smbtorture crashs when I make a ALL test. It seems to be the RAW-ACLS testcase TESTING SID_CREATOR_OWNER get the original sd set a sec desc allowing no write by CREATOR_OWNER (torture/raw/acls.c:557) Incorrect status ERRDOS:ERRnoaccess - should be NT_STATUS_OK TESTING FILE GENERIC BITS get the original sd =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= INTERNAL ERROR: Signal 11 in pid 7621 (4.0.0alpha8-GIT-af6316d) When I only run the RAW-ACLS testcase then i didn't get a sigsegv. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= INTERNAL ERROR: Signal 11 in pid 7621 (4.0.0alpha8-GIT-af6316d) Please read the file BUGS.txt in the distribution =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= PANIC: internal error BACKTRACE: 36 stack frames: #0 bin/smbtorture(call_backtrace+0x2b) [0x8b6e773] #1 bin/smbtorture(smb_panic+0x26e) [0x8b6eab9] #2 bin/smbtorture [0x8b6ec5c] #3 bin/smbtorture(fault_setup+0) [0x8b6ec91] #4 [0xb7f3a400] #5 bin/smbtorture(convert_string_talloc_convenience+0x6b) [0x8b7bcc9] #6 bin/smbtorture(ndr_pull_charset+0x123) [0x8a4c527] #7 bin/smbtorture [0x877e843] #8 bin/smbtorture [0x878256e] #9 bin/smbtorture(ndr_pull_ncacn_packet+0x221) [0x8782f4a] #10 bin/smbtorture [0x875cc43] #11 bin/smbtorture [0x875d804] #12 bin/smbtorture [0x8764161] #13 bin/smbtorture [0x87a8b5a] #14 bin/smbtorture(packet_recv+0x73c) [0x88437d4] #15 bin/smbtorture [0x87a7a99] #16 bin/smbtorture [0x8b63054] #17 bin/smbtorture [0x8b63704] #18 bin/smbtorture(_tevent_loop_once+0xdf) [0x8b5fc83] #19 bin/smbtorture(composite_wait+0x44) [0x888f511] #20 bin/smbtorture(dcerpc_bind_recv+0x28) [0x875df66] #21 bin/smbtorture(dcerpc_bind_auth_none_recv+0x25) [0x87607ae] #22 bin/smbtorture(dcerpc_bind_auth_none+0x41) [0x87607fd] #23 bin/smbtorture [0x87565fb] #24 bin/smbtorture(smblsa_sid_privileges+0x24) [0x875670f] #25 bin/smbtorture(smblsa_sid_check_privilege+0x8d) [0x87567fa] #26 bin/smbtorture [0x87404d3] #27 bin/smbtorture(torture_raw_acls+0xde) [0x874880b] #28 bin/smbtorture [0x875617e] #29 bin/smbtorture [0x8b5e4af] #30 bin/smbtorture(torture_run_tcase+0x16d) [0x8b5e750] #31 bin/smbtorture(torture_run_suite+0xc8) [0x8b5e1ce] #32 bin/smbtorture [0x80f716e] #33 bin/smbtorture(main+0xc3f) [0x80f8b70] #34 /lib/i686/cmov/libc.so.6(__libc_start_main+0xe5) [0xb7a7e455] #35 bin/smbtorture [0x80f6dc1]
Can you get a build with --enable-developer then use gdb --args bin/smbtorture RAW-ACLS ... and run bt full when it crashes? (The cause of this - a missing iconv_convenience somewhere - is known, but the details will help us figure out where better) Thanks,
