While accessing the Security Settings on a windows XP client, the accessed Samba server crashes. this crash results in a hanging Security dialog, which will eventually recover, but without resolved SIDs. The Server runs with security=domain, but the error also occurres with security=ADS. At first the problem occurred after an update from Samba 3.0.2a to 3.0.23d. File Serving does work perfectly anyways, the user are just unable to change any permissions of their files. I'm using winbindd to resolve the usernames on the serverside, which are served by two native Win2003 Servers. lookup and SID-user/group mapping works perfectly when checked through wbinfo. Here is a log of the dump: [2007/01/04 14:46:46, 0] lib/fault.c:fault_report(41) =============================================================== [2007/01/04 14:46:46, 0] lib/fault.c:fault_report(42) INTERNAL ERROR: Signal 6 in pid 26364 (3.0.23d-6-1083-SUSE-SL10.2) Please read the Trouble-Shooting section of the Samba3-HOWTO [2007/01/04 14:46:46, 0] lib/fault.c:fault_report(44) From: http://www.samba.org/samba/docs/Samba3-HOWTO.pdf [2007/01/04 14:46:46, 0] lib/fault.c:fault_report(45) =============================================================== [2007/01/04 14:46:46, 0] lib/util.c:smb_panic(1599) PANIC (pid 26364): internal error [2007/01/04 14:46:46, 0] lib/util.c:log_stack_trace(1706) BACKTRACE: 24 stack frames: #0 /usr/sbin/smbd(log_stack_trace+0x1c) [0x55555575260c] #1 /usr/sbin/smbd(smb_panic+0x43) [0x5555557526f3] #2 /usr/sbin/smbd [0x555555740c72] #3 /lib64/libpthread.so.0 [0x2b9ac7711130] #4 /lib64/libc.so.6(gsignal+0x35) [0x2b9ac8a1a535] #5 /lib64/libc.so.6(abort+0x110) [0x2b9ac8a1b990] #6 /usr/sbin/smbd [0x555555757739] #7 /usr/sbin/smbd(talloc_steal+0x35) [0x5555557578e5] #8 /usr/sbin/smbd(lookup_sids+0x34e) [0x555555717cee] #9 /usr/sbin/smbd [0x555555666e5f] #10 /usr/sbin/smbd(_lsa_lookup_sids2+0x113) [0x5555556673f3] #11 /usr/sbin/smbd [0x555555663ce0] #12 /usr/sbin/smbd(api_rpcTNP+0x16d) [0x5555556b4d0d] #13 /usr/sbin/smbd(api_pipe_request+0x168) [0x5555556b5248] #14 /usr/sbin/smbd [0x5555556b1426] #15 /usr/sbin/smbd [0x5555556b18bd] #16 /usr/sbin/smbd [0x5555555ca413] #17 /usr/sbin/smbd [0x5555555ca7f2] #18 /usr/sbin/smbd(reply_trans+0x650) [0x5555555cb110] #19 /usr/sbin/smbd [0x555555617ac2] #20 /usr/sbin/smbd(smbd_process+0x720) [0x555555618aa0] #21 /usr/sbin/smbd(main+0xa0b) [0x5555557e4efb] #22 /lib64/libc.so.6(__libc_start_main+0xf4) [0x2b9ac8a07ae4] #23 /usr/sbin/smbd [0x5555555b21c9] [2007/01/04 14:46:46, 0] lib/fault.c:dump_core(168) unable to change to /var/log/samba/cores/smbdrefusing to dump core [2007/01/04 14:46:46, 2] auth/auth.c:check_ntlm_password(309) check_ntlm_password: authentication for user [thielt] -> [thielt] -> [BIT+thielt] succeeded [2007/01/04 