Bug 16158 - smbd crash (memory corruption) in mask_match() during SHUTDOWN_CLOSE of a delete-on-close file at session logoff
Summary: smbd crash (memory corruption) in mask_match() during SHUTDOWN_CLOSE of a del...
Status: NEW
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: File services (show other bugs)
Version: 4.22.8
Hardware: x64 Linux
: P5 major (vote)
Target Milestone: ---
Assignee: Samba QA Contact
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-07-05 18:42 UTC by Luca Leprini
Modified: 2026-07-05 18:42 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Luca Leprini 2026-07-05 18:42:10 UTC
# smbd crash (memory corruption) in mask_match() during SHUTDOWN_CLOSE
of a delete-on-close file at session logoff

## Summary

`smbd` crashes with SIGSEGV during session logoff while closing a file that has
delete-on-close set (`close_type = SHUTDOWN_CLOSE`, `delete_object = true`).
The crash happens in `mask_match()` because the `pattern` argument is
a corrupted
pointer. The corrupted value decodes to an ASCII string, which strongly suggests
memory corruption / use-after-free upstream of the veto/hide path-matching code
rather than a NULL dereference.

The crash is independent of `veto files` configuration: it reproduces both on a
share that has a global `veto files` list and on a share where `veto files` is
explicitly cleared. It occurs at logoff, not during normal file access.

## Version

- Samba 4.22.8 (Debian package `2:4.22.8+dfsg-0+deb13u2`)
- OS: Debian 13 (trixie), x86_64
- smbd started as: `/usr/sbin/smbd --foreground --no-process-group`

## Relevant smb.conf settings

```
kernel oplocks = no
smb2 leases = no
delete veto files = no
veto files = /*.ext1/*.ext2/.../*.extN/   (global list)
# on some shares: veto files =   (explicitly emptied to disable the global list)
```

vfs objects in use on the affected share(s):
```
vfs objects = full_audit recycle acl_xattr
```

## Crash signature

```
INTERNAL ERROR: Signal 11: Segmentation fault in smbd
(4.22.8-Debian-4.22.8+dfsg-0+deb13u2)
```

## Faulting frame (with debug symbols)

The immediate fault is a bad `pattern` pointer passed to `mask_match()`:

```
#10 mask_match (string=string@entry=<ptr> "AA",
                pattern=<INVALID_PTR> <error: Cannot access memory at
address <INVALID_PTR>>,
                is_case_sensitive=false)
    at source3/lib/util.c:1397
```

The invalid `pattern` pointer value decodes as ASCII (little-endian) to a
printable string. This indicates the pattern-list entry (or a neighbouring
structure) has been overwritten, i.e. memory corruption, rather than a plain
NULL/uninitialised pointer.

The caller passes a valid-looking namelist, and `name`/`string` is valid:

```
#11 is_in_path (name=<optimized out>, namelist=<ptr>, case_sensitive=false)
    at source3/lib/util.c:793
```

## Context of the close

The file being closed is a file open at logoff with delete-on-close active:

```
#12 openat_pathref_fsp_nosymlink (conn=<ptr>, in_dirfsp=<ptr>,
        path_in=<ptr> "<dir>", twrp=0, posix=true, ...)
    at source3/smbd/files.c:1150

#13 filename_convert_dirfsp_nosymlink (conn=<ptr>, basedir=<ptr>,
        name_in=<ptr> "<dir>/<subdir>", ucf_flags=8, twrp=0, ...)
    at source3/smbd/filename.c:768

#18 parent_pathref (dirfsp=<ptr>, smb_fname=<ptr>, ...)
    at source3/smbd/files.c:1922

#19 close_remove_share_mode (fsp=<ptr>, close_type=SHUTDOWN_CLOSE)
    at source3/smbd/close.c:618
        delete_object = true
        reset_delete_on_close = false
        got_tokens = true
        del_token = <ptr>
        del_nt_token = <ptr>

#20 close_normal_file (req=0x0, fsp=<ptr>, close_type=SHUTDOWN_CLOSE)
    at source3/smbd/close.c:1000

#21 close_file_smb (req=0x0, fsp=<ptr>, close_type=SHUTDOWN_CLOSE)
    at source3/smbd/close.c:1499

#24-27 file_close_user_fn / files_forall / file_close_user
    at source3/smbd/files.c

#28 smbXsrv_session_logoff (session=<ptr>)
    at source3/smbd/smbXsrv_session.c:1892

#29 smbXsrv_session_remove_channel_done (subreq=...)
    at source3/smbd/smbXsrv_session.c:1726
```

