Bug 7168 - Ricoh MP C2800 PCL5 driver causes smbd crashes in 3.4.5
Ricoh MP C2800 PCL5 driver causes smbd crashes in 3.4.5
Status: RESOLVED FIXED
Product: Samba 3.4
Classification: Unclassified
Component: Printing
3.4.5
Other Windows XP
: P3 major
: ---
Assigned To: Guenther Deschner
Samba QA Contact
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2010-02-22 07:38 UTC by Arvid de Jong
Modified: 2010-03-19 06:17 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Arvid de Jong 2010-02-22 07:38:01 UTC
On a Dell PowerEdge 840 with SLES10sp3(x86_64) I upgraded from the stable Samba(3.0.36) to 3.4.5 because of a Win 2008R2 installation that needed to be added to the domain.
This all went fine except for one of our two main printers, the printer driver causes the samba processes of the user that tries to use the printer with that driver to crash.

Users are either using Win 2000 or WinXP.

The driver causing the problems can be found here:
http://support.ricoh.com/bb/pub_e/dr_ut_e/0001159/0001159743/V1200/r37978en.exe

It's the driver for the Ricoh MP C2800.

Our other printer is a Nashuatec DSM627, which works fine, so currently I use that driver for the MPC2800 too, that works, but that has no color so I have to install the MPC2800 driver locally for users that really need color.

This was in the logs(some repeated errors have been removed):
[2010/02/04 11:54:55,  1] smbd/service.c:1047(make_connection_snum)
   pc203 (::ffff:192.168.0.71) connect to service print$ initially as 
user frits (uid=509, gid=10000) (pid 28311)
[2010/02/04 11:54:55,  0] lib/fault.c:46(fault_report)
   ===============================================================
[2010/02/04 11:54:55,  0] lib/fault.c:47(fault_report)
   INTERNAL ERROR: Signal 6 in pid 7577 (3.4.5-1.1-2280-SUSE-CODE10)
   Please read the Trouble-Shooting section of the Samba3-HOWTO
[2010/02/04 11:54:55,  0] lib/fault.c:49(fault_report)

   From: http://www.samba.org/samba/docs/Samba3-HOWTO.pdf
[2010/02/04 11:54:55,  0] lib/fault.c:50(fault_report)
   ===============================================================
[2010/02/04 11:54:55,  0] lib/util.c:1480(smb_panic)
   PANIC (pid 7577): internal error
[2010/02/04 11:54:55,  0] lib/util.c:1584(log_stack_trace)
   BACKTRACE: 28 stack frames:
    #0 /usr/sbin/smbd(log_stack_trace+0x1c) [0x55555582fc2c]
    #1 /usr/sbin/smbd(smb_panic+0x2b) [0x55555582fcfb]
    #2 /usr/sbin/smbd [0x55555581ff6e]
    #3 /lib64/libc.so.6 [0x2ab566a89fc0]
    #4 /lib64/libc.so.6(gsignal+0x35) [0x2ab566a89f45]
    #5 /lib64/libc.so.6(abort+0x110) [0x2ab566a8b340]
    #6 /usr/lib64/libtalloc.so.1 [0x2ab566623bff]
    #7 /usr/lib64/libtalloc.so.1 [0x2ab566624ac5]
    #8 /usr/lib64/libtalloc.so.1(talloc_free+0xd0) [0x2ab566627ad0]
    #9 /usr/sbin/smbd [0x55555579a028]
    #10 /usr/sbin/smbd(api_pipe_request+0x23a) [0x5555557bf5ca]
    #11 /usr/sbin/smbd [0x5555557bb444]
    #12 /usr/sbin/smbd(np_write_send+0x66b) [0x5555557bbadb]
    #13 /usr/sbin/smbd [0x55555561c199]
    #14 /usr/sbin/smbd [0x55555561c60b]
    #15 /usr/sbin/smbd(reply_trans+0x56e) [0x55555561d3ee]
    #16 /usr/sbin/smbd [0x5555556759a4]
    #17 /usr/sbin/smbd [0x555555678203]
    #18 /usr/sbin/smbd [0x5555556785b8]
    #19 /usr/sbin/smbd(run_events+0x10f) [0x55555583ed3f]
    #20 /usr/sbin/smbd(smbd_process+0x7a3) [0x555555677ad3]
    #21 /usr/sbin/smbd [0x555555aaae0e]
    #22 /usr/sbin/smbd(run_events+0x10f) [0x55555583ed3f]
    #23 /usr/sbin/smbd [0x55555583ef91]
    #24 /usr/sbin/smbd(_tevent_loop_once+0x90) [0x55555583f360]
    #25 /usr/sbin/smbd(main+0xe6c) [0x555555aaa9cc]
    #26 /lib64/libc.so.6(__libc_start_main+0xf4) [0x2ab566a77304]
    #27 /usr/sbin/smbd [0x5555556026f9]
[2010/02/04 11:54:55,  0] lib/fault.c:326(dump_core)
   dumping core in /var/log/samba/cores/smbd
[2010/02/04 11:54:55,  1] ../librpc/ndr/ndr.c:374(ndr_pull_error)
   ndr_pull_error(11): Pull bytes 4
[2010/02/04 11:54:55,  0] lib/fault.c:46(fault_report)
   ===============================================================
[2010/02/04 11:54:55,  0] lib/fault.c:47(fault_report)
   INTERNAL ERROR: Signal 6 in pid 10745 (3.4.5-1.1-2280-SUSE-CODE10)
   Please read the Trouble-Shooting section of the Samba3-HOWTO
[2010/02/04 11:54:55,  0] lib/fault.c:49(fault_report)

