Just upgraded one of our production file servers to Samba 4.22.3 (with the fix for chown/acl) and got a spat of coredumps yesterday. The stack backtrace looks like this: 5 0x000021159df409bf in smb_panic ( why=why@entry=0x2115954f4e58 "assert failed: (dirfd != -1) || (smb_fname->base_name[0] == '/')") at ../../lib/util/fault.c:209 #6 0x00002115953f8070 in vfswrap_openat (handle=<optimized out>, dirfsp=<optimized out>, smb_fname=0x2115df1c4a80, fsp=0x2115df0ba020, how=0x21159287d2a0) at ../../source3/modules/vfs_default.c:619 #7 0x000021159543941c in smb_vfs_call_openat (handle=<optimized out>, dirfsp=<optimized out>, smb_fname=<optimized out>, fsp=fsp@entry=0x2115df0ba020, how=how@entry=0x21159287d2a0) at ../../source3/smbd/vfs.c:1588 #8 0x00002115e179008e in smb_full_audit_openat (handle=0x2115df0a8e40, dirfsp=<optimized out>, smb_fname=<optimized out>, fsp=0x2115df0ba020, how=0x21159287d2a0) at ../../source3/modules/vfs_full_audit.c:1092 #9 0x000021159543941c in smb_vfs_call_openat (handle=<optimized out>, dirfsp=dirfsp@entry=0x2115df0b9e60, smb_fname=smb_fname@entry=0x2115df1c4a80, fsp=fsp@entry=0x2115df0ba020, how=how@entry=0x21159287d2a0) at ../../source3/smbd/vfs.c:1588 --Type <RET> for more, q to quit, c to continue without paging-- #10 0x00002115e1d03ed1 in streams_xattr_openat (handle=0x2115df0a8f80, dirfsp=0x2115df0b9e60, smb_fname=0x2115df1c4a80, fsp=0x2115df0ba020, how=0x21159287d2a0) at ../../source3/modules/vfs_streams_xattr.c:412 #11 0x000021159543941c in smb_vfs_call_openat (handle=<optimized out>, dirfsp=dirfsp@entry=0x2115df0b9e60, smb_fname=smb_fname@entry=0x2115df1c4a80, fsp=fsp@entry=0x2115df0ba020, how=how@entry=0x21159287d2a0) at ../../source3/smbd/vfs.c:1588 #12 0x00002115e298dc7f in shadow_copy2_openat (handle=0x2115df0a9020, dirfsp=0x2115df0b9e60, smb_fname_in=0x2115df1c4a80, fsp=0x2115df0ba020, _how=<optimized out>) at ../../source3/modules/vfs_shadow_copy2.c:1600 #13 0x000021159543941c in smb_vfs_call_openat (handle=<optimized out>, dirfsp=dirfsp@entry=0x2115df0b9e60, smb_fname=smb_fname@entry=0x2115df1c4a80, fsp=fsp@entry=0x2115df0ba020, how=how@entry=0x21159287d410) at ../../source3/smbd/vfs.c:1588 #14 0x0000211595400875 in smb_vfs_openat_ci (mem_ctx=mem_ctx@entry=0x2115df1c4a80, case_sensitive=true, conn=conn@entry=0x2115df0b6c60, dirfsp=dirfsp@entry=0x2115df0b9e60, smb_fname_rel=smb_fname_rel@entry=0x2115df1c4a80, fsp=0x2115df0ba020, how=0x21159287d410) at ../../source3/smbd/files.c:929 #15 0x0000211595404a80 in openat_pathref_fsp_lcomp (dirfsp=0x2115df0b9e60, smb_fname_rel=smb_fname_rel@entry=0x2115df1c4a80, ucf_flags=ucf_flags@entry=8) at ../../source3/smbd/files.c:1577 #16 0x000021159542336a in filename_convert_dirfsp_nosymlink (mem_ctx=mem_ctx@entry=0x2115df0f1080, conn=conn@entry=0x2115df0b6c60, basedir=basedir@entry=0x2115df0b9ae0, name_in=name_in@entry=0x2115df1c4420 "desktop.ini", ucf_flags=ucf_flags@entry=8, twrp=twrp@entry=0, _dirfsp=<optimized out>, _smb_fname=<optimized out>, _smb_fname_rel=<optimized out>, _symlink_err=<optimized out>) at ../../source3/smbd/filename.c:890 #17 0x000021159542443f in filename_convert_dirfsp_rel (mem_ctx=0x2115df0f1080, conn=conn@entry=0x2115df0b6c60, basedir=basedir@entry=0x2115df0b9ae0, name_in=name_in@entry=0x2115df1c4420 "desktop.ini", ucf_flags=ucf_flags@entry=8, twrp=twrp@entry=0, _dirfsp=0x21159287d6f0, _smb_fname=0x21159287d6f8, _smb_fname_rel=0x21159287d700) at ../../source3/smbd/filename.c:1093 #18 0x00002115954274b8 in fd_openat (dirfsp=dirfsp@entry=0x2115df0b9ae0, smb_fname=smb_fname@entry=0x2115df1c4300, fsp=fsp@entry=0x2115df0b9ca0, _how=_how@entry=0x21159287d790) at ../../source3/smbd/open.c:549 #19 0x0000211595427d0a in fd_open_atomic (file_created=0x21159287da87, _how=0x21159287d920, fsp=0x2115df0b9ca0, smb_fname=0x2115df1c4300, dirfsp=0x2115df0b9ae0) at ../../source3/smbd/open.c:775 #20 reopen_from_fsp (dirfsp=dirfsp@entry=0x2115df0b9ae0, smb_fname=smb_fname@entry=0x2115df1c4300, fsp=fsp@entry=0x2115df0b9ca0, how=how@entry=0x21159287d920, p_file_created=p_file_created@entry=0x21159287da87) at ../../source3/smbd/open.c:933 #21 0x0000211595428230 in open_file (req=req@entry=0x2115df0e29c0, dirfsp=0x2115df0b9ae0, smb_fname_atname=smb_fname_atname@entry=0x2115df1c4300, fsp=fsp@entry=0x2115df0b9ca0, _how=_how@entry=0x21159287dac0, access_mask=1179785, open_access_mask=1179785, private_flags=0, p_file_created=0x21159287da87) at ../../source3/smbd/open.c:1122 #22 0x000021159543009e in open_file_ntcreate (fsp=<optimized out>, pinfo=0x21159287da88, smb_fname_atname=<optimized out>, parent_dir_fname=<optimized out>, private_flags=<optimized out>, lease=<optimized out>, oplock_request=<optimized out>, new_dos_attributes=<optimized out>, create_options=<optimized out>, create_disposition=<optimized out>, share_access=<optimized out>, access_mask=<optimized out>, req=<optimized out>, conn=0x2115df0b6c60) at ../../source3/smbd/open.c:3962 #23 create_file_unixpath (conn=conn@entry=0x2115df0b6c60, req=req@entry=0x2115df0e29c0, dirfsp=<optimized out>, dirfsp@entry=0x2115df0b9ae0, smb_fname=smb_fname@entry=0x2115df0e2ff0, access_mask=access_mask@entry=1179785, share_access=share_access@entry=7, create_disposition=<optimized out>, create_options=<optimized out>, file_attributes=<optimized out>, oplock_request=<optimized out>, lease=<optimized out>, allocation_size=<optimized out>, private_flags=<optimized out>, sd=<optimized out>, ea_list=<optimized out>, result=<optimized out>, pinfo=<optimized out>) at ../../source3/smbd/open.c:6554 #24 0x0000211595431e7d in create_file_default (conn=0x2115df0b6c60, req=0x2115df0e29c0, dirfsp=0x2115df0b9ae0, smb_fname=0x2115df0e2ff0, access_mask=1179785, share_access=7, create_disposition=1, create_options=68, file_attributes=0, oplock_request=2, lease=0x0, allocation_size=0, private_flags=0, sd=0x0, ea_list=0x0, result=0x2115df0e2698, pinfo=0x2115df0e26b0, in_context_blobs=0x21159287e170, out_context_blobs=0x2115df116090) at ../../source3/smbd/open.c:6871 #25 0x00002115953f7f69 in vfswrap_create_file (handle=<optimized out>, req=<optimized out>, dirfsp=<optimized out>, smb_fname=<optimized out>, access_mask=<optimized out>, share_access=<optimized out>, create_disposition=1, create_options=68, file_attributes=0, oplock_request=2, lease=0x0, allocation_size=0, private_flags=0, sd=0x0, ea_list=0x0, result=0x2115df0e2698, pinfo=0x2115df0e26b0, in_context_blobs=0x21159287e170, out_context_blobs=0x2115df116090) at ../../source3/modules/vfs_default.c:736 #26 0x0000211595439500 in smb_vfs_call_create_file (handle=<optimized out>, req=<optimized out>, dirfsp=<optimized out>, smb_fname=smb_fname@entry=0x2115df0e2ff0, access_mask=access_mask@entry=1179785, share_access=<optimized out>, create_disposition=1, create_options=68, file_attributes=0, oplock_request=2, lease=0x0, allocation_size=0, private_flags=0, sd=0x0, ea_list=0x0, result=0x2115df0e2698, pinfo=0x2115df0e26b0, in_context_blobs=0x21159287e170, out_context_blobs=0x2115df116090) at ../../source3/smbd/vfs.c:1616 #27 0x00002115e178ffc5 in smb_full_audit_create_file (handle=0x2115df0a8e40, req=<optimized out>, dirfsp=<optimized out>, smb_fname=0x2115df0e2ff0, access_mask=1179785, share_access=<optimized out>, create_disposition=1, create_options=68, file_attributes=0, oplock_request=2, lease=0x0, allocation_size=0, private_flags=0, sd=0x0, ea_list=0x0, result_fsp=0x2115df0e2698, pinfo=0x2115df0e26b0, in_context_blobs=0x21159287e170, out_context_blobs=0x2115df116090) at ../../source3/modules/vfs_full_audit.c:1147 #28 0x0000211595439500 in smb_vfs_call_create_file (handle=<optimized out>, req=req@entry=0x2115df0e29c0, dirfsp=<optimized out>, smb_fname=<optimized out>, access_mask=access_mask@entry=1179785, share_access=share_access@entry=7, create_disposition=1, create_options=68, file_attributes=0, oplock_request=2, lease=0x0, allocation_size=0, private_flags=0, sd=0x0, ea_list=0x0, result=0x2115df0e2698, pinfo=0x2115df0e26b0, in_context_blobs=0x21159287e170, out_context_blobs=0x2115df116090) at ../../source3/smbd/vfs.c:1616 #29 0x000021159546a1d3 in smbd_smb2_create_send (in_context_blobs=..., in_name=<optimized out>, _in_create_options=<optimized out>, in_create_disposition=<optimized out>, in_share_access=7, in_file_attributes=0, in_desired_access=1179785, in_impersonation_level=2, in_oplock_level=9 '\t', smb2req=0x2115df0e18e0, ev=0x2115df0b6060, mem_ctx=0x2115df0e18e0) at ../../source3/smbd/smb2_create.c:1276 #30 smbd_smb2_request_process_create (smb2req=smb2req@entry=0x2115df0e18e0) at ../../source3/smbd/smb2_create.c:295 #31 0x000021159545e67b in smbd_smb2_request_dispatch (req=req@entry=0x2115df0e18e0) at ../../source3/smbd/smb2_server.c:3521 #32 0x000021159545efa2 in smbd_smb2_advance_incoming (n=<optimized out>, xconn=0x2115df0c3560) at ../../source3/smbd/smb2_server.c:5144 #33 smbd_smb2_io_handler (fde_flags=<optimized out>, xconn=0x2115df0c3560) at ../../source3/smbd/smb2_server.c:5259 #34 smbd_smb2_connection_handler (ev=<optimized out>, fde=<optimized out>, flags=<optimized out>, private_data=<optimized out>) at ../../source3/smbd/smb2_server.c:5289 #35 0x000021159c494710 in tevent_common_invoke_fd_handler (fde=fde@entry=0x2115df135d60, flags=<optimized out>, removed=removed@entry=0x0) at ../../lib/tevent/tevent_fd.c:174 #36 0x000021159c4974c7 in poll_event_loop_poll (tvalp=0x21159287e300, ev=0x2115df0b6060) at ../../lib/tevent/tevent_poll.c:603 #37 poll_event_loop_once (ev=0x2115df0b6060, location=<optimized out>) at ../../lib/tevent/tevent_poll.c:658 #38 0x000021159c493a5d in _tevent_loop_once (ev=ev@entry=0x2115df0b6060, location=location@entry=0x21159550ccf8 "../../source3/smbd/smb2_process.c:2163") at ../../lib/tevent/tevent.c:820 #39 0x000021159c493ca0 in tevent_common_loop_wait (ev=0x2115df0b6060, location=0x21159550ccf8 "../../source3/smbd/smb2_process.c:2163") at ../../lib/tevent/tevent.c:949 #40 0x000021159c493d02 in _tevent_loop_wait (ev=ev@entry=0x2115df0b6060, location=location@entry=0x21159550ccf8 "../../source3/smbd/smb2_process.c:2163") at ../../lib/tevent/tevent.c:968 #41 0x000021159544c738 in smbd_process (ev_ctx=ev_ctx@entry=0x2115df0b6060, msg_ctx=msg_ctx@entry=0x2115df0aa140, sock_fd=sock_fd@entry=32, interactive=interactive@entry=false) at ../../source3/smbd/smb2_process.c:2163 #42 0x0000210d721d64c5 in smbd_accept_connection (ev=0x2115df0b6060, fde=<optimized out>, flags=<optimized out>, private_data=<optimized out>) at ../../source3/smbd/server.c:1039 #43 0x000021159c494710 in tevent_common_invoke_fd_handler (fde=fde@entry=0x2115df135860, flags=<optimized out>, removed=removed@entry=0x0) ... (gdb) frame 6 q f (gdb) print *smb_fname $2 = {base_name = 0x2115df1c4ba0 "desktop.ini", stream_name = 0x0, flags = 1, st = {st_ex_dev = 0, st_ex_ino = 0, st_ex_mode = 0, st_ex_nlink = 0, st_ex_uid = 0, st_ex_gid = 0, st_ex_rdev = 0, st_ex_size = 0, st_ex_atime = {tv_sec = 0, tv_nsec = 0}, st_ex_mtime = { tv_sec = 0, tv_nsec = 0}, st_ex_ctime = {tv_sec = 0, tv_nsec = 0}, st_ex_btime = {tv_sec = 0, tv_nsec = 0}, cached_dos_attributes = 0, st_ex_blksize = 0, st_ex_blocks = 0, st_ex_flags = 0, st_ex_iflags = 0}, twrp = 0, fsp = 0x0, fsp_link = 0x0} (gdb) print *fsp $3 = {next = 0x2115df0b9e60, prev = 0x2115df0b9ae0, fnum = 0, op = 0x0, conn = 0x2115df0b6c60, fh = 0x2115df0a97a0, num_smb_operations = 0, file_id = {devid = 0, inode = 0, extid = 0}, initial_allocation_size = 0, file_pid = 0, vuid = 0, open_time = {tv_sec = 1755690855, tv_usec = 923717}, access_mask = 0, fsp_flags = {is_pathref = true, is_fsa = false, have_proc_fds = false, kernel_share_modes_taken = false, update_write_time_triggered = false, update_write_time_on_close = false, write_time_forced = false, can_lock = false, can_read = false, can_write = false, modified = false, is_directory = false, is_dirfsp = false, aio_write_behind = false, initial_delete_on_close = false, delete_on_close = false, is_sparse = false, backup_intent = false, use_ofd_locks = false, closing = false, lock_failure_seen = false, encryption_required = false, fstat_before_close = false, posix_open = false, posix_append = false}, update_write_time_event = 0x0, close_write_time = {tv_sec = 0, tv_nsec = -2}, oplock_type = 0, leases_db_seqnum = 0, lease_type = 0, lease = 0x0, sent_oplock_break = 0, oplock_timeout = 0x0, current_lock_count = 0, fsp_name = 0x2115df1c4d00, name_hash = 1655811084, mid = 0, vfs_extension = 0x0, fake_file_handle = 0x0, notify = 0x0, base_fsp = 0x0, stream_fsp = 0x0, share_mode_flags_seqnum = 0, share_mode_flags = 0, brlock_seqnum = 0, brlock_rec = 0x0, dptr = 0x0, print_file = 0x0, num_aio_requests = 0, aio_requests = 0x0, blocked_smb1_lock_reqs = 0x0, lock_failure_offset = 0}
