Are you using security = server by chance?  Can you get a level 
10 debug log surrounding the crash an atach it to this report?
Or possible a backtrace from an smbd built with -g ?

Created attachment 1707 [details]
my smb.conf

(In reply to comment #1)
> Are you using security = server by chance?  Can you get a level 
> 10 debug log surrounding the crash an atach it to this report?
> Or possible a backtrace from an smbd built with -g ?
> 

I use "security = user" (see my smb.conf attached).

I returned to the old machine (with samba 2.2.10 + redhat 6.2) for the server that have most probems. Now I try to reproduce the bug with smbtorture.

The other servers are in production, and the bug appear max 3 or 4 time per week , so I think it's difficult to set the debug level = 10. Nevertheless I'll test it on the server the less critical.

The same error with the debug level =2.

It's stange : the error occured with a PID different from the activity logged before or after the "INTERNAL Error signal 11".

[2006/01/27 10:40:24, 1] smbd/service.c:make_connection_snum(662)
  10021603 (185.100.11.63) connect to service q_recep_1 initially as user M00877 (uid=1010, gid=1000) (pid 24718)
[2006/01/27 10:42:46, 1] smbd/service.c:close_cnum(835)
  10021603 (185.100.11.63) closed connection to service q_recep_1
[2006/01/27 10:44:01, 1] smbd/service.c:make_connection_snum(662)
  10021603 (185.100.11.63) connect to service q_recep_1 initially as user M00877 (uid=1010, gid=1000) (pid 24718)
[2006/01/27 10:48:46, 1] smbd/service.c:close_cnum(835)
  10021603 (185.100.11.63) closed connection to service q_recep_1
[2006/01/27 10:52:55, 0] lib/fault.c:fault_report(36)
  ===============================================================
[2006/01/27 10:52:55, 0] lib/fault.c:fault_report(37)
  INTERNAL ERROR: Signal 11 in pid 20724 (3.0.20b-2.1-SUSE)
  Please read the Trouble-Shooting section of the Samba3-HOWTO
[2006/01/27 10:52:55, 0] lib/fault.c:fault_report(39)

  From: http://www.samba.org/samba/docs/Samba3-HOWTO.pdf
[2006/01/27 10:52:55, 0] lib/fault.c:fault_report(40)
  ===============================================================
[2006/01/27 10:52:55, 0] lib/util.c:smb_panic2(1548)
  PANIC: internal error
[2006/01/27 10:52:55, 0] lib/util.c:smb_panic2(1556)
  BACKTRACE: 21 stack frames:
   #0 /usr/sbin/smbd(smb_panic2+0x120) [0x822e570]
   #1 /usr/sbin/smbd(smb_panic+0x26) [0x822e746]
   #2 /usr/sbin/smbd [0x82188bb]
   #3 [0xffffe420]
   #4 /lib/tls/libc.so.6 [0xb7d2eff4]
   #5 /lib/tls/libc.so.6 [0xb7d2f2e2]
   #6 /lib/tls/libc.so.6(getpwnam_r+0x14d) [0xb7cd0bed]
   #7 /lib/tls/libc.so.6(getpwnam+0x91) [0xb7cd05b1]
   #8 /usr/sbin/smbd(sys_getpwnam+0x1d) [0x821b78d]
   #9 /usr/sbin/smbd(getpwnam_alloc+0x5a) [0x822077a]
   #10 /usr/sbin/smbd(Get_Pwnam_alloc+0xfe) [0x821e5be]
   #11 /usr/sbin/smbd(Get_Pwnam+0x22) [0x821e8f2]
   #12 /usr/sbin/smbd(standard_sub_basic+0x306) [0x8237186]
   #13 /usr/sbin/smbd(lp_file_list_changed+0xf0) [0x8086ad0]
   #14 /usr/sbin/smbd(reload_services+0x37) [0x82bb097]
   #15 /usr/sbin/smbd(check_reload+0x9b) [0x80e7fbb]
   #16 /usr/sbin/smbd [0x80e8165]
   #17 /usr/sbin/smbd(smbd_process+0xdd) [0x80ea09d]
   #18 /usr/sbin/smbd(main+0x585) [0x82bc3f5]
   #19 /lib/tls/libc.so.6(__libc_start_main+0xe0) [0xb7c5fb10]
   #20 /usr/sbin/smbd [0x807d951]
[2006/01/27 10:55:17, 2] smbd/close.c:close_normal_file(270)
  M00877 closed file OFFICE.97/OFFICE/XL8409.DLL (numopen=56)
[2006/01/27 10:55:17, 2] smbd/close.c:close_normal_file(270)
  M00877 closed file OFFICE.97/OFFICE/XL840C.DLL (numopen=55)
[2006/01/27 10:55:17, 2] smbd/close.c:close_normal_file(270)
  M00877 closed file OFFICE.97/OFFICE/MSO7FRA.DLL (numopen=54)
[2006/01/27 10:55:17, 2] smbd/close.c:close_normal_file(270)
  M00877 closed file PROG/OFFICE.97/OFFICE/XLQPW.DLL (numopen=10)
[2006/01/27 10:55:17, 2] smbd/close.c:close_normal_file(270)
  M00877 closed file OFFICE.97/OFFICE/SCANLOAD.DLL (numopen=53)
[2006/01/27 10:55:17, 2] smbd/close.c:close_normal_file(270)
  M00877 closed file OFFICE.97/OFFICE/EXCEL.EXE (numopen=52)

(In reply to comment #4)

Here a more complete log with the 3 PID :