## Full backtrace

```
Script started on 2026-07-03 11:45:02+02:00 [TERM="tmux-256color"
TTY="/dev/pts/0" COLUMNS="211" LINES="56"]
# coredumpctl gdb 1900245
coredumpctl gdb 1900245

           PID: 1900245 (smbd[xx.x.xx.xx)
           UID: 0 (root)
           GID: 0 (root)
        Signal: 6 (ABRT)
     Timestamp: Fri 2026-07-03 11:16:35 CEST (28min ago)
  Command Line: $'smbd: client [xx.x.xx.xxx]'
    Executable: /usr/sbin/smbd
 Control Group: /system.slice/smbd.service
          Unit: smbd.service
         Slice: system.slice
       Boot ID: fe592ce253fb487a988e5e3465e9fc82
    Machine ID: 2c5b41cf3e12437ea4f07dd78ec6cbb8
      Hostname: xxx
       Storage:
/var/lib/systemd/coredump/core.smbd[10\x2e0\x2e41\x2e21.0.fe592ce253fb487a988e5e3465e9fc82.1900245.1783070195000000.zst
(present)
  Size on Disk: 2.8M
       Message: Process 1900245 (smbd[xx.x.xx.xx) of user 0 dumped core.

                Module libnss_systemd.so.2 from deb
systemd-257.13-1~deb13u1.amd64
                Module libzstd.so.1 from deb libzstd-1.5.7+dfsg-1.amd64
                Module libgcc_s.so.1 from deb gcc-14-14.2.0-19.amd64
                Module libstdc++.so.6 from deb gcc-14-14.2.0-19.amd64
                Module libsystemd.so.0 from deb systemd-257.13-1~deb13u1.amd64
                Stack trace of thread 1900245:
                #0  0x00007fecb607f95c __pthread_kill_implementation
(libc.so.6 + 0x9495c)
                #1  0x00007fecb602acc2 __GI_raise (libc.so.6 + 0x3fcc2)
                #2  0x00007fecb60134ac __GI_abort (libc.so.6 + 0x284ac)
                #3  0x00007fecb656e894 dump_core (libsmbconf.so.0 + 0x5a894)
                #4  0x00007fecb6564224 smb_panic_s3 (libsmbconf.so.0 + 0x50224)
                #5  0x00007fecb623486e smb_panic
(libgenrand-private-samba.so.0 + 0x286e)
                #6  0x00007fecb62348f5 n/a
(libgenrand-private-samba.so.0 + 0x28f5)
                #7  0x00007fecb602adf0 __restore_rt (libc.so.6 + 0x3fdf0)
                #8  0x00007fecb65650bf mask_match (libsmbconf.so.0 + 0x510bf)
                #9  0x00007fecb65651b9 is_in_path (libsmbconf.so.0 + 0x511b9)
                #10 0x00007fecb663685b openat_pathref_fsp_nosymlink
(libsmbd-base-private-samba.so.0 + 0x5a85b)
                #11 0x00007fecb665678a
filename_convert_dirfsp_nosymlink (libsmbd-base-private-samba.so.0 +
0x7a78a)
                #12 0x00007fecb6657349 filename_convert_dirfsp_rel
(libsmbd-base-private-samba.so.0 + 0x7b349)
                #13 0x00007fecb665a6d7 fd_openat
(libsmbd-base-private-samba.so.0 + 0x7e6d7)
                #14 0x00007fecb663607c n/a
(libsmbd-base-private-samba.so.0 + 0x5a07c)
                #15 0x00007fecb6639171 openat_pathref_fsp
(libsmbd-base-private-samba.so.0 + 0x5d171)
                #16 0x00007fecb6639503 parent_pathref
(libsmbd-base-private-samba.so.0 + 0x5d503)
                #17 0x00007fecb66667b6 close_file_smb
(libsmbd-base-private-samba.so.0 + 0x8a7b6)
                #18 0x00007fecb666607f close_file_free
(libsmbd-base-private-samba.so.0 + 0x8a07f)
                #19 0x00007fecb663986e n/a
(libsmbd-base-private-samba.so.0 + 0x5d86e)
                #20 0x00007fecb66399fe n/a