   From: http://www.samba.org/samba/docs/Samba3-HOWTO.pdf
[2010/02/04 11:54:55,  0] lib/fault.c:50(fault_report)
   ===============================================================
[2010/02/04 11:54:55,  0] lib/util.c:1480(smb_panic)
   PANIC (pid 10745): internal error
[2010/02/04 11:54:55,  0] lib/util.c:1584(log_stack_trace)
   BACKTRACE: 28 stack frames:
    #0 /usr/sbin/smbd(log_stack_trace+0x1c) [0x55555582fc2c]
    #1 /usr/sbin/smbd(smb_panic+0x2b) [0x55555582fcfb]
    #2 /usr/sbin/smbd [0x55555581ff6e]
    #3 /lib64/libc.so.6 [0x2ab566a89fc0]
    #4 /lib64/libc.so.6(gsignal+0x35) [0x2ab566a89f45]
    #5 /lib64/libc.so.6(abort+0x110) [0x2ab566a8b340]
    #6 /usr/lib64/libtalloc.so.1 [0x2ab566623bff]
    #7 /usr/lib64/libtalloc.so.1 [0x2ab566624ac5]
    #8 /usr/lib64/libtalloc.so.1(talloc_free+0xd0) [0x2ab566627ad0]
    #9 /usr/sbin/smbd [0x55555579a028]
    #10 /usr/sbin/smbd(api_pipe_request+0x23a) [0x5555557bf5ca]
    #11 /usr/sbin/smbd [0x5555557bb444]
    #12 /usr/sbin/smbd(np_write_send+0x66b) [0x5555557bbadb]
    #13 /usr/sbin/smbd [0x55555561c199]
    #14 /usr/sbin/smbd [0x55555561c60b]
    #15 /usr/sbin/smbd(reply_trans+0x56e) [0x55555561d3ee]
    #16 /usr/sbin/smbd [0x5555556759a4]
    #17 /usr/sbin/smbd [0x555555678203]
    #18 /usr/sbin/smbd [0x5555556785b8]
    #19 /usr/sbin/smbd(run_events+0x10f) [0x55555583ed3f]
    #20 /usr/sbin/smbd(smbd_process+0x7a3) [0x555555677ad3]
    #21 /usr/sbin/smbd [0x555555aaae0e]
    #22 /usr/sbin/smbd(run_events+0x10f) [0x55555583ed3f]
    #23 /usr/sbin/smbd [0x55555583ef91]
    #24 /usr/sbin/smbd(_tevent_loop_once+0x90) [0x55555583f360]
    #25 /usr/sbin/smbd(main+0xe6c) [0x555555aaa9cc]
    #26 /lib64/libc.so.6(__libc_start_main+0xf4) [0x2ab566a77304]
    #27 /usr/sbin/smbd [0x5555556026f9]
[2010/02/04 11:54:55,  0] lib/fault.c:326(dump_core)
   dumping core in /var/log/samba/cores/smbd
[2010/02/04 11:54:55,  1] ../librpc/ndr/ndr.c:374(ndr_pull_error)
   ndr_pull_error(11): Pull bytes 4
[2010/02/04 11:54:55,  0] lib/fault.c:46(fault_report)
   ===============================================================
[2010/02/04 11:54:55,  0] lib/fault.c:47(fault_report)
   INTERNAL ERROR: Signal 6 in pid 10747 (3.4.5-1.1-2280-SUSE-CODE10)
   Please read the Trouble-Shooting section of the Samba3-HOWTO
[2010/02/04 11:54:55,  0] lib/fault.c:49(fault_report)

