Bug#741412: exim4: process crashed with signal 11 while delivering

[Christian Hilgers]

Package: exim4
Version: 4.84-8
Followup-For: Bug #741412

Dear Maintainer,

after upgrading from Wheezy to Jessie I see the behaviour described in this bug
happens on one box.

It shows up in dmesg
[51017.459665] exim4[10550]: segfault at eeec4996 ip b6ac4614 sp bfaea690 error 7 in libgnutls-deb0.so.28.41.0[b6a10000+13a000]
[54616.785455] exim4[11809]: segfault at b4631e9b ip b6a67614 sp bff99640 error 6 in libgnutls-deb0.so.28.41.0[b69b3000+13a000]
[54619.569462] exim4[11814]: segfault at 4dcbf1a3 ip b6a51614 sp bfa46170 error 6 in libgnutls-deb0.so.28.41.0[b699d000+13a000]
[55928.429117] exim4[11921]: segfault at a6ecaeae ip b6ae3614 sp bf9d5400 error 6 in libgnutls-deb0.so.28.41.0[b6a2f000+13a000]
[55929.513981] exim4[11936]: segfault at e52cd7a6 ip b6a2b614 sp bff8f4b0 error 7 in libgnutls-deb0.so.28.41.0[b6977000+13a000]


from exim4 mainlog:
2015-06-08 10:25:44 1Z1sNL-00036J-3W == postmaster at X R=smarthost T=remote_smtp_smarthost defer (-1): smtp transport process returned non-zero status 0x000b: terminated by signal 11
2015-06-08 10:25:44 1Z1sNL-00036J-3W Frozen

and when manually starting a delivery it is OK

root at server:~# exim -M 1Z1sNL-00036J-3W 
root at server:~# echo $?
0
root at server:~# 


I tried to create a usable core dump with exim4-daemon-heavy-dbg but
the stacktrace is not helpful. 


root at server:~# gdb /usr/sbin/exim4  /var/spool/exim4/core       
GNU gdb (Debian 7.7.1+dfsg-5) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i586-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/sbin/exim4...Reading symbols from /usr/lib/debug//usr/sbin/exim4...done.
done.
[New LWP 16621]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/i386-linux-gnu/i686/cmov/libthread_db.so.1".
Core was generated by `/usr/sbin/exim4 -v -Mc 1Z1tsn-0004K1-6w'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0xb6a2f614 in ?? () from /usr/lib/i386-linux-gnu/libgnutls-deb0.so.28
(gdb) 
(gdb) 
(gdb) where
#0  0xb6a2f614 in ?? () from /usr/lib/i386-linux-gnu/libgnutls-deb0.so.28
#1  0xada689b9 in ?? ()
#2  0x43eadd17 in ?? ()
....
#24 0xbf936297 in ?? ()
#25 0xb7396497 in __ham_onpage_replace () from /usr/lib/i386-linux-gnu/libdb-5.3.so
#26 0x3db0c97d in ?? ()
....
#111 0x149dbc6a in ?? ()
#112 0x582ff8de in ?? ()
#113 0xb6c63960 in ?? () from /lib/i386-linux-gnu/i686/cmov/libc.so.6
Backtrace stopped: previous frame inner to this frame (corrupt stack?)
(gdb) 

The skipped lines all show ??


I will run memtest the next time I am onsite. But as only exim fails and it started
after the upgrade I assume memtest will not show anything.

What can I do to get a usefull stacktrace? Or other tests to narrow it down?

Kind regards

Christian


-- Package-specific info:
Exim version 4.84 #2 built 17-Feb-2015 17:01:49
Copyright (c) University of Cambridge, 1995 - 2014
(c) The Exim Maintainers and contributors in ACKNOWLEDGMENTS file, 2007 - 2014
Berkeley DB: Berkeley DB 5.3.28: (September  9, 2013)
Support for: crypteq iconv() IPv6 PAM Perl Expand_dlfunc GnuTLS move_frozen_messages Content_Scanning DKIM Old_Demime PRDR OCSP
Lookups (built-in): lsearch wildlsearch nwildlsearch iplsearch cdb dbm dbmjz dbmnz dnsdb dsearch ldap ldapdn ldapm mysql nis nis0 passwd pgsql sqlite
Authenticators: cram_md5 cyrus_sasl dovecot plaintext spa
Routers: accept dnslookup ipliteral iplookup manualroute queryprogram redirect
Transports: appendfile/maildir/mailstore/mbx autoreply lmtp pipe smtp
Fixed never_users: 0
Size of off_t: 8
Configuration file is /var/lib/exim4/config.autogenerated

-- System Information:
Debian Release: 8.1
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'oldstable-updates'), (500, 'stable'), (500, 'oldstable')
Architecture: i386 (i686)

Kernel: Linux 3.16.0-4-686-pae (SMP w/1 CPU core)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to de_DE.utf8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages exim4 depends on:
ii  debconf [debconf-2.0]  1.5.56
ii  exim4-base             4.84-8
ii  exim4-daemon-heavy     4.84-8

exim4 recommends no packages.

exim4 suggests no packages.

-- debconf information:
* exim4/drec: