Samba 4.1.6 Panic with Trusty 14.04.3 LTS

[Andre Schlegel]

Description: Ubuntu 14.04.3 LTS
Release: 14.04

The Samba 'panic action' script, /usr/share/samba/panic-action,
was called for PID 26738 (/usr/sbin/smbd).

This means there was a problem with the program, such as a segfault.
Below is a backtrace for this process generated with gdb, which shows
the state of the program at the time the error occurred. The Samba log
files may contain additional information about the problem.

If the problem persists, you are encouraged to first install the
samba-dbg package, which contains the debugging symbols for the Samba
binaries. Then submit the provided information as a bug report to
Ubuntu by visiting this link:
https://launchpad.net/ubuntu/+source/samba/+filebug

[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
0x00007f9955f6eb4c in __libc_waitpid (pid=28019, stat_loc=stat_loc@entry=0x7ffe73814640, options=options@entry=0) at ../sysdeps/unix/sysv/linux/waitpid.c:31
#0 0x00007f9955f6eb4c in __libc_waitpid (pid=28019, stat_loc=stat_loc@entry=0x7ffe73814640, options=options@entry=0) at ../sysdeps/unix/sysv/linux/waitpid.c:31
#1 0x00007f9955ef42e2 in do_system (line=line@entry=0x7f9959aa0f20 "/usr/share/samba/panic-action 26738") at ../sysdeps/posix/system.c:148
#2 0x00007f9955ef464a in __libc_system (line=line@entry=0x7f9959aa0f20 "/usr/share/samba/panic-action 26738") at ../sysdeps/posix/system.c:184
#3 0x00007f9958fd8235 in system (line=line@entry=0x7f9959aa0f20 "/usr/share/samba/panic-action 26738") at pt-system.c:28
#4 0x00007f9957888061 in smb_panic_s3 (why=<optimized out>) at ../source3/lib/util.c:798
#5 0x00007f9958db0c6f in smb_panic (why=why@entry=0x7f9958ab9f00 "assert failed: conn->force_group_gid != (gid_t)-1") at ../lib/util/fault.c:159
#6 0x00007f9958979116 in change_to_user_internal (conn=conn@entry=0x7f9959aa19c0, session_info=<optimized out>, vuid=831126676) at ../source3/smbd/uid.c:317
#7 0x00007f9958979203 in change_to_user (conn=conn@entry=0x7f9959aa19c0, vuid=<optimized out>) at ../source3/smbd/uid.c:396
#8 0x00007f99589a1cef in make_connection_snum (sconn=sconn@entry=0x7f9959a47370, conn=conn@entry=0x7f9959aa19c0, snum=snum@entry=5, pdev=pdev@entry=0x7f9958aabb2f "???", vuser=0x7f9959a6edb0, vuser=0x7f9959a6edb0) at ../source3/smbd/service.c:730
#9 0x00007f99589a289c in make_connection_smb2 (sconn=0x7f9959a47370, tcon=0x7f9959a610c0, snum=snum@entry=5, vuser=0x7f9959a6edb0, pdev=pdev@entry=0x7f9958aabb2f "???", pstatus=pstatus@entry=0x7ffe73814b50) at ../source3/smbd/service.c:974
#10 0x00007f99589b9214 in smbd_smb2_tree_connect (out_tree_id=0x7f9959acece8, out_maximal_access=0x7f9959acece4, out_capabilities=0x7f9959acece0, out_share_flags=0x7f9959acecdc, out_share_type=0x7f9959acecd8 "", in_path=<optimized out>, req=0x7f9959ace650) at ../source3/smbd/smb2_tcon.c:269
#11 smbd_smb2_tree_connect_send (in_path=<optimized out>, smb2req=0x7f9959ace650, ev=0x7f9959a14030, mem_ctx=0x7f9959ace650) at ../source3/smbd/smb2_tcon.c:372
#12 smbd_smb2_request_process_tcon (req=req@entry=0x7f9959ace650) at ../source3/smbd/smb2_tcon.c:92
#13 0x00007f99589b2f8d in smbd_smb2_request_dispatch (req=req@entry=0x7f9959ace650) at ../source3/smbd/smb2_server.c:2130
#14 0x00007f99589b3c3b in smbd_smb2_io_handler (sconn=0x7f9959a47370, fde_flags=<optimized out>) at ../source3/smbd/smb2_server.c:3253
#15 0x00007f99589b48bc in smbd_smb2_connection_handler (ev=0x6d73, fde=0x7ffe73814640, flags=0, private_data=0xffffffffffffffff) at ../source3/smbd/smb2_server.c:3291
#16 0x00007f995789e09c in run_events_poll (ev=0x7f9959a14030, pollrtn=<optimized out>, pfds=0x7f9959a57020, num_pfds=4) at ../source3/lib/events.c:257
#17 0x00007f995789e2f0 in s3_event_loop_once (ev=0x7f9959a14030, location=<optimized out>) at ../source3/lib/events.c:326
#18 0x00007f99562765ed in _tevent_loop_once () from /usr/lib/x86_64-linux-gnu/libtevent.so.0
#19 0x00007f99589a055a in smbd_process (ev_ctx=0x7f9959a14030, msg_ctx=<optimized out>, sock_fd=<optimized out>, interactive=<optimized out>) at ../source3/smbd/process.c:3626
#20 0x00007f9959414fa4 in smbd_accept_connection (ev=0x7f9959a14030, fde=<optimized out>, flags=<optimized out>, private_data=<optimized out>) at ../source3/smbd/server.c:621
#21 0x00007f995789e09c in run_events_poll (ev=0x7f9959a14030, pollrtn=<optimized out>, pfds=0x7f9959a57020, num_pfds=5) at ../source3/lib/events.c:257
#22 0x00007f995789e2f0 in s3_event_loop_once (ev=0x7f9959a14030, location=<optimized out>) at ../source3/lib/events.c:326
#23 0x00007f99562765ed in _tevent_loop_once () from /usr/lib/x86_64-linux-gnu/libtevent.so.0
#24 0x00007f9959411b8b in smbd_parent_loop (parent=<optimized out>, ev_ctx=0x7f9959a14030) at ../source3/smbd/server.c:943
#25 main (argc=<optimized out>, argv=<optimized out>) at ../source3/smbd/server.c:1577
A debugging session is active.

 Inferior 1 [process 26738] will be detached.

testparm:

Load smb config files from /etc/samba/smb.conf
Processing section "[share1]"
Processing section "[share2]"
Processing section "[share3]"
Processing section "[share4]"
Processing section "[share5]"
Processing section "[share6]"
Loaded services file OK.
Server role: ROLE_STANDALONE
Press enter to see a dump of your service definitions

[global]
        unix charset = ISO8859-1
        workgroup = INTERNAL
        server string = %h server (Samba, Ubuntu 64Bit)
        passdb backend = ldapsam:"ldap://ldap.internal.de"
        passwd program = /usr/local/sbin/smbldap-passwd "%u"
        passwd chat = *New*password* %n\n *Retype*new*password* %n\n *all*authentication*tokens*updated*
        username map = /etc/samba/smbusers
        username level = 8
        syslog = 0
        log file = /var/log/samba/log.%m
        max log size = 100
        socket options = TCP_NODELAY SO_RCVBUF=16384 SO_SNDBUF=16384 IPTOS_LOWDELAY
        load printers = No
        printcap name = /etc/printcap
        logon script = logon.cmd
        logon path = \\%L\Profiles\%U
        os level = 16
        local master = No
        domain master = No
        dns proxy = No
        wins proxy = Yes
        ldap admin dn = cn=admin,dc=internal,dc=de
        ldap group suffix = ou=group
        ldap idmap suffix = ou=people
        ldap machine suffix = ou=machines
        ldap suffix = dc=internal,dc=de
        ldap user suffix = ou=people
        panic action = /usr/share/samba/panic-action %d
        idmap config * : backend = tdb
        invalid users = root, admin
        hosts allow = 192.168.16., 127.

[share1]
        path = /opt/data/share1
        read only = No
        create mask = 0770
        directory mask = 0770

[share2]
        path = /opt/data/share2
        read only = No
        create mask = 0775
        directory mask = 0775

[share3]
        path = /opt/data/share3
        read only = No
        create mask = 0775
        directory mask = 0775

[share4]
        path = /opt/data/share4
        read only = No
        create mask = 0775
        directory mask = 0775

[share5]
        path = /opt/data/share5
        force group = internal
        read only = No
        create mask = 0775
        directory mask = 0775

[share6]
        path = /opt/data/share6
        force group = internal
        read only = No
        create mask = 0755

----------------------------------------------

Samba using ldap authentication. The panic action accour randomized. I have two other servers with similar configuration but without any errors and with less load.

[Brady Shea (bmatthewshea)]

Started getting this as root email today... "Panic or segfault in Samba"
-> I have not changed my etc config in years, so I am not posting it.
-> Nothing really changed on my end and my samba shares are still accessible via Windows - so process seems to be working for the most part.
-> I didn't have samba-dbg installed.. Will install now and repost if I get segfault again.

Ubuntu 14.04.3 LTS
Uname:
Linux {HOST REMOVED} 3.13.0-57-generic #95-Ubuntu SMP Fri Jun 19 09:28:15 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
Samba:
Version: 2:4.1.6+dfsg-1ubuntu2.14.04.9

"
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
0x00007f17c348cb4c in __libc_waitpid (pid=1829, stat_loc=stat_loc@entry=0x7ffd92f26ef0, options=options@entry=0) at ../sysdeps/unix/sysv/linux/waitpid.c:31
#0 0x00007f17c348cb4c in __libc_waitpid (pid=1829, stat_loc=stat_loc@entry=0x7ffd92f26ef0, options=options@entry=0) at ../sysdeps/unix/sysv/linux/waitpid.c:31
#1 0x00007f17c34122e2 in do_system (line=<optimized out>) at ../sysdeps/posix/system.c:148
#2 0x00007f17c4da6061 in smb_panic_s3 () from /usr/lib/x86_64-linux-gnu/libsmbconf.so.0
#3 0x00007f17c62cec6f in smb_panic () from /usr/lib/x86_64-linux-gnu/libsamba-util.so.0
#4 0x00007f17c5e9c25d in ?? () from /usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0
#5 0x00007f17c379844f in tevent_common_loop_timer_delay () from /usr/lib/x86_64-linux-gnu/libtevent.so.0
#6 0x00007f17c4dbc0f9 in run_events_poll () from /usr/lib/x86_64-linux-gnu/libsmbconf.so.0
#7 0x00007f17c4dbc254 in ?? () from /usr/lib/x86_64-linux-gnu/libsmbconf.so.0
#8 0x00007f17c37945ed in _tevent_loop_once () from /usr/lib/x86_64-linux-gnu/libtevent.so.0
#9 0x00007f17c5ebe55a in smbd_process () from /usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0
#10 0x00007f17c6932fa4 in ?? ()
#11 0x00007f17c4dbc09c in run_events_poll () from /usr/lib/x86_64-linux-gnu/libsmbconf.so.0
#12 0x00007f17c4dbc2f0 in ?? () from /usr/lib/x86_64-linux-gnu/libsmbconf.so.0
#13 0x00007f17c37945ed in _tevent_loop_once () from /usr/lib/x86_64-linux-gnu/libtevent.so.0
#14 0x00007f17c692fb8b in main ()
A debugging session is active.
"

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Brady Shea (bmatthewshea)]

Still getting this crash occasionally. Only change is newer version of Samba s installed since last comment.
Samba: 2:4.3.8+dfsg-0ubuntu0.1

Lately, when it crashes I receive no debug info in the email. I grepped out some info in log this time.

================================
/var/log/samba/log.someusername-pc :
================================
[2016/04/18 08:05:09.682321, 0] ../source3/smbd/smbXsrv_session.c:1070(smbXsrv_session_destructor)
  smbXsrv_session_destructor: smbXsrv_session_logoff() failed: NT_STATUS_NOT_FOUND
[2016/04/18 08:05:09.682602, 0] ../source3/smbd/smbXsrv_session.c:1336(smbXsrv_session_logoff)
  smbXsrv_session_logoff(0xd4a8ff54): failed to delete global key 'D4A8FF54': NT_STATUS_NOT_FOUND
[2016/04/18 08:05:09.689931, 0] ../source3/smbd/smbXsrv_session.c:1070(smbXsrv_session_destructor)
  smbXsrv_session_destructor: smbXsrv_session_logoff() failed: NT_STATUS_NOT_FOUND

... Most of log file looks like this ^
But at the end:

[2016/04/18 08:05:09.692020, 0] ../source3/lib/util.c:785(smb_panic_s3)
  PANIC (pid 25072): smbXsrv_session_logoff_all failed
[2016/04/18 08:05:09.770610, 0] ../source3/lib/util.c:896(log_stack_trace)
  BACKTRACE: 19 stack frames:
   #0 /usr/lib/x86_64-linux-gnu/libsmbconf.so.0(log_stack_trace+0x1a) [0x7f4cffd12f3a]
   #1 /usr/lib/x86_64-linux-gnu/libsmbconf.so.0(smb_panic_s3+0x20) [0x7f4cffd13010]
   #2 /usr/lib/x86_64-linux-gnu/libsamba-util.so.0(smb_panic+0x2f) [0x7f4d0126cc6f]
   #3 /usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0(+0x143c92) [0x7f4d00e8ac92]
   #4 /usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0(+0x143f6e) [0x7f4d00e8af6e]
   #5 /usr/lib/x86_64-linux-gnu/samba/libsmbd_shim.so.0(exit_server_cleanly+0x12) [0x7f4cff66cb22]
   #6 /usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0(+0x10fac0) [0x7f4d00e56ac0]
   #7 /usr/lib/x86_64-linux-gnu/libtevent.so.0(tevent_common_check_signal+0x247) [0x7f4cfe6fd917]
   #8 /usr/lib/x86_64-linux-gnu/libsmbconf.so.0(run_events_poll+0x24) [0x7f4cffd28f64]
   #9 /usr/lib/x86_64-linux-gnu/libsmbconf.so.0(+0x37300) [0x7f4cffd29300]
   #10 /usr/lib/x86_64-linux-gnu/libtevent.so.0(_tevent_loop_once+0x8d) [0x7f4cfe6fa5ed]
   #11 /usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0(smbd_process+0x9ca) [0x7f4d00e5c93a]
   #12 smbd(+0x9fa4) [0x7f4d018d0fa4]
   #13 /usr/lib/x86_64-linux-gnu/libsmbconf.so.0(run_events_poll+0x16c) [0x7f4cffd290ac]
   #14 /usr/lib/x86_64-linux-gnu/libsmbconf.so.0(+0x37300) [0x7f4cffd29300]
   #15 /usr/lib/x86_64-linux-gnu/libtevent.so.0(_tevent_loop_once+0x8d) [0x7f4cfe6fa5ed]
   #16 smbd(main+0x13eb) [0x7f4d018cdb8b]
   #17 /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5) [0x7f4cfe353ec5]
   #18 smbd(+0x6f1d) [0x7f4d018cdf1d]
[2016/04/18 08:05:09.770915, 0] ../source3/lib/util.c:797(smb_panic_s3)
  smb_panic(): calling panic action [/usr/share/samba/panic-action 25072]
/usr/sbin/smbd (deleted): No such file or directory.
/usr/sbin/smbd (deleted): No such file or directory.
//25072: No such file or directory.
/etc/samba/gdbcommands:1: Error in sourced command file:
No stack.

=========================
testparm /etc/samba/smb.conf
=========================

Load smb config files from /etc/samba/smb.conf
rlimit_max: i...

[Christian Ehrhardt  (paelzer)]

Dupping multiple bugs together to hope to find the common cause even after that much time