[SA-exim] local_scan - function crashed with signal 11

[Martin Balvers]

Hi list,

I have been using sa-exim for many years without any problems.
Unfortunately that i ran into a little snag while setting up a replacement
for my old mailserver.

The first hitch i encountered was while compiling sa-exim, the compilation
failed on amd64 and i had to add -fPIC to the BUILDCFLAGS option in the
makefile.

The problem i'm having is that if i enable the sa-exim by setting
local_scan_path in the exim config, i am unable to send mail to more than
1 recipient. As soon as i enter a second address, either in the to: or Cc:
line, i get the following error:
2009-10-07 13:49:34 1MvV1S-00049q-GY local_scan() function crashed with
signal 11 - message temporarily rejected (size 90)

Messages to a single recipient work just fine, they are scanned and
delivered (or rejected/dropped according to the spam score).

------------------------------------------------------------------------
test:
exim -v -d -bs < test.mail

------------------------------------------------------------------------
contents of test.mail:
HELO example.com
MAIL FROM: <***@example.com>
RCPT TO: <***@addicts.nl>
RCPT TO: <***@addicts.nl>
DATA
Subject: Exim Cc test
To: <***@addicts.nl>
Cc: <***@addicts.nl>
testing Cc in Exim
.
QUIT

------------------------------------------------------------------------
output of test:
Exim version 4.69 uid=0 gid=0 pid=16064 D=fbb95cfd
Berkeley DB: Berkeley DB 4.7.25: (2009-10-05)
Support for: crypteq iconv() PAM Perl TCPwrappers OpenSSL Content_Scanning
Old_Demime
Lookups: lsearch wildlsearch nwildlsearch iplsearch cdb dbm dbmnz dsearch
mysql passwd
Authenticators: cram_md5 plaintext spa
Routers: accept dnslookup ipliteral manualroute queryprogram redirect
Transports: appendfile/maildir/mailstore autoreply pipe smtp
Fixed never_users: 0
Size of off_t: 8
changed uid/gid: forcing real = effective
uid=0 gid=0 pid=16064
auxiliary group list: <none>
seeking password data for user "root": cache not available
getpwnam() succeeded uid=0 gid=0
configuration file is /etc/exim/exim.conf
log selectors = 00000ffc 00612001
cwd=/root 4 args: exim -v -d -bs
trusted user
admin user
changed uid/gid: privilege not needed
uid=8 gid=12 pid=16064
auxiliary group list: 12
seeking password data for user "mail": cache not available
getpwnam() succeeded uid=8 gid=12
originator: uid=0 gid=0 login=root name=root
sender address = NULL
set_process_info: 16064 accepting a local SMTP message from <root>
in hosts_connection_nolog? no (option unset)
LOG: smtp_connection MAIN
SMTP connection from root
using ACL "acl_check_connect"
processing "deny"
check hosts = ${if exists
{/etc/mail/blacklist-hosts}{/etc/mail/blacklist-hosts}{}}
in ""? no (end of list)
deny: condition test failed
processing "accept"
accept: condition test succeeded
SMTP>> 220 mail.addicts.nl ESMTP Exim 4.69 Wed, 07 Oct 2009 13:55:41 +0200
220 mail.addicts.nl ESMTP Exim 4.69 Wed, 07 Oct 2009 13:55:41 +0200
smtp_setup_msg entered
SMTP<< HELO example.com
250 mail.addicts.nl Hello root at example.com
SMTP>> 250 mail.addicts.nl Hello root at example.com
SMTP<< MAIL FROM: <***@example.com>
SMTP>> 250 OK
250 OK
SMTP<< RCPT TO: <***@addicts.nl>
using ACL "acl_check_rcpt"
processing "accept"
check hosts = :
in ":"? yes (matched "")
accept: condition test succeeded
SMTP>> 250 Accepted
250 Accepted
SMTP<< RCPT TO: <***@addicts.nl>
using ACL "acl_check_rcpt"
processing "accept"
check hosts = :
in ":"? yes (matched "")
accept: condition test succeeded
SMTP>> 250 Accepted
250 Accepted
SMTP<< DATA
SMTP>> 354 Enter message, ending with "." on a line by itself
354 Enter message, ending with "." on a line by itself
search_tidyup called
Subject: Exim Cc test
To: <***@addicts.nl>
Cc: <***@addicts.nl>

rewrite_one_header: type=T:
To: <***@addicts.nl>
rewrite_one_header: type=C:
Cc: <***@addicts.nl>
rewrite_one_header: type=F:
From: ***@example.com
search_tidyup called
Subject: Exim Cc test
T To: <***@addicts.nl>
C Cc: <***@addicts.nl>
I Message-Id: <E1MvV7N-0004B6-***@mail.addicts.nl>
F From: ***@example.com
Date: Wed, 07 Oct 2009 13:55:41 +0200