(libsmbd-base-private-samba.so.0 + 0x5d9fe)
                #21 0x00007fecb6634681 files_forall
(libsmbd-base-private-samba.so.0 + 0x58681)
                #22 0x00007fecb66347bc file_close_user
(libsmbd-base-private-samba.so.0 + 0x587bc)
                #23 0x00007fecb66b7441 smbXsrv_session_logoff
(libsmbd-base-private-samba.so.0 + 0xdb441)
                #24 0x00007fecb66b7969 n/a
(libsmbd-base-private-samba.so.0 + 0xdb969)
                #25 0x00007fecb63a2d9e
tevent_common_invoke_immediate_handler (libtevent.so.0 + 0x8d9e)
                #26 0x00007fecb63a2dfa tevent_common_loop_immediate
(libtevent.so.0 + 0x8dfa)
                #27 0x00007fecb63a975d n/a (libtevent.so.0 + 0xf75d)
                #28 0x00007fecb63a748b n/a (libtevent.so.0 + 0xd48b)
                #29 0x00007fecb63a1953 _tevent_loop_once
(libtevent.so.0 + 0x7953)
                #30 0x00007fecb63a1c4b tevent_common_loop_wait
(libtevent.so.0 + 0x7c4b)
                #31 0x00007fecb63a741b n/a (libtevent.so.0 + 0xd41b)
                #32 0x00007fecb6680a25 smbd_process
(libsmbd-base-private-samba.so.0 + 0xa4a25)
                #33 0x000055cbcb723217 n/a (/usr/sbin/smbd + 0xb217)
                #34 0x00007fecb63a2815 tevent_common_invoke_fd_handler
(libtevent.so.0 + 0x8815)
                #35 0x00007fecb63a9a56 n/a (libtevent.so.0 + 0xfa56)
                #36 0x00007fecb63a748b n/a (libtevent.so.0 + 0xd48b)
                #37 0x00007fecb63a1953 _tevent_loop_once
(libtevent.so.0 + 0x7953)
                #38 0x00007fecb63a1c4b tevent_common_loop_wait
(libtevent.so.0 + 0x7c4b)
                #39 0x00007fecb63a741b n/a (libtevent.so.0 + 0xd41b)
                #40 0x000055cbcb72035a main (/usr/sbin/smbd + 0x835a)
                #41 0x00007fecb6014ca8 __libc_start_call_main
(libc.so.6 + 0x29ca8)
                #42 0x00007fecb6014d65 __libc_start_main_impl
(libc.so.6 + 0x29d65)
                #43 0x000055cbcb720e61 _start (/usr/sbin/smbd + 0x8e61)
                ELF object binary architecture: AMD x86-64

GNU gdb (Debian 16.3-1) 16.3
Copyright (C) 2024 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/sbin/smbd...
(No debugging symbols found in /usr/sbin/smbd)
[New LWP 1900245]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/usr/sbin/smbd --foreground --no-process-group'.
Program terminated with signal SIGABRT, Aborted.
#0  __pthread_kill_implementation (threadid=<optimized out>,
signo=signo@entry=6, no_tid=no_tid@entry=0) at
./nptl/pthread_kill.c:44

warning: 44 ./nptl/pthread_kill.c: File o directory non esistente
(gdb) bt full

#0  __pthread_kill_implementation (threadid=<optimized out>,
signo=signo@entry=6, no_tid=no_tid@entry=0) at
./nptl/pthread_kill.c:44
        tid = <optimized out>
        ret = 0
        pd = <optimized out>
        old_mask = {__val = {0}}
        ret = <optimized out>
#1  0x00007fecb607f9ff in __pthread_kill_internal (threadid=<optimized
out>, signo=6) at ./nptl/pthread_kill.c:89
No locals.
#2  0x00007fecb602acc2 in __GI_raise (sig=sig@entry=6) at
../sysdeps/posix/raise.c:26
        ret = <optimized out>
#3  0x00007fecb60134ac in __GI_abort () at ./stdlib/abort.c:77
        act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction =
0x0}, sa_mask = {__val = {0, 20, 140654598949472, 140654644881344,
140654643492073, 20, 10, 140731987220752, 140654644860049,
              140654644881024, 6, 140731987220672, 140731987220720, 0,
335544320, 140654642638320}}, sa_flags = 353589760, sa_restorer =
0x290c}
#4  0x00007fecb656e894 in dump_core () at source3/lib/dumpcore.c:339
        called = true
        __FUNCTION__ = "dump_core"
#5  0x00007fecb6564224 in smb_panic_s3 (why=<optimized out>) at
source3/lib/util.c:730
No locals.
#6  0x00007fecb623486e in smb_panic (why=why@entry=0x7ffeb81b5a90
"Signal 11: Errore di segmentazione") at lib/util/fault.c:209
No locals.
#7  0x00007fecb62348f5 in fault_report (sig=11) at lib/util/fault.c:83
        signal_string = "Signal 11: Errore di
segmentazione\000\000\000\000\000\000\350\212\335\000\000\000\000\000\020\352\306\a\314U\000\000\220\360\263\a\314U\000\000\2602\353\265\354\177\000\000\220\360\263\a\314U\000\000\000\000\000\000\000\000\000\000h\246\a\266\354\177\000\000\b\016h\263\354\177\000\000\000\000\000\000\000\000\000\000\300\224\320\a\314U\000\000h\246\a\266\354\177\000"
        counter = 1
        signal_string = <optimized out>
#8  sig_fault (sig=11) at lib/util/fault.c:94
No locals.
#9  <signal handler called>
No locals.
#10 mask_match (string=string@entry=0x55cc07cfd410 "xx",
pattern=0x7974697275636553 <error: Cannot access memory at address
0x7974697275636553>, is_case_sensitive=is_case_sensitive@entry=false)
    at source3/lib/util.c:1397
No locals.
#11 0x00007fecb65651b9 in is_in_path (name=<optimized out>,
namelist=0x55cc07c989b0, case_sensitive=false) at
source3/lib/util.c:793
        last_component = <optimized out>
        __FUNCTION__ = "is_in_path"
#12 0x00007fecb663685b in openat_pathref_fsp_nosymlink
(mem_ctx=mem_ctx@entry=0x55cc07ce7cd0, conn=conn@entry=0x55cc07c92a80,
in_dirfsp=in_dirfsp@entry=0x55cc07ab3fd0,
    path_in=path_in@entry=0x55cc07cad520 "xx/xxxx", twrp=twrp@entry=0,
posix=posix@entry=true, _smb_fname=0x7ffeb81b62b8,
_symlink_err=0x7ffeb81b62c0) at source3/smbd/files.c:1150
        dirfsp = 0x55cc07ab3fd0
        full_fname = {base_name = 0x55cc07bc73c0 "", stream_name =
0x0, flags = 1, st = {st_ex_dev = 0, st_ex_ino = 0, st_ex_mode = 0,
st_ex_nlink = 0, st_ex_uid = 0, st_ex_gid = 0, st_ex_rdev = 0,
            st_ex_size = 0, st_ex_atime = {tv_sec = 0, tv_nsec = 0},
st_ex_mtime = {tv_sec = 0, tv_nsec = 0}, st_ex_ctime = {tv_sec = 0,
tv_nsec = 0}, st_ex_btime = {tv_sec = 0, tv_nsec = 0},
            cached_dos_attributes = 0, st_ex_blksize = 0, st_ex_blocks
= 0, st_ex_flags = 0, st_ex_iflags = 0}, twrp = 0, fsp = 0x0, fsp_link
= 0x0}
        rel_fname = {base_name = 0x55cc07cfd410 "xx", stream_name =
0x0, flags = 1, st = {st_ex_dev = 0, st_ex_ino = 0, st_ex_mode = 0,
st_ex_nlink = 0, st_ex_uid = 0, st_ex_gid = 0, st_ex_rdev = 0,
            st_ex_size = 0, st_ex_atime = {tv_sec = 0, tv_nsec = 0},
st_ex_mtime = {tv_sec = 0, tv_nsec = 0}, st_ex_ctime = {tv_sec = 0,
tv_nsec = 0}, st_ex_btime = {tv_sec = 0, tv_nsec = 0},
            cached_dos_attributes = 0, st_ex_blksize = 0, st_ex_blocks
= 0, st_ex_flags = 0, st_ex_iflags = 0}, twrp = 0, fsp = 0x0, fsp_link
