winbindd segfaults regularly

[Gavin McCullagh]

Binary package hint: samba

We have an Ubuntu Hardy server with samba and winbindd installed on it. At the moment it's doing very little, though we intend to use winbindd to authenticate squid on this machine.

Ever since we joined it up to the AD domain 3 days ago (reporting bug 246578 during the process), we've been getting 1-2 emails oer day from the server detailing a segfault. I've installed gdb and samba-dbg and the full output from the latest one is below.

----------------------------------------------------------------------------------------------------
The Samba 'panic action' script, /usr/share/samba/panic-action,
was called for PID 25103 (/usr/sbin/winbindd).

This means there was a problem with the program, such as a segfault.
Below is a backtrace for this process generated with gdb, which shows
the state of the program at the time the error occurred. The Samba log
files may contain additional information about the problem.

If the problem persists, you are encouraged to first install the
samba-dbg package, which contains the debugging symbols for the Samba
binaries. Then submit the provided information as a bug report to
Ubuntu by visiting this link:
https://launchpad.net/ubuntu/+source/samba/+filebug

[Thread debugging using libthread_db enabled]
[New Thread 0xb7afa6d0 (LWP 25103)]
0xb7f0f410 in __kernel_vsyscall ()
#0 0xb7f0f410 in __kernel_vsyscall ()
#1 0xb7cb94d3 in waitpid () from /lib/tls/i686/cmov/libc.so.6
#2 0xb7c5c643 in ?? () from /lib/tls/i686/cmov/libc.so.6
#3 0x08123148 in smb_panic (why=0x8276e64 "internal error") at lib/util.c:1639
#4 0x0810d96a in sig_fault (sig=6) at lib/fault.c:47
#5 <signal handler called>
#6 0xb7f0f410 in __kernel_vsyscall ()
#7 0xb7c4f085 in raise () from /lib/tls/i686/cmov/libc.so.6
#8 0xb7c50a01 in abort () from /lib/tls/i686/cmov/libc.so.6
#9 0xb7c4810e in __assert_fail () from /lib/tls/i686/cmov/libc.so.6
#10 0xb7d8fbea in ldap_parse_result () from /usr/lib/libldap_r-2.4.so.2
#11 0x08239e0c in ads_do_paged_search_args (ads=0x832d120,
    bind_path=<value optimized out>, scope=0,
    expr=0x82656f5 "(objectclass=*)", attrs=0xbfd2da60, args=0x0,
    res=0xbfd2da68, count=0xbfd2d984, cookie=0xbfd2d988) at libads/ldap.c:700
#12 0x0823a18f in ads_do_search_all_args (ads=0x832d120,
    bind_path=0x8332838 "", scope=0, expr=0x82656f5 "(objectclass=*)",
    attrs=0xbfd2da60, args=0x0, res=0xbfd2da68) at libads/ldap.c:772
#13 0x0824394e in ads_do_search_retry_internal (ads=0x832d120,
    bind_path=0x82aa775 "", scope=0, expr=0x82656f5 "(objectclass=*)",
    attrs=0xbfd2da60, args=0x0, res=0xbfd2da68) at libads/ldap_utils.c:101
#14 0x08243c9a in ads_do_search_retry (ads=0x832d120, bind_path=0x82aa775 "",
    scope=0, expr=0x82656f5 "(objectclass=*)", attrs=0xbfd2da60,
    res=0xbfd2da68) at libads/ldap_utils.c:124
#15 0x08236c8c in ads_USN (ads=0x832d120, usn=0x832e33c) at libads/ldap.c:2328
#16 0x080b4269 in sequence_number (domain=0x832deb8, seq=0x832e33c)
    at nsswitch/winbindd_ads.c:1021
#17 0x08098a31 in refresh_sequence_number (domain=0x832deb8,
    force=<value optimized out>) at nsswitch/winbindd_cache.c:479
#18 0x08099059 in wcache_fetch (cache=0x832de20, domain=0x832deb8,
    format=0x826069f "TRUSTDOMS/%s") at nsswitch/winbindd_cache.c:601
#19 0x08099aa8 in trusted_domains (domain=0x832deb8, mem_ctx=0x83536a8,
    num_domains=0xbfd2dce8, names=0xbfd2dce4, alt_names=0xbfd2dce0,
    dom_sids=0xbfd2dcdc) at nsswitch/winbindd_cache.c:1942
#20 0x080a90b8 in winbindd_dual_list_trusted_domains (domain=0x832deb8,
    state=0xbfd2ddf8) at nsswitch/winbindd_misc.c:123
#21 0x080b941f in schedule_async_request (child=0x832e390)
    at nsswitch/winbindd_dual.c:481
#22 0x080bad88 in async_domain_request (mem_ctx=0x83535d8, domain=0x832deb8,
    request=0x8331e60, response=0x832fb80,
    continuation=0x8096700 <trustdom_recv>, private_data_data=0x830c3f8)
    at nsswitch/winbindd_dual.c:340
#23 0x080965f0 in rescan_trusted_domains () at nsswitch/winbindd_util.c:217
#24 0x0808c17d in main (argc=) at nsswitch/winbindd.c:753
The program is running. Quit anyway (and detach it)? (y or n) [answered Y; input not from terminal]
----------------------------------------------------------------------------------------------------

