Samba crashing on null path in cleanup_tmp_files

[paul_crane]

Hi Everyone,

I'm running Ubuntu 14.04, and the samba package from the repos, and am getting the following panic-action email when the system starts up. I'm also not able to start samba manually after boot either.

Here's a back-trace:

[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/i386-linux-gnu/libthread_db.so.1".
0xb7707424 in __kernel_vsyscall ()
#0 0xb7707424 in __kernel_vsyscall ()
#1 0xb6f08e53 in __waitpid_nocancel () at ../sysdeps/unix/syscall-template.S:81
#2 0xb6e92fcd in do_system (line=line@entry=0xbfa71a64 "/usr/share/samba/panic-action 1001") at ../sysdeps/posix/system.c:148
#3 0xb6e933d0 in __libc_system (line=line@entry=0xbfa71a64 "/usr/share/samba/panic-action 1001") at ../sysdeps/posix/system.c:184
#4 0xb76d810b in system (line=line@entry=0xbfa71a64 "/usr/share/samba/panic-action 1001") at pt-system.c:28
#5 0xb76af3bd in smb_panic_default (why=0xb76bc552 "internal error") at ../lib/util/fault.c:134
#6 smb_panic (why=why@entry=0xb76bc552 "internal error") at ../lib/util/fault.c:162
#7 0xb76af551 in fault_report (sig=11) at ../lib/util/fault.c:77
#8 sig_fault (sig=11) at ../lib/util/fault.c:88
#9 <signal handler called>
#10 __opendirat (dfd=dfd@entry=-100, name=name@entry=0x0) at ../sysdeps/posix/opendir.c:91
#11 0xb6f04a7d in __opendir (name=0x0) at ../sysdeps/posix/opendir.c:160
#12 0xb773253f in recursive_delete (path=0x0) at ../source4/smbd/server.c:56
#13 0xb7732e6c in cleanup_tmp_files (lp_ctx=0xb77e1018) at ../source4/smbd/server.c:102
#14 binary_smbd_main (argc=<optimized out>, argv=<optimized out>, binary_name=0xb77362e2 "samba") at ../source4/smbd/server.c:385
#15 0xb772e431 in main (argc=2, argv=0xbfa724b4) at ../source4/smbd/server.c:514
A debugging session is active.

 Inferior 1 [process 1001] will be detached.

If I'm interpreting right, the recursive_delete is getting a null path which is causing the problems.

Other information:

$ lsb_release -rd
Description: Ubuntu 14.04 LTS
Release: 14.04

$ apt-cache policy samba
samba:
  Installed: 2:4.1.6+dfsg-1ubuntu2.14.04.2
  Candidate: 2:4.1.6+dfsg-1ubuntu2.14.04.2
  Version table:
 *** 2:4.1.6+dfsg-1ubuntu2.14.04.2 0
        500 mirror://mirrors.ubuntu.com/mirrors.txt/ trusty-updates/main i386 Packages
        500 mirror://mirrors.ubuntu.com/mirrors.txt/ trusty-security/main i386 Packages
        100 /var/lib/dpkg/status
     2:4.1.6+dfsg-1ubuntu2 0
        500 mirror://mirrors.ubuntu.com/mirrors.txt/ trusty/main i386 Packages

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Samuel Leslie (sdl)]

Seeing the exact same issue here. I also note that the crash seems to be from starting smbd with the '-D' parameter by samba-ad-dc, however, it shouldn't even be trying to run this from what I can see. The system is running a fresh installation of Samba with a vanilla configuration and as such is not configured to function as a domain controller. The init.d script for samba-ad-dc contains this excerpt:

start)
                SERVER_ROLE=`samba-tool testparm --parameter-name="server role" 2>/dev/null | tail -1`
                if [ "$SERVER_ROLE" != "active directory domain controller" ]; then
                    exit 0
                fi

However, the upstart script performs no such check and simply attempts to start it unconditionally. I'm not sure if this is related to the behaviour we see here (expecting configuration parameters that aren't present?) or is a separate issue.