I tried to get it working, but the gdb with smbtorture get pushd in the background again and again. Some wierd stuff is also going on: 1) a RAW-ACLS doesn't sigsegv 2) a RAW doesn't sigsegv, too 3) a ALL does I called a friend and he told me how I could attach gdb to a process and this is what came out with a ALL Program received signal SIGABRT, Aborted. [Switching to Thread 0xb7a0a6b0 (LWP 7543)] 0xb7ef2424 in __kernel_vsyscall () #0 0xb7ef2424 in __kernel_vsyscall () No symbol table info available. #1 0xb7a4b640 in raise () from /lib/i686/cmov/libc.so.6 No symbol table info available. #2 0xb7a4d018 in abort () from /lib/i686/cmov/libc.so.6 No symbol table info available. #3 0x08b85462 in talloc_abort ( reason=0x8d9cdc8 "Bad talloc magic value - unknown value") at ../lib/talloc/talloc.c:151 No locals. #4 0x08b854bc in talloc_abort_unknown_value () at ../lib/talloc/talloc.c:164 No locals. #5 0x08b85587 in talloc_chunk_from_ptr (ptr=0xbfb0b3b0) at ../lib/talloc/talloc.c:176 pp = 0xbfb0b3b0 "\237\025" tc = (struct talloc_chunk *) 0xbfb0b380 #6 0x08b859fa in _talloc_reference (context=0xa0a96e0, ptr=0xbfb0b3b0) at ../lib/talloc/talloc.c:474 tc = (struct talloc_chunk *) 0xb7a4ce21 handle = (struct talloc_reference_handle *) 0x9ff3430 #7 0x087a77c5 in smbcli_sock_connect_send (mem_ctx=0xa0c27a0, host_addr=0xa0ad6e8 "127.0.0.1", ports=0x9ff48e8, host_name=0xa04c9d0 "localhost", resolve_ctx=0x0, event_ctx=0xa04cc08, socket_options=0xbfb0b3b0 "\237\025") at libcli/raw/clisocket.c:81 result = (struct composite_context *) 0xa0a9690 ctx = (struct composite_context *) 0x8d8f858 state = (struct sock_connect_state *) 0xa0a96e0 i = 2 #8 0x0879f6a6 in connect_resolve (c=0xa0c2750, io=0xa0c44d8) at libcli/smb_composite/connect.c:377 state = (struct connect_state *) 0xa0c27a0 status = {v = 0} address = 0xa0ad6e8 "127.0.0.1" #9 0x0879f76d in state_handler (c=0xa0c2750) at libcli/smb_composite/connect.c:401 state = (struct connect_state *) 0xa0c27a0 #10 0x0879f91d in composite_handler (creq=0xa0a9690) at libcli/smb_composite/connect.c:451 c = (struct composite_context *) 0xa0c2750 #11 0x0888f954 in composite_trigger (ev=0xa04cc08, te=0xa092fc0, t= {tv_sec = 0, tv_usec = 0}, ptr=0xa0a9690) at libcli/composite/composite.c:101 c = (struct composite_context *) 0xa0a9690 #12 0x08b61555 in tevent_common_loop_timer_delay (ev=0xa04cc08) at ../lib/tevent/tevent_timed.c:254 current_time = {tv_sec = 0, tv_usec = 0} te = (struct tevent_timer *) 0xa092fc0 #13 0x08b640e4 in std_event_loop_once (ev=0xa04cc08, location=0x8cded3c "torture/raw/composite.c:185") at ../lib/tevent/tevent_standard.c:537 std_ev = (struct std_event_context *) 0xa04cc70 tval = {tv_sec = -1212713760, tv_usec = -1214208336} #14 