Bug 2624 - Signal 11 at startup of nmbd and smbd
Signal 11 at startup of nmbd and smbd
Status: RESOLVED FIXED
Product: Samba 3.0
Classification: Unclassified
Component: nmbd
3.0.13
x86 Linux
: P3 critical
: none
Assigned To: Samba Bugzilla Account
Samba QA Contact
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2005-04-17 13:44 UTC by Norbert Schmidt
Modified: 2005-10-04 04:52 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Norbert Schmidt 2005-04-17 13:44:37 UTC
Just compiled 3.0.14a on a slightly ancient;-) system:
Linux (once was RedHat 7.2) Kernel: 2.4.0-test10
egcs-2.91.66

Both nmbd and smbd crash on startup with Signal 11.

Even with "--enable-debug" I only get:
[...]
[2005/04/17 22:09:31, 5] lib/iconv.c:smb_register_charset(103)
  Attempting to register new charset UCS2-HEX
[2005/04/17 22:09:31, 5] lib/iconv.c:smb_register_charset(111)
  Registered charset UCS2-HEX
[2005/04/17 22:09:31, 5] lib/iconv.c:smb_register_charset(103)
  Attempting to register new charset CP850
[2005/04/17 22:09:31, 5] lib/iconv.c:smb_register_charset(111)
  Registered charset CP850
[2005/04/17 22:09:31, 0] lib/fault.c:fault_report(36)
  ===============================================================
[2005/04/17 22:09:31, 0] lib/fault.c:fault_report(37)
  INTERNAL ERROR: Signal 11 in pid 20809 (3.0.14a)
  Please read the appendix Bugs of the Samba HOWTO collection
[2005/04/17 22:09:31, 0] lib/fault.c:fault_report(39)
  ===============================================================
[2005/04/17 22:09:31, 0] lib/util.c:smb_panic2(1495)
  PANIC: internal error
[2005/04/17 22:09:31, 0] lib/util.c:smb_panic2(1503)
  BACKTRACE: 14 stack frames:
   #0 [0x81fb0c4]
   #1 [0x81faeda]
   #2 [0x81e4ccb]
   #3 [0x81e4d34]
   #4 /lib/libc.so.6(sigaction+0x268) [0x40097c68]
   #5 [0x821799a]
   #6 [0x8209a25]
   #7 [0x8209bc3]
   #8 [0x81e15c6]
   #9 [0x808045f]
   #10 [0x8262924]
   #11 [0x82631a7]
   #12 /lib/libc.so.6(__libc_start_main+0xff) [0x400919cb]
   #13 [0x8076b01]
Comment 1 Gerald (Jerry) Carter 2005-04-20 06:19:32 UTC
Is this just when you start up ?  If so then try running 
'nmbd -i' inside of gdb to get the backtrace.  Thanks.
Comment 2 Norbert Schmidt 2005-04-20 09:46:06 UTC
(In reply to comment #1)
> Is this just when you start up ?  

Yes. I start it and it crashes.

GDB says:

(gdb) set args="-i"
(gdb) run
Starting program: /usr/local/samba/sbin/nmbd ="-i"

Program received signal SIGSEGV, Segmentation fault.
smb_register_charset (funcs=0x8134a44) at lib/iconv.c:113
113     lib/iconv.c: No such file or directory.

(gdb) bt
#0  smb_register_charset (funcs=0x8134a44) at lib/iconv.c:113
#1  0x80f869a in charset_CP850_init () at modules/CP850.c:121
#2  0x80ea725 in lazy_initialize_iconv () at lib/iconv.c:125
#3  0x80ea8c3 in smb_iconv_open (tocode=0x81224e0 "UTF-16LE", fromcode=0x8122588
"ASCII") at lib/iconv.c:208
#4  0x80c22c6 in init_iconv () at lib/charcnv.c:128
#5  0x8087e4f in lp_load (pszFname=0x812eee0 "/usr/local/samba/lib/smb.conf",
global_only=1, save_defaults=0, add_ipc=0)
    at param/loadparm.c:3964
#6  0x8060721 in reload_nmbd_services (test=0) at nmbd/nmbd.c:293
#7  0x8060d8a in main (argc=2, argv=0xbffffa4c) at nmbd/nmbd.c:671
Comment 3 Norbert Schmidt 2005-04-20 11:00:20 UTC
I thought maybe some variable values may help a bit:

(gdb) print funcs
$1 = (struct charset_functions *) 0x8134a44
(gdb) print *funcs
$2 = {name = 0x812bde5 "CP850", pull = 0x80f85ec <CP850_pull>, push = 0x80f8470
<CP850_push>, prev = 0x0, next = 0x81349b8}

(gdb) print charsets
$5 = (struct charset_functions *) 0x8134a44

(gdb) print *(funcs->next)
$6 = {name = 0x81292c0 "UCS2-HEX", pull = 0x80eaedc <ucs2hex_pull>, push =
0x80eb02c <ucs2hex_push>, prev = 0x8134a44, next = 0x81349a4}

looking at these values I don't see any obvious reason to segfault ... :-(

Maybe the registers and some disassembled code ....

(gdb) i all
eax            0x8134a44        135481924
ecx            0x63     99
edx            0x81349b8        135481784
ebx            0x0      0
esp            0xbfffec28       -1073746904
ebp            0xbfffec2c       -1073746900
esi            0x80ff740        135264064
edi            0xbffff5d8       -1073744424
eip            0x80ea699        135177881
eflags         0x10206  66054
cs             0x23     35
ss             0x2b     43
ds             0x2b     43
es             0x2b     43
fs             0x0      0
gs             0x0      0
cwd            0xffff037f       -64641
swd            0xffff0000       -65536
twd            0xffffffff       -1
fip            0x0      0
fcs            0x0      0
fopo           0x0      0
fos            0xffff0000       -65536
st             1561.4179222530578098337983306009846     (raw 0x4009c32d5f9e7d24ecfd)
st1            0        (raw 0x00000000000000000000)
st2            2962131  (raw 0x4014b4cb4c0000000000)
st3            0        (raw 0x00000000000000000000)
st4            1        (raw 0x3fff8000000000000000)
st5            1        (raw 0x3fff8000000000000000)
st6            1114017695       (raw 0x401d84cd1f3e00000000)
st7            8        (raw 0x40028000000000000000)

[...]
0x80ea670 <smb_register_charset+376>:   mov    0x81349e0,%eax
0x80ea675 <smb_register_charset+381>:   mov    0xc(%ebp),%edx
0x80ea678 <smb_register_charset+384>:   mov    %edx,0xc(%eax)
0x80ea67b <smb_register_charset+387>:   mov    0xc(%ebp),%eax
0x80ea67e <smb_register_charset+390>:   mov    0x81349e0,%edx
0x80ea684 <smb_register_charset+396>:   mov    %edx,0x10(%eax)
0x80ea687 <smb_register_charset+399>:   mov    0xc(%ebp),%eax
0x80ea68a <smb_register_charset+402>:   movl   $0x0,0xc(%eax)
0x80ea691 <smb_register_charset+409>:   mov    0xc(%ebp),%eax
0x80ea694 <smb_register_charset+412>:   mov    %eax,0x81349e0
0x80ea699 <smb_register_charset+417>:   movl   $0x0,(%ebx)

Ooops! %bx points to NULL!

0x80ea69f <smb_register_charset+423>:   jmp    0x80ea6a1 <smb_register_charset+425>
0x80ea6a1 <smb_register_charset+425>:   mov    %ebx,%eax
0x80ea6a3 <smb_register_charset+427>:   mov    0xfffffffc(%ebp),%ebx
0x80ea6a6 <smb_register_charset+430>:   leave
0x80ea6a7 <smb_register_charset+431>:   ret    $0x4
End of assembler dump.

Comment 4 Norbert Schmidt 2005-04-20 12:01:53 UTC
Hmmm. It seems that my ancient "egcs-2.91.66" messed something up with the
creation of the return value in this case. 

I looked and found in config.log:  

#define HAVE_IMMEDIATE_STRUCTURES 1

Maybe it compiles "immediate structures" but they don't work reliably?
Comment 5 Norbert Schmidt 2005-05-05 10:38:44 UTC
(In reply to comment #4)
> Hmmm. It seems that my ancient "egcs-2.91.66" messed something up with the
> creation of the return value in this case. 

I just compiled it with a gcc 3.3.6: crashed again. :-(((
Comment 6 Gerald (Jerry) Carter 2005-10-04 04:52:04 UTC
Please retest against 3.0.20. Although this looks more like an old iconv lib.