   From: http://www.samba.org/samba/docs/Samba3-HOWTO.pdf
[2010/02/04 11:54:55,  0] lib/fault.c:50(fault_report)
   ===============================================================
[2010/02/04 11:54:55,  0] lib/util.c:1480(smb_panic)
   PANIC (pid 10747): internal error
[2010/02/04 11:54:55,  0] lib/util.c:1584(log_stack_trace)
   BACKTRACE: 28 stack frames:
    #0 /usr/sbin/smbd(log_stack_trace+0x1c) [0x55555582fc2c]
    #1 /usr/sbin/smbd(smb_panic+0x2b) [0x55555582fcfb]
    #2 /usr/sbin/smbd [0x55555581ff6e]
    #3 /lib64/libc.so.6 [0x2ab566a89fc0]
    #4 /lib64/libc.so.6(gsignal+0x35) [0x2ab566a89f45]
    #5 /lib64/libc.so.6(abort+0x110) [0x2ab566a8b340]
    #6 /usr/lib64/libtalloc.so.1 [0x2ab566623bff]
    #7 /usr/lib64/libtalloc.so.1 [0x2ab566624ac5]
    #8 /usr/lib64/libtalloc.so.1(talloc_free+0xd0) [0x2ab566627ad0]
    #9 /usr/sbin/smbd [0x55555579a028]
    #10 /usr/sbin/smbd(api_pipe_request+0x23a) [0x5555557bf5ca]
    #11 /usr/sbin/smbd [0x5555557bb444]
    #12 /usr/sbin/smbd(np_write_send+0x66b) [0x5555557bbadb]
    #13 /usr/sbin/smbd [0x55555561c199]
    #14 /usr/sbin/smbd [0x55555561c60b]
    #15 /usr/sbin/smbd(reply_trans+0x56e) [0x55555561d3ee]
    #16 /usr/sbin/smbd [0x5555556759a4]
    #17 /usr/sbin/smbd [0x555555678203]
    #18 /usr/sbin/smbd [0x5555556785b8]
    #19 /usr/sbin/smbd(run_events+0x10f) [0x55555583ed3f]
    #20 /usr/sbin/smbd(smbd_process+0x7a3) [0x555555677ad3]
    #21 /usr/sbin/smbd [0x555555aaae0e]
    #22 /usr/sbin/smbd(run_events+0x10f) [0x55555583ed3f]
    #23 /usr/sbin/smbd [0x55555583ef91]
    #24 /usr/sbin/smbd(_tevent_loop_once+0x90) [0x55555583f360]
    #25 /usr/sbin/smbd(main+0xe6c) [0x555555aaa9cc]
    #26 /lib64/libc.so.6(__libc_start_main+0xf4) [0x2ab566a77304]
    #27 /usr/sbin/smbd [0x5555556026f9]
[2010/02/04 11:54:55,  0] lib/fault.c:326(dump_core)
   dumping core in /var/log/samba/cores/smbd
[2010/02/04 11:54:55,  1] ../librpc/ndr/ndr.c:374(ndr_pull_error)
   ndr_pull_error(11): Pull bytes 4
[2010/02/04 11:54:55,  1] ../librpc/ndr/ndr.c:374(ndr_pull_error)
   ndr_pull_error(11): Pull bytes 4
[2010/02/04 11:54:55,  1] ../librpc/ndr/ndr.c:374(ndr_pull_error)
   ndr_pull_error(11): Pull bytes 4
[2010/02/04 11:54:55,  1] ../librpc/ndr/ndr.c:374(ndr_pull_error)
   ndr_pull_error(11): Pull bytes 4
[2010/02/04 11:54:55,  1] ../librpc/ndr/ndr.c:374(ndr_pull_error)
   ndr_pull_error(11): Pull bytes 4
[2010/02/04 11:54:55,  1] ../librpc/ndr/ndr.c:374(ndr_pull_error)
   ndr_pull_error(11): Pull bytes 4
[2010/02/04 11:54:55,  1] ../librpc/ndr/ndr.c:374(ndr_pull_error)
   ndr_pull_error(11): Pull bytes 4
[2010/02/04 11:54:55,  1] ../librpc/ndr/ndr.c:374(ndr_pull_error)
   ndr_pull_error(11): Pull bytes 4
[2010/02/04 11:54:55,  1] ../librpc/ndr/ndr.c:374(ndr_pull_error)
   ndr_pull_error(11): Pull bytes 4
[2010/02/04 11:54:55,  1] ../librpc/ndr/ndr.c:374(ndr_pull_error)
   ndr_pull_error(11): Pull bytes 4
[2010/02/04 11:54:55,  1] ../librpc/ndr/ndr.c:374(ndr_pull_error)
   ndr_pull_error(11): Pull bytes 4
[2010/02/04 11:54:55,  1] ../librpc/ndr/ndr.c:374(ndr_pull_error)
   ndr_pull_error(11): Pull bytes 4
[2010/02/04 11:54:55,  0] lib/fault.c:46(fault_report)
   ===============================================================
[2010/02/04 11:54:55,  0] lib/fault.c:47(fault_report)
   INTERNAL ERROR: Signal 6 in pid 10749 (3.4.5-1.1-2280-SUSE-CODE10)
   Please read the Trouble-Shooting section of the Samba3-HOWTO
[2010/02/04 11:54:55,  0] lib/fault.c:49(fault_report)