= 0x0}
        result = 0x0
        symlink_err = 0x0
        fsp = 0x55cc07cced70
        path = 0x55cc07cfd410 "xx"
        next = 0x55cc07cfd413 "2026"
        ok = <optimized out>
        is_toplevel = <optimized out>
        fd = <optimized out>
        status = <optimized out>
        how = {flags = 2230272, mode = 0, resolve = 0}
        __func__ = "openat_pathref_fsp_nosymlink"
--Type <RET> for more, q to quit, c to continue without paging--c

        nomem = <optimized out>
        __FUNCTION__ = "openat_pathref_fsp_nosymlink"
#13 0x00007fecb665678a in filename_convert_dirfsp_nosymlink
(mem_ctx=mem_ctx@entry=0x55cc07ce7cd0, conn=conn@entry=0x55cc07c92a80,
basedir=basedir@entry=0x55cc07ab3fd0,
    name_in=name_in@entry=0x55cc07cf3160 "xx/xxxx/xx xxxxxx",
ucf_flags=ucf_flags@entry=8, twrp=twrp@entry=0,
_dirfsp=0x7ffeb81b6400, _smb_fname=0x7ffeb81b6408,
_smb_fname_rel=0x7ffeb81b6410,
    _symlink_err=0x7ffeb81b6380) at source3/smbd/filename.c:768
        smb_dirname = 0x0
        smb_fname_rel = 0x0
        smb_fname = 0x0
        symlink_err = 0x0
        posix = true
        dirname = <optimized out>
        fname_rel = <optimized out>
        streamname = <optimized out>
        saved_streamname = 0x0
        base_fsp = 0x0
        ok = <optimized out>
        status = {v = 0}
        __FUNCTION__ = "filename_convert_dirfsp_nosymlink"
        fail = <optimized out>
        __func__ = "filename_convert_dirfsp_nosymlink"
#14 0x00007fecb6657349 in filename_convert_dirfsp_rel
(mem_ctx=0x55cc07ce7cd0, conn=conn@entry=0x55cc07c92a80,
basedir=basedir@entry=0x55cc07ab3fd0,
name_in=name_in@entry=0x55cc07cf3160 "xx/xxxx/xx xxxxxx",
    ucf_flags=ucf_flags@entry=8, twrp=twrp@entry=0,
_dirfsp=0x7ffeb81b6400, _smb_fname=0x7ffeb81b6408,
_smb_fname_rel=0x7ffeb81b6410) at source3/smbd/filename.c:1083
        symlink_err = 0x0
        lnk = <optimized out>
        status = <optimized out>
        target = 0x0
        base_name = 0x0
        safe_target = 0x0
        symlink_redirects = <optimized out>
        ret = <optimized out>
#15 0x00007fecb665a6d7 in fd_openat
(dirfsp=dirfsp@entry=0x55cc07ab3fd0,
smb_fname=smb_fname@entry=0x55cc07cf3030, fsp=0x55cc07cd5080,
_how=_how@entry=0x7ffeb81b6500) at source3/smbd/open.c:549
        how = {flags = 133120, mode = 0, resolve = 0}
        conn = 0x55cc07c92a80
        status = <optimized out>
        fsp_is_stream = <optimized out>
        smb_fname_is_stream = <optimized out>
        dirfsp_conv = 0x0
        smb_fname_conv = 0x0
        smb_fname_rel = 0x0
        root_fsp = 0x0
        name_in = 0x55cc07cf3160 "xx/xxxx/xx xxxxxx"
        fd = <optimized out>
        __FUNCTION__ = "fd_openat"
        done = <optimized out>
        __func__ = "fd_openat"
#16 0x00007fecb663607c in openat_pathref_fullname
(conn=conn@entry=0x55cc07c92a80, dirfsp=dirfsp@entry=0x55cc07ab3fd0,
full_fname=full_fname@entry=0x7ffeb81b64f8,
smb_fname=smb_fname@entry=0x55cc07cf3030,
    how=how@entry=0x7ffeb81b6500) at source3/smbd/files.c:434
        fsp = 0x55cc07cd5080
        status = {v = 0}
        __func__ = "openat_pathref_fullname"
        __FUNCTION__ = "openat_pathref_fullname"