14:46:46, 2] smbd/reply.c:reply_tcon_and_X(711) Serving IPC$ as a Dfs root [2007/01/04 14:46:46, 0] lib/fault.c:fault_report(41) =============================================================== [2007/01/04 14:46:46, 0] lib/fault.c:fault_report(42) INTERNAL ERROR: Signal 6 in pid 26380 (3.0.23d-6-1083-SUSE-SL10.2) Please read the Trouble-Shooting section of the Samba3-HOWTO [2007/01/04 14:46:46, 0] lib/fault.c:fault_report(44) From: http://www.samba.org/samba/docs/Samba3-HOWTO.pdf [2007/01/04 14:46:46, 0] lib/fault.c:fault_report(45) =============================================================== [2007/01/04 14:46:46, 0] lib/util.c:smb_panic(1599) PANIC (pid 26380): internal error [2007/01/04 14:46:46, 0] lib/util.c:log_stack_trace(1706) BACKTRACE: 24 stack frames: #0 /usr/sbin/smbd(log_stack_trace+0x1c) [0x55555575260c] #1 /usr/sbin/smbd(smb_panic+0x43) [0x5555557526f3] #2 /usr/sbin/smbd [0x555555740c72] #3 /lib64/libpthread.so.0 [0x2b9ac7711130] #4 /lib64/libc.so.6(gsignal+0x35) [0x2b9ac8a1a535] #5 /lib64/libc.so.6(abort+0x110) [0x2b9ac8a1b990] #6 /usr/sbin/smbd [0x555555757739] #7 /usr/sbin/smbd(talloc_steal+0x35) [0x5555557578e5] #8 /usr/sbin/smbd(lookup_sids+0x34e) [0x555555717cee] #9 /usr/sbin/smbd [0x555555666e5f] #10 /usr/sbin/smbd(_lsa_lookup_sids2+0x113) [0x5555556673f3] #11 /usr/sbin/smbd [0x555555663ce0] #12 /usr/sbin/smbd(api_rpcTNP+0x16d) [0x5555556b4d0d] #13 /usr/sbin/smbd(api_pipe_request+0x168) [0x5555556b5248] #14 /usr/sbin/smbd [0x5555556b1426] #15 /usr/sbin/smbd [0x5555556b18bd] #16 /usr/sbin/smbd [0x5555555ca413] #17 /usr/sbin/smbd [0x5555555ca7f2] #18 /usr/sbin/smbd(reply_trans+0x650) [0x5555555cb110] #19 /usr/sbin/smbd [0x555555617ac2] #20 /usr/sbin/smbd(smbd_process+0x720) [0x555555618aa0] #21 /usr/sbin/smbd(main+0xa0b) [0x5555557e4efb] #22 /lib64/libc.so.6(__libc_start_main+0xf4) [0x2b9ac8a07ae4] #23 /usr/sbin/smbd [0x5555555b21c9] [2007/01/04 14:46:46, 0] lib/fault.c:dump_core(168) unable to change to /var/log/samba/cores/smbdrefusing to dump core [2007/01/04 14:46:46, 2] auth/auth.c:check_ntlm_password(309) check_ntlm_password: authentication for user [thielt] -> [thielt] -> [BIT+thielt] succeeded [2007/01/04 14:46:46, 2] smbd/reply.c:reply_tcon_and_X(711) Serving IPC$ as a Dfs root [2007/01/04 14:46:46, 0] lib/fault.c:fault_report(41) =============================================================== [2007/01/04 14:46:46, 0] lib/fault.c:fault_report(42) INTERNAL ERROR: Signal 6 in pid 26381 (3.0.23d-6-1083-SUSE-SL10.2) Please read the Trouble-Shooting section of the Samba3-HOWTO [2007/01/04 14:46:46, 0] lib/fault.c:fault_report(44) From: http://www.samba.org/samba/docs/Samba3-HOWTO.pdf [2007/01/04 14:46:46, 0] lib/fault.c:fault_report(45) =============================================================== [2007/01/04 14:46:46, 