   From: http://www.samba.org/samba/docs/Samba3-HOWTO.pdf
[2010/02/04 11:54:55,  0] lib/fault.c:50(fault_report)
   ===============================================================
[2010/02/04 11:54:55,  0] lib/util.c:1480(smb_panic)
   PANIC (pid 10749): internal error
[2010/02/04 11:54:55,  0] lib/util.c:1584(log_stack_trace)
   BACKTRACE: 28 stack frames:
    #0 /usr/sbin/smbd(log_stack_trace+0x1c) [0x55555582fc2c]
    #1 /usr/sbin/smbd(smb_panic+0x2b) [0x55555582fcfb]
    #2 /usr/sbin/smbd [0x55555581ff6e]
    #3 /lib64/libc.so.6 [0x2ab566a89fc0]
    #4 /lib64/libc.so.6(gsignal+0x35) [0x2ab566a89f45]
    #5 /lib64/libc.so.6(abort+0x110) [0x2ab566a8b340]
    #6 /usr/lib64/libtalloc.so.1 [0x2ab566623bff]
    #7 /usr/lib64/libtalloc.so.1 [0x2ab566624ac5]
    #8 /usr/lib64/libtalloc.so.1(talloc_free+0xd0) [0x2ab566627ad0]
    #9 /usr/sbin/smbd [0x55555579a028]
    #10 /usr/sbin/smbd(api_pipe_request+0x23a) [0x5555557bf5ca]
    #11 /usr/sbin/smbd [0x5555557bb444]
    #12 /usr/sbin/smbd(np_write_send+0x66b) [0x5555557bbadb]
    #13 /usr/sbin/smbd [0x55555561c199]
    #14 /usr/sbin/smbd [0x55555561c60b]
    #15 /usr/sbin/smbd(reply_trans+0x56e) [0x55555561d3ee]
    #16 /usr/sbin/smbd [0x5555556759a4]
    #17 /usr/sbin/smbd [0x555555678203]
    #18 /usr/sbin/smbd [0x5555556785b8]
    #19 /usr/sbin/smbd(run_events+0x10f) [0x55555583ed3f]
    #20 /usr/sbin/smbd(smbd_process+0x7a3) [0x555555677ad3]
    #21 /usr/sbin/smbd [0x555555aaae0e]
    #22 /usr/sbin/smbd(run_events+0x10f) [0x55555583ed3f]
    #23 /usr/sbin/smbd [0x55555583ef91]
    #24 /usr/sbin/smbd(_tevent_loop_once+0x90) [0x55555583f360]
    #25 /usr/sbin/smbd(main+0xe6c) [0x555555aaa9cc]
    #26 /lib64/libc.so.6(__libc_start_main+0xf4) [0x2ab566a77304]
    #27 /usr/sbin/smbd [0x5555556026f9]
[2010/02/04 11:54:55,  0] lib/fault.c:326(dump_core)
   dumping core in /var/log/samba/cores/smbd
[2010/02/04 11:54:55,  1] ../librpc/ndr/ndr.c:374(ndr_pull_error)
   ndr_pull_error(11): Pull bytes 4
[2010/02/04 11:54:55,  1] ../librpc/ndr/ndr.c:374(ndr_pull_error)
   ndr_pull_error(11): Pull bytes 4
[2010/02/04 11:54:55,  1] ../librpc/ndr/ndr.c:374(ndr_pull_error)
   ndr_pull_error(11): Pull bytes 4
[2010/02/04 11:54:55,  1] ../librpc/ndr/ndr.c:374(ndr_pull_error)
   ndr_pull_error(11): Pull bytes 4
Comment 1 Arvid de Jong 2010-02-22 07:39:12 UTC
The driver worked fine in 3.0.36
Comment 2 Guenther Deschner 2010-02-22 08:12:17 UTC
Just installed the 

"RICOH Aficio MP C3300 PCL 5c" and the
"RICOH Aficio MP C2800 PCL 5c"

on a 3.5.0rc3 box w/o any problems.