#17 0x00007fecb6639171 in openat_pathref_fsp
(dirfsp=dirfsp@entry=0x55cc07ab3fd0, smb_fname=0x55cc07cf3030) at
source3/smbd/files.c:542
        conn = 0x55cc07c92a80
        full_fname = 0x0
        base_fname = 0x0
        how = {flags = 2048, mode = 0, resolve = 0}
        status = <optimized out>
        __func__ = "openat_pathref_fsp"
#18 0x00007fecb6639503 in parent_pathref (mem_ctx=<optimized out>,
dirfsp=dirfsp@entry=0x55cc07ab3fd0,
smb_fname=smb_fname@entry=0x55cc07cbf830,
_parent=_parent@entry=0x7ffeb81b6628,
    _atname=_atname@entry=0x7ffeb81b6630) at source3/smbd/files.c:1922
        parent = 0x55cc07cf3030
        atname = 0x55cc07a89cf0
        status = {v = 0}
#19 0x00007fecb66667b6 in close_remove_share_mode (fsp=0x55cc07cd1a20,
close_type=SHUTDOWN_CLOSE) at source3/smbd/close.c:618
        conn = 0x55cc07c92a80
        parent_fname = 0x0
        base_fname = 0x0
        lck_state = {prepare_state = {__fid = {devid = 2064, inode =
16808651812, extid = 0}, __lck_ptr = 0x7ffeb81b67d0, {
              __u8_space =
"\020\b\000\000\000\000\000\000$\254\337\351\003", '\000' <repeats 11
times>, "Pl\274\a\314U\000"}}, object_type = 0x7fecb6731417 "file",
fsp = 0x55cc07cd1a20,
          close_type = SHUTDOWN_CLOSE, delete_object = true,
got_tokens = true, parent_lease_key = {data = {673, 140654644366768}},
del_token = 0x55cc07cb3cf0, del_nt_token = 0x55cc07cd22c0,
          reset_delete_on_close = false, cleanup_fn = 0x7fecb6665400
<close_share_mode_lock_cleanup>}
        status = <optimized out>
        tmp_status = <optimized out>
        id = {devid = 2064, inode = 16808651812, extid = 0}
        ret = <optimized out>
        changed_user = true
        ulstatus = <optimized out>
        conn = <optimized out>
        lck_state = <optimized out>
        changed_user = <optimized out>
        status = <optimized out>
        tmp_status = <optimized out>
        ulstatus = <optimized out>
        id = <optimized out>
        parent_fname = <optimized out>
        base_fname = <optimized out>
        ret = <optimized out>
        __func__ = "close_remove_share_mode"
        done = <optimized out>
        __FUNCTION__ = "close_remove_share_mode"
        ftmp1 = <optimized out>
        ftmp2 = <optimized out>
        lease = <optimized out>
#20 close_normal_file (req=0x0, fsp=0x55cc07cd1a20,
close_type=SHUTDOWN_CLOSE) at source3/smbd/close.c:1000
        status = {v = 0}
        tmp = <optimized out>
        conn = <optimized out>
        is_durable = <optimized out>
        status = <optimized out>
        tmp = <optimized out>
        conn = <optimized out>
        is_durable = <optimized out>
        __FUNCTION__ = "close_normal_file"
        new_cookie = <optimized out>
        tv = <optimized out>
        now = <optimized out>
#21 close_file_smb (req=req@entry=0x0, fsp=fsp@entry=0x55cc07cd1a20,
close_type=close_type@entry=SHUTDOWN_CLOSE) at
source3/smbd/close.c:1499
        status = <optimized out>
        __FUNCTION__ = "close_file_smb"
        __func__ = "close_file_smb"
#22 0x00007fecb666607f in close_file_free (req=req@entry=0x0,
_fsp=_fsp@entry=0x7ffeb81b68b8,
close_type=close_type@entry=SHUTDOWN_CLOSE) at
