connection loss, application crashes, unable to edit or open documents

[Mirka Zeljkovic]

With 16.04 as a client and 14.04 as a server no file handling is possible. One can't open, delete or copy any file.

This is an upstream bug and upstream patch solves the problem.

[2016/09/12 11:02:08.650492, 0] ../source3/lib/popt_common.c:68(popt_s3_talloc_log_fn)
  talloc: access after free error - first free may be at ../source3/smbd/open.c:3248
[2016/09/12 11:02:08.650654, 0] ../source3/lib/popt_common.c:68(popt_s3_talloc_log_fn)
  Bad talloc magic value - access after free
[2016/09/12 11:02:08.650711, 0] ../source3/lib/util.c:789(smb_panic_s3)
  PANIC (pid 31253): Bad talloc magic value - access after free
[2016/09/12 11:02:08.652528, 0] ../source3/lib/util.c:900(log_stack_trace)
  BACKTRACE: 37 stack frames:
   #0 /usr/lib/i386-linux-gnu/samba/libsmbregistry.so.0(log_stack_trace+0x29) [0xb738b459]
   #1 /usr/lib/i386-linux-gnu/samba/libsmbregistry.so.0(smb_panic_s3+0x28) [0xb738b558]
   #2 /usr/lib/i386-linux-gnu/libsamba-util.so.0(smb_panic+0x3a) [0xb7725cfa]
   #3 /usr/lib/i386-linux-gnu/libtalloc.so.2(+0x1ea3) [0xb6cbdea3]
   #4 /usr/lib/i386-linux-gnu/libtalloc.so.2(+0x158f) [0xb6cbd58f]
   #5 /usr/lib/i386-linux-gnu/libtalloc.so.2(_talloc_steal_loc+0xba) [0xb6cc406a]
   #6 /usr/lib/i386-linux-gnu/libtalloc.so.2(_talloc_move+0x30) [0xb6cc40c0]
   #7 /usr/lib/i386-linux-gnu/samba/libsmbd-base.so.0(+0x1a99cb) [0xb75659cb]
   #8 /usr/lib/i386-linux-gnu/samba/libsmbd-base.so.0(+0x1a9f08) [0xb7565f08]
   #9 /usr/lib/i386-linux-gnu/samba/libdbwrap.so.0(+0x59af) [0xb697d9af]
   #10 /usr/lib/i386-linux-gnu/libtdb.so.1(+0x8c7d) [0xb64fec7d]
   #11 /usr/lib/i386-linux-gnu/libtdb.so.1(tdb_parse_record+0x8b) [0xb64f960b]
   #12 /usr/lib/i386-linux-gnu/samba/libdbwrap.so.0(+0x5e62) [0xb697de62]
   #13 /usr/lib/i386-linux-gnu/samba/libdbwrap.so.0(dbwrap_parse_record+0x4a) [0xb697a80a]
   #14 /usr/lib/i386-linux-gnu/samba/libsmbd-base.so.0(fetch_share_mode_unlocked+0x88) [0xb7566dd8]
   #15 /usr/lib/i386-linux-gnu/samba/libsmbd-base.so.0(get_file_infos+0x75) [0xb755d6e5]
   #16 /usr/lib/i386-linux-gnu/samba/libsmbd-base.so.0(+0xe9799) [0xb74a5799]
   #17 /usr/lib/i386-linux-gnu/samba/libsmbd-base.so.0(+0xef4cb) [0xb74ab4cb]
   #18 /usr/lib/i386-linux-gnu/samba/libsmbd-base.so.0(reply_trans2+0x646) [0xb74ae906]
   #19 /usr/lib/i386-linux-gnu/samba/libsmbd-base.so.0(+0x121283) [0xb74dd283]
   #20 /usr/lib/i386-linux-gnu/samba/libsmbd-base.so.0(+0x12332d) [0xb74df32d]
   #21 /usr/lib/i386-linux-gnu/samba/libsmbd-base.so.0(+0x124e5f) [0xb74e0e5f]
   #22 /usr/lib/i386-linux-gnu/libsmbconf.so.0(run_events_poll+0x163) [0xb7064273]
   #23 /usr/lib/i386-linux-gnu/libsmbconf.so.0(+0x2352d) [0xb706452d]
   #24 /usr/lib/i386-linux-gnu/libtevent.so.0(_tevent_loop_once+0xa0) [0xb6caf2e0]
   #25 /usr/lib/i386-linux-gnu/libtevent.so.0(tevent_common_loop_wait+0x2c) [0xb6caf4dc]
   #26 /usr/lib/i386-linux-gnu/libtevent.so.0(_tevent_loop_wait+0x17) [0xb6caf577]
   #27 /usr/lib/i386-linux-gnu/samba/libsmbd-base.so.0(smbd_process+0x8b4) [0xb74e26e4]
   #28 smbd(+0x8b19) [0xb77c6b19]
   #29 /usr/lib/i386-linux-gnu/libsmbconf.so.0(run_events_poll+0x163) [0xb7064273]
   #30 /usr/lib/i386-linux-gnu/libsmbconf.so.0(+0x2352d) [0xb706452d]
   #31 /usr/lib/i386-linux-gnu/libtevent.so.0(_tevent_loop_once+0xa0) [0xb6caf2e0]
   #32 /usr/lib/i386-linux-gnu/libtevent.so.0(tevent_common_loop_wait+0x2c) [0xb6caf4dc]
   #33 /usr/lib/i386-linux-gnu/libtevent.so.0(_tevent_loop_wait+0x17) [0xb6caf577]
   #34 smbd(main+0x1b9e) [0xb77c424e]
   #35 /lib/i386-linux-gnu/libc.so.6(__libc_start_main+0xf3) [0xb6b17a83]
   #36 smbd(+0x672e) [0xb77c472e]
[2016/09/12 11:02:08.653508, 0] ../source3/lib/dumpcore.c:318(dump_core)
  dumping core in /var/log/samba/cores/smbd

[Ante Karamatić (ivoks)]

This impacts Samba 4.3.9+dfsg-0ubuntu0.14.04.3.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Jon Grimm (jgrimm)]

The fix referenced in the upstream bug is already in Yakkety & Xenial. Needs to be fixed in Trusty.

[Jon Grimm (jgrimm)]

And looks like its actually fixed in trusty now too. Came in with:
samba (2:4.3.11+dfsg-0ubuntu0.14.04.1)

Marking fix released, please reopen if you think there is still an issue after applying all updates.

[Ante Karamatić (ivoks)]

@Jon I think this bug was resolved few days ago when 4.3.11 was released in both Xenial and Trusty updates.

[Jon Grimm (jgrimm)]

@Ante. :) Just noticed that too. Thanks!

[Ante Karamatić (ivoks)]

Jinx! You owe me a Coke