> The same error with the debug level =2.
> 
> It's stange : the error occured with a PID different from the activity logged
> before or after the "INTERNAL Error signal 11".
> 
> [2006/01/27 10:40:24, 1] smbd/service.c:make_connection_snum(662)
>   10021603 (185.100.11.63) connect to service q_recep_1 initially as user
> M00877 (uid=1010, gid=1000) (pid 24718)
> [2006/01/27 10:42:46, 1] smbd/service.c:close_cnum(835)
>   10021603 (185.100.11.63) closed connection to service q_recep_1
> [2006/01/27 10:44:01, 1] smbd/service.c:make_connection_snum(662)
>   10021603 (185.100.11.63) connect to service q_recep_1 initially as user
> M00877 (uid=1010, gid=1000) (pid 24718)
> [2006/01/27 10:48:46, 1] smbd/service.c:close_cnum(835)
>   10021603 (185.100.11.63) closed connection to service q_recep_1
> [2006/01/27 10:52:55, 0] lib/fault.c:fault_report(36)
>   ===============================================================
> [2006/01/27 10:52:55, 0] lib/fault.c:fault_report(37)
>   INTERNAL ERROR: Signal 11 in pid 20724 (3.0.20b-2.1-SUSE)
>   Please read the Trouble-Shooting section of the Samba3-HOWTO
> [2006/01/27 10:52:55, 0] lib/fault.c:fault_report(39)
> 
>   From: http://www.samba.org/samba/docs/Samba3-HOWTO.pdf
> [2006/01/27 10:52:55, 0] lib/fault.c:fault_report(40)
>   ===============================================================
> [2006/01/27 10:52:55, 0] lib/util.c:smb_panic2(1548)
>   PANIC: internal error
> [2006/01/27 10:52:55, 0] lib/util.c:smb_panic2(1556)
>   BACKTRACE: 21 stack frames:
>    #0 /usr/sbin/smbd(smb_panic2+0x120) [0x822e570]
>    #1 /usr/sbin/smbd(smb_panic+0x26) [0x822e746]
>    #2 /usr/sbin/smbd [0x82188bb]
>    #3 [0xffffe420]
>    #4 /lib/tls/libc.so.6 [0xb7d2eff4]
>    #5 /lib/tls/libc.so.6 [0xb7d2f2e2]
>    #6 /lib/tls/libc.so.6(getpwnam_r+0x14d) [0xb7cd0bed]
>    #7 /lib/tls/libc.so.6(getpwnam+0x91) [0xb7cd05b1]
>    #8 /usr/sbin/smbd(sys_getpwnam+0x1d) [0x821b78d]
>    #9 /usr/sbin/smbd(getpwnam_alloc+0x5a) [0x822077a]
>    #10 /usr/sbin/smbd(Get_Pwnam_alloc+0xfe) [0x821e5be]
>    #11 /usr/sbin/smbd(Get_Pwnam+0x22) [0x821e8f2]
>    #12 /usr/sbin/smbd(standard_sub_basic+0x306) [0x8237186]
>    #13 /usr/sbin/smbd(lp_file_list_changed+0xf0) [0x8086ad0]
>    #14 /usr/sbin/smbd(reload_services+0x37) [0x82bb097]
>    #15 /usr/sbin/smbd(check_reload+0x9b) [0x80e7fbb]
>    #16 /usr/sbin/smbd [0x80e8165]
>    #17 /usr/sbin/smbd(smbd_process+0xdd) [0x80ea09d]
>    #18 /usr/sbin/smbd(main+0x585) [0x82bc3f5]
>    #19 /lib/tls/libc.so.6(__libc_start_main+0xe0) [0xb7c5fb10]
>    #20 /usr/sbin/smbd [0x807d951]
> [2006/01/27 10:55:17, 2] smbd/close.c:close_normal_file(270)
>   M00877 closed file OFFICE.97/OFFICE/XL8409.DLL (numopen=56)
> [2006/01/27 10:55:17, 2] smbd/close.c:close_normal_file(270)
>   M00877 closed file OFFICE.97/OFFICE/XL840C.DLL (numopen=55)
> [2006/01/27 10:55:17, 2] smbd/close.c:close_normal_file(270)
>   M00877 closed file OFFICE.97/OFFICE/MSO7FRA.DLL (numopen=54)
> [2006/01/27 10:55:17, 2] smbd/close.c:close_normal_file(270)
>   M00877 closed file PROG/OFFICE.97/OFFICE/XLQPW.DLL (numopen=10)
> [2006/01/27 10:55:17, 2] smbd/close.c:close_normal_file(270)
>   M00877 closed file OFFICE.97/OFFICE/SCANLOAD.DLL (numopen=53)
> [2006/01/27 10:55:17, 2] smbd/close.c:close_normal_file(270)
>   M00877 closed file OFFICE.97/OFFICE/EXCEL.EXE (numopen=52)
> 

[...]