source3/smbd/close.c:1534
        fsp = 0x55cc07cd1a20
        status = <optimized out>
#23 0x00007fecb663986e in close_file_in_loop (fsp=<optimized out>,
close_type=close_type@entry=SHUTDOWN_CLOSE) at
source3/smbd/files.c:1982
        __FUNCTION__ = "close_file_in_loop"
#24 0x00007fecb66399fe in file_close_user_fn (fsp=<optimized out>,
private_data=0x7ffeb81b6900) at source3/smbd/files.c:2111
        state = <optimized out>
        did_close = <optimized out>
#25 file_close_user_fn (fsp=<optimized out>,
private_data=0x7ffeb81b6900) at source3/smbd/files.c:2100
        state = 0x7ffeb81b6900
        did_close = <optimized out>
#26 0x00007fecb6634681 in files_forall
(sconn=sconn@entry=0x55cc07c80780, fn=fn@entry=0x7fecb66399e0
<file_close_user_fn>, private_data=private_data@entry=0x7ffeb81b6900)
at source3/smbd/files.c:2147
        ret = <optimized out>
        fsp = <optimized out>
        next = 0x0
#27 0x00007fecb66347bc in file_close_user
(sconn=sconn@entry=0x55cc07c80780, vuid=<optimized out>) at
source3/smbd/files.c:2123
        state = {vuid = 3584376335, fsp_left_behind = false}
        __FUNCTION__ = "file_close_user"
#28 0x00007fecb66b7441 in smbXsrv_session_logoff
(session=session@entry=0x55cc07c84120) at
source3/smbd/smbXsrv_session.c:1892
        table = 0x55cc07c91cb0
        local_rec = 0x0
        global_rec = 0x0
        sconn = 0x55cc07c80780
        status = <optimized out>
        error = {v = 0}
        __func__ = "smbXsrv_session_logoff"
#29 0x00007fecb66b7969 in smbXsrv_session_remove_channel_done
(subreq=<optimized out>) at source3/smbd/smbXsrv_session.c:1726
        session = 0x55cc07c84120
        status = {v = 0}
        __func__ = "smbXsrv_session_remove_channel_done"
#30 0x00007fecb63a2d9e in tevent_common_invoke_immediate_handler ()
from /lib/x86_64-linux-gnu/libtevent.so.0
No symbol table info available.
#31 0x00007fecb63a2dfa in tevent_common_loop_immediate () from
/lib/x86_64-linux-gnu/libtevent.so.0
No symbol table info available.
#32 0x00007fecb63a975d in ?? () from /lib/x86_64-linux-gnu/libtevent.so.0
No symbol table info available.
#33 0x00007fecb63a748b in ?? () from /lib/x86_64-linux-gnu/libtevent.so.0
No symbol table info available.
#34 0x00007fecb63a1953 in _tevent_loop_once () from
/lib/x86_64-linux-gnu/libtevent.so.0
No symbol table info available.
#35 0x00007fecb63a1c4b in tevent_common_loop_wait () from
/lib/x86_64-linux-gnu/libtevent.so.0
No symbol table info available.
#36 0x00007fecb63a741b in ?? () from /lib/x86_64-linux-gnu/libtevent.so.0
No symbol table info available.
#37 0x00007fecb6680a25 in smbd_process (ev_ctx=0x55cc07a869a0,
msg_ctx=<optimized out>, sock_fd=35, interactive=<optimized out>) at
source3/smbd/smb2_process.c:2163
        lp_sub = 0x7fecb65a4e50 <s3_global_substitution>
        client = 0x55cc07c88fb0
        sconn = 0x55cc07c80780
        xconn = 0x55cc07ad98d0
        locaddr = <optimized out>
        remaddr = <optimized out>
        ret = <optimized out>
        status = <optimized out>
        tv = {tv_sec = 1783035094, tv_usec = 752544}
        trace_state = {ev = 0x55cc07a869a0, frame = 0x55cc07ce7cd0,
profile_idle = {start = 0, stats = 0x0}, before_wait_tv = {tv_sec =
