# smbd crash (memory corruption) in mask_match() during SHUTDOWN_CLOSE of a delete-on-close file at session logoff ## Summary `smbd` crashes with SIGSEGV during session logoff while closing a file that has delete-on-close set (`close_type = SHUTDOWN_CLOSE`, `delete_object = true`). The crash happens in `mask_match()` because the `pattern` argument is a corrupted pointer. The corrupted value decodes to an ASCII string, which strongly suggests memory corruption / use-after-free upstream of the veto/hide path-matching code rather than a NULL dereference. The crash is independent of `veto files` configuration: it reproduces both on a share that has a global `veto files` list and on a share where `veto files` is explicitly cleared. It occurs at logoff, not during normal file access. ## Version - Samba 4.22.8 (Debian package `2:4.22.8+dfsg-0+deb13u2`) - OS: Debian 13 (trixie), x86_64 - smbd started as: `/usr/sbin/smbd --foreground --no-process-group` ## Relevant smb.conf settings ``` kernel oplocks = no smb2 leases = no delete veto files = no veto files = /*.ext1/*.ext2/.../*.extN/ (global list) # on some shares: veto files = (explicitly emptied to disable the global list) ``` vfs objects in use on the affected share(s): ``` vfs objects = full_audit recycle acl_xattr ``` ## Crash signature ``` INTERNAL ERROR: Signal 11: Segmentation fault in smbd (4.22.8-Debian-4.22.8+dfsg-0+deb13u2) ``` ## Faulting frame (with debug symbols) The immediate fault is a bad `pattern` pointer passed to `mask_match()`: ``` #10 mask_match (string=string@entry=<ptr> "AA", pattern=<INVALID_PTR> <error: Cannot access memory at address <INVALID_PTR>>, is_case_sensitive=false) at source3/lib/util.c:1397 ``` The invalid `pattern` pointer value decodes as ASCII (little-endian) to a printable string. This indicates the pattern-list entry (or a neighbouring structure) has been overwritten, i.e. memory corruption, rather than a plain NULL/uninitialised pointer. The caller passes a valid-looking namelist, and `name`/`string` is valid: ``` #11 is_in_path (name=<optimized out>, namelist=<ptr>, case_sensitive=false) at source3/lib/util.c:793 ``` ## Context of the close The file being closed is a file open at logoff with delete-on-close active: ``` #12 openat_pathref_fsp_nosymlink (conn=<ptr>, in_dirfsp=<ptr>, path_in=<ptr> "<dir>", twrp=0, posix=true, ...) at source3/smbd/files.c:1150 #13 filename_convert_dirfsp_nosymlink (conn=<ptr>, basedir=<ptr>, name_in=<ptr> "<dir>/<subdir>", ucf_flags=8, twrp=0, ...) at source3/smbd/filename.c:768 #18 parent_pathref (dirfsp=<ptr>, smb_fname=<ptr>, ...) at source3/smbd/files.c:1922 #19 close_remove_share_mode (fsp=<ptr>, close_type=SHUTDOWN_CLOSE) at source3/smbd/close.c:618 delete_object = true reset_delete_on_close = false got_tokens = true del_token = <ptr> del_nt_token = <ptr> #20 close_normal_file (req=0x0, fsp=<ptr>, close_type=SHUTDOWN_CLOSE) at source3/smbd/close.c:1000 #21 close_file_smb (req=0x0, fsp=<ptr>, close_type=SHUTDOWN_CLOSE) at source3/smbd/close.c:1499 #24-27 file_close_user_fn / files_forall / file_close_user at source3/smbd/files.c #28 smbXsrv_session_logoff (session=<ptr>) at source3/smbd/smbXsrv_session.c:1892 #29 smbXsrv_session_remove_channel_done (subreq=...) at source3/smbd/smbXsrv_session.c:1726 ``` ## Full backtrace ``` Script started on 2026-07-03 11:45:02+02:00 [TERM="tmux-256color" TTY="/dev/pts/0" COLUMNS="211" LINES="56"] # coredumpctl gdb 1900245 coredumpctl gdb 1900245 PID: 1900245 (smbd[xx.x.xx.xx) UID: 0 (root) GID: 0 (root) Signal: 6 (ABRT) Timestamp: Fri 2026-07-03 11:16:35 CEST (28min ago) Command Line: $'smbd: client [xx.x.xx.xxx]' Executable: /usr/sbin/smbd Control Group: /system.slice/smbd.service Unit: smbd.service Slice: system.slice Boot ID: fe592ce253fb487a988e5e3465e9fc82 Machine ID: 2c5b41cf3e12437ea4f07dd78ec6cbb8 Hostname: xxx Storage: /var/lib/systemd/coredump/core.smbd[10\x2e0\x2e41\x2e21.0.fe592ce253fb487a988e5e3465e9fc82.1900245.1783070195000000.zst (present) Size on Disk: 2.8M Message: Process 1900245 (smbd[xx.x.xx.xx) of user 0 dumped core. Module libnss_systemd.so.2 from deb systemd-257.13-1~deb13u1.amd64 Module libzstd.so.1 from deb libzstd-1.5.7+dfsg-1.amd64 Module libgcc_s.so.1 from deb gcc-14-14.2.0-19.amd64 Module libstdc++.so.6 from deb gcc-14-14.2.0-19.amd64 Module libsystemd.so.0 from deb systemd-257.13-1~deb13u1.amd64 Stack trace of thread 1900245: #0 0x00007fecb607f95c __pthread_kill_implementation (libc.so.6 + 0x9495c) #1 0x00007fecb602acc2 __GI_raise (libc.so.6 + 0x3fcc2) #2 0x00007fecb60134ac __GI_abort (libc.so.6 + 0x284ac) #3 0x00007fecb656e894 dump_core (libsmbconf.so.0 + 0x5a894) #4 0x00007fecb6564224 smb_panic_s3 (libsmbconf.so.0 + 0x50224) #5 0x00007fecb623486e smb_panic (libgenrand-private-samba.so.0 + 0x286e) #6 0x00007fecb62348f5 n/a (libgenrand-private-samba.so.0 + 0x28f5) #7 0x00007fecb602adf0 __restore_rt (libc.so.6 + 0x3fdf0) #8 0x00007fecb65650bf mask_match (libsmbconf.so.0 + 0x510bf) #9 0x00007fecb65651b9 is_in_path (libsmbconf.so.0 + 0x511b9) #10 0x00007fecb663685b openat_pathref_fsp_nosymlink (libsmbd-base-private-samba.so.0 + 0x5a85b) #11 0x00007fecb665678a filename_convert_dirfsp_nosymlink (libsmbd-base-private-samba.so.0 + 0x7a78a) #12 0x00007fecb6657349 filename_convert_dirfsp_rel (libsmbd-base-private-samba.so.0 + 0x7b349) #13 0x00007fecb665a6d7 fd_openat (libsmbd-base-private-samba.so.0 + 0x7e6d7) #14 0x00007fecb663607c n/a (libsmbd-base-private-samba.so.0 + 0x5a07c) #15 0x00007fecb6639171 openat_pathref_fsp (libsmbd-base-private-samba.so.0 + 0x5d171) #16 0x00007fecb6639503 parent_pathref (libsmbd-base-private-samba.so.0 + 0x5d503) #17 0x00007fecb66667b6 close_file_smb (libsmbd-base-private-samba.so.0 + 0x8a7b6) #18 0x00007fecb666607f close_file_free (libsmbd-base-private-samba.so.0 + 0x8a07f) #19 0x00007fecb663986e n/a (libsmbd-base-private-samba.so.0 + 0x5d86e) #20 0x00007fecb66399fe n/a (libsmbd-base-private-samba.so.0 + 0x5d9fe) #21 0x00007fecb6634681 files_forall (libsmbd-base-private-samba.so.0 + 0x58681) #22 0x00007fecb66347bc file_close_user (libsmbd-base-private-samba.so.0 + 0x587bc) #23 0x00007fecb66b7441 smbXsrv_session_logoff (libsmbd-base-private-samba.so.0 + 0xdb441) #24 0x00007fecb66b7969 n/a (libsmbd-base-private-samba.so.0 + 0xdb969) #25 0x00007fecb63a2d9e tevent_common_invoke_immediate_handler (libtevent.so.0 + 0x8d9e) #26 0x00007fecb63a2dfa tevent_common_loop_immediate (libtevent.so.0 + 0x8dfa) #27 0x00007fecb63a975d n/a (libtevent.so.0 + 0xf75d) #28 0x00007fecb63a748b n/a (libtevent.so.0 + 0xd48b) #29 0x00007fecb63a1953 _tevent_loop_once (libtevent.so.0 + 0x7953) #30 0x00007fecb63a1c4b tevent_common_loop_wait (libtevent.so.0 + 0x7c4b) #31 0x00007fecb63a741b n/a (libtevent.so.0 + 0xd41b) #32 0x00007fecb6680a25 smbd_process (libsmbd-base-private-samba.so.0 + 0xa4a25) #33 0x000055cbcb723217 n/a (/usr/sbin/smbd + 0xb217) #34 0x00007fecb63a2815 tevent_common_invoke_fd_handler (libtevent.so.0 + 0x8815) #35 0x00007fecb63a9a56 n/a (libtevent.so.0 + 0xfa56) #36 0x00007fecb63a748b n/a (libtevent.so.0 + 0xd48b) #37 0x00007fecb63a1953 _tevent_loop_once (libtevent.so.0 + 0x7953) #38 0x00007fecb63a1c4b tevent_common_loop_wait (libtevent.so.0 + 0x7c4b) #39 0x00007fecb63a741b n/a (libtevent.so.0 + 0xd41b) #40 0x000055cbcb72035a main (/usr/sbin/smbd + 0x835a) #41 0x00007fecb6014ca8 __libc_start_call_main (libc.so.6 + 0x29ca8) #42 0x00007fecb6014d65 __libc_start_main_impl (libc.so.6 + 0x29d65) #43 0x000055cbcb720e61 _start (/usr/sbin/smbd + 0x8e61) ELF object binary architecture: AMD x86-64 GNU gdb (Debian 16.3-1) 16.3 Copyright (C) 2024 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <https://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from /usr/sbin/smbd... (No debugging symbols found in /usr/sbin/smbd) [New LWP 1900245] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Core was generated by `/usr/sbin/smbd --foreground --no-process-group'. Program terminated with signal SIGABRT, Aborted. #0 __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44 warning: 44 ./nptl/pthread_kill.c: File o directory non esistente (gdb) bt full #0 __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44 tid = <optimized out> ret = 0 pd = <optimized out> old_mask = {__val = {0}} ret = <optimized out> #1 0x00007fecb607f9ff in __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89 No locals. #2 0x00007fecb602acc2 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 ret = <optimized out> #3 0x00007fecb60134ac in __GI_abort () at ./stdlib/abort.c:77 act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0, 20, 140654598949472, 140654644881344, 140654643492073, 20, 10, 140731987220752, 140654644860049, 140654644881024, 6, 140731987220672, 140731987220720, 0, 335544320, 140654642638320}}, sa_flags = 353589760, sa_restorer = 0x290c} #4 0x00007fecb656e894 in dump_core () at source3/lib/dumpcore.c:339 called = true __FUNCTION__ = "dump_core" #5 0x00007fecb6564224 in smb_panic_s3 (why=<optimized out>) at source3/lib/util.c:730 No locals. #6 0x00007fecb623486e in smb_panic (why=why@entry=0x7ffeb81b5a90 "Signal 11: Errore di segmentazione") at lib/util/fault.c:209 No locals. #7 0x00007fecb62348f5 in fault_report (sig=11) at lib/util/fault.c:83 signal_string = "Signal 11: Errore di segmentazione\000\000\000\000\000\000\350\212\335\000\000\000\000\000\020\352\306\a\314U\000\000\220\360\263\a\314U\000\000\2602\353\265\354\177\000\000\220\360\263\a\314U\000\000\000\000\000\000\000\000\000\000h\246\a\266\354\177\000\000\b\016h\263\354\177\000\000\000\000\000\000\000\000\000\000\300\224\320\a\314U\000\000h\246\a\266\354\177\000" counter = 1 signal_string = <optimized out> #8 sig_fault (sig=11) at lib/util/fault.c:94 No locals. #9 <signal handler called> No locals. #10 mask_match (string=string@entry=0x55cc07cfd410 "xx", pattern=0x7974697275636553 <error: Cannot access memory at