Can you please retry to test the drivers with 3.5.0rc3 ?

Comment 3 Arvid de Jong 2010-02-24 14:43:35 UTC
I configured our old fileserver with opensuse 11.1 with 3.5.0rc3 from the suse-TESTING repository. There seem to be no samba crashes there.
I couldn't get 3.4.5 from the STABLE-repository to work there because of a dependency that isn't solved, apparently, so I don't know if I can reproduce the problem there.

I'm not too keen on installing a rc-version of samba on a production machine where 40 engineers are dependent on. I will talk about it with my manager, if he thinks it's not a problem I will install 3.5.0rc3 tuesday morning (March 3rd) before worktime CET.
Comment 4 Karolin Seeger 2010-03-08 04:22:47 UTC
(In reply to comment #3)
> I'm not too keen on installing a rc-version of samba on a production machine
> where 40 engineers are dependent on. I will talk about it with my manager, if
> he thinks it's not a problem I will install 3.5.0rc3 tuesday morning (March
> 3rd) before worktime CET.
>

Samba 3.5.0 is available meanwhile. Did you have a chance to try this version?

Comment 5 Arvid de Jong 2010-03-16 10:45:21 UTC
Yes, I did a test with 3.5.0 as well on the testserver.
Today I upgraded the SLES 10 machine that's production to 3.5.1 and now I have more problems with printing, and general slowness as well. There are lot's of crashing samba processes and I guess the slowness is a result of that.

One of the problems I have now is that there isn't an easy way to downgrade, but I will try anyway, because the slowness currently experienced is unacceptable.

I added logs and core.
Comment 6 Arvid de Jong 2010-03-16 10:55:11 UTC
Oh, I can't upload to here because the files are too big. Logs and core are at http://arvid.org/sambabug/

The situation is: People can't print on the Ricoh MP C2800 with the dsm627 driver(this was the workaround with 3.4.5).
Most people can print once on the Nashuatec dsm627 printer. After that it looks ok from the Windows workstations, but the job is never received by cups. 

As a workaround I use our testserver as printserver now, the opensuse 11.1 with samba 3.5.0.
Comment 7 Guenther Deschner 2010-03-16 17:19:51 UTC
(In reply to comment #6)
> Oh, I can't upload to here because the files are too big. Logs and core are at
> http://arvid.org/sambabug/

You are right, the general slowness is caused by hundreds of crashes of _netr_LogonSamLogon as I see from your logfile.

We fixed this core authentication routine crash for 3.5.2 (and added a test to assure this can never come back), the required fix is in bug #7237. 3.5.2 is planned to be released on Wednesday, April 7.

Not a single crash related to printing in your logs.
Comment 8 Arvid de Jong 2010-03-17 06:51:35 UTC
The problem might be largely related to the STABLE repository provided by OpenSUSE. The former 3.4.5 installation was also from there.
http://download.opensuse.org/repositories/network:/samba:/STABLE/SLE_10/

I installed 3.5.1 found here:
http://ftp.sernet.de/pub/samba/3.5/sles/10/x86_64/
and had no samba crashes anymore. The problem with printing didn't go away though. The logs regarding cups stayed the same. Maybe some compatibility issue with CUPS. SLES10 has CUPS 1.3.7 while opensuse 11.1 has 1.3.9
I had new domain trust issues with the Win2008r2 server, which was also a reason to downgrade.

So I installed 3.4.7 found here:
http://ftp.sernet.de/pub/samba/3.4/sles/10/x86_64/
And all problems went away, after I put the Win2008r2 server back in the domain.

I really should thank the guys at http://enterprisesamba.org for this.
I'm not at work today, but didn't receive a panic phone call, so I guess it's working ok now. Will check that tomorrow, if that's the case, I will put this one to FIXED (or maybe it's INVALID, but that's up to you).
Comment 9 Arvid de Jong 2010-03-19 06:17:10 UTC
As above. Everything works fine now.