Bug 11663 - net usershare info segfaults if /var/lock/samba/gencache_notrans.tdb does not exist
Summary: net usershare info segfaults if /var/lock/samba/gencache_notrans.tdb does no...
Status: NEW
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: Tools (show other bugs)
Version: 4.2.7
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Andrew Bartlett
QA Contact: Samba QA Contact
Depends on:
Reported: 2016-01-06 20:33 UTC by Fabio Coatti
Modified: 2016-01-06 20:33 UTC (History)
0 users

See Also:


Note You need to log in before you can comment on or make changes to this bug.
Description Fabio Coatti 2016-01-06 20:33:07 UTC
On my system (gentoo with systemd ) /var/lock/ is a symlink to /run/lock, that is mounted on tmpfs.

On package installation, /var/run/samba is created but of course deleted at first reboot. This can be considered a distro issue, however samba does not handles it nicely, at least to my understanding.

What happens is that running "net usershare info" causes a SEGV, here the backtrace:

#0  0x00007fd55069a9da in ?? () from /lib64/libc.so.6
#1  0x00007fd54ed91f75 in tdb_wrap_open (mem_ctx=mem_ctx@entry=0x0, name=name@entry=0x0, hash_size=hash_size@entry=0, tdb_flags=tdb_flags@entry=6337, 
    open_flags=open_flags@entry=0, mode=mode@entry=420) at ../lib/tdb_wrap/tdb_wrap.c:146
#2  0x00007fd555310f80 in gencache_init () at ../source3/lib/gencache.c:118
#3  0x00007fd5553114e5 in gencache_init () at ../source3/lib/gencache.c:672
#4  gencache_stabilize () at ../source3/lib/gencache.c:631
#5  0x0000558664b7fed0 in main (argc=<optimized out>, argv=0x7ffc3193c348) at ../source3/utils/net.c:965

in fact, name parameter of tdb_wrap_open is null and likely this leads to segv. If I'm not wrong (well, being wrong on my side is quite likely, I fear), this happens because the call to lock_path() (gencache.c:114) does not check the return value, null if something gone wrong, and goes straigt into tdb_wrap_open() ad into a SEGV at line 146 of tdb_wrap.c:

		if (strcmp(name, w->name) == 0) {

The problem seems to be here:

===== source3/lib/gencache.c:114
	cache_fname = lock_path("gencache_notrans.tdb");

	DEBUG(5, ("Opening cache file at %s\n", cache_fname));

	cache_notrans = tdb_wrap_open(NULL, cache_fname, 0,
				      open_flags, 0644);

I guess this is caused by wrong setup on the system, but maybe a segfault should be avoided and a more informative error printed :)

Many thanks, and sorry if I got this issue completely wrong.