Segfault in smbd

[Derek Chen-Becker]

Binary package hint: samba

Ubuntu: 9.04 (Jaunty)
Samba: 3.3.2-1ubuntu3

I'm getting emails periodically that smbd is having a panic. I installed the debug symbols and here's the stack trace:

[Thread debugging using libthread_db enabled]
[New Thread 0x7fbc9b551710 (LWP 20441)]
0x00007fbc981058f5 in waitpid () from /lib/libc.so.6
#0 0x00007fbc981058f5 in waitpid () from /lib/libc.so.6
#1 0x00007fbc9809d2d1 in ?? () from /lib/libc.so.6
#2 0x00007fbc9b7427a8 in smb_panic (why=<value optimized out>)
    at lib/util.c:1679
#3 0x00007fbc9b72fbe7 in sig_fault (sig=11) at lib/fault.c:46
#4 <signal handler called>
#5 pdb_get_domain (sampass=0x0) at passdb/pdb_get_set.c:285
#6 0x00007fbc9b63db4c in change_to_user (conn=0x7fbc9c9052f0, vuid=100)
    at smbd/uid.c:88
#7 0x00007fbc9b6573cf in switch_message (type=50 '2', req=0x7fbc9c8eb370,
    size=<value optimized out>) at smbd/process.c:1429
#8 0x00007fbc9b6593cd in smbd_process () at smbd/process.c:1509
#9 0x00007fbc9b626cc8 in main (argc=<value optimized out>, argv=0x2)
    at smbd/server.c:1512
The program is running. Quit anyway (and detach it)? (y or n) [answered Y; input not from terminal]

I posted it to 281118, but Thierry Carrez said that it's not the same bug and should be a new ticket.

[Thierry Carrez (ttx)]

Any "audit" lines showing in kern.log ?

[Derek Chen-Becker (dchenbecker)]

There are some audit lines, but none for smb or samba. Anything in particular I should be looking for?

[Thierry Carrez (ttx)]

@Derek:
I was looking for failure to read or write to samba-related files, from a profile that happens to use a samba library. In doubt, could you please attach them here so that I can review them ? (grep audit kern.log ?)

[Derek Chen-Becker (dchenbecker)]

Here they are. I'm pretty sure there's nothing in there related to Samba, but let me know.

[Derek Chen-Becker (dchenbecker)]

Just got another panic. Looks like the same stack trace:

[Thread debugging using libthread_db enabled]
[New Thread 0x7f176d176710 (LWP 24480)]
0x00007f1769d298f5 in waitpid () from /lib/libc.so.6
#0 0x00007f1769d298f5 in waitpid () from /lib/libc.so.6
#1 0x00007f1769cc12d1 in ?? () from /lib/libc.so.6
#2 0x00007f176d3667a8 in smb_panic (why=<value optimized out>)
    at lib/util.c:1679
#3 0x00007f176d353be7 in sig_fault (sig=11) at lib/fault.c:46
#4 <signal handler called>
#5 pdb_get_domain (sampass=0x0) at passdb/pdb_get_set.c:285
#6 0x00007f176d261b4c in change_to_user (conn=0x7f176e972e80, vuid=100)
    at smbd/uid.c:88
#7 0x00007f176d27b3cf in switch_message (type=50 '2', req=0x7f176e958610,
    size=<value optimized out>) at smbd/process.c:1429
#8 0x00007f176d27d3cd in smbd_process () at smbd/process.c:1509
#9 0x00007f176d24acc8 in main (argc=<value optimized out>, argv=0x2)
    at smbd/server.c:1512
The program is running. Quit anyway (and detach it)? (y or n) [answered Y; input not from terminal]

No audit lines in kern.log

[Thierry Carrez (ttx)]

OK, this is probably the following fix, present in 3.3.4

Extracted from http://gitweb.samba.org/samba.git/?p=samba.git;a=commit;h=26c73280654efc1320bcfe1808ebf545d43b4487

[Thierry Carrez (ttx)]

Fixed in development release (3.3.5), nominating for Jaunty

[Clint Byrum (clint-fewbar)]

Since Jaunty is EOL, closing Jaunty task as Won't Fix.