[2006/01/27 10:55:26, 2] smbd/close.c:close_normal_file(270)
  M00877 closed file ORA817/OCOMMON/nls/ADMIN/DATA/LX10001.NLB (numopen=54)
[2006/01/27 10:55:26, 2] smbd/close.c:close_normal_file(270)
  M00877 closed file CODP32/agence.dat (numopen=4)
[2006/01/27 10:55:26, 2] smbd/close.c:close_normal_file(270)
  M00877 closed file CODP32/mode_ven.dat (numopen=3)
[2006/01/27 10:55:26, 2] smbd/close.c:close_normal_file(270)
  M00877 closed file CODP32/wdjpays.dat (numopen=2)
[2006/01/27 10:55:26, 2] smbd/close.c:close_normal_file(270)
  M00877 closed file CODP32/produit.dat (numopen=1)
[2006/01/27 10:55:27, 2] smbd/close.c:close_normal_file(270)
  M00877 closed file CODP32/wdjparam.dat (numopen=0)
[2006/01/27 10:55:28, 2] smbd/close.c:close_normal_file(270)
  M00877 closed file ORA817/RDBMS/mesg/oraf.msb (numopen=53)
[2006/01/27 10:55:36, 2] smbd/open.c:open_file(372)
  M00877 opened file ORA817/RDBMS/mesg/oraf.msb read=Yes write=No (numopen=54)
[2006/01/27 10:55:36, 2] smbd/close.c:close_normal_file(270)
  M00877 closed file PRODUCT/CODI/BMP/CAMION.BMP (numopen=53)
[2006/01/27 10:55:37, 2] smbd/close.c:close_normal_file(270)
  M00877 closed file PRODUCT/CODI/BMP/GRAVELEA.BMP (numopen=52)
[2006/01/27 10:55:39, 2] smbd/close.c:close_normal_file(270)
  M00877 closed file ORA817/RDBMS/mesg/oraf.msb (numopen=51)
[2006/01/27 10:55:55, 2] smbd/open.c:open_file(372)
  M00877 opened file ORA817/RDBMS/mesg/oraf.msb read=Yes write=No (numopen=52)
[2006/01/27 10:55:59, 2] smbd/close.c:close_normal_file(270)
  M00877 closed file ORA817/RDBMS/mesg/oraf.msb (numopen=51)
[2006/01/27 10:56:39, 2] smbd/open.c:open_file(372)
  M00877 opened file ORA817/RDBMS/mesg/oraf.msb read=Yes write=No (numopen=52)
[2006/01/27 10:56:43, 2] smbd/close.c:close_normal_file(270)
  M00877 closed file ORA817/RDBMS/mesg/oraf.msb (numopen=51)
[2006/01/27 10:56:43, 2] smbd/open.c:open_file(372)
  M00877 opened file GUPTA/DEPLOY/RDWI31.DLL read=Yes write=No (numopen=52)
[2006/01/27 10:56:43, 2] smbd/open.c:open_file(372)
  M00877 opened file GUPTA/DEPLOY/GSWDLL32.DLL read=Yes write=No (numopen=53)
[2006/01/27 10:56:43, 2] smbd/open.c:open_file(372)
  M00877 opened file GUPTA/DEPLOY/GSWAG32.DLL read=Yes write=No (numopen=54)
[2006/01/27 10:56:43, 2] smbd/open.c:open_file(372)
  M00877 opened file GUPTA/DEPLOY/GEEI31.DLL read=Yes write=No (numopen=55)
[2006/01/27 10:56:44, 2] smbd/open.c:open_file(372)
  M00877 opened file PRODUCT/CODI/QRP/CCC01_01.QRP read=Yes write=No (numopen=56)
[2006/01/27 10:56:44, 2] smbd/close.c:close_normal_file(270)
  M00877 closed file PRODUCT/CODI/QRP/CCC01_01.QRP (numopen=55)
[2006/01/27 10:56:44, 2] smbd/open.c:open_file(372)
  M00877 opened file PRODUCT/CODI/QRP/CCC01_01.QRP read=Yes write=No (numopen=56)
[2006/01/27 10:56:44, 1] smbd/service.c:make_connection_snum(662)
  10021603 (185.100.11.63) connect to service q_recep_1 initially as user M00877 (uid=1010, gid=1000) (pid 24718)
[2006/01/27 10:58:46, 1] smbd/service.c:close_cnum(835)
  10021603 (185.100.11.63) closed connection to service q_recep_1
[2006/01/27 11:00:36, 2] smbd/open.c:open_file(372)
  M00877 opened file ORA817/RDBMS/mesg/oraf.msb read=Yes write=No (numopen=57)
[2006/01/27 11:00:37, 2] smbd/close.c:close_normal_file(270)
  M00877 closed file ORA817/RDBMS/mesg/oraf.msb (numopen=56)
[2006/01/27 11:01:10, 1] smbd/service.c:make_connection_snum(662)
  10021603 (185.100.11.63) connect to service q_recep_1 initially as user M00877 (uid=1010, gid=1000) (pid 24718)

Here a sample of the log surrounding the crash with the debug level 10.

I attach the complete log too.

[2006/01/31 14:25:05, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/01/31 14:25:05, 5] auth/auth_util.c:debug_nt_user_token(452)
  NT user token: (NULL)
[2006/01/31 14:25:05, 5] auth/auth_util.c:debug_unix_user_token(473)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2006/01/31 14:25:05, 5] smbd/uid.c:change_to_root_user(319)
  change_to_root_user: now uid=(0,0) gid=(0,0)
[2006/01/31 14:25:05, 6] param/loadparm.c:lp_file_list_changed(2840)
  lp_file_list_changed()
  file /home/smbhome/netlogon/smb_PC_%m.conf -> /home/smbhome/netlogon/smb_PC_10021186.conf  last mod_time: Thu Jan  1 01:00:00 1970

  file /home/smbhome/netlogon/smb_%U.conf -> /home/smbhome/netlogon/smb_m02869.conf  last mod_time: Thu Jan  1 01:00:00 1970