(gdb) frame 6 #6 0x00002115953f8070 in vfswrap_openat (handle=<optimized out>, dirfsp=<optimized out>, smb_fname=0x2115df1c4a80, fsp=0x2115df0ba020, how=0x21159287d2a0) at ../../source3/modules/vfs_default.c:619 619 in ../../source3/modules/vfs_default.c (gdb) print dirfd $14 = -1 (gdb) print smb_fname->base_name $15 = 0x2115df1c4ba0 "desktop.ini"
It's a bit strange because it looks like the access was done for a user which doesn't have access to that directory... # getfacl _HU_Integration_old/ # file: _HU_Integration_old/ # owner: <hidden admin user> # group: fillager-nobody group:fillager-admins:rwxpDdaARWcCo-:fd-----:allow (gdb) frame 6 (gdb) print *fsp->conn->session_info->unix_info $4 = {unix_name = 0x2115df137b60 "<hidden normal user>", sanitized_username = 0x2115df137c60 "<hidden normal user>"} The <hidden normal user> is not a member of the group "fillager-admins" so it should never even try to access "_HU_Integration_old/./desktop.ini".
Looks like it's something happening in the zfsacl vfs module. If I disable that one then I don't see any core dumps. One way to force a core is if a Windows user tries to "click" on a folder where the permssions deny access. smbclient: Core dumps doesn't seem to happen if I try to access it via smbclient (with zfsacl enabled) With "zfsacl" enabled I see all folders, even those that I'm not supposed to. Without "zfsacl" enabled I only see folders I have access to.
Ways to reproduce: 1. Create a directory "noaccess" in a folder. 2. Set the permissions of "noaccess" so that the user doesn't have access. 3. Create a file "desktop.ini" inside "noaccess" (ACL doesn't matter but it must exist) 4. Connect to the share with smbclient and try "get noaccess/desktop.ini" To get coredumps of smbd on FreeBSD you need to do this: 1. mkdir /var/cores 2. sysctl 'kern.corefile=/var/cores/%N.%P.core' 3. sysctl 'kern.sugid_coredump=1' ACL I use on noaccess: /export/test # getfacl noaccess # file: noaccess # owner: root # group: nobody owner@:rwxpDdaARWcCos:-------:allow /export/test # ls -ld noaccess drwx------+ 2 root nobody 3 Aug 22 19:21 noaccess smb.conf: bind interfaces only = yes workgroup = GREBO netbios name = KATLA security = user passdb backend = tdbsam vfs objects = zfsacl [test] path = /export/test browsable = yes $ smbclient -W GREBO //katla/test Password for [GREBO\peter]: Try "help" to get a list of possible commands. smb: \> dir . D 0 Thu Aug 21 22:17:07 2025 .. D 0 Thu Aug 21 22:17:07 2025 noaccess D 0 Fri Aug 22 19:21:21 2025 s D 0 Fri May 31 20:03:41 2024 d D 0 Sat Jun 22 16:20:39 2024 1737041884 blocks of size 1024. 1737041748 blocks available smb: \> get noaccess/desktop.ini NT_STATUS_CONNECTION_DISCONNECTED opening remote file \noaccess\desktop.ini smb: \> SMBecho failed (NT_STATUS_CONNECTION_DISCONNECTED). The connection is disconnected now
Samba 4.21.7 seems to work better (no assert-fail-coredump)
Same problem with Samba 4.23.0rc3 - still assert-fails and core dumps if the VFS module "zfsacl" is enabled and a client tries to access a file inside a directory with permissions that denies access to anything inside that directory.