1783035094, tv_usec = 752544}, after_wait_tv = {tv_sec = 1783035094,
            tv_usec = 752544}}
        debug = false
        now = <optimized out>
        chroot_dir = <optimized out>
        rc = <optimized out>
        __func__ = "smbd_process"
        __FUNCTION__ = "smbd_process"
#38 0x000055cbcb723217 in ?? ()
No symbol table info available.
#39 0x00007fecb63a2815 in tevent_common_invoke_fd_handler () from
/lib/x86_64-linux-gnu/libtevent.so.0
No symbol table info available.
#40 0x00007fecb63a9a56 in ?? () from /lib/x86_64-linux-gnu/libtevent.so.0
No symbol table info available.
#41 0x00007fecb63a748b in ?? () from /lib/x86_64-linux-gnu/libtevent.so.0
No symbol table info available.
#42 0x00007fecb63a1953 in _tevent_loop_once () from
/lib/x86_64-linux-gnu/libtevent.so.0
No symbol table info available.
#43 0x00007fecb63a1c4b in tevent_common_loop_wait () from
/lib/x86_64-linux-gnu/libtevent.so.0
No symbol table info available.
#44 0x00007fecb63a741b in ?? () from /lib/x86_64-linux-gnu/libtevent.so.0
No symbol table info available.
#45 0x000055cbcb72035a in main ()
No symbol table info available.
(gdb) frame 9

#9  <signal handler called>
(gdb) info locals

No locals.
(gdb) info args
info args

No symbol table info available.
(gdb) info locals
info locals

No locals.
(gdb) frame 10
frame 10

#10 mask_match (string=string@entry=0x55cc07cfd410 "xx",
pattern=0x7974697275636553 <error: Cannot access memory at address
0x7974697275636553>, is_case_sensitive=is_case_sensitive@entry=false)
    at source3/lib/util.c:1397
warning: 1397 source3/lib/util.c: File o directory non esistente
(gdb) info args
info args

string = 0x55cc07cfd410 "xx"
pattern = 0x7974697275636553 <error: Cannot access memory at address
0x7974697275636553>
is_case_sensitive = false
(gdb) info args
frame 10 1

#11 0x00007fecb65651b9 in is_in_path (name=<optimized out>,
namelist=0x55cc07c989b0, case_sensitive=false) at
source3/lib/util.c:793
793 in source3/lib/util.c
(gdb) info args

name = <optimized out>
namelist = 0x55cc07c989b0
case_sensitive = false
(gdb) infol  locals

last_component = <optimized out>
__FUNCTION__ = "is_in_path"
(gdb) quit

Script done on 2026-07-03 11:48:19+02:00 [COMMAND_EXIT_CODE="0"]
```

## Reproduction

The crash occurs at client session logoff/disconnect while a delete-on-close
file is still open. It has been observed on two different clients and on two
shares with opposite `veto files` configuration (one with the global list
active, one with it explicitly emptied), producing an identical stack.
Frequency: Three times a day

Client type(s): SMB3_11

## Notes

- Independent of `veto files`, `kernel oplocks`, `smb2 leases`.
- The corrupted `pattern` pointer decodes to a printable ASCII string, which
  suggests the corruption may originate near security-descriptor / NT ACL /
  xattr handling during the delete-on-close path (possibly in interaction with
  a VFS module such as acl_xattr / streams_xattr / full_audit - see vfs objects
  above).
- Core dump available and can be provided (~2.8 MB, .zst). Debug symbols from
  Debian debuginfod / dbgsym packages were used to produce the backtrace above.