[2006/01/31 14:25:05, 5] lib/username.c:Get_Pwnam_alloc(313)
  Finding user M02869
[2006/01/31 14:25:05, 5] lib/username.c:Get_Pwnam_internals(262)
  Trying _Get_Pwnam(), username as lowercase is m02869
[2006/01/31 14:25:20, 0] lib/fault.c:fault_report(36)
  ===============================================================
[2006/01/31 14:25:20, 0] lib/fault.c:fault_report(37)
  INTERNAL ERROR: Signal 11 in pid 6345 (3.0.20b-2.1-SUSE)
  Please read the Trouble-Shooting section of the Samba3-HOWTO
[2006/01/31 14:25:20, 0] lib/fault.c:fault_report(39)

  From: http://www.samba.org/samba/docs/Samba3-HOWTO.pdf
[2006/01/31 14:25:20, 0] lib/fault.c:fault_report(40)
  ===============================================================
[2006/01/31 14:25:20, 0] lib/util.c:smb_panic2(1548)
  PANIC: internal error
[2006/01/31 14:25:20, 0] lib/util.c:smb_panic2(1556)
  BACKTRACE: 21 stack frames:
   #0 /usr/sbin/smbd(smb_panic2+0x120) [0x822e570]
   #1 /usr/sbin/smbd(smb_panic+0x26) [0x822e746]
   #2 /usr/sbin/smbd [0x82188bb]
   #3 [0xffffe420]
   #4 /lib/tls/libc.so.6 [0xb7d2eff4]
   #5 /lib/tls/libc.so.6 [0xb7d2f2e2]
   #6 /lib/tls/libc.so.6(getpwnam_r+0x14d) [0xb7cd0bed]
   #7 /lib/tls/libc.so.6(getpwnam+0x91) [0xb7cd05b1]
   #8 /usr/sbin/smbd(sys_getpwnam+0x1d) [0x821b78d]
   #9 /usr/sbin/smbd(getpwnam_alloc+0x5a) [0x822077a]
   #10 /usr/sbin/smbd(Get_Pwnam_alloc+0xfe) [0x821e5be]
   #11 /usr/sbin/smbd(Get_Pwnam+0x22) [0x821e8f2]
   #12 /usr/sbin/smbd(standard_sub_basic+0x306) [0x8237186]
   #13 /usr/sbin/smbd(lp_file_list_changed+0xf0) [0x8086ad0]
   #14 /usr/sbin/smbd(reload_services+0x37) [0x82bb097]
   #15 /usr/sbin/smbd(check_reload+0x9b) [0x80e7fbb]
   #16 /usr/sbin/smbd [0x80e8165]
   #17 /usr/sbin/smbd(smbd_process+0x21e) [0x80ea1de]
   #18 /usr/sbin/smbd(main+0x585) [0x82bc3f5]
   #19 /lib/tls/libc.so.6(__libc_start_main+0xe0) [0xb7c5fb10]
   #20 /usr/sbin/smbd [0x807d951]
[2006/01/31 14:25:20, 6] param/loadparm.c:lp_file_list_changed(2840)
  lp_file_list_changed()
  file /home/smbhome/netlogon/smb_PC_%m.conf -> /home/smbhome/netlogon/smb_PC_10021186.conf  last mod_time: Thu Jan  1 01:00:00 1970

  file /home/smbhome/netlogon/smb_%U.conf -> /home/smbhome/netlogon/smb_.conf  last mod_time: Thu Jan  1 01:00:00 1970

[2006/01/31 14:25:20, 10] lib/username.c:Get_Pwnam_alloc(307)
  Get_Pwnam: empty username!
  file /home/smbhome/netlogon/smb_%G.conf -> /home/smbhome/netlogon/smb_%G.conf  last mod_time: Thu Jan  1 01:00:00 1970

  file /home/smbhome/netlogon/smb_%a.conf -> /home/smbhome/netlogon/smb_UNKNOWN.conf  last mod_time: Thu Jan  1 01:00:00 1970

  file /etc/samba/dhcp.conf -> /etc/samba/dhcp.conf  last mod_time: Fri Jun 10 16:37:15 2005

  file /etc/samba/smb.conf -> /etc/samba/smb.conf  last mod_time: Mon Jan 30 14:32:50 2006

Created attachment 1714 [details]
log of crash "INTERNAL ERROR Signal 11" with debug level 10

The log of the machine with the crash "INTERNAL ERROR Signal 11" with log level 10.

Please try with 3.0.21b to see if this has been fixed as a memory corruption bug.
Thanks,
Jeremy.

(In reply to comment #8)
> Please try with 3.0.21b to see if this has been fixed as a memory corruption
> bug.
> Thanks,
> Jeremy.
> 


Sorry the bug is still in 3.0.21b : 


[2006/02/02 11:19:47, 0] lib/fault.c:fault_report(36)
  ===============================================================
[2006/02/02 11:19:47, 0] lib/fault.c:fault_report(37)
  INTERNAL ERROR: Signal 11 in pid 8025 (3.0.21b-1.1.2-SUSE-SL9.2)
  Please read the Trouble-Shooting section of the Samba3-HOWTO
[2006/02/02 11:19:47, 0] lib/fault.c:fault_report(39)

  From: http://www.samba.org/samba/docs/Samba3-HOWTO.pdf
[2006/02/02 11:19:47, 0] lib/fault.c:fault_report(40)
  ===============================================================
[2006/02/02 11:19:47, 0] lib/util.c:smb_panic2(1554)
  PANIC: internal error
[2006/02/02 11:19:47, 0] lib/util.c:smb_panic2(1562)
  BACKTRACE: 21 stack frames:
   #0 /usr/sbin/smbd(smb_panic2+0x120) [0x8241f90]
   #1 /usr/sbin/smbd(smb_panic+0x26) [0x8242166]
   #2 /usr/sbin/smbd [0x822bdab]
   #3 [0xffffe420]
   #4 /lib/tls/libc.so.6 [0x40384ff4]
   #5 /lib/tls/libc.so.6 [0x403852e2]
   #6 /lib/tls/libc.so.6(getpwnam_r+0x14d) [0x40326bed]
   #7 /lib/tls/libc.so.6(getpwnam+0x91) [0x403265b1]
   #8 /usr/sbin/smbd(sys_getpwnam+0x1d) [0x822ec7d]
   [...]