0] lib/util.c:smb_panic(1599) PANIC (pid 26381): internal error [2007/01/04 14:46:46, 0] lib/util.c:log_stack_trace(1706) BACKTRACE: 24 stack frames: #0 /usr/sbin/smbd(log_stack_trace+0x1c) [0x55555575260c] #1 /usr/sbin/smbd(smb_panic+0x43) [0x5555557526f3] #2 /usr/sbin/smbd [0x555555740c72] #3 /lib64/libpthread.so.0 [0x2b9ac7711130] #4 /lib64/libc.so.6(gsignal+0x35) [0x2b9ac8a1a535] #5 /lib64/libc.so.6(abort+0x110) [0x2b9ac8a1b990] #6 /usr/sbin/smbd [0x555555757739] #7 /usr/sbin/smbd(talloc_steal+0x35) [0x5555557578e5] #8 /usr/sbin/smbd(lookup_sids+0x34e) [0x555555717cee] #9 /usr/sbin/smbd [0x555555666e5f] #10 /usr/sbin/smbd(_lsa_lookup_sids2+0x113) [0x5555556673f3] #11 /usr/sbin/smbd [0x555555663ce0] #12 /usr/sbin/smbd(api_rpcTNP+0x16d) [0x5555556b4d0d] #13 /usr/sbin/smbd(api_pipe_request+0x168) [0x5555556b5248] #14 /usr/sbin/smbd [0x5555556b1426] #15 /usr/sbin/smbd [0x5555556b18bd] #16 /usr/sbin/smbd [0x5555555ca413] #17 /usr/sbin/smbd [0x5555555ca7f2] #18 /usr/sbin/smbd(reply_trans+0x650) [0x5555555cb110] #19 /usr/sbin/smbd [0x555555617ac2] #20 /usr/sbin/smbd(smbd_process+0x720) [0x555555618aa0] #21 /usr/sbin/smbd(main+0xa0b) [0x5555557e4efb] #22 /lib64/libc.so.6(__libc_start_main+0xf4) [0x2b9ac8a07ae4] #23 /usr/sbin/smbd [0x5555555b21c9] [2007/01/04 14:46:46, 0] lib/fault.c:dump_core(168) unable to change to /var/log/samba/cores/smbdrefusing to dump core [2007/01/04 14:46:46, 2] auth/auth.c:check_ntlm_password(309) check_ntlm_password: authentication for user [thielt] -> [thielt] -> [BIT+thielt] succeeded [2007/01/04 14:46:46, 2] smbd/reply.c:reply_tcon_and_X(711) Serving IPC$ as a Dfs root [2007/01/04 14:46:46, 0] lib/fault.c:fault_report(41) =============================================================== [2007/01/04 14:46:46, 0] lib/fault.c:fault_report(42) INTERNAL ERROR: Signal 6 in pid 26382 (3.0.23d-6-1083-SUSE-SL10.2) Please read the Trouble-Shooting section of the Samba3-HOWTO [2007/01/04 14:46:46, 0] lib/fault.c:fault_report(44) From: http://www.samba.org/samba/docs/Samba3-HOWTO.pdf [2007/01/04 14:46:46, 0] lib/fault.c:fault_report(45) =============================================================== [2007/01/04 14:46:46, 0] lib/util.c:smb_panic(1599) PANIC (pid 26382): internal error [2007/01/04 14:46:46, 0] lib/util.c:log_stack_trace(1706) BACKTRACE: 24 stack frames: #0 /usr/sbin/smbd(log_stack_trace+0x1c) [0x55555575260c] #1 /usr/sbin/smbd(smb_panic+0x43) [0x5555557526f3] #2 /usr/sbin/smbd [0x555555740c72] #3 /lib64/libpthread.so.0 [0x2b9ac7711130] #4 /lib64/libc.so.6(gsignal+0x35) [0x2b9ac8a1a535] #5 /lib64/libc.so.6(abort+0x110) [0x2b9ac8a1b990] #6 /usr/sbin/smbd [0x555555757739] #7 /usr/sbin/smbd(talloc_steal+0x35) [0x5555557578e5] #8 /usr/sbin/smbd(lookup_sids+0x34e) [0x555555717cee] #9 /usr/sbin/smbd [0x555555666e5f] #10 /usr/sbin/smbd(_lsa_lookup_sids2+0x113) [0x5555556673f3] #11 /usr/sbin/smbd [0x555555663ce0] #12 /usr/sbin/smbd(api_rpcTNP+0x16d) [0x5555556b4d0d] #13 /usr/sbin/smbd(api_pipe_request+0x168) [0x5555556b5248] #14 /usr/sbin/smbd [0x5555556b1426] #15 /usr/sbin/smbd [0x5555556b18bd] #16 /usr/sbin/smbd [0x5555555ca413] #17 /usr/sbin/smbd [0x5555555ca7f2] #18 /usr/sbin/smbd(reply_trans+0x650) [0x5555555cb110] #19 /usr/sbin/smbd [0x555555617ac2] #20 /usr/sbin/smbd(smbd_process+0x720) [0x555555618aa0] #21 /usr/sbin/smbd(main+0xa0b) [0x5555557e4efb] #22 /lib64/libc.so.6(__libc_start_main+0xf4) [0x2b9ac8a07ae4] #23 /usr/sbin/smbd [0x5555555b21c9] [2007/01/04 14:46:46, 0] lib/fault.c:dump_core(168) unable to change to /var/log/samba/cores/smbdrefusing to dump core [2007/01/04 14:46:46, 2] auth/auth.c:check_ntlm_password(309) My global-config: [global] workgroup = BIT security = domain interfaces = 127.0.0.1 eth0 bind interfaces only = true printing = cups printcap name = cups printer admin = @ntadmin, root, administrator guest account = nobody map to guest = Bad User domain master = no local master = no winbind separator = + winbind cache time = 10 template shell = /bin/bash template homedir = /home/%D/%U idmap uid = 50000-60000 idmap gid = 50000-60000 password server = ad2.bit.uni-bonn.de ad3.bit.uni-bonn.de * winbind enum users = yes winbind enum groups = yes wins server = 131.220.148.68 netbios aliases = bitlpr bitsmb log level = 2 log file = /var/log/samba/log.smb.%m realm = BIT.UNI-BONN.DE usershare allow guests = No winbind refresh tickets = yes Here is another logfile with high debug level: api_rpcTNP: rpc command: LSA_LOOKUPSIDS2 [2007/01/04 15:11:27, 6] rpc_server/srv_pipe.c:api_rpcTNP(2284) api_rpc_cmds[30].fn == 0x555555663bf0 [2007/01/04 15:11:27, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 lsa_io_q_lookup_sids2 [2007/01/04 15:11:27, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_pol_hnd pol_hnd [2007/01/04 15:11:27, 5] rpc_parse/parse_prs.c:prs_uint32(704) 0000 data1: 00000000 [2007/01/04 15:11:27, 5] rpc_parse/parse_prs.c:prs_uint32(704) 0004 data2: 00000004 [2007/01/04 15:11:27, 5] rpc_parse/parse_prs.c:prs_uint16(675) 0008 data3: 0000 [2007/01/04 15:11:27, 5] rpc_parse/parse_prs.c:prs_uint16(675) 000a data4: 0000 [2007/01/04 15:11:27, 5] rpc_parse/parse_prs.c:prs_uint8s(851) 000c data5: 0f 0b 9d 45 af 67 00 00 [2007/01/04 15:11:27, 6] rpc_parse/parse_prs.c:prs_debug(84) 000014 lsa_io_sid_enum sids [2007/01/04 15:11:27, 5] rpc_parse/parse_prs.c:prs_uint32(704) 0014 num_entries : 00000001 [2007/01/04 15:11:27, 5] rpc_parse/parse_prs.c:prs_uint32(704) 0018 ptr_sid_enum: 000f62a8 [2007/01/04 15:11:27, 5] rpc_parse/parse_prs.c:prs_uint32(704) 001c num_entries2: 00000001 [2007/01/04 15:11:27, 5] rpc_parse/parse_prs.c:prs_uint32(704) 