After upgrading from 4.20.6 to 4.20.7, smbd regularly segfaults in smb2_lease_key_equal(). Considering the call stack, the patches included for bug 15697 look suspicious. #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50 #1 0x00007fbbd96a4859 in __GI_abort () at abort.c:79 #2 0x00007fbbd9ba29b8 in dump_core () at ../../source3/lib/dumpcore.c:338 #3 0x00007fbbd9bb0248 in smb_panic_s3 (why=<optimized out>) at ../../source3/lib/util.c:720 #4 0x00007fbbd98d3db8 in smb_panic (why=why@entry=0x7ffd503bfcd0 "Signal 11: Segmentation fault") at ../../lib/util/fault.c:209 #5 0x00007fbbd98d3e44 in fault_report (sig=11) at ../../lib/util/fault.c:83 #6 sig_fault (sig=11) at ../../lib/util/fault.c:94 #7 <signal handler called> #8 0x00007fbbd90b853c in smb2_lease_key_equal (k1=k1@entry=0x18, k2=k2@entry=0x7ffd503c04c8) at ../../libcli/smb/smb2_lease.c:93 #9 0x00007fbbd90b858d in smb2_lease_equal (g1=<optimized out>, k1=k1@entry=0x18, g2=g2@entry=0x7ffd503c04b4, k2=k2@entry=0x7ffd503c04c8) at ../../libcli/smb/smb2_lease.c:101 #10 0x00007fbbd9d727cd in delay_rename_lease_break_fn (e=0x7ffd503c0490, private_data=0x7ffd503c05c0) at ../../source3/smbd/smb2_setinfo.c:202 #11 0x00007fbbd9cd7237 in share_mode_forall_leases_fn (e=e@entry=0x7ffd503c0490, modified=modified@entry=0x7ffd503c042f, private_data=private_data@entry=0x7ffd503c0560) at ../../source3/locking/locking.c:1327 #12 0x00007fbbd9ce4d95 in share_mode_for_one_entry (writeback=<synthetischer Zeiger>, num_share_modes=<synthetischer Zeiger>, data=0x5623991d635f "\362\302=", i=<synthetischer Zeiger>, private_data=0x7ffd503c0560, fn=0x7fbbd9cd7131 <share_mode_forall_leases_fn>) at ../../source3/locking/share_mode_lock.c:2161 #13 share_mode_forall_entries (lck=lck@entry=0x5623991abae0, fn=fn@entry=0x7fbbd9cd7131 <share_mode_forall_leases_fn>, private_data=private_data@entry=0x7ffd503c0560) at ../../source3/locking/share_mode_lock.c:2265 #14 0x00007fbbd9cd93d4 in share_mode_forall_leases (lck=lck@entry=0x5623991abae0, fn=fn@entry=0x7fbbd9d72790 <delay_rename_lease_break_fn>, private_data=private_data@entry=0x7ffd503c05c0) at ../../source3/locking/locking.c:1344 #15 0x00007fbbd9d723c4 in delay_rename_for_lease_break (req=req@entry=0x5623991e5ca0, smb2req=smb2req@entry=0x5623991e3850, ev=ev@entry=0x5623991699c0, fsp=fsp@entry=0x5623991e3010, lck=lck@entry=0x5623991abae0, data=0x5623991ba190 "\001", data_size=92) at ../../source3/smbd/smb2_setinfo.c:245 #16 0x00007fbbd9d731a6 in smbd_smb2_setinfo_send (in_additional_information=<optimized out>, in_input_buffer=..., in_file_info_class=<optimized out>, in_info_type=<optimized out>, fsp=0x5623991e3010, smb2req=0x5623991e3850, ev=0x5623991699c0, mem_ctx=0x5623991e3850) at ../../source3/smbd/smb2_setinfo.c:491 #17 smbd_smb2_request_process_setinfo (req=req@entry=0x5623991e3850) at ../../source3/smbd/smb2_setinfo.c:112 #18 0x00007fbbd9d57b7f in smbd_smb2_request_dispatch (req=req@entry=0x5623991e3850) at ../../source3/smbd/smb2_server.c:3580 #19 0x00007fbbd9d57e43 in smbd_smb2_request_dispatch_immediate (ctx=<optimized out>, im=<optimized out>, private_data=<optimized out>) at ../../source3/smbd/smb2_server.c:3908 #20 0x00007fbbd9ad0970 in tevent_common_invoke_immediate_handler (im=0x5623991e0670, removed=removed@entry=0x0) at ../../lib/tevent/tevent_immediate.c:190 #21 0x00007fbbd9ad0995 in tevent_common_loop_immediate (ev=ev@entry=0x5623991699c0) at ../../lib/tevent/tevent_immediate.c:236 #22 0x00007fbbd9ad7a55 in epoll_event_loop_once (ev=0x5623991699c0, location=<optimized out>) at ../../lib/tevent/tevent_epoll.c:904 #23 0x00007fbbd9ad4f72 in std_event_loop_once (ev=0x5623991699c0, location=0x7fbbd9e09f70 "../../source3/smbd/smb2_process.c:2128") at ../../lib/tevent/tevent_standard.c:110 #24 0x00007fbbd9acf6b7 in _tevent_loop_once (ev=ev@entry=0x5623991699c0, location=location@entry=0x7fbbd9e09f70 "../../source3/smbd/smb2_process.c:2128") at ../../lib/tevent/tevent.c:820 #25 0x00007fbbd9acf905 in tevent_common_loop_wait (ev=0x5623991699c0, location=0x7fbbd9e09f70 "../../source3/smbd/smb2_process.c:2128") at ../../lib/tevent/tevent.c:949 #26 0x00007fbbd9ad4f1c in std_event_loop_wait (ev=0x5623991699c0, location=0x7fbbd9e09f70 "../../source3/smbd/smb2_process.c:2128") at ../../lib/tevent/tevent_standard.c:141 #27 0x00007fbbd9acf965 in _tevent_loop_wait (ev=ev@entry=0x5623991699c0, location=location@entry=0x7fbbd9e09f70 "../../source3/smbd/smb2_process.c:2128") at ../../lib/tevent/tevent.c:968 #28 0x00007fbbd9d44882 in smbd_process (ev_ctx=0x5623991699c0, msg_ctx=<optimized out>, sock_fd=34, interactive=<optimized out>) at ../../source3/smbd/smb2_process.c:2128 #29 0x000056236b6a458b in smbd_accept_connection (ev=0x5623991699c0, fde=<optimized out>, flags=<optimized out>, private_data=<optimized out>) at ../../source3/smbd/server.c:1031 #30 0x00007fbbd9ad0418 in tevent_common_invoke_fd_handler (fde=0x5623991a4410, flags=<optimized out>, removed=removed@entry=0x0) at ../../lib/tevent/tevent_fd.c:174 #31 0x00007fbbd9ad7efc in epoll_event_loop (tvalp=0x7ffd503c0c40, epoll_ev=0x562399169b60) at ../../lib/tevent/tevent_epoll.c:696 #32 epoll_event_loop_once (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent_epoll.c:926 #33 0x00007fbbd9ad4f72 in std_event_loop_once (ev=0x5623991699c0, location=0x56236b6a89f8 "../../source3/smbd/server.c:1373") at ../../lib/tevent/tevent_standard.c:110 #34 0x00007fbbd9acf6b7 in _tevent_loop_once (ev=ev@entry=0x5623991699c0, location=location@entry=0x56236b6a89f8 "../../source3/smbd/server.c:1373") at ../../lib/tevent/tevent.c:820 #35 0x00007fbbd9acf905 in tevent_common_loop_wait (ev=0x5623991699c0, location=0x56236b6a89f8 "../../source3/smbd/server.c:1373") at ../../lib/tevent/tevent.c:949 #36 0x00007fbbd9ad4f1c in std_event_loop_wait (ev=0x5623991699c0, location=0x56236b6a89f8 "../../source3/smbd/server.c:1373") at ../../lib/tevent/tevent_standard.c:141 #37 0x00007fbbd9acf965 in _tevent_loop_wait (ev=<optimized out>, location=<optimized out>) at ../../lib/tevent/tevent.c:968 #38 0x000056236b6a5e4f in smbd_parent_loop (parent=0x562399166460, ev_ctx=0x5623991699c0) at ../../source3/smbd/server.c:1373 #39 main (argc=<optimized out>, argv=<optimized out>) at ../../source3/smbd/server.c:2131
The fixes for bug 15608 fix this, unfortunately those have not been backported yet. I have already done a backport for 4.21, 4.20 is next.
Would you be able to test the backport from bug 15608?
I have applied the backported patches to 4.20.7-SerNet. So far there have been no new crashes.