(In reply to comment #9)

We are currently running 3.0.20b and have seen the same issues to the point wehre it has brought us to our knees. We have a kill script in place to assist with this.

One thing to note -- We have also attempted to back off the samba version and ran 3.0.10 and still have the Signal 11 failure.

We cannot submit any log files due to the systems this runs on, but can try and answer any related questions.

> (In reply to comment #8)
> > Please try with 3.0.21b to see if this has been fixed as a memory corruption
> > bug.
> > Thanks,
> > Jeremy.
> > 
> Sorry the bug is still in 3.0.21b : 
> [2006/02/02 11:19:47, 0] lib/fault.c:fault_report(36)
>   ===============================================================
> [2006/02/02 11:19:47, 0] lib/fault.c:fault_report(37)
>   INTERNAL ERROR: Signal 11 in pid 8025 (3.0.21b-1.1.2-SUSE-SL9.2)
>   Please read the Trouble-Shooting section of the Samba3-HOWTO
> [2006/02/02 11:19:47, 0] lib/fault.c:fault_report(39)
>   From: http://www.samba.org/samba/docs/Samba3-HOWTO.pdf
> [2006/02/02 11:19:47, 0] lib/fault.c:fault_report(40)
>   ===============================================================
> [2006/02/02 11:19:47, 0] lib/util.c:smb_panic2(1554)
>   PANIC: internal error
> [2006/02/02 11:19:47, 0] lib/util.c:smb_panic2(1562)
>   BACKTRACE: 21 stack frames:
>    #0 /usr/sbin/smbd(smb_panic2+0x120) [0x8241f90]
>    #1 /usr/sbin/smbd(smb_panic+0x26) [0x8242166]
>    #2 /usr/sbin/smbd [0x822bdab]
>    #3 [0xffffe420]
>    #4 /lib/tls/libc.so.6 [0x40384ff4]
>    #5 /lib/tls/libc.so.6 [0x403852e2]
>    #6 /lib/tls/libc.so.6(getpwnam_r+0x14d) [0x40326bed]
>    #7 /lib/tls/libc.so.6(getpwnam+0x91) [0x403265b1]
>    #8 /usr/sbin/smbd(sys_getpwnam+0x1d) [0x822ec7d]
>    [...]

I don't really see how this can be a bu in Samba.  
The segfault occurs in glibc.  What OS is this? Are you 
running the current patches from your vendor?

Mathias,

In your environment are you running Matlab through samba?
We have seen that Matlab was running heavily every time the signal 11 dumps occurred.

We are also workin gon getting data pulled together on a debug 10 level so we can submit and see how it compares to your data.

(In reply to comment #11)
> I don't really see how this can be a bu in Samba.  
> The segfault occurs in glibc.  What OS is this? Are you 
> running the current patches from your vendor?

We are currently running samba on AIX 5.3 Maintenance level 3.
We authenticate using active directory and using Netgroups.

Adam

IT really appears to be a system library issue.  That is what is 
puzzling to me.  It's crashing in getpwnam().  Did you compile
with a build of gcc that includes threads by default?

(In reply to comment #13)
> (In reply to comment #11)
> > I don't really see how this can be a bu in Samba.  
> > The segfault occurs in glibc.  What OS is this? Are you 
> > running the current patches from your vendor?
> We are currently running samba on AIX 5.3 Maintenance level 3.
> We authenticate using active directory and using Netgroups.
> Adam


Ok, we've got two different platforms here. Can we split these out into two separate bugs? I agree with Jerry that this is a libc.so problem in SUSE, Mathias.

Adam, you are running AIX 5.3. If you create a separate bug, I'll help you as best I can. Please place additional info about the event.

Bill

(In reply to comment #15)
> (In reply to comment #13)
> > (In reply to comment #11)
> > > I don't really see how this can be a bu in Samba.  
> > > The segfault occurs in glibc.  What OS is this? Are you 
> > > running the current patches from your vendor?
> > We are currently running samba on AIX 5.3 Maintenance level 3.
> > We authenticate using active directory and using Netgroups.
> > Adam
> 
> 
> Ok, we've got two different platforms here. Can we split these out into two
> separate bugs? I agree with Jerry that this is a libc.so problem in SUSE,
> Mathias.
> 
> Adam, you are running AIX 5.3. If you create a separate bug, I'll help you as
> best I can. Please place additional info about the event.
> 
> Bill
> 

I tried to update from glibc-2.3.3-118 to glibc-2.3.5-40 and now there is no "INTERNAL ERROR Signal 11" but the libc trap the memory error with this message :

*** glibc detected *** free(): invalid pointer: 0xb7d5e0b8 ***



I captured the error twice in debug level 10 :