Just to let you know: I've tried to get my normal build environment up and running with Samba master on latest FreeBSD, but I failed miserably after a few hours on my weekend. I would think that once I have this problem under my fingers with a debugger and the ability to rebuild, this should be simple to solve. Any BSD, as worthwhile as it might be to have, is not part of our daily routine, so unfortunately it bit-rots. Because there is nobody with budget behind it to get a FreeBSD runner in Samba's gitlab CI, it will always remain a catch-up game. Sincere apologies, but that's what it is.
Yes, I understand the problem with the normal build testing. Something changed between 4.21.7 and 4.22 that causes this to happen. I've tried reading the new code/changes but so far I've not really found why this happens. There is something that the zfsacl code does that causes the crash later on (the crash doesn't happen inside the zfsacl vfs module, and I've not found any other module that causes it either. And the zfsacl module code seems pretty straightforward too... If someone wants it I've got a "BUILD" script that I normally use to build my Sambas. It downloads, unpacks, applies some patches normally and then builds and installs it. (This bug happens also without my patches) To build Samba 4.19-4.23 I minimally need this patch on my FreeBSD systems: --- samba-4.22.0/lib/util/util_crypt.c.ORIG 2025-04-10 09:40:34.264785000 +0200 +++ samba-4.22.0/lib/util/util_crypt.c 2025-04-10 09:40:51.310543000 +0200 @@ -2,7 +2,9 @@ #include "data_blob.h" #include "discard.h" #include <talloc.h> +#ifdef HAVE_CRYPT_H #include <crypt.h> +#endif #include "util_crypt.h"
No promises, but if you could upload your steps from a plain FreeBSD 14.3 install to a Samba build with debug symbols, it would greatly help. I'm not familiar enough with the FreeBSD ports system so that this would be an easy excercise for me.
Sure thing, here is what works for me to build Samba 4.23.0rc3 in a barebones FreeBSD 14.3 (in a jail): export CC=gcc export MAKE=gmake export CFLAGS=-g export PATH=/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin pkg install -y wget gmake python3 pkgconf bison flex p5-Parse-Yapp libxslt ncurses libarchive icu gcc gdb docbook-xsl libinotify libsunacl gnutls openldap26-client lmdb jansson fam wget wget -N -q --show-progress https://download.samba.org/pub/samba/rc/samba-4.23.0rc3.tar.gz tar zxf samba-4.23.0rc3.tar.gz cd samba-4.23.0rc3 || exit 1 patch -p1 -s </tmp/util_crypt.patch patch -p1 -s </tmp/dev_fds.patch ./configure --sysconfdir=/etc/samba --localstatedir=/var/samba --without-ad-dc --without-gettext --disable-cups --disable-iprint --with-shared-modules=nfs4_acls,vfs_zfsacl,vfs_dfs_samba4 --with-privatedir=/etc/samba/private --with-configdir=/etc/samba --with-logfilebase=/var/samba/logs --enable-debug gmake The patches (it would be great if we could get those into the normal source :-) The "util_crypt.patch": # more util_crypt.c.patch --- samba-4.22.0/lib/util/util_crypt.c.ORIG 2025-04-10 09:40:34.264785000 +0200 +++ samba-4.22.0/lib/util/util_crypt.c 2025-04-10 09:40:51.310543000 +0200 @@ -2,7 +2,9 @@ #include "data_blob.h" #include "discard.h" #include <talloc.h> +#ifdef HAVE_CRYPT_H #include <crypt.h> +#endif #include "util_crypt.h" The "dev_fds.patch" (not strictly necessary, but without it Samba falls back to the non-O_PATH codepath), to use it you also need to mount /var/samba/fd using: "mkdir -p /var/samba/fd ; mount -t fdescfs -o nodup fdesc /var/samba/fd": # more dev_fds.patch --- samba-4.21.3/source3/lib/system.c 2024-07-29 11:03:15.334630500 +0200 +++ samba-4.21.3-proc_fds-fix/source3/lib/system.c 2025-01-10 14:30:05.235895000 +0100 @@ -1067,6 +1067,12 @@ } #endif +#ifdef __FreeBSD__ +#define PATH_PROC_FDS "/var/samba/fd" +#elif __linux__ +#define PATH_PROC_FDS "/proc/self/fd" +#endif + bool sys_have_proc_fds(void) { static bool checked = false; @@ -1078,9 +1084,13 @@ return have_proc_fds; } - ret = stat("/proc/self/fd/0", &sb); +#ifdef PATH_PROC_FDS + ret = stat(PATH_PROC_FDS "/0", &sb); have_proc_fds = (ret == 0); +#else + have_proc_fds = 0; checked = true; +#endif return have_proc_fds; } @@ -1088,7 +1098,11 @@ char *sys_proc_fd_path(int fd, struct sys_proc_fd_path_buf *buf) { int written = - snprintf(buf->buf, sizeof(buf->buf), "/proc/self/fd/%d", fd); +#ifdef PATH_PROC_FDS + snprintf(buf->buf, sizeof(buf->buf), PATH_PROC_FDS "/%d", fd); +#else + -1; +#endif SMB_ASSERT(sys_have_proc_fds() && (written >= 0));
Got it reproduced, and I have a patch that fixes this panic. Running an autobuild now to see what the patch breaks...
Created attachment 18708 [details] Patch Can you try the attached patch?
A quick first test with that patch om 4.23.0rc4 indicates that it works fine. No core dumps atleast... Will do some more testing.
This bug was referenced in samba master: 83ece80ecc2baa52a3caa0ee3b0f954b005b2268 7143caeecc856d3326fdc3eb466ef1f37bc564b5
Created attachment 18714 [details] Patch from master
This bug was referenced in samba master: 1ec54347acac241f900b52c16c2dcba04164e898
Created attachment 18727 [details] patch from master for v4-23-test
Don't we need a backport for v4.22?
Created attachment 18758 [details] patch from master for v4-22-test
Created attachment 18759 [details] patch from master for v4-22-test
Reassigning to Jule for inclusion in 4.22 and 4.23.
Pushed to autobuild-v4-{23,22}-test.
This bug was referenced in samba v4-23-test: 0d94edcb98b4c04e8a56be3ca1fd60f0f89fa505 ecbfd23640bbb56306362b6fac0b511961220cce 15875ce6f0ce377e1d111a8a0c6d3eace246e315
This bug was referenced in samba v4-22-test: fd9de4bd525de4a0934399a42de818f07b616c35 b42548e5f7073f8b08bba8415ba8462ab60ec946 593b3a43369546b95a31e924d51028a894f24171
Closing out bug report. Thanks!
This bug was referenced in samba v4-23-stable (Release samba-4.23.4): 0d94edcb98b4c04e8a56be3ca1fd60f0f89fa505 ecbfd23640bbb56306362b6fac0b511961220cce 15875ce6f0ce377e1d111a8a0c6d3eace246e315
This bug was referenced in samba v4-22-stable (Release samba-4.22.7): fd9de4bd525de4a0934399a42de818f07b616c35 b42548e5f7073f8b08bba8415ba8462ab60ec946 593b3a43369546b95a31e924d51028a894f24171