Bug 15941 - Panic in openat_pathref_fsp_nosymlink -> is_in_path -> mask_match
Summary: Panic in openat_pathref_fsp_nosymlink -> is_in_path -> mask_match
Status: NEW
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: File services (show other bugs)
Version: 4.23.2
Hardware: x64 FreeBSD
: P5 normal (vote)
Target Milestone: ---
Assignee: Samba QA Contact
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-11-03 10:19 UTC by Peter Eriksson
Modified: 2025-11-03 10:19 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Peter Eriksson 2025-11-03 10:19:40 UTC
Just found a core-dump from smbd on one of our servers.

GDB backtrack:
#5  0x000000083202298f in smb_panic (
    why=why@entry=0x8210604d0 "Signal 10: Bus error")
    at ../../lib/util/fault.c:209
#6  0x0000000832022a10 in fault_report (sig=10) at ../../lib/util/fault.c:83
#7  sig_fault (sig=10) at ../../lib/util/fault.c:94
#8  0x0000000846897310 in ?? () from /lib/libthr.so.3
#9  0x00000008468968db in ?? () from /lib/libthr.so.3
#10 <signal handler called>
#11 mask_match (string=string@entry=0x8736307b0 "aneph19", 
    pattern=0x545528766e6f6369 <error: Cannot access memory at address 0x545528766e6f6369>, is_case_sensitive=is_case_sensitive@entry=false)
    at ../../source3/lib/util.c:1397
#12 0x0000000827353265 in is_in_path (name=<optimized out>, 
    namelist=0x87354b5e0, case_sensitive=false) at ../../source3/lib/util.c:793
#13 0x000000082457aa23 in openat_pathref_fsp_nosymlink (
    mem_ctx=mem_ctx@entry=0x873630080, conn=conn@entry=0x8735bcae0, 
    in_dirfsp=in_dirfsp@entry=0x8735bf920, 
--Type <RET> for more, q to quit, c to continue without paging--
    path_in=path_in@entry=0x8736306c0 "aneph19/LokalSynk/Mina Dokument", twrp=twrp@entry=0, posix=posix@entry=true, _smb_fname=0x821061258, _symlink_err=0x821061260)
    at ../../source3/smbd/files.c:1151
#14 0x000000082459a6fe in filename_convert_dirfsp_nosymlink (mem_ctx=mem_ctx@entry=0x873630080, conn=conn@entry=0x8735bcae0, basedir=basedir@entry=0x8735bf920, 
    name_in=name_in@entry=0x873630540 "aneph19/LokalSynk/Mina Dokument/XL-filer", ucf_flags=ucf_flags@entry=8, twrp=twrp@entry=0, _dirfsp=0x8210613c0, 
    _smb_fname=0x8210613c8, _smb_fname_rel=0x8210613d0, _symlink_err=0x821061330) at ../../source3/smbd/filename.c:782
#15 0x000000082459b7d3 in filename_convert_dirfsp_rel (mem_ctx=0x873630080, conn=conn@entry=0x8735bcae0, basedir=basedir@entry=0x8735bf920, 
    name_in=name_in@entry=0x873630540 "aneph19/LokalSynk/Mina Dokument/XL-filer", ucf_flags=ucf_flags@entry=8, twrp=twrp@entry=0, _dirfsp=0x8210613c0, 
    _smb_fname=0x8210613c8, _smb_fname_rel=0x8210613d0) at ../../source3/smbd/filename.c:1097
#16 0x000000082459e7ac in fd_openat (dirfsp=dirfsp@entry=0x8735bf920, smb_fname=smb_fname@entry=0x873630420, fsp=0x8735c2160, _how=_how@entry=0x8210614d0)
    at ../../source3/smbd/open.c:549
#17 0x0000000824579d54 in openat_pathref_fullname (conn=conn@entry=0x8735bcae0, dirfsp=dirfsp@entry=0x8735bf920, full_fname=full_fname@entry=0x8210614c8, 
    smb_fname=smb_fname@entry=0x873630420, how=how@entry=0x8210614d0) at ../../source3/smbd/files.c:435
#18 0x000000082457ced9 in openat_pathref_fsp (dirfsp=dirfsp@entry=0x8735bf920, smb_fname=0x873630420) at ../../source3/smbd/files.c:543
#19 0x000000082457d242 in parent_pathref (mem_ctx=<optimized out>, dirfsp=dirfsp@entry=0x8735bf920, smb_fname=smb_fname@entry=0x8735ca480, 
    _parent=_parent@entry=0x8210615f8, _atname=_atname@entry=0x821061600) at ../../source3/smbd/files.c:1923
#20 0x00000008245ab315 in close_remove_share_mode (close_type=SHUTDOWN_CLOSE, fsp=0x8735c1360) at ../../source3/smbd/close.c:586
#21 close_normal_file (close_type=SHUTDOWN_CLOSE, fsp=0x8735c1360, req=0x0) at ../../source3/smbd/close.c:937
#22 close_file_smb (req=req@entry=0x0, fsp=fsp@entry=0x8735c1360, close_type=close_type@entry=SHUTDOWN_CLOSE) at ../../source3/smbd/close.c:1419
#23 0x00000008245a9f2d in close_file_free (req=req@entry=0x0, _fsp=_fsp@entry=0x821061828, close_type=close_type@entry=SHUTDOWN_CLOSE)
    at ../../source3/smbd/close.c:1454
#24 0x000000082457d6cc in close_file_in_loop (fsp=<optimized out>, close_type=close_type@entry=SHUTDOWN_CLOSE) at ../../source3/smbd/files.c:1983
#25 0x000000082457d74e in file_close_user_fn (fsp=<optimized out>, private_data=0x8210618a0) at ../../source3/smbd/files.c:2112
#26 0x0000000824578380 in files_forall (sconn=sconn@entry=0x8735b7060, fn=fn@entry=0x82457d729 <file_close_user_fn>, private_data=private_data@entry=0x8210618a0)
    at ../../source3/smbd/files.c:2148
#27 0x00000008245784b5 in file_close_user (sconn=sconn@entry=0x8735b7060, vuid=<optimized out>) at ../../source3/smbd/files.c:2124
#28 0x00000008245fb82d in smbXsrv_session_logoff (session=session@entry=0x8735b1800) at ../../source3/smbd/smbXsrv_session.c:1893