---------------------------------------
[2006/03/10 15:20:22, 10] smbd/posix_acls.c:canonicalise_acl(2224)
  canon_ace index 0. Type = allow SID = S-1-1-0 other SMB_ACL_OTHER perms rwx
[2006/03/10 15:20:22, 10] smbd/posix_acls.c:canonicalise_acl(2224)
  canon_ace index 1. Type = allow SID = S-1-5-21-2013498585-4159311833-597275497-2003 gid 501 (communs) SMB_ACL_GROUP_OBJ perms rwx
[2006/03/10 15:20:22, 10] smbd/posix_acls.c:canonicalise_acl(2224)
  canon_ace index 2. Type = allow SID = S-1-5-21-2013498585-4159311833-597275497-2058 uid 529 (M07761) SMB_ACL_USER_OBJ perms rwx
[2006/03/10 15:20:22, 10] smbd/posix_acls.c:print_canon_ace_list(593)
  print_canon_ace_list: canonicalise_acl: ace entries after arrange
*** glibc detected *** free(): invalid pointer: 0xb7d5e0b8 ***
  canon_ace index 0. Type = allow SID = S-1-5-21-2013498585-4159311833-597275497-2058 ===============================================================
[2006/03/10 16:04:06, 6] param/loadparm.c:lp_file_list_changed(2989)
  lp_file_list_changed()
  file /home/smbhome/netlogon/smb_PC_%m.conf -> /home/smbhome/netlogon/smb_PC_10020937.conf  last mod_time: Thu Jan  1 01:00:00 1970

  file /home/smbhome/netlogon/smb_%U.conf -> /home/smbhome/netlogon/smb_.conf  last mod_time: Thu Jan  1 01:00:00 1970

[2006/03/10 16:04:06, 10] lib/username.c:Get_Pwnam_alloc(284)
  Get_Pwnam: empty username!
  file /home/smbhome/netlogon/smb_%G.conf -> /home/smbhome/netlogon/smb_%G.conf  last mod_time: Thu Jan  1 01:00:00 1970

  file /home/smbhome/netlogon/smb_%a.conf -> /home/smbhome/netlogon/smb_UNKNOWN.conf  last mod_time: Thu Jan  1 01:00:00 1970

  file /etc/samba/dhcp.conf -> /etc/samba/dhcp.conf  last mod_time: Fri Jun 10 16:37:15 2005

  file /etc/samba/smb.conf -> /etc/samba/smb.conf  last mod_time: Fri Mar 10 11:11:53 2006

[2006/03/10 16:04:06, 5] smbd/reply.c:reply_special(537)
  init msg_type=0x81 msg_flags=0x0
---------------------------------------

and 

---------------------------------------
[2006/03/10 12:33:37, 3] printing/pcap.c:pcap_cache_reload(117)
  reloading printcap cache
[2006/03/10 12:33:37, 5] printing/print_cups.c:cups_cache_reload(71)
  reloading cups printcap cache
[2006/03/10 12:33:37, 10] printing/print_cups.c:cups_server(51)
  cups server left to default localhost
[2006/03/10 12:33:38, 3] printing/pcap.c:pcap_cache_reload(223)
  reload status: ok
[2006/03/10 12:33:38, 10] smbd/process.c:setup_select_timeout(1265)
  change_notify_timeout: -1
[2006/03/10 12:34:38, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/03/10 12:34:38, 5] auth/auth_util.c:debug_nt_user_token(433)
  NT user token: (NULL)
[2006/03/10 12:34:38, 5] auth/auth_util.c:debug_unix_user_token(454)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2006/03/10 12:34:38, 5] smbd/uid.c:change_to_root_user(324)
  change_to_root_user: now uid=(0,0) gid=(0,0)
[2006/03/10 12:34:38, 10] smbd/process.c:setup_select_timeout(1265)
  change_notify_timeout: -1
[2006/03/10 12:35:38, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/03/10 12:35:38, 5] auth/auth_util.c:debug_nt_user_token(433)
  NT user token: (NULL)
[2006/03/10 12:35:38, 5] auth/auth_util.c:debug_unix_user_token(454)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2006/03/10 12:35:38, 5] smbd/uid.c:change_to_root_user(324)
  change_to_root_user: now uid=(0,0) gid=(0,0)
[2006/03/10 12:35:38, 10] smbd/process.c:setup_select_timeout(1265)
  change_notify_timeout: -1
[2006/03/10 12:36:38, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/03/10 12:36:38, 5] auth/auth_util.c:debug_nt_user_token(433)
  NT user token: (NULL)
[2006/03/10 12:36:38, 5] auth/auth_util.c:debug_unix_user_token(454)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2006/03/10 12:36:38, 5] smbd/uid.c:change_to_root_user(324)
  change_to_root_user: now uid=(0,0) gid=(0,0)
[2006/03/10 12:36:38, 6] param/loadparm.c:lp_file_list_changed(2989)
  lp_file_list_changed()
  file /home/smbhome/netlogon/smb_PC_%m.conf -> /home/smbhome/netlogon/smb_PC_10020255.conf  last mod_time: Thu Jan  1 01:00:00 1970

  file /home/smbhome/netlogon/smb_%U.conf -> /home/smbhome/netlogon/smb_m06332.conf  last mod_time: Thu Jan  1 01:00:00 1970

[2006/03/10 12:36:38, 5] lib/username.c:Get_Pwnam_alloc(290)
  Finding user M06332
[2006/03/10 12:36:38, 5] lib/username.c:Get_Pwnam_internals(234)
  Trying _Get_Pwnam(), username as lowercase is m06332
*** glibc detected *** free(): invalid pointer: 0xb7d5e094 ***
[2006/03/10 13:46:27, 6] param/loadparm.c:lp_file_list_changed(2989)
  lp_file_list_changed()
  file /home/smbhome/netlogon/smb_PC_%m.conf -> /home/smbhome/netlogon/smb_PC_10020255.conf  last mod_time: Thu Jan  1 01:00:00 1970

  file /home/smbhome/netlogon/smb_%U.conf -> /home/smbhome/netlogon/smb_.conf  last mod_time: Thu Jan  1 01:00:00 1970

