Created attachment 9605 [details] Packet capture Hi when mounting a Samba share (Samba version from git master) with a OS X 10.9.1 client (SMB2), the smbd process repeatedly terminates on SMB_CLOSE op after running into this error: [2014/01/20 17:07:35.026052, 10, pid=22941, effective(1000, 1000), real(1000, 0)] ../source3/smbd/smb2_server.c:2598(smbd_smb2_request_error_ex) smbd_smb2_request_error_ex: idx[1] status[STATUS_NOTIFY_ENUM_DIR] || at ../source3/smbd/smb2_notify.c:120 As a result, the connection hangs for ~60s seconds until the client attempts a reconnect. The sequence of SMB2 commands that seems to trigger this are (packet numbers from attached pcap): p.210: SMB2_CREATE_REQ(open, share basedir path) p.213: SMB2_NOTIFY_REQ(file handle from p.210) ... p.317: SMB2_CLOSE_REQ(file handle from p.210)
Created attachment 9606 [details] Level 10 debug log
Problem is reproducible with smbtorture: [ralph@fedora20 samba]$ ./bin/smbtorture -Uuser%secret -d 2 //server/share smb2.notify.dir smbtorture 4.2.0pre1-GIT-6135535 lpcfg_load: refreshing parameters from /opt/samba/etc/smb.conf Using seed 1390397858 time: 2014-01-22 14:37:38.486658 test: dir time: 2014-01-22 14:37:38.489254 TESTING CHANGE NOTIFY ON DIRECTORIES Testing notify cancel Testing notify mkdir Testing notify rmdir Testing notify mkdir - rmdir - mkdir - rmdir Testing buffered notify on create of 10 files Testing notify on unlink for the first file and now from the 1st notify (3rd notify) this notify will only see the 1st unlink Testing if a close() on the dir handle triggers the notify reply ^C [ralph@fedora20 samba]$ smbtorture hang thus I aborted with ^C.
smbd process hangs is: (gdb) bt #0 0x00007ff6c5441860 in __read_nocancel () from /lib64/libpthread.so.0 #1 0x00007ff6c37b4db0 in sys_read () from /home/ralph/samba/bin/shared/libsmbconf.so.0 #2 0x00007ff6c37b67da in drain_socket () from /home/ralph/samba/bin/shared/libsmbconf.so.0 #3 0x00007ff6c4ddd7bf in smbd_smb2_request_error_ex () from /home/ralph/samba/bin/shared/private/libsmbd_base.so #4 0x00007ff6c4df5a26 in smbd_smb2_request_notify_done () from /home/ralph/samba/bin/shared/private/libsmbd_base.so #5 0x00007ff6c4a55f40 in _tevent_req_notify_callback () from /home/ralph/samba/bin/shared/private/libtevent.so.0 #6 0x00007ff6c4a56006 in tevent_req_finish () from /home/ralph/samba/bin/shared/private/libtevent.so.0 #7 0x00007ff6c4a5612b in tevent_req_trigger () from /home/ralph/samba/bin/shared/private/libtevent.so.0 #8 0x00007ff6c4a55324 in tevent_common_loop_immediate () from /home/ralph/samba/bin/shared/private/libtevent.so.0 #9 0x00007ff6c37d5425 in run_events_poll () from /home/ralph/samba/bin/shared/libsmbconf.so.0 #10 0x00007ff6c37d5a99 in s3_event_loop_once () from /home/ralph/samba/bin/shared/libsmbconf.so.0 #11 0x00007ff6c4a54466 in _tevent_loop_once () from /home/ralph/samba/bin/shared/private/libtevent.so.0 #12 0x00007ff6c4dc04f0 in smbd_process () from /home/ralph/samba/bin/shared/private/libsmbd_base.so #13 0x00007ff6c587c59a in smbd_accept_connection () #14 0x00007ff6c37d591e in run_events_poll () from /home/ralph/samba/bin/shared/libsmbconf.so.0 #15 0x00007ff6c37d5baa in s3_event_loop_once () from /home/ralph/samba/bin/shared/libsmbconf.so.0 #16 0x00007ff6c4a54466 in _tevent_loop_once () from /home/ralph/samba/bin/shared/private/libtevent.so.0 #17 0x00007ff6c587d252 in smbd_parent_loop () #18 0x00007ff6c587eb4a in main ()
smb.conf: [global] server role = standalone log file = /var/log/samba.log log level = 10 store dos attributes = yes read only = no [SMB2_maeh] path = /Volumes/test2 delete veto files = yes Changing "delete veto files" to no results in a different error, but at least no hang: [ralph@fedora20 samba]$ ./bin/smbtorture -Uuser%secret -d 2 //server/share smb2.notify.dir ... Testing if a close() on the dir handle triggers the notify reply time: 2014-01-22 15:08:43.655462 failure: dir [ (../source4/torture/smb2/notify.c:457) Incorrect status STATUS_NOTIFY_ENUM_DIR - should be STATUS_NOTIFY_CLEANUP ] [ralph@fedora20 samba]$