Data file written for message 1MvV7N-0004B6-9F

Generated Received: header line

P Received: from root (helo=example.com)
by mail.addicts.nl with local-smtp (Exim 4.69)
(envelope-from <***@example.com>)
id 1MvV7N-0004B6-9F; Wed, 07 Oct 2009 13:55:41 +0200
using ACL "acl_check_data"
processing "deny"
check demime = *
check condition = ${if > {$demime_errorlevel}{2}{1}{0}}
= 0
deny: condition test failed
processing "warn"
check demime = *
check malware = *
waiting for data on socket
warn: condition test failed
processing "accept"
accept: condition test succeeded
unspool_mbox(): unlinking
'/var/spool/exim/scan/1MvV7N-0004B6-9F/1MvV7N-0004B6-9F-00000.com'
unspool_mbox(): unlinking
'/var/spool/exim/scan/1MvV7N-0004B6-9F/1MvV7N-0004B6-9F.eml'
calling local_scan(); timeout=300
LOG: MAIN REJECT
local_scan() function crashed with signal 11 - message temporarily
rejected (size 90)
SMTP>> 421 mail.addicts.nl local verification problem - closing connection.
421 mail.addicts.nl local verification problem - closing connection.
search_tidyup called

------------------------------------------------------------------------
log entry debug level 9:
2009-10-07 15:24:50 1MvWVe-0004hl-9P SA: Debug4: Debug enabled, reading
config from file /etc/exim/sa-exim.conf
2009-10-07 15:24:50 1MvWVe-0004hl-9P SA: Debug4: config read SAspamcpath
= /usr/bin/spamc
2009-10-07 15:24:50 1MvWVe-0004hl-9P SA: Debug4: config read
SAspamcSockPath = /var/run/spamd/spamd.sock
2009-10-07 15:24:50 1MvWVe-0004hl-9P SA: Debug4: config read
SAEximRunCond = ${if and {{def:sender_host_address} {!eq
{$sender_host_address}{127.0.0.1}} {!eq
{$sender_host_address}{62.177.186.104/29}} {!eq
{$h_X-SA-Do-Not-Run:}{Yes}} } $
2009-10-07 15:24:50 1MvWVe-0004hl-9P SA: Debug4: config read
SAEximRejCond = ${if !eq {$h_X-SA-Do-Not-Rej:}{Yes} {1}{0}}
2009-10-07 15:24:50 1MvWVe-0004hl-9P SA: Debug4: config read SAmaxbody =
512000
2009-10-07 15:24:50 1MvWVe-0004hl-9P SA: Debug4: config read
SATruncBodyCond = 0
2009-10-07 15:24:50 1MvWVe-0004hl-9P SA: Debug4: config read
SARewriteBody = 0
2009-10-07 15:24:50 1MvWVe-0004hl-9P SA: Debug4: config read
SAPrependArchiveWith

[Marc MERLIN]

2009-10-07 15:24:50 1MvWVe-0004hl-9P SA: Debug3: expanded SAtempreject =
1048576.00
2009-10-07 15:24:50 1MvWVe-0004hl-9P local_scan() function crashed with
signal 11 - message temporarily rejected (size 90)
The next debug line in a message that doesn't cause local_scan to crash
SA: Debug9: Did not find X-SA-Exim- in Received: from h220-21.tijo.pl
([78.133.220.21])
------------------------------------------------------------------------
Linux mail.addicts.nl 2.6.29-xen-r4 #8 SMP Wed Sep 16 13:13:23 CEST 2009
x86_64 AMD Phenom(tm) II X4 945 Processor AuthenticAMD GNU/Linux
exim 4.69
sa-exim 4.2.1
Seems to me that local_scan crashes in (or just before) the logic that
looks for the X-SA-Exim- headers.
I have looked at the code, but can't find anything wrong with it.
Any help will be greatly appreciated.

Thanks for the detailled bugreport.

Ok, I just spent a very quick time looking at the code too (sorry, I haven't
worked on it for years, it quick of just worksforme [tm], so I've left it
alone and on other projects now).

It may very well be a 64 bit bug.

If you have time, the best way to find out what happening would be to
1) recompile sa-exim with -lefence if you have it (this should help to
ensure it crashes in the right place and not later)
2) compile -g and without -O2
3) get a core and do a gdb bt on it to see which line it actually crashes at.

The other approach is to put a bunch of printfs between the two debug
entries and narrow down where it dies, but even there using electricfence
or equivalent is recommended so that the crash happens as soon as it should
and not later.

Marc