[2006/03/10 13:46:27, 10] lib/username.c:Get_Pwnam_alloc(284)
  Get_Pwnam: empty username!
  file /home/smbhome/netlogon/smb_%G.conf -> /home/smbhome/netlogon/smb_%G.conf  last mod_time: Thu Jan  1 01:00:00 1970

  file /home/smbhome/netlogon/smb_%a.conf -> /home/smbhome/netlogon/smb_UNKNOWN.conf  last mod_time: Thu Jan  1 01:00:00 1970

  file /etc/samba/dhcp.conf -> /etc/samba/dhcp.conf  last mod_time: Fri Jun 10 16:37:15 2005

  file /etc/samba/smb.conf -> /etc/samba/smb.conf  last mod_time: Fri Mar 10 11:11:53 2006

[2006/03/10 13:46:27, 5] smbd/reply.c:reply_special(537)
  init msg_type=0x81 msg_flags=0x0
[2006/03/10 13:46:27, 10] smbd/process.c:setup_select_timeout(1265)

---------------------------------------

I had a new crash and I debugged with gdb with the command "bt":

# gdb program 14925
GNU gdb 6.2.1
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i586-suse-linux"...program: No such file or directory.

Attaching to process 14925
Reading symbols from /usr/sbin/smbd...(no debugging symbols found)...done.
Using host libthread_db library "/lib/tls/libthread_db.so.1".
Reading symbols from /usr/lib/libldap-2.2.so.7...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libldap-2.2.so.7
Reading symbols from /usr/lib/liblber-2.2.so.7...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/liblber-2.2.so.7
Reading symbols from /lib/libcom_err.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/libcom_err.so.2
Reading symbols from /usr/lib/libgssapi.so.1...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libgssapi.so.1
Reading symbols from /usr/lib/libkrb5.so.17...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libkrb5.so.17
Reading symbols from /usr/lib/libasn1.so.6...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libasn1.so.6
Reading symbols from /usr/lib/libcrypto.so.0.9.7...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libcrypto.so.0.9.7
Reading symbols from /usr/lib/libroken.so.16...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libroken.so.16
Reading symbols from /lib/libcrypt.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libcrypt.so.1
Reading symbols from /lib/libresolv.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/libresolv.so.2
Reading symbols from /usr/lib/libcups.so.2...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libcups.so.2
Reading symbols from /usr/lib/libssl.so.0.9.7...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libssl.so.0.9.7
Reading symbols from /lib/libnsl.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libnsl.so.1
Reading symbols from /lib/libpam.so.0...(no debugging symbols found)...done.
Loaded symbols for /lib/libpam.so.0
Reading symbols from /lib/libattr.so.1...done.
Loaded symbols for /lib/libattr.so.1
Reading symbols from /lib/libacl.so.1...done.
Loaded symbols for /lib/libacl.so.1
Reading symbols from /lib/libdl.so.2...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /usr/lib/libpopt.so.0...done.
Loaded symbols for /usr/lib/libpopt.so.0
Reading symbols from /lib/tls/libc.so.6...done.
Loaded symbols for /lib/tls/libc.so.6
Reading symbols from /usr/lib/libsasl2.so.2...done.
Loaded symbols for /usr/lib/libsasl2.so.2
Reading symbols from /usr/lib/tls/libdb-4.2.so...done.
Loaded symbols for /usr/lib/tls/libdb-4.2.so
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
Reading symbols from /lib/tls/libpthread.so.0...done.
[Thread debugging using libthread_db enabled]
[New Thread -1212926272 (LWP 14925)]
Loaded symbols for /lib/tls/libpthread.so.0
Reading symbols from /usr/lib/gconv/UTF-16.so...done.
Loaded symbols for /usr/lib/gconv/UTF-16.so
Reading symbols from /usr/lib/gconv/ISO8859-1.so...done.
Loaded symbols for /usr/lib/gconv/ISO8859-1.so
Reading symbols from /usr/lib/gconv/IBM850.so...done.
Loaded symbols for /usr/lib/gconv/IBM850.so
Reading symbols from /lib/libnss_files.so.2...done.
Loaded symbols for /lib/libnss_files.so.2
Reading symbols from /lib/libnss_compat.so.2...done.
Loaded symbols for /lib/libnss_compat.so.2
Reading symbols from /lib/libnss_nis.so.2...done.
Loaded symbols for /lib/libnss_nis.so.2
#0  0xffffe410 in ?? ()
#1  0xbfff830c in ?? ()
#2  0x00000002 in ?? ()
#3  0x00000000 in ?? ()
#4  0xb7d0b45e in __lll_mutex_lock_wait () from /lib/tls/libc.so.6
#5  0xb7ca8b24 in _L_mutex_lock_3518 () from /lib/tls/libc.so.6
#6  0xb7d4fcfb in __libc_ptyname1 () from /lib/tls/libc.so.6
#7  0x00000000 in ?? ()
#8  0xb7d5bff4 in ?? () from /lib/tls/libc.so.6
#9  0x08383068 in ?? ()
#10 0x00000000 in ?? ()
#11 0xbfff8390 in ?? ()
#12 0xb7cbe8db in tzset_internal () from /lib/tls/libc.so.6
#13 0xb7cbe8db in tzset_internal () from /lib/tls/libc.so.6
#14 0xb7cbf29e in tzset () from /lib/tls/libc.so.6
#15 0xb7cc3f73 in strftime_l () from /lib/tls/libc.so.6
#16 0xb7cc3e16 in strftime () from /lib/tls/libc.so.6
#17 0x000000ff in ?? ()
#18 0x083377d0 in se_priv_end ()
#19 0xb7d5f940 in _obstack_compat () from /lib/tls/libc.so.6
#20 0xb7d5c3c0 in _nl_C_locobj () from /lib/tls/libc.so.6
#21 0x08363d38 in ?? ()
#22 0xbfff856c in ?? ()
#23 0x08230ca8 in timestring ()
Previous frame inner to this frame (corrupt stack?)



