Bug 14568 - smbd INTERNAL ERROR: spoolss due to user_ok_token() mismatch
Summary: smbd INTERNAL ERROR: spoolss due to user_ok_token() mismatch
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: File services (show other bugs)
Version: 4.12.10
Hardware: x64 Linux
: P5 major (vote)
Target Milestone: ---
Assignee: Karolin Seeger
QA Contact: Samba QA Contact
: 14569 14572 (view as bug list)
Depends on:
Reported: 2020-11-05 22:45 UTC by Bo Kersey
Modified: 2021-01-14 08:33 UTC (History)
3 users (show)

See Also:

backtrace (18.23 KB, text/plain)
2020-11-05 22:45 UTC, Bo Kersey
no flags Details
packet capture (8.50 KB, application/gzip)
2020-11-05 22:46 UTC, Bo Kersey
no flags Details
client debug log (595.43 KB, application/gzip)
2020-11-05 22:47 UTC, Bo Kersey
no flags Details
Test patch. (666 bytes, patch)
2020-11-05 23:47 UTC, Jeremy Allison
no flags Details
git-am fix for 4.12.next, 4.13.next. (1.49 KB, patch)
2020-11-09 18:53 UTC, Jeremy Allison
abartlet: review+

Note You need to log in before you can comment on or make changes to this bug.
Description Bo Kersey 2020-11-05 22:45:11 UTC
Created attachment 16325 [details]

Ubuntu 16.04.7 LTS

Linux fs 4.4.0-193-generic #224-Ubuntu SMP Tue Oct 6 17:15:28 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

ii  libwbclient0:amd64                    99:4.12.10-9                                             amd64        Glue package for sernet-samba-libs.
ii  sernet-samba                          99:4.12.10-9                                             amd64        SMB/CIFS file, print, and login server for Unix
ii  sernet-samba-ad                       99:4.12.10-9                                             amd64        Samba Active Directory Domain Controller
ii  sernet-samba-client                   99:4.12.10-9                                             amd64        a LanManager-like simple client for Unix
ii  sernet-samba-common                   99:4.12.10-9                                             all          Samba common files used by both the server and the client
ii  sernet-samba-dbg                      99:4.12.10-9                                             amd64        Samba debugging symbols
ii  sernet-samba-keyring                  1.10                                                     all          GnuPG archive keys of the SerNet Samba archive
ii  sernet-samba-libs:amd64               99:4.12.10-9                                             amd64        Samba common library files used by both the server and the client
ii  sernet-samba-libsmbclient0:amd64      99:4.12.10-9                                             amd64        Shared library that allows applications to talk to SMB servers
ii  sernet-samba-winbind                  99:4.12.10-9                                             amd64        Samba nameservice integration server

After upgrading from Samba 4.10.18 to 4.12.9 the smbd process crashes with INTERNAL ERROR the first time a Windows client connects.  This can be reliably reproduced.  The crash also happens when enumerating a printer.

I have attached packet capture, full backtrace and debug log.  

Comment 1 Bo Kersey 2020-11-05 22:46:52 UTC
Created attachment 16326 [details]
packet capture
Comment 2 Bo Kersey 2020-11-05 22:47:22 UTC
Created attachment 16327 [details]
client debug log
Comment 3 Jeremy Allison 2020-11-05 23:34:59 UTC
Problem looks to be here in source3/rpc_server/spoolss/srv_spoolss_nt.c:

 1883                 if (!user_ok_token(uidtoname(p->session_info->unix_token->uid), NULL,
 1884                                    p->session_info->security_token, snum) ||

user_ok_token() takes parameters:

bool user_ok_token(const char *username, const char *domain,
                   const struct security_token *token, int snum);

This is the only place in smbd where 'const char *domain' is being passed in as NULL.
Comment 4 Jeremy Allison 2020-11-05 23:47:39 UTC
Created attachment 16328 [details]
Test patch.

Can you try the following patch ? Looks like the spoolss code got missed when the calls to user_ok_token() got updated.
Comment 5 Bo Kersey 2020-11-06 14:17:24 UTC
rebuilding now.  FWIW, I see the problem on connecting to shares as well.  My prediction is that the patch will help with printing, but I think there is something else going on.
Comment 6 Bo Kersey 2020-11-06 14:53:26 UTC
Having a problem rebuilding.... I'm getting the following error:

[ 900/4426] Compiling source4/heimdal/lib/roken/rtbl.c
In file included from ../../third_party/aesni-intel/aesni-intel_asm.c:44:0:
../../third_party/aesni-intel/inst-intel.h:15:2: error: expected identifier or ‘(’ before ‘.’ token
  .macro R32_NUM opd r32
../../third_party/aesni-intel/inst-intel.h:16:2: error: stray ‘\’ in program

It must be my build environment.... ubuntu-xenial schroot env...  What should I be looking for?
Comment 7 Bo Kersey 2020-11-06 15:25:36 UTC
(In reply to Bo Kersey from comment #6)
updated debian/rules so that aesni is not built for amd64 - should not cause problems with testing, but seems to be working now.
Comment 8 Bo Kersey 2020-11-06 15:38:29 UTC
(In reply to Jeremy Allison from comment #4)
Jeremy, the patch that you provided works.  I'm always amazed at your expertise in pin pointing problems and providing fixes.

I testing by bringing up the same windows client and accessing the printer.  That was good, so I rebooted the machine, logged back in to see if there were other issues accessing the file server and there were none.  Printed a test page and there were no errors.

Comment 9 Jeremy Allison 2020-11-06 18:30:41 UTC
MR: https://gitlab.com/samba-team/samba/-/merge_requests/1669
Comment 10 Samba QA Contact 2020-11-09 04:11:14 UTC
This bug was referenced in samba master:

Comment 11 Jeremy Allison 2020-11-09 16:57:10 UTC
*** Bug 14569 has been marked as a duplicate of this bug. ***
Comment 12 Jeremy Allison 2020-11-09 18:53:20 UTC
Created attachment 16331 [details]
git-am fix for 4.12.next, 4.13.next.

Cherry-picked from master. Applies cleanly to 4.13.next, 4.12.next.
Comment 13 Jeremy Allison 2020-11-10 20:15:35 UTC
Re-assigned to Karolin for inclusion in 4.12.next, 4.13.next.
Comment 14 Jeremy Allison 2020-11-12 16:39:35 UTC
*** Bug 14572 has been marked as a duplicate of this bug. ***
Comment 15 Karolin Seeger 2020-11-19 09:55:06 UTC
(In reply to Jeremy Allison from comment #13)
Pushed to autobuild-v4-{13,12}-test.
Comment 16 Samba QA Contact 2020-11-19 11:25:46 UTC
This bug was referenced in samba v4-13-test:

Comment 17 Samba QA Contact 2020-11-19 14:10:39 UTC
This bug was referenced in samba v4-12-test:

Comment 18 Karolin Seeger 2020-11-24 11:19:05 UTC
Pushed to both branches.
Closing out bug report.

Comment 19 Samba QA Contact 2020-12-16 12:22:17 UTC
This bug was referenced in samba v4-13-stable (Release samba-4.13.3):

Comment 20 Samba QA Contact 2021-01-14 08:33:53 UTC
This bug was referenced in samba v4-12-stable (Release samba-4.12.11):