Bug 10390 - Connection hang with OS X 10.9 client and smbd from master
Connection hang with OS X 10.9 client and smbd from master
Status: NEW
Product: Samba 4.1 and newer
Classification: Unclassified
Component: File services
All All
: P5 major
: ---
Assigned To: Ralph Böhme
Samba QA Contact
Depends on:
  Show dependency treegraph
Reported: 2014-01-20 16:47 UTC by Ralph Böhme
Modified: 2014-10-13 11:10 UTC (History)
0 users

See Also:

Packet capture (136.96 KB, application/octet-stream)
2014-01-20 16:47 UTC, Ralph Böhme
no flags Details
Level 10 debug log (3.86 MB, application/octet-stream)
2014-01-20 16:51 UTC, Ralph Böhme
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Ralph Böhme 2014-01-20 16:47:44 UTC
Created attachment 9605 [details]
Packet capture


when mounting a Samba share (Samba version from git master) with a OS X 10.9.1 client (SMB2), the smbd process repeatedly terminates on SMB_CLOSE op after running into this error:

[2014/01/20 17:07:35.026052, 10, pid=22941, effective(1000, 1000), real(1000, 0)] ../source3/smbd/smb2_server.c:2598(smbd_smb2_request_error_ex)
  smbd_smb2_request_error_ex: idx[1] status[STATUS_NOTIFY_ENUM_DIR] || at ../source3/smbd/smb2_notify.c:120

As a result, the connection hangs for ~60s seconds until the client attempts a reconnect.

The sequence of SMB2 commands that seems to trigger this are (packet numbers from attached pcap):

p.210: SMB2_CREATE_REQ(open, share basedir path)
p.213: SMB2_NOTIFY_REQ(file handle from p.210)
p.317: SMB2_CLOSE_REQ(file handle from p.210)
Comment 1 Ralph Böhme 2014-01-20 16:51:15 UTC
Created attachment 9606 [details]
Level 10 debug log
Comment 2 Ralph Böhme 2014-01-22 13:47:28 UTC
Problem is reproducible with smbtorture:

[ralph@fedora20 samba]$ ./bin/smbtorture -Uuser%secret -d 2 //server/share smb2.notify.dir
smbtorture 4.2.0pre1-GIT-6135535
lpcfg_load: refreshing parameters from /opt/samba/etc/smb.conf
Using seed 1390397858
time: 2014-01-22 14:37:38.486658
test: dir
time: 2014-01-22 14:37:38.489254
Testing notify cancel
Testing notify mkdir
Testing notify rmdir
Testing notify mkdir - rmdir - mkdir - rmdir
Testing buffered notify on create of 10 files
Testing notify on unlink for the first file
and now from the 1st notify
(3rd notify) this notify will only see the 1st unlink
Testing if a close() on the dir handle triggers the notify reply
[ralph@fedora20 samba]$

smbtorture hang thus I aborted with ^C.
Comment 3 Ralph Böhme 2014-01-22 13:50:30 UTC
smbd process hangs is:
(gdb) bt
#0  0x00007ff6c5441860 in __read_nocancel () from /lib64/libpthread.so.0
#1  0x00007ff6c37b4db0 in sys_read () from /home/ralph/samba/bin/shared/libsmbconf.so.0
#2  0x00007ff6c37b67da in drain_socket () from /home/ralph/samba/bin/shared/libsmbconf.so.0
#3  0x00007ff6c4ddd7bf in smbd_smb2_request_error_ex () from /home/ralph/samba/bin/shared/private/libsmbd_base.so
#4  0x00007ff6c4df5a26 in smbd_smb2_request_notify_done () from /home/ralph/samba/bin/shared/private/libsmbd_base.so
#5  0x00007ff6c4a55f40 in _tevent_req_notify_callback () from /home/ralph/samba/bin/shared/private/libtevent.so.0
#6  0x00007ff6c4a56006 in tevent_req_finish () from /home/ralph/samba/bin/shared/private/libtevent.so.0
#7  0x00007ff6c4a5612b in tevent_req_trigger () from /home/ralph/samba/bin/shared/private/libtevent.so.0
#8  0x00007ff6c4a55324 in tevent_common_loop_immediate () from /home/ralph/samba/bin/shared/private/libtevent.so.0
#9  0x00007ff6c37d5425 in run_events_poll () from /home/ralph/samba/bin/shared/libsmbconf.so.0
#10 0x00007ff6c37d5a99 in s3_event_loop_once () from /home/ralph/samba/bin/shared/libsmbconf.so.0
#11 0x00007ff6c4a54466 in _tevent_loop_once () from /home/ralph/samba/bin/shared/private/libtevent.so.0
#12 0x00007ff6c4dc04f0 in smbd_process () from /home/ralph/samba/bin/shared/private/libsmbd_base.so
#13 0x00007ff6c587c59a in smbd_accept_connection ()
#14 0x00007ff6c37d591e in run_events_poll () from /home/ralph/samba/bin/shared/libsmbconf.so.0
#15 0x00007ff6c37d5baa in s3_event_loop_once () from /home/ralph/samba/bin/shared/libsmbconf.so.0
#16 0x00007ff6c4a54466 in _tevent_loop_once () from /home/ralph/samba/bin/shared/private/libtevent.so.0
#17 0x00007ff6c587d252 in smbd_parent_loop ()
#18 0x00007ff6c587eb4a in main ()
Comment 4 Ralph Böhme 2014-01-22 14:08:35 UTC
    server role = standalone
    log file = /var/log/samba.log
    log level = 10
    store dos attributes = yes
    read only = no

    path = /Volumes/test2
    delete veto files = yes

Changing "delete veto files" to no results in a different error, but at least no hang:

[ralph@fedora20 samba]$ ./bin/smbtorture -Uuser%secret -d 2 //server/share smb2.notify.dir
Testing if a close() on the dir handle triggers the notify reply
time: 2014-01-22 15:08:43.655462
failure: dir [
(../source4/torture/smb2/notify.c:457) Incorrect status STATUS_NOTIFY_ENUM_DIR - should be STATUS_NOTIFY_CLEANUP
[ralph@fedora20 samba]$