address 0x7974697275636553>, is_case_sensitive=is_case_sensitive@entry=false) at source3/lib/util.c:1397 No locals. #11 0x00007fecb65651b9 in is_in_path (name=<optimized out>, namelist=0x55cc07c989b0, case_sensitive=false) at source3/lib/util.c:793 last_component = <optimized out> __FUNCTION__ = "is_in_path" #12 0x00007fecb663685b in openat_pathref_fsp_nosymlink (mem_ctx=mem_ctx@entry=0x55cc07ce7cd0, conn=conn@entry=0x55cc07c92a80, in_dirfsp=in_dirfsp@entry=0x55cc07ab3fd0, path_in=path_in@entry=0x55cc07cad520 "xx/xxxx", twrp=twrp@entry=0, posix=posix@entry=true, _smb_fname=0x7ffeb81b62b8, _symlink_err=0x7ffeb81b62c0) at source3/smbd/files.c:1150 dirfsp = 0x55cc07ab3fd0 full_fname = {base_name = 0x55cc07bc73c0 "", stream_name = 0x0, flags = 1, st = {st_ex_dev = 0, st_ex_ino = 0, st_ex_mode = 0, st_ex_nlink = 0, st_ex_uid = 0, st_ex_gid = 0, st_ex_rdev = 0, st_ex_size = 0, st_ex_atime = {tv_sec = 0, tv_nsec = 0}, st_ex_mtime = {tv_sec = 0, tv_nsec = 0}, st_ex_ctime = {tv_sec = 0, tv_nsec = 0}, st_ex_btime = {tv_sec = 0, tv_nsec = 0}, cached_dos_attributes = 0, st_ex_blksize = 0, st_ex_blocks = 0, st_ex_flags = 0, st_ex_iflags = 0}, twrp = 0, fsp = 0x0, fsp_link = 0x0} rel_fname = {base_name = 0x55cc07cfd410 "xx", stream_name = 0x0, flags = 1, st = {st_ex_dev = 0, st_ex_ino = 0, st_ex_mode = 0, st_ex_nlink = 0, st_ex_uid = 0, st_ex_gid = 0, st_ex_rdev = 0, st_ex_size = 0, st_ex_atime = {tv_sec = 0, tv_nsec = 0}, st_ex_mtime = {tv_sec = 0, tv_nsec = 0}, st_ex_ctime = {tv_sec = 0, tv_nsec = 0}, st_ex_btime = {tv_sec = 0, tv_nsec = 0}, cached_dos_attributes = 0, st_ex_blksize = 0, st_ex_blocks = 0, st_ex_flags = 0, st_ex_iflags = 0}, twrp = 0, fsp = 0x0, fsp_link = 0x0} result = 0x0 symlink_err = 0x0 fsp = 0x55cc07cced70 path = 0x55cc07cfd410 "xx" next = 0x55cc07cfd413 "2026" ok = <optimized out> is_toplevel = <optimized out> fd = <optimized out> status = <optimized out> how = {flags = 2230272, mode = 0, resolve = 0} __func__ = "openat_pathref_fsp_nosymlink" --Type <RET> for more, q to quit, c to continue without paging--c nomem = <optimized out> __FUNCTION__ = "openat_pathref_fsp_nosymlink" #13 0x00007fecb665678a in filename_convert_dirfsp_nosymlink (mem_ctx=mem_ctx@entry=0x55cc07ce7cd0, conn=conn@entry=0x55cc07c92a80, basedir=basedir@entry=0x55cc07ab3fd0, name_in=name_in@entry=0x55cc07cf3160 "xx/xxxx/xx xxxxxx", ucf_flags=ucf_flags@entry=8, twrp=twrp@entry=0, _dirfsp=0x7ffeb81b6400, _smb_fname=0x7ffeb81b6408, _smb_fname_rel=0x7ffeb81b6410, _symlink_err=0x7ffeb81b6380) at source3/smbd/filename.c:768 smb_dirname = 0x0 smb_fname_rel = 0x0 smb_fname = 0x0 symlink_err = 0x0 posix = true dirname = <optimized out> fname_rel = <optimized out> streamname = <optimized out> saved_streamname = 0x0 base_fsp = 0x0 ok = <optimized out> status = {v = 0} __FUNCTION__ = "filename_convert_dirfsp_nosymlink" fail = <optimized out> __func__ = "filename_convert_dirfsp_nosymlink" #14 0x00007fecb6657349 in filename_convert_dirfsp_rel (mem_ctx=0x55cc07ce7cd0, conn=conn@entry=0x55cc07c92a80, basedir=basedir@entry=0x55cc07ab3fd0, name_in=name_in@entry=0x55cc07cf3160 "xx/xxxx/xx xxxxxx", ucf_flags=ucf_flags@entry=8, twrp=twrp@entry=0, _dirfsp=0x7ffeb81b6400, _smb_fname=0x7ffeb81b6408, _smb_fname_rel=0x7ffeb81b6410) at source3/smbd/filename.c:1083 symlink_err = 0x0 lnk = <optimized out> status = <optimized out> target = 0x0 base_name = 0x0 safe_target = 0x0 symlink_redirects = <optimized out> ret = <optimized out> #15 0x00007fecb665a6d7 in fd_openat (dirfsp=dirfsp@entry=0x55cc07ab3fd0, smb_fname=smb_fname@entry=0x55cc07cf3030, fsp=0x55cc07cd5080, _how=_how@entry=0x7ffeb81b6500) at source3/smbd/open.c:549 how = {flags = 133120, mode = 0, resolve = 0} conn = 0x55cc07c92a80 status = <optimized out> fsp_is_stream = <optimized out> smb_fname_is_stream = <optimized out> dirfsp_conv = 0x0 smb_fname_conv = 0x0 smb_fname_rel = 0x0 root_fsp = 0x0 name_in = 0x55cc07cf3160 "xx/xxxx/xx xxxxxx" fd = <optimized out> __FUNCTION__ = "fd_openat" done = <optimized out> __func__ = "fd_openat" #16 0x00007fecb663607c in openat_pathref_fullname (conn=conn@entry=0x55cc07c92a80, dirfsp=dirfsp@entry=0x55cc07ab3fd0, full_fname=full_fname@entry=0x7ffeb81b64f8, smb_fname=smb_fname@entry=0x55cc07cf3030, how=how@entry=0x7ffeb81b6500) at source3/smbd/files.c:434 fsp = 0x55cc07cd5080 status = {v = 0} __func__ = "openat_pathref_fullname" __FUNCTION__ = "openat_pathref_fullname" #17 0x00007fecb6639171 in openat_pathref_fsp (dirfsp=dirfsp@entry=0x55cc07ab3fd0, smb_fname=0x55cc07cf3030) at source3/smbd/files.c:542 conn = 0x55cc07c92a80 full_fname = 0x0 base_fname = 0x0 how = {flags = 2048, mode = 0, resolve = 0} status = <optimized out> __func__ = "openat_pathref_fsp" #18 0x00007fecb6639503 in parent_pathref (mem_ctx=<optimized out>, dirfsp=dirfsp@entry=0x55cc07ab3fd0, smb_fname=smb_fname@entry=0x55cc07cbf830, _parent=_parent@entry=0x7ffeb81b6628, _atname=_atname@entry=0x7ffeb81b6630) at source3/smbd/files.c:1922 parent = 0x55cc07cf3030 atname = 0x55cc07a89cf0 status = {v = 0} #19 0x00007fecb66667b6 in close_remove_share_mode (fsp=0x55cc07cd1a20, close_type=SHUTDOWN_CLOSE) at source3/smbd/close.c:618 conn = 0x55cc07c92a80 parent_fname = 0x0 base_fname = 0x0 lck_state = {prepare_state = {__fid = {devid = 2064, inode = 16808651812, extid = 0}, __lck_ptr = 0x7ffeb81b67d0, { __u8_space = "\020\b\000\000\000\000\000\000$\254\337\351\003", '\000' <repeats 11 times>, "Pl\274\a\314U\000"}}, object_type = 0x7fecb6731417 "file", fsp = 0x55cc07cd1a20, close_type = SHUTDOWN_CLOSE, delete_object = true, got_tokens = true, parent_lease_key = {data = {673, 140654644366768}}, del_token = 0x55cc07cb3cf0, del_nt_token = 0x55cc07cd22c0, reset_delete_on_close = false, cleanup_fn = 0x7fecb6665400 <close_share_mode_lock_cleanup>} status = <optimized out> tmp_status = <optimized out> id = {devid = 2064, inode = 16808651812, extid = 0} ret = <optimized out> changed_user = true ulstatus = <optimized out> conn = <optimized out> lck_state = <optimized out> changed_user = <optimized out> status = <optimized out> tmp_status = <optimized out> ulstatus = <optimized out> id = <optimized out> parent_fname = <optimized out> base_fname = <optimized out> ret = <optimized out> __func__ = "close_remove_share_mode" done = <optimized out> __FUNCTION__ = "close_remove_share_mode" ftmp1 = <optimized out> ftmp2 = <optimized out> lease = <optimized out> #20 close_normal_file (req=0x0, fsp=0x55cc07cd1a20, close_type=SHUTDOWN_CLOSE) at source3/smbd/close.c:1000 status = {v = 0} tmp = <optimized out> conn = <optimized out> is_durable = <optimized out> status = <optimized out> tmp = <optimized out> conn = <optimized out> is_durable = <optimized out> __FUNCTION__ = "close_normal_file" new_cookie = <optimized out> tv = <optimized out> now = <optimized out> #21 close_file_smb (req=req@entry=0x0, fsp=fsp@entry=0x55cc07cd1a20, close_type=close_type@entry=SHUTDOWN_CLOSE) at source3/smbd/close.c:1499 status = <optimized out> __FUNCTION__ = "close_file_smb" __func__ = "close_file_smb" #22 0x00007fecb666607f in close_file_free (req=req@entry=0x0, _fsp=_fsp@entry=0x7ffeb81b68b8, close_type=close_type@entry=SHUTDOWN_CLOSE) at source3/smbd/close.c:1534 fsp = 0x55cc07cd1a20 status = <optimized out> #23 0x00007fecb663986e in close_file_in_loop (fsp=<optimized out>, close_type=close_type@entry=SHUTDOWN_CLOSE) at source3/smbd/files.c:1982 __FUNCTION__ = "close_file_in_loop" #24 0x00007fecb66399fe in file_close_user_fn (fsp=<optimized out>, private_data=0x7ffeb81b6900) at source3/smbd/files.c:2111 state = <optimized out> did_close = <optimized out> #25 file_close_user_fn (fsp=<optimized out>, private_data=0x7ffeb81b6900) at source3/smbd/files.c:2100 state = 0x7ffeb81b6900 did_close = <optimized out> #26 0x00007fecb6634681 in files_forall (sconn=sconn@entry=0x55cc07c80780, fn=fn@entry=0x7fecb66399e0 <file_close_user_fn>, private_data=private_data@entry=0x7ffeb81b6900) at source3/smbd/files.c:2147 ret = <optimized out> fsp = <optimized out> next = 0x0 #27 0x00007fecb66347bc in file_close_user (sconn=sconn@entry=0x55cc07c80780, vuid=<optimized out>) at source3/smbd/files.c:2123 state = {vuid = 3584376335, fsp_left_behind = false} __FUNCTION__ = "file_close_user" #28 0x00007fecb66b7441 in smbXsrv_session_logoff (session=session@entry=0x55cc07c84120) at source3/smbd/smbXsrv_session.c:1892 table = 0x55cc07c91cb0 local_rec = 0x0 global_rec = 0x0 sconn = 0x55cc07c80780 status = <optimized out> error = {v = 0} __func__ = "smbXsrv_session_logoff" #29 0x00007fecb66b7969 in smbXsrv_session_remove_channel_done (subreq=<optimized out>) at source3/smbd/smbXsrv_session.c:1726 session = 0x55cc07c84120 status = {v = 0} __func__ = "smbXsrv_session_remove_channel_done" #30 0x00007fecb63a2d9e in tevent_common_invoke_immediate_handler () from /lib/x86_64-linux-gnu/libtevent.so.0 No symbol table info available. #31 0x00007fecb63a2dfa in tevent_common_loop_immediate () from /lib/x86_64-linux-gnu/libtevent.so.0 No symbol table info available. #32 0x00007fecb63a975d in ?? () from /lib/x86_64-linux-gnu/libtevent.so.0 No symbol table info available. #33 0x00007fecb63a748b in ?? () from /lib/x86_64-linux-gnu/libtevent.so.0 No symbol table info available. #34 0x00007fecb63a1953 in _tevent_loop_once () from /lib/x86_64-linux-gnu/libtevent.so.0 No symbol table info available. #35 0x00007fecb63a1c4b in tevent_common_loop_wait () from /lib/x86_64-linux-gnu/libtevent.so.0 No symbol table info available. #36 0x00007fecb63a741b in ?? () from /lib/x86_64-linux-gnu/libtevent.so.0 No symbol table info available. #37 0x00007fecb6680a25 in smbd_process (ev_ctx=0x55cc07a869a0, msg_ctx=<optimized out>, sock_fd=35, interactive=<optimized out>) at source3/smbd/smb2_process.c:2163 lp_sub = 0x7fecb65a4e50 <s3_global_substitution> client = 0x55cc07c88fb0 sconn = 0x55cc07c80780 xconn = 0x55cc07ad98d0 locaddr = <optimized out> remaddr = <optimized