when remote mta suddenly dies, segv sometimes occurs

[toddfries]

Program received signal SIGSEGV, Segmentation fault.
mta_enter_state (s=0x81777500, newstate=12)
    at /usr/src/usr.sbin/smtpd/smtpd/../mta_session.c:467
467                     if (s->task->sender.user[0] && s->task->sender.domain[0])
(gdb) print s
$1 = (struct mta_session *) 0x81777500
(gdb) print *s
$2 = {id = 6348794322668282305, route = 0xe3e473c2, 
  secret = 0xcd13df01 , flags = -908832919, 
  msgcount = -661298030, state = MTA_SMTP_MAIL, hosts = {
    tqh_first = 0x5825dd7d, tqh_last = 0x6dc2de01}, task = 0x35d9accd, 
  datafp = 0x237502b8, currevp = 0x1b2e000e, iobuf = {
    buf = 0x66e52cc2 , max = 3195029584, 
    size = 735276414, wpos = 1945546755, rpos = 374185188, queued = 596914217, 
    outq = 0xf5a9ef26, outqlast = 0xee87ef28}, io = {sock = 1324545014, 
    arg = 0xf082bba6, cb = 0xdb51d6d8, iobuf = 0xa8a766db, lowat = 2945433811, 
    timeout = -1944325894, flags = 2041716700, state = -1758072588, ev = {
      ev_next = {tqe_next = 0xc6647f49, tqe_prev = 0x36e6c4ef}, 
      ev_active_next = {tqe_next = 0xedb71237, tqe_prev = 0x451074ec}, 
      ev_signal_next = {tqe_next = 0x61e10a49, tqe_prev = 0xedfafab3}, 
      min_heap_idx = 2487805295, ev_base = 0x37d159b, ev_fd = -1113905571, 
      ev_events = -7502, ev_ncalls = -29827, ev_pncalls = 0x66caf085, 
      ev_timeout = {tv_sec = 601523305, tv_usec = -1731764986}, 
      ev_pri = 1966974901, ev_callback = 0xe17542da, ev_arg = 0xe2085741, 
      ev_res = 631995870, ev_flags = -1361666196}, ssl = 0xc81c6fe9}, 
  is_reading = -339285120, ext = 1429137871, ssl = 0x20134e7a}
(gdb) print s->task
$3 = (struct mta_task *) 0x35d9accd
(gdb) print *s->task
Cannot access memory at address 0x35d9accd
(gdb) bt
#0  mta_enter_state (s=0x81777500, newstate=12)
    at /usr/src/usr.sbin/smtpd/smtpd/../mta_session.c:467
#1  0x1c012a9c in mta_session_imsg (iev=0x873bb000, imsg=0xcfbe4ac4)
    at /usr/src/usr.sbin/smtpd/smtpd/../mta_session.c:188
#2  0x1c0112be in mta_imsg (iev=0x873bb000, imsg=0xcfbe4ac4)
    at /usr/src/usr.sbin/smtpd/smtpd/../mta.c:158
#3  0x1c01d7fd in imsg_dispatch (fd=59, event=2, p=0x873bb000)
    at /usr/src/usr.sbin/smtpd/smtpd/../smtpd.c:1153
#4  0x05be30a2 in event_base_loop (base=0x846d6000, flags=0)
    at /usr/src/lib/libevent/event.c:402
#5  0x05be3359 in event_loop (flags=0) at /usr/src/lib/libevent/event.c:478
#6  0x05be337e in event_dispatch () at /usr/src/lib/libevent/event.c:416
#7  0x1c0110a7 in mta () at /usr/src/usr.sbin/smtpd/smtpd/../mta.c:277
#8  0x1c01e30e in main (argc=4, argv=0xcfbe55cc)
    at /usr/src/usr.sbin/smtpd/smtpd/../smtpd.c:667
(gdb) 

The above is after applying the below diff which seems to help but obviously there is a task removal race somewhere in the mta since going from s->task == NULL to s->task == 'Address out of bounds' still produces the same result, a SEGV.

diff --git a/smtpd/mta_session.c b/smtpd/mta_session.c
index b5887e9..84624a4 100644
--- a/smtpd/mta_session.c
+++ b/smtpd/mta_session.c
@@ -293,6 +293,7 @@ mta_enter_state(struct mta_session *s, int newstate)
        /*
         * Obtain message body fd.
         */
+       if (s->task)
        imsg_compose_event(env->sc_ievs[PROC_QUEUE],
            IMSG_QUEUE_MESSAGE_FD, s->task->msgid, 0, -1,
            &s->id, sizeof(s->id));
@@ -462,19 +463,23 @@ mta_enter_state(struct mta_session *s, int newstate)
        break;
 
    case MTA_SMTP_MAIL:
+       if (s->task) {
        if (s->task->sender.user[0] && s->task->sender.domain[0])
            mta_send(s, "MAIL FROM: <%s@%s>",
                s->task->sender.user, s->task->sender.domain);
        else
            mta_send(s, "MAIL FROM: <>");
+       }
        break;
 
    case MTA_SMTP_RCPT:
+       if (s->task) {
        if (s->currevp == NULL)
            s->currevp = TAILQ_FIRST(&s->task->envelopes);
        mta_send(s, "RCPT TO: <%s@%s>",
            s->currevp->dest.user,
            s->currevp->dest.domain);
+       }
        break;
 
    case MTA_SMTP_DATA:

[poolpOrg]

@ericfaurot isn't this what was observed by miky and fixed ?

[poolpOrg]

@toddfries can you still observe that with -current ?

[ericfaurot]

Considered fixed until proven otherwise.