0x08b606a7 in _tevent_loop_once (ev=0xa04cc08, location=0x8cded3c "torture/raw/composite.c:185") at ../lib/tevent/tevent.c:488 ret = 22 nesting_stack_ptr = (void *) 0x0 #15 0x0875203b in test_fetchfile (cli=0xa0aef20, tctx=0xa04ccb8) at torture/raw/composite.c:185 fname = 0x8cdeb08 "\\composite\\test.txt" status = {v = 0} io1 = {in = {fname = 0x8cdeb08 "\\composite\\test.txt", data = 0xa09f688 "bQ]\207;\2006�T\035[*)/�i\001y\027\002=7\006��\035\016\034TGI-\027\006?\201\b���<qP'j�:�\v�. \216\216Z\a\vѸ\201\\\206�\204XK�#(\0028g\201c\231Q��\205��o;��\207\221�2�)\003�3ۯ�&r�}�\016b�3_M \n�!\205pv��\0300��\005u_\211\213���\020�5.O�F�\2124H^ �\016�\226j\032߾\v��u\220�\237��d�", size = 5535}} io2 = {in = {dest_host = 0xa04c9d0 "localhost", ports = 0x9ff48e8, called_name = 0xa04c9d0 "localhost", service = 0xa04cab8 "test", service_type = 0x8cded0f "A:", socket_options = 0xbfb0b3b0 "\237\025", credentials = 0x9ff4b98, workgroup = 0x9ff33c0 "TNG-WORKGROUP", filename = 0x8cdeb08 "\\composite\\test.txt", options = {use_oplocks = 1, use_level2_oplocks = 1, use_spnego = 0, unicode = 1, ntstatus_support = 1, max_protocol = 5, max_xmit = 12288, max_mux = 50, request_timeout = 60, signing = SMB_SIGNING_SUPPORTED}, session_options = {lanman_auth = 0, ntlmv2_auth = 0, plaintext_auth = 0}, resolve_ctx = 0xa0b26b0, iconv_convenience = 0x9ff5db8, gensec_settings = 0xa0bff78}, out = { data = 0xbfb0b398 "\237\025", size = 3221225761}} c = (struct composite_context **) 0xa0b8b30 data = ( uint8_t *) 0xa09f688 "bQ]\207;\2006�T\035[*)/�i\001y\027\002=7\006��\035\016\034TGI-\027\006?\201\b���<qP'j�:�\v�. \216\216Z\a\vѸ\201\\\206�\204XK�#(\0028g\201c\231Q��\205��o;��\207\221�2�)\003�3ۯ�&r�}�\016b�3_M \n�!\205pv��\0300��\005u_\211\213���\020�5.O�F�\2124H^ �\016�\226j\032߾\v��u\220�\237��d�" i = 10 len = 5535 event_ctx = (struct tevent_context *) 0xa04cc08 count = (int *) 0xa0af4b0 ret = true #16 0x08752b81 in torture_raw_composite (tctx=0xa04ccb8, cli=0xa0aef20) at torture/raw/composite.c:421 ret = true #17 0x087565aa in wrap_simple_1smb_test (torture_ctx=0xa04ccb8, tcase=0xa005cd0, test=0xa005d68) at torture/util_smb.c:842 fn = (_Bool (*)(struct torture_context *, struct smbcli_state *)) 0x8752b2f <torture_raw_composite> ret = 10 cli1 = (struct smbcli_state *) 0xa0aef20 #18 0x08b5eeb5 in internal_torture_run_test (context=0xa04ccb8, tcase=0xa005cd0, test=0xa005d68, already_setup=true) at ../lib/torture/torture.c:341 success = 191 old_testname = 0x0 #19 0x08b5f156 in torture_run_tcase (context=0xa04ccb8, tcase=0xa005cd0) at ../lib/torture/torture.c:400 ret = true old_testname = 0xa04dd90 "RAW" test = (struct torture_test *) 0xa005d68 #20 0x08b5ebd4 in torture_run_suite (context=0xa04ccb8, suite=0x9fff300) at ../lib/torture/torture.c:270 ret = false tcase = (struct torture_tcase *) 0xa005cd0 tsuite = (struct torture_suite *) 0xbfb0b440 old_testname = 0x0 #21 0x080f716e in run_test (torture=0xa04ccb8, name=0x9ff4d40 "all") at torture/smbtorture.c:113 ret = true matched = false o = (struct torture_suite *) 0x9fff300 #22 0x080f8b70 in main (argc=7, argv=0xbfb0b924) at torture/smbtorture.c:662 opt = -1 i = 2 correct = true max_runtime = 0 argc_new = 3 torture = (struct torture_context *) 0xa04ccb8 results = (struct torture_results *) 0xa04cbc8 ui_ops = (const struct torture_ui_ops *) 0x8d9e020 argv_new = (char **) 0x9ff21c8 pc = (poptContext) 0x9ff2028 status = {v = 3080845244} shell = 0 basedir = 0x0 extra_module = 0x0 num_extra_users = 0 long_options = {{longName = 0x0, shortName = 0 '\0', argInfo = 4, arg = 0xb7b84c00, val = 0, descrip = 0x8b89290 "Help options:", argDescrip = 0x0}, { longName = 0x8b8929e "format", shortName = 0 '\0', argInfo = 1, arg = 0x8db1e28, val = 0, descrip = 0x8b892a8 "Output format (one of: simple, subunit)", argDescrip = 0x0}, {longName = 0x8b892d0 "smb-ports", shortName = 112 'p', argInfo = 1, arg = 0x0, val = 1006, descrip = 0x8b892da "SMB ports", argDescrip = 0x0}, {longName = 0x8b892e4 "basedir", shortName = 0 '\0', argInfo = 1, arg = 0xbfb0b830, val = 0, descrip = 0x8b892ec "base directory", argDescrip = 0x8b892fb "BASEDIR"}, {longName = 0x8b89303 "seed", shortName = 0 '\0', argInfo = 2, arg = 0x8dbf5ec, val = 0, descrip = 0x8b89308 "Seed to use for randomizer", argDescrip = 0x0}, { longName = 0x8b89323 "num-progs", shortName = 0 '\0', argInfo = 2, arg = 0x0, val = 1008, descrip = 0x8b8932d "num progs", argDescrip = 0x0}, { longName = 0x8b89337 "num-ops", shortName = 0 '\0', argInfo = 2, arg = 0x8db1e30, val = 0, descrip = 0x8b8933f "num ops", argDescrip = 0x0}, { longName = 0x8b89347 "entries", shortName = 0 '\0', argInfo = 2, arg = 0x8db1e34, val = 0, descrip = 0x8b89347 "entries", argDescrip = 0x0}, { longName = 0x8b8934f "loadfile", shortName = 0 '\0', argInfo = 1, arg = 0x0, val = 1000, descrip = 0x8b89358 "NBench load file to use", argDescrip = 0x0}, { longName = 0x8b89370 "list", shortName = 0 '\0', argInfo = 0, arg = 0x8dbf5e8, val = 0, descrip = 0x8b89375 "List available tests and exit", argDescrip = 0x0}, { longName = 0x8b89393 "unclist", shortName = 0 '\0', argInfo = 1, arg = 0x0, val = 1001, descrip = 0x8b89393 "unclist", argDescrip = 0x0}, { longName = 0x8b8939b "timelimit", shortName = 116 't', argInfo = 2, arg = 0x0, val = 1002, descrip = 0x8b893a5 "Set time limit (in seconds)", argDescrip = 0x0}, { longName = 0x8b893c1 "failures", shortName = 102 'f', argInfo = 2, arg = 0x8db1e38, val = 0, descrip = 0x8b893c1 "failures", argDescrip = 0x0}, { longName = 0x8b893ca "parse-dns", shortName = 68 'D', argInfo = 1, arg = 0x0, val = 1003, descrip = 0x8b893ca "parse-dns", argDescrip = 0x0}, { longName = 0x8b893d4 "dangerous", shortName = 88 'X', argInfo = 0, arg = 0x0, val = 1005, descrip = 0x8b893e0 "run dangerous tests (eg. wiping out password database)", argDescrip = 0x0}, {longName = 0x8b89417 "load-module", shortName = 0 '\0', argInfo = 1, arg = 0xbfb0b82c, val = 0, descrip = 0x8b89423 "load tests from DSO file", argDescrip = 0x8b8943c "SOFILE"}, { longName = 0x8b89443 "shell", shortName = 0 '\0', argInfo = 0, arg = 0xbfb0b834, val = 1, descrip = 0x8b89449 "Run shell", argDescrip = 0x0}, { longName = 0x8b89453 "target", shortName = 84 'T', argInfo = 1, arg = 0x8db1e2c, val = 0, descrip = 0x8b8945a "samba3|samba4|other", argDescrip = 0x0}, { longName = 0x8b8946e "async", shortName = 97 'a', argInfo = 0, arg = 0x0, val = 1007, descrip = 0x8b89474 "run async tests", argDescrip = 0x0}, { longName = 0x8b89484 "num-async", shortName = 0 '\0', argInfo = 2, arg = 0x8db1e3c, val = 0, descrip = 0x8b89490 "number of simultaneous async requests", argDescrip = 0x0}, {longName = 0x8b894b6 "maximum-runtime", shortName = 0 '\0', argInfo = 2, arg = 0xbfb0b83c, val = 0, descrip = 0x8b894c8 "set maximum time for smbtorture to live", argDescrip = 0x8b894f0 "seconds"}, {longName = 0x8b894f8 "extra-user", shortName = 0 '\0', argInfo = 1, arg = 0x0, val = 1009, descrip = 0x8b89503 "extra user credentials", argDescrip = 0x0}, {longName = 0x0, shortName = 0 '\0', argInfo = 4, arg = 0x8dbe480, val = 0, descrip = 0x8b8951a "Common samba options:", argDescrip = 0x0}, {longName = 0x0, shortName = 0 '\0', argInfo = 4, arg = 0x8dbe360, val = 0, descrip = 0x8b89530 "Connection options:", argDescrip = 0x0}, {longName = 0x0, shortName = 0 '\0', argInfo = 4, arg = 0x8db92c0, val = 0, descrip = 0x8b89544 "Authentication options:", argDescrip = 0x0}, {longName = 0x0, shortName = 0 '\0', argInfo = 4, arg = 0x8dbe580, val = 0, descrip = 0x8b8951a "Common samba options:", argDescrip = 0x0}, {longName = 0x0, shortName = 0 '\0', argInfo = 0, arg = 0x0, val = 0, descrip = 0x0, argDescrip = 0x0}} target = 0x8b8928a "other" ui_ops_name = 0x8b89283 "simple" list_tests = 0 But I think this is a different failure bcause it's a sigabrt
Hello Andrew, did the information help?
It could be due to your OS (Linux) distribution (system library bugs). Any chance to relaunch the torture suite on another machine/environment? So we should know more.
