[BUG] Segmentation fault when adding "BAYES_SPAM" to symbols_disabled

[fhtw20]

Prerequisites

• Put an X between the brackets on this line if you have done all of the following:
  • Read about bug reporting in general: https://rspamd.com/doc/faq.html#how-to-report-bugs-found-in-rspamd
  • Enabled relevant debugging logs: https://rspamd.com/doc/faq.html#how-to-debug-some-module-in-rspamd
  • Checked the FAQs about Core files in case of fatal crash: https://rspamd.com/doc/faq.html#how-to-figure-out-why-rspamd-process-crashed
  • Tried ASAN package and obtained the ASAN report (if possible): https://rspamd.com/doc/faq.html#asan-builds
  • Checked that your issue isn't already filed: https://github.com/issues?utf8=%E2%9C%93&q=is%3Aissue+user%3Arspamd
  • Checked that there is not already an experimental package or master branch

Describe the bug

When I add BAYES_SPAM to symbols_disabled rspamd will crash.

authenticated {
  priority = high;
  authenticated = yes;
  apply {
    groups_disabled = ["rbl", "spf"];
    symbols_disabled = [
      "CUSTOM_SYMBOL1",
      "CUSTOM_SYMBOL2",
      "BAYES_SPAM",
    ];
  }
}

rspamd.log

(rspamd_proxy) rspamd_crash_sig_handler: caught fatal signal 11(Segmentation fault), pid: xxxxx, trace:
(rspamd_proxy) log_backtrace: #0: /usr/lib/rspamd/librspamd-server.so in rspamd::log_backtrace()
(rspamd_proxy) log_backtrace: #1: /usr/lib/rspamd/librspamd-server.so in rspamd_worker_check_controller_presence
(rspamd_proxy) log_backtrace: #2: /lib/x86_64-linux-gnu/libpthread.so.0 in __funlockfile
(rspamd_proxy) log_backtrace: #3: /usr/lib/rspamd/librspamd-server.so in rspamd_mempool_delete
(rspamd_proxy) log_backtrace: #4: /usr/bin/rspamd in
(rspamd_proxy) log_backtrace: #5: /usr/bin/rspamd in
(rspamd_proxy) log_backtrace: #6: /usr/bin/rspamd in
(rspamd_proxy) log_backtrace: #7: /usr/lib/rspamd/librspamd-server.so in rspamd_session_pending
(rspamd_proxy) log_backtrace: #8: /usr/lib/rspamd/librspamd-server.so in luaopen_regexp
(rspamd_proxy) log_backtrace: #9: /usr/lib/rspamd/librspamd-server.so in redisProcessCallbacks
(rspamd_proxy) log_backtrace: #10: /usr/lib/rspamd/librspamd-ev.so in ev_invoke_pending
(rspamd_proxy) log_backtrace: #11: /usr/lib/rspamd/librspamd-ev.so in ev_run
(rspamd_proxy) log_backtrace: #12: /usr/bin/rspamd in
(rspamd_proxy) log_backtrace: #13: /usr/lib/rspamd/librspamd-server.so in rspamd_fork_worker
(rspamd_proxy) log_backtrace: #14: /usr/bin/rspamd in
(rspamd_proxy) log_backtrace: #15: /usr/lib/rspamd/librspamd-ev.so in ev_invoke_pending
(rspamd_proxy) log_backtrace: #16: /usr/lib/rspamd/librspamd-ev.so in ev_run
(rspamd_proxy) log_backtrace: #17: /usr/bin/rspamd in
(rspamd_proxy) log_backtrace: #18: /lib/x86_64-linux-gnu/libc.so.6 in __libc_start_main
(rspamd_proxy) log_backtrace: #19: /usr/bin/rspamd in
(rspamd_proxy) log_backtrace: #20: in
(main) main; rspamd_srv_handler: cannot read from worker's srv pipe connection closed; command = heartbeat
(main) main; rspamd_check_termination_clause: rspamd_proxy process xxxxx terminated abnormally with exit code 0 by signal: Segmentation fault
(main) main; rspamd_cld_handler: respawn process rspamd_proxy in lieu of terminated process with pid xxxxx

coredumps

Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007fb97871dde2 in freeReplyObject (reply=0x70626a7a74757438) at ../contrib/hiredis/./contrib/hiredis/hiredis.c:81
81	../contrib/hiredis/./contrib/hiredis/hiredis.c: file or directory not found.

Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007fb978619a98 in redis_stat_runtime<float, true>::process_tokens (tokens=<optimized out>, this=<optimized out>) at ./src/libstat/backends/redis_backend.cxx:155
155	./src/libstat/backends/redis_backend.cxx: file or directory not found.

Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007fb97831b339 in g_atomic_ref_count_dec () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0

Steps to Reproduce

1. Adding "BAYES_SPAM" to a settings.conf rule
2. Restarting rspamd daemon

Expected behavior

• No rspamd crash

Versions

• Rspamd daemon version 3.8.4
• CPU architecture x86_64

Additional Information

How can I disable the BAYES_SPAM check for authenticated users?

[vstakhov]

Nice, it might be probably the issue with the Bayes we have observed previously but were unable to reproduce.

[fhtw20]

Thanks for the quick reply. Please tell me if you need more information.

[fatalbanana]

Adding BAYES_HAM to symbols_disabled should help avoid the issue (another approach could be rescoring BAYES_SPAM instead of disabling it).

Likely related to #4787 and #4799

[A1bi]

We're experiencing the same issue. Frequent crashes with BAYES_SPAM present in symbols_disabled. Adding BAYES_HAM as well did indeed fix it for us, thank you @fatalbanana.