Bug 396980 - akonadi_imap_resource segfaults [due to ImapQuotaAttribute in libakonadi-singlefileresource.so]
Summary: akonadi_imap_resource segfaults [due to ImapQuotaAttribute in libakonadi-sing...
Status: RESOLVED FIXED
Alias: None
Product: Akonadi
Classification: Frameworks and Libraries
Component: IMAP resource (show other bugs)
Version: unspecified
Platform: Gentoo Packages Linux
: NOR crash
Target Milestone: ---
Assignee: kdepim bugs
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-07-30 10:50 UTC by Grzegorz Kowal
Modified: 2018-08-10 09:22 UTC (History)
2 users (show)

See Also:
Latest Commit:
Version Fixed In:


Attachments
full backtrace of akonadi_imap_resource (10.55 KB, text/x-log)
2018-07-30 10:50 UTC, Grzegorz Kowal
Details
IMAP log of account causing segfault (8.69 KB, text/plain)
2018-07-30 10:50 UTC, Grzegorz Kowal
Details
Patch fixing segfaults (1.14 KB, patch)
2018-07-30 10:51 UTC, Grzegorz Kowal
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Grzegorz Kowal 2018-07-30 10:50:00 UTC
Created attachment 114217 [details]
full backtrace of akonadi_imap_resource

Recently, probably after upgrading KDE Apps to 17.12.3, I've started getting segfaults of akonadi_imap_resource very frequently. The kernel log shows something like that:

[ 1832.361081] akonadi_imap_re[1210]: segfault at 383832343235 ip 00007f3658eace80 sp 00007fff1e1c56f8 error 4 in libakonadi-singlefileresource.so.5.8.3[7f3658e90000+28000]
[ 3188.614448] traps: akonadi_imap_re[1203] general protection ip:7feaa070ce80 sp:7ffc63373068 error:0 in libakonadi-singlefileresource.so.5.8.3[7feaa06f0000+28000]
[ 3188.807180] akonadi_imap_re[1205]: segfault at 383832343235 ip 00007f8d3a9f4e80 sp 00007ffd7158e8c8 error 4 in libakonadi-singlefileresource.so.5.8.3[7f8d3a9d8000+28000]
[ 3189.820913] akonadi_imap_re[1208]: segfault at 383832343235 ip 00007ff573254e80 sp 00007ffea33ed038 error 4 in libakonadi-singlefileresource.so.5.8.3[7ff573238000+28000]
[ 3282.218915] traps: akonadi_imap_re[13081] general protection ip:7fd7132dce80 sp:7ffc131a2f08 error:0 in libakonadi-singlefileresource.so.5.8.3[7fd7132c0000+28000]
[ 3285.284912] akonadi_imap_re[13096]: segfault at 383832343235 ip 00007fa5a0da4e80 sp 00007ffc13bc6738 error 4 in libakonadi-singlefileresource.so.5.8.3[7fa5a0d88000+28000]
[ 3876.300437] traps: akonadi_imap_re[13666] general protection ip:7f89fed5ce80 sp:7ffd12de0c18 error:0 in libakonadi-singlefileresource.so.5.8.3[7f89fed40000+28000]

I was able to debug it and found out that crashes happen always in the same place, i.e. Akonadi::ImapQuotaAttribute::serialized() in kdepim-runtime-18.04.3/resources/shared/singlefileresource/imapquotaattribute.cpp:93. See the attached backtrace log.

Investigating more, I've found that the crash happens because sizes of mRoots, mLimits and mUsages do not match. For example mRoots.size() returns 2, while mLimits.size() returns 1. I don't know why, but this happens from time to time.  See the attached IMAP log. Due to this the Limits and Usages loops iterate over non existing elements, what causes segfaults.

I could avoid segfaults by applying the attached patch. However, I am not sure if this the desired solution.
Comment 1 Grzegorz Kowal 2018-07-30 10:50:57 UTC
Created attachment 114218 [details]
IMAP log of account causing segfault
Comment 2 Grzegorz Kowal 2018-07-30 10:51:37 UTC
Created attachment 114219 [details]
Patch fixing segfaults
Comment 3 Laurent Montel 2018-07-31 12:12:03 UTC
could you use phabricator for your patch please ?

Thanks
Comment 4 Christoph Feck 2018-07-31 13:07:57 UTC
For help see https://community.kde.org/Get_Involved/development
Comment 5 Grzegorz Kowal 2018-08-02 12:42:48 UTC
Created patch revision https://phabricator.kde.org/D14554
Comment 6 Daniel Vrátil 2018-08-10 09:22:38 UTC
Git commit c9254f3497e0cd37039333c17085b064e3b323a2 by Daniel Vrátil, on behalf of Grzegorz Kowal.
Committed on 10/08/2018 at 09:20.
Pushed by dvratil into branch 'Applications/18.08'.

Fix array access bounds in IMAP resource

Summary:
ImapQuotaAttribute::serialized() processes IMAP roots assigning corresponding QUOTA and USAGE attributes to each root. It uses three dictionaries: mRoots, mLimits, and mUsages assuming that these dictionaries always have the same number of  elements. In a case when mRoots contains more elements than other two dictionaries, this causes referencing to non-existent elements in mLimits and mUsages and segfaults.

Fix this by using mLimits.size() and mUsages.size() in corresponding loops.

Reviewers: #kde_pim, dvratil

Reviewed By: #kde_pim, dvratil

Subscribers: mlaurent, cfeck, kde-pim

Tags: #kde_pim

Differential Revision: https://phabricator.kde.org/D14554

M  +2    -2    resources/shared/singlefileresource/imapquotaattribute.cpp

https://commits.kde.org/kdepim-runtime/c9254f3497e0cd37039333c17085b064e3b323a2