Hello Matthias, I updated my environment to debian/testing and there is the same Problem. I made a gdb bt Program received signal SIGABRT, Aborted. [Switching to Thread 0xb7b4a6c0 (LWP 23161)] 0xb7f1c424 in __kernel_vsyscall () (gdb) bt #0 0xb7f1c424 in __kernel_vsyscall () #1 0xb7b77680 in raise () from /lib/i686/cmov/libc.so.6 #2 0xb7b7ad68 in abort () from /lib/i686/cmov/libc.so.6 #3 0x08b8f276 in talloc_abort (reason=0x8da9b48 "Bad talloc magic value - unknown value") at ../lib/talloc/talloc.c:151 #4 0x08b8f2d0 in talloc_abort_unknown_value () at ../lib/talloc/talloc.c:164 #5 0x08b8f39b in talloc_chunk_from_ptr (ptr=0xbf839810) at ../lib/talloc/talloc.c:176 #6 0x08b8f80e in _talloc_reference (context=0x9a585c8, ptr=0xbf839810) at ../lib/talloc/talloc.c:474 #7 0x087b1ded in smbcli_sock_connect_send (mem_ctx=0x9a6c980, host_addr=0x9a5f288 "127.0.0.1", ports=0x99a88c8, host_name=0x99f8e58 "localhost", resolve_ctx=0x0, event_ctx=0x99f9078, socket_options=0xbf839810 "�\f") at libcli/raw/clisocket.c:81 #8 0x087a9c3e in connect_resolve (c=0x9a6c930, io=0x9a57fc8) at libcli/smb_composite/connect.c:377 #9 0x087a9d05 in state_handler (c=0x9a6c930) at libcli/smb_composite/connect.c:401 #10 0x087a9eb5 in composite_handler (creq=0x9a585c8) at libcli/smb_composite/connect.c:451 #11 0x08896a30 in composite_trigger (ev=0x99f9078, te=0x9a5da28, t={tv_sec = 0, tv_usec = 0}, ptr=0x9a585c8) at libcli/composite/composite.c:101 #12 0x08b6ac1d in tevent_common_loop_timer_delay (ev=0x99f9078) at ../lib/tevent/tevent_timed.c:254 #13 0x08b6d7d0 in std_event_loop_once (ev=0x99f9078, location=0x8cec81c "torture/raw/composite.c:185") at ../lib/tevent/tevent_standard.c:537 #14 0x08b69d6f in _tevent_loop_once (ev=0x99f9078, location=0x8cec81c "torture/raw/composite.c:185") at ../lib/tevent/tevent.c:488 #15 0x0875c52f in test_fetchfile (cli=0x9a55c28, tctx=0x99f9128) at torture/raw/composite.c:185 #16 0x0875d074 in torture_raw_composite (tctx=0x99f9128, cli=0x9a55c28) at torture/raw/composite.c:421 #17 0x08760a9a in wrap_simple_1smb_test (torture_ctx=0x99f9128, tcase=0x99af6a0, test=0x99af738) at torture/util_smb.c:842 #18 0x08b6857d in internal_torture_run_test (context=0x99f9128, tcase=0x99af6a0, test=0x99af738, already_setup=true) at ../lib/torture/torture.c:341 #19 0x08b6881e in torture_run_tcase (context=0x99f9128, tcase=0x99af6a0) at ../lib/torture/torture.c:400 #20 0x08b6829c in torture_run_suite (context=0x99f9128, suite=0x99a73a0) at ../lib/torture/torture.c:270 #21 0x080f6e05 in run_matching (torture=0x99f9128, prefix=0x0, expr=0x99a8eb8 "RAW", suite=0x0, matched=0xbf83999a) at torture/smbtorture.c:56 #22 0x080f70dc in run_test (torture=0x99f9128, name=0x99a8eb8 "RAW") at torture/smbtorture.c:118 #23 0x080f8a8f in main (argc=7, argv=0xbf839dd4) at torture/smbtorture.c:662 Maybe this will help you to pinpoint the problem.
If I rember it right, I think I got also once this error when running "smbtorture ALL" after a long series of tests (system is Ubuntu 6.06). Maybe could it be due to the lack of (RAM) memory?
I don't know what to do with this bug. It seems to me that the cause is the lack of memory on the test machine. I e.g. got the bug after a long series of tests and therefore it could be, that the memory has been completely filled. Running the failing test alone it worked like a charm. Please provide your thoughts, otherwise I would prefer to close this bug - since I don't thing it's really one.
Hello Matthias, I don't think low memory does trigger this. My system doesn't swap at all and, as far as I can tell, there is enough memory for the server and the smbtorture on the machine.
I agree this looks like a real bug, and no, it's unlikely to be things like low memory. What is the exact smbtorture command in use here?
Good, I for example got the problem with "smbtorture localhost ALL" (but after many tests). I think the reporter got it also with smbtorture ALL.
Does the error still persist? (We make progress from time to time, fix error cases; therefore I reask).
I close this for now, if the problem still persists - please reopen!