[Gavin McCullagh (gmccullagh)]

gavinmc@craic:~$ apt-cache policy samba-dbg
samba-dbg:
  Installed: 3.0.28a-1ubuntu4.4
  Candidate: 3.0.28a-1ubuntu4.4
  Version table:
 *** 3.0.28a-1ubuntu4.4 0
        500 http://ie.archive.ubuntu.com hardy-updates/main Packages
        500 http://security.ubuntu.com hardy-security/main Packages
        100 /var/lib/dpkg/status
     3.0.28a-1ubuntu4 0
        500 http://ie.archive.ubuntu.com hardy/main Packages

[Gavin McCullagh (gmccullagh)]

another today...

[Thread debugging using libthread_db enabled]
[New Thread 0xb7afa6d0 (LWP 12582)]
0xb7f0f410 in __kernel_vsyscall ()
#0 0xb7f0f410 in __kernel_vsyscall ()
#1 0xb7cb94d3 in waitpid () from /lib/tls/i686/cmov/libc.so.6
#2 0xb7c5c643 in ?? () from /lib/tls/i686/cmov/libc.so.6
#3 0x08123148 in smb_panic (why=0x8276e64 "internal error") at lib/util.c:1639
#4 0x0810d96a in sig_fault (sig=6) at lib/fault.c:47
#5 <signal handler called>
#6 0xb7f0f410 in __kernel_vsyscall ()
#7 0xb7c4f085 in raise () from /lib/tls/i686/cmov/libc.so.6
#8 0xb7c50a01 in abort () from /lib/tls/i686/cmov/libc.so.6
#9 0xb7c4810e in __assert_fail () from /lib/tls/i686/cmov/libc.so.6
#10 0xb7d8fbea in ldap_parse_result () from /usr/lib/libldap_...

[Beat Strasser (beat-stradax)]

Same problem here:

(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
[Thread debugging using libthread_db enabled]
[New Thread 0xb7bc96d0 (LWP 7493)]
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
0xb7fdc410 in __kernel_vsyscall ()
#0 0xb7fdc410 in __kernel_vsyscall ()
#1 0xb7d884d3 in waitpid () from /lib/tls/i686/cmov/libc.so.6
#2 0xb7d2b643 in ?? () from /lib/tls/i686/cmov/libc.so.6
#3 0x08123148 in smb_panic ()
#4 0x0810d96a in ?? ()
#5 <signal handler called>
#6 0xb7fdc410 in __kernel_vsyscall ()
#7 0xb7d1e085 in raise () from /lib/tls/i686/cmov/libc.so.6
#8 0xb7d1fa01 in abort () from /lib/tls/i686/cmov/libc.so.6
#9 0x0810637e in talloc_get_name ()
#10 0x081065bc in talloc_check_name ()
#11 0x0812327c in talloc_check_name_abort ()
#12 0x080bc3b7 in ?? ()
#13 0x080ba7c5 in ?? ()
#14 0x0808b959 in ?? ()
#15 0x0808c3d9 in main ()

[Steve Langasek (vorlon)]

Thank you for taking the time to report this issue and help to improve Ubuntu.

This is the same as the previously-reported bug #244265; I'm therefore marking this report as a duplicate.