And the samba machine log with debug 10 :

[2006/03/14 09:15:39, 10] smbd/posix_acls.c:map_canon_ace_perms(844)
  map_canon_ace_perms: Mapped (UNIX) 1c0 to (NT) 1f01ff
[2006/03/14 09:15:39, 10] smbd/posix_acls.c:map_canon_ace_perms(844)
  map_canon_ace_perms: Mapped (UNIX) 140 to (NT) 1200a9
[2006/03/14 09:15:39, 10] smbd/posix_acls.c:map_canon_ace_perms(844)
  map_canon_ace_perms: Mapped (UNIX) 140 to (NT) 1200a9
[2006/03/14 09:15:39, 5] smbd/files.c:file_free(450)
  freed files structure 13945 (17 used)
[2006/03/14 09:15:39, 10] lib/util_seaccess.c:se_access_check(233)
  se_access_check: requested access 0x00000001, for NT token with 5 entries and first sid S-1-5-21-2013498585-4159311833-597275497-2022.
[2006/03/14 09:15:39, 3] lib/util_seaccess.c:se_access_check(250)
[2006/03/14 09:15:39, 3] lib/util_seaccess.c:se_access_check(251)
  se_access_check: user sid is S-1-5-21-2013498585-4159311833-597275497-2022
  se_access_check: also S-1-5-21-2013498585-4159311833-597275497-2003
  se_access_check: also S-1-1-0
  se_access_check: also S-1-5-2
  se_access_check: also S-1-5-11
  se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-5-21-2013498585-4159311833-597275497-2000 mask = 1f01ff, current desired = 1
  se_access_check: ACE 1: type 0, flags = 0x00, SID = S-1-5-21-2013498585-4159311833-597275497-1001 mask = 1200a9, current desired = 1
  se_access_check: ACE 2: type 0, flags = 0x00, SID = S-1-1-0 mask = 1200a9, current desired = 1
[2006/03/14 09:15:39, 5] lib/util_seaccess.c:se_access_check(308)
  se_access_check: access (1) granted.
[2006/03/14 09:15:39, 8] smbd/trans2.c:get_lanman2_dir_entry(1079)
  get_lanman2_dir_entry:readdir on dirptr 0x847d578 now at offset 2120332928
[2006/03/14 09:15:39, 5] smbd/files.c:file_new(128)
  allocated file structure 9850, fnum = 13946 (18 used)
[2006/03/14 09:15:39, 5] smbd/open.c:open_file_stat(2028)
  open_file_stat: 'opening' file NOTES5/IMPROV.BMP
[2006/03/14 09:15:39, 10] smbd/posix_acls.c:get_nt_acl(2734)
  get_nt_acl: called for file NOTES5/IMPROV.BMP
[2006/03/14 09:15:39, 5] smbd/posix_acls.c:get_nt_acl(2771)
  get_nt_acl : file ACL present, directory ACL absent
[2006/03/14 09:15:39, 3] passdb/lookup_sid.c:fetch_sid_from_uid_cache(193)
  fetch sid from uid cache 500 -> S-1-5-21-2013498585-4159311833-597275497-2000
[2006/03/14 09:15:39, 3] passdb/lookup_sid.c:fetch_sid_from_gid_cache(267)
  fetch sid from gid cache 0 -> S-1-5-21-2013498585-4159311833-597275497-1001
[2006/03/14 09:15:39, 10] smbd/posix_acls.c:canonicalise_acl(2211)
  canonicalise_acl: Access ace entries before arrange :
[2006/03/14 09:15:39, 10] smbd/posix_acls.c:canonicalise_acl(2224)
  canon_ace index 0. Type = allow SID = S-1-1-0 other SMB_ACL_OTHER perms r-x
[2006/03/14 09:15:39, 10] smbd/posix_acls.c:canonicalise_acl(2224)
  canon_ace index 1. Type = allow SID = S-1-5-21-2013498585-4159311833-597275497-1001 gid 0 (root) SMB_ACL_GROUP_OBJ perms r-x
[2006/03/14 09:15:39, 10] smbd/posix_acls.c:canonicalise_acl(2224)
*** glibc detected *** free(): invalid pointer: 0xb7d5e0b8 ***
  canon_ace index 2. Type = allow SID = S-1-5-21-2013498585-4159311833-597275497-2000 ===============================================================

severity should be determined by the developers and not the reporter.

After many test I can summarize the situation like that :

The problem appear only on my servers IBM xseries XS206 8487 and XS225. I try to switch on a PC HP dc7600 with the same config and the pb doesn't occur. I try to reinstall the IBM server with a SLES9 too and it's Ok. So I think it is a compatibility issue between OS SUSE 9.2 PRO and the hardware IBM Xseries 206/225 and not a issue in samba.