in receive.c we know
> we got as far as. We don't seem to have gotten as far as sending an SMTP
> response (I'd expect a debug line for that) - sos the suspect code range
> is not too long (4383 - 4521 in my working copy)
>
>
> We're not getting much info from the self-produced stack backtrace;
> almost certainly the compile was not including debug info ("cc -ggdb")
> and may even have been stripped. A pity. Are you set up for getting
> coredump files? If so, please feed one to gdb and see if it's any
> better for a stack backtrace ("bt").
> If not - could you?
>
> (The "libpthread" function in the stack is interesting... perhaps that's
> an artifact of handling the SIGSEGV though)
>
>
> --
> Cheers,
> Jeremy
>
> --
> ## subscription configuration (requires account):
> ##
> https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
> ## unsubscribe (doesn't require an account):
> ## exim-users-unsubscribe@lists.exim.org
> ## Exim details at http://www.exim.org/
> ## Please use the Wiki with this list - http://wiki.exim.org/
>

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/