out> ret = <optimized out> status = <optimized out> tv = {tv_sec = 1783035094, tv_usec = 752544} trace_state = {ev = 0x55cc07a869a0, frame = 0x55cc07ce7cd0, profile_idle = {start = 0, stats = 0x0}, before_wait_tv = {tv_sec = 1783035094, tv_usec = 752544}, after_wait_tv = {tv_sec = 1783035094, tv_usec = 752544}} debug = false now = <optimized out> chroot_dir = <optimized out> rc = <optimized out> __func__ = "smbd_process" __FUNCTION__ = "smbd_process" #38 0x000055cbcb723217 in ?? () No symbol table info available. #39 0x00007fecb63a2815 in tevent_common_invoke_fd_handler () from /lib/x86_64-linux-gnu/libtevent.so.0 No symbol table info available. #40 0x00007fecb63a9a56 in ?? () from /lib/x86_64-linux-gnu/libtevent.so.0 No symbol table info available. #41 0x00007fecb63a748b in ?? () from /lib/x86_64-linux-gnu/libtevent.so.0 No symbol table info available. #42 0x00007fecb63a1953 in _tevent_loop_once () from /lib/x86_64-linux-gnu/libtevent.so.0 No symbol table info available. #43 0x00007fecb63a1c4b in tevent_common_loop_wait () from /lib/x86_64-linux-gnu/libtevent.so.0 No symbol table info available. #44 0x00007fecb63a741b in ?? () from /lib/x86_64-linux-gnu/libtevent.so.0 No symbol table info available. #45 0x000055cbcb72035a in main () No symbol table info available. (gdb) frame 9 #9 <signal handler called> (gdb) info locals No locals. (gdb) info args info args No symbol table info available. (gdb) info locals info locals No locals. (gdb) frame 10 frame 10 #10 mask_match (string=string@entry=0x55cc07cfd410 "xx", pattern=0x7974697275636553 <error: Cannot access memory at address 0x7974697275636553>, is_case_sensitive=is_case_sensitive@entry=false) at source3/lib/util.c:1397 warning: 1397 source3/lib/util.c: File o directory non esistente (gdb) info args info args string = 0x55cc07cfd410 "xx" pattern = 0x7974697275636553 <error: Cannot access memory at address 0x7974697275636553> is_case_sensitive = false (gdb) info args frame 10 1 #11 0x00007fecb65651b9 in is_in_path (name=<optimized out>, namelist=0x55cc07c989b0, case_sensitive=false) at source3/lib/util.c:793 793 in source3/lib/util.c (gdb) info args name = <optimized out> namelist = 0x55cc07c989b0 case_sensitive = false (gdb) infol locals last_component = <optimized out> __FUNCTION__ = "is_in_path" (gdb) quit Script done on 2026-07-03 11:48:19+02:00 [COMMAND_EXIT_CODE="0"] ``` ## Reproduction The crash occurs at client session logoff/disconnect while a delete-on-close file is still open. It has been observed on two different clients and on two shares with opposite `veto files` configuration (one with the global list active, one with it explicitly emptied), producing an identical stack. Frequency: Three times a day Client type(s): SMB3_11 ## Notes - Independent of `veto files`, `kernel oplocks`, `smb2 leases`. - The corrupted `pattern` pointer decodes to a printable ASCII string, which suggests the corruption may originate near security-descriptor / NT ACL / xattr handling during the delete-on-close path (possibly in interaction with a VFS module such as acl_xattr / streams_xattr / full_audit - see vfs objects above). - Core dump available and can be provided (~2.8 MB, .zst). Debug symbols from Debian debuginfod / dbgsym packages were used to produce the backtrace above.