0020 ptr_sid[0]: 0121d1d8 [2007/01/04 15:11:27, 7] rpc_parse/parse_prs.c:prs_debug(84) 000024 smb_io_dom_sid2 sid[0] [2007/01/04 15:11:27, 5] rpc_parse/parse_prs.c:prs_uint32(704) 0024 num_auths: 00000005 [2007/01/04 15:11:27, 8] rpc_parse/parse_prs.c:prs_debug(84) 000028 smb_io_dom_sid sid [2007/01/04 15:11:27, 5] rpc_parse/parse_prs.c:prs_uint8(615) 0028 sid_rev_num: 01 [2007/01/04 15:11:27, 5] rpc_parse/parse_prs.c:prs_uint8(615) 0029 num_auths : 05 [2007/01/04 15:11:27, 5] rpc_parse/parse_prs.c:prs_uint8(615) 002a id_auth[0] : 00 [2007/01/04 15:11:27, 5] rpc_parse/parse_prs.c:prs_uint8(615) 002b id_auth[1] : 00 [2007/01/04 15:11:27, 5] rpc_parse/parse_prs.c:prs_uint8(615) 002c id_auth[2] : 00 [2007/01/04 15:11:27, 5] rpc_parse/parse_prs.c:prs_uint8(615) 002d id_auth[3] : 00 [2007/01/04 15:11:27, 5] rpc_parse/parse_prs.c:prs_uint8(615) 002e id_auth[4] : 00 [2007/01/04 15:11:27, 5] rpc_parse/parse_prs.c:prs_uint8(615) 002f id_auth[5] : 05 [2007/01/04 15:11:27, 5] rpc_parse/parse_prs.c:prs_uint32s(991) 0030 sub_auths : 00000015 0b01818b 8a95da6f 1f07cccc 00000510 [2007/01/04 15:11:27, 6] rpc_parse/parse_prs.c:prs_debug(84) 000044 lsa_io_trans_names2 names [2007/01/04 15:11:27, 5] rpc_parse/parse_prs.c:prs_uint32(704) 0044 num_entries : 00000000 [2007/01/04 15:11:27, 5] rpc_parse/parse_prs.c:prs_uint32(704) 0048 ptr_trans_names: 00000000 [2007/01/04 15:11:27, 5] rpc_parse/parse_prs.c:prs_uint16(675) 004c level: 0001 [2007/01/04 15:11:27, 5] rpc_parse/parse_prs.c:prs_uint32(704) 0050 mapped_count: 00000000 [2007/01/04 15:11:27, 5] rpc_parse/parse_prs.c:prs_uint32(704) 0054 unknown1: 00000000 [2007/01/04 15:11:27, 5] rpc_parse/parse_prs.c:prs_uint32(704) 0058 unknown2: 00000002 [2007/01/04 15:11:27, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 04 00 00 00 00 00 00 00 0F 0B 9D 45 ........ .......E [010] AF 67 00 00 .g.. [2007/01/04 15:11:27, 10] passdb/lookup_sid.c:check_dom_sid_to_level(625) Accepting SID S-1-5-21-184648075-2325076591-520604876 in level 1 [2007/01/04 15:11:27, 0] lib/fault.c:fault_report(41) =============================================================== [2007/01/04 15:11:27, 0] lib/fault.c:fault_report(42) INTERNAL ERROR: Signal 6 in pid 26543 (3.0.23d-6-1083-SUSE-SL10.2) Please read the Trouble-Shooting section of the Samba3-HOWTO [2007/01/04 15:11:27, 0] lib/fault.c:fault_report(44) From: http://www.samba.org/samba/docs/Samba3-HOWTO.pdf [2007/01/04 15:11:27, 0] lib/fault.c:fault_report(45) =============================================================== [2007/01/04 15:11:27, 0] lib/util.c:smb_panic(1599) PANIC (pid 26543): internal error [2007/01/04 15:11:27, 0] lib/util.c:log_stack_trace(1706) BACKTRACE: 24 stack frames: #0 /usr/sbin/smbd(log_stack_trace+0x1c) [0x55555575260c] #1 /usr/sbin/smbd(smb_panic+0x43) [0x5555557526f3] #2 /usr/sbin/smbd [0x555555740c72] #3 /lib64/libpthread.so.0 [0x2b2fff86c130] #4 /lib64/libc.so.6(gsignal+0x35) [0x2b3000b75535] #5 /lib64/libc.so.6(abort+0x110) [0x2b3000b76990] #6 /usr/sbin/smbd [0x555555757739] #7 /usr/sbin/smbd(talloc_steal+0x35) [0x5555557578e5] #8 /usr/sbin/smbd(lookup_sids+0x34e) [0x555555717cee] #9 /usr/sbin/smbd [0x555555666e5f] #10 /usr/sbin/smbd(_lsa_lookup_sids2+0x113) [0x5555556673f3] #11 /usr/sbin/smbd [0x555555663ce0] #12 /usr/sbin/smbd(api_rpcTNP+0x16d) [0x5555556b4d0d] #13 /usr/sbin/smbd(api_pipe_request+0x168) [0x5555556b5248] #14 /usr/sbin/smbd [0x5555556b1426] #15 /usr/sbin/smbd [0x5555556b18bd] #16 /usr/sbin/smbd [0x5555555ca413] #17 /usr/sbin/smbd [0x5555555ca7f2] #18 /usr/sbin/smbd(reply_trans+0x650) [0x5555555cb110] #19 /usr/sbin/smbd [0x555555617ac2] #20 /usr/sbin/smbd(smbd_process+0x720) [0x555555618aa0] #21 /usr/sbin/smbd(main+0xa0b) [0x5555557e4efb] #22 /lib64/libc.so.6(__libc_start_main+0xf4) [0x2b3000b62ae4] #23 /usr/sbin/smbd [0x5555555b21c9] [2007/01/04 15:11:27, 0] lib/fault.c:dump_core(168) unable to change to /var/log/samba/cores/smbdrefusing to dump core My uname -a: Linux fs1 2.6.18.2-34-default #1 SMP Mon Nov 27 11:46:27 UTC 2006 x86_64 x86_64 x86_64 GNU/Linux Its a productive Server which did work perfectly with the old samba version, using the same configuration. I would be very thankful for quick help...
Can you upload a debug level 10 log with a few thousand lines prior to that crash? Is it possible that you recompile with -g so that we get better stack traces? And, if possible it would be extremely helpful to run smbd under valgrind with the -g compile. I'm pretty sure that if I get that output the fix will be trivial. Thanks, Volker
(In reply to comment #1) OK, here you are, a loglevel 10 cutout of crash. If this will not help, I could recompile with the -g option, but would like to circumvent this, as this server is in productive use, with user who will get unhappy with their smb connection getting lost due to server restarts. ;) I will attach the log to this bug.
Created attachment 2248 [details] a few thousand lines of level 10 log of this bug
Created attachment 2249 [details] level 10 log of the same problem, but without the smbd crash this log resulted in a try to replicate the problem, which resulted in a list of unresolved SIDs on the client side, but this time without a panic of smbd.
I'm afraid I still don't see how this can happen. Further option: Get the valgrind log with -g which is not guaranteed to give results, or somehow get me enough info to reproduce it. But to be honest, I don't know how... Next option: That code has changed slightly for 3.0.24. So you might try the 3_0_24 branch on a test machine. Volker
Samba 3.0.x is not supported anymore.