(gdb) frame 11
#11 mask_match (string=string@entry=0x8736307b0 "aneph19", pattern=0x545528766e6f6369 <error: Cannot access memory at address 0x545528766e6f6369>, 
    is_case_sensitive=is_case_sensitive@entry=false) at ../../source3/lib/util.c:1397
(gdb) print string
$1 = 0x8736307b0 "aneph19"
(gdb) print pattern
$2 = 0x545528766e6f6369 <error: Cannot access memory at address 0x545528766e6f6369>


(gdb) frame 12
#12 0x0000000827353265 in is_in_path (name=<optimized out>, namelist=0x87354b5e0, case_sensitive=false) at ../../source3/lib/util.c:793
793	in ../../source3/lib/util.c
(gdb) print *namelist
$5 = {name = 0x545528766e6f6369 <error: Cannot access memory at address 0x545528766e6f6369>, is_wild = 70}


(gdb) frame 13
#13 0x000000082457aa23 in openat_pathref_fsp_nosymlink (mem_ctx=mem_ctx@entry=0x873630080, conn=conn@entry=0x8735bcae0, in_dirfsp=in_dirfsp@entry=0x8735bf920, 
    path_in=path_in@entry=0x8736306c0 "aneph19/LokalSynk/Mina Dokument", twrp=twrp@entry=0, posix=posix@entry=true, _smb_fname=0x821061258, _symlink_err=0x821061260)
    at ../../source3/smbd/files.c:1151

The source code at line 11 in files.c:

               /* Check veto files. */
                if (IS_VETO_PATH(conn, rel_fname.base_name)) {
                        DBG_DEBUG("%s contains veto files path component %s\n",
                                  path_in, rel_fname.base_name);
                        status = NT_STATUS_OBJECT_PATH_NOT_FOUND;
                        goto fail;
		}


smb.conf contains this regarding veto files:

   veto files = /.zfs/