Bug 7541 - "printer admin" not working when %D is used (smbd crashes)
"printer admin" not working when %D is used (smbd crashes)
Status: RESOLVED FIXED
Product: Samba 3.4
Classification: Unclassified
Component: Printing
3.4.8
Other Linux
: P3 normal
: ---
Assigned To: Karolin Seeger
Samba QA Contact
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2010-07-01 05:48 UTC by Guenther Deschner
Modified: 2011-06-17 07:34 UTC (History)
1 user (show)

See Also:


Attachments
patch for 3.5 (3.96 KB, patch)
2010-07-01 07:21 UTC, Guenther Deschner
bjacke: review+
vl: review+
Details
patch for 3.4 (3.96 KB, patch)
2010-07-01 07:22 UTC, Guenther Deschner
bjacke: review+
vl: review+
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Guenther Deschner 2010-07-01 05:48:29 UTC
===============================================================
[2010/07/01 00:13:21,  0] lib/fault.c:47(fault_report)
  INTERNAL ERROR: Signal 11 in pid 19463 (3.4.8-SerNet-Debian)
  Please read the Trouble-Shooting section of the Samba3-HOWTO
[2010/07/01 00:13:21,  0] lib/fault.c:49(fault_report)

  From: http://www.samba.org/samba/docs/Samba3-HOWTO.pdf
[2010/07/01 00:13:21,  0] lib/fault.c:50(fault_report)
  ===============================================================
[2010/07/01 00:13:21,  0] lib/util.c:1480(smb_panic)
  PANIC (pid 19463): internal error
[2010/07/01 00:13:21,  0] lib/util.c:1584(log_stack_trace)
  BACKTRACE: 29 stack frames:
   #0 /usr/sbin/smbd(log_stack_trace+0x2d) [0xb736deed]
   #1 /usr/sbin/smbd(smb_panic+0x2d) [0xb736dfed]
   #2 /usr/sbin/smbd(+0x2f7966) [0xb735b966]
   #3 [0xb7046400]
   #4 /usr/sbin/smbd(strdup_upper+0x1f) [0xb7357bbf]
   #5 /usr/sbin/smbd(alloc_sub_basic+0x44b) [0xb73750cb]
   #6 /usr/sbin/smbd(talloc_sub_basic+0x35) [0xb7375bf5]
   #7 /usr/sbin/smbd(token_contains_name_in_list+0x94) [0xb710b764]
   #8 /usr/sbin/smbd(print_access_check+0x18a) [0xb739c3aa]
   #9 /usr/sbin/smbd(_spoolss_OpenPrinterEx+0x3a1) [0xb72b4611]
   #10 /usr/sbin/smbd(+0x254be0) [0xb72b8be0]
   #11 /usr/sbin/smbd(api_pipe_request+0x1ac) [0xb72f019c]
   #12 /usr/sbin/smbd(+0x2862ed) [0xb72ea2ed]
   #13 /usr/sbin/smbd(np_write_send+0x180) [0xb72ea490]
   #14 /usr/sbin/smbd(+0xaac81) [0xb710ec81]
   #15 /usr/sbin/smbd(+0xab28f) [0xb710f28f]
   #16 /usr/sbin/smbd(reply_trans+0x5ff) [0xb710fd2f]
   #17 /usr/sbin/smbd(+0x10d3de) [0xb71713de]
   #18 /usr/sbin/smbd(+0x10ff2d) [0xb7173f2d]
   #19 /usr/sbin/smbd(+0x11041a) [0xb717441a]
   #20 /usr/sbin/smbd(run_events+0x13c) [0xb737ef4c]
   #21 /usr/sbin/smbd(smbd_process+0x931) [0xb7173a51]
   #22 /usr/sbin/smbd(+0x5e9ead) [0xb764dead]
   #23 /usr/sbin/smbd(run_events+0x13c) [0xb737ef4c]
   #24 /usr/sbin/smbd(+0x31b1ee) [0xb737f1ee]
   #25 /usr/sbin/smbd(_tevent_loop_once+0x9b) [0xb737f82b]
   #26 /usr/sbin/smbd(main+0xc07) [0xb764eba7]
   #27 /lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe6) [0xb6bb7bd6]
   #28 /usr/sbin/smbd(+0x8b8e1) [0xb70ef8e1]
[2010/07/01 00:13:21,  0] lib/util.c:1485(smb_panic)
  smb_panic(): calling panic action [/etc/samba/panic-action 19463]
sh: /etc/samba/panic-action: not found
[2010/07/01 00:13:21,  0] lib/util.c:1493(smb_panic)
  smb_panic(): action returned status 127
Comment 1 Guenther Deschner 2010-07-01 05:52:07 UTC
I think this is caused by the SMB_STRDUP on a NULL domain name in strdup_upper().
Comment 2 Guenther Deschner 2010-07-01 06:02:13 UTC
I also think we never hit this issue before up to this change:
commit a99d9e7678de17486bf34320ef0fda071b24197a
Author: Jeremy Allison <jra@samba.org>
Date:   Thu Mar 18 11:21:15 2010 +0100

    s3-printing: Fix "printer admin" functionality.
    
    Fix bug #7255 ("printer admin" parameter does not work as expected).
    (cherry picked from commit 0d6d068bc4f76c2816f969fcce6013e1945794d4)
    (cherry picked from commit e74ced9f90ade37fa7bd179a91803f775c77e25b)

diff --git a/source3/printing/nt_printing.c b/source3/printing/nt_printing.c
index afb3406..30905fc 100644
--- a/source3/printing/nt_printing.c
+++ b/source3/printing/nt_printing.c
@@ -5734,7 +5734,7 @@ bool print_access_check(struct auth_serversupplied_info *server_info, int snum,
 
         /* see if we need to try the printer admin list */
 
-        if ((access_granted == 0) &&
+        if (!NT_STATUS_IS_OK(status) &&
            (token_contains_name_in_list(uidtoname(server_info->utok.uid),
                                         NULL, NULL, server_info->ptok,
                                         lp_printer_admin(snum)))) {

commit e6b6027218b96bf3357837d051ca5d2df0d88561
Comment 3 Guenther Deschner 2010-07-01 06:31:31 UTC
I guess the initial reporter (not me) has "printer admin" set and is using %D in there. That also crashes master (and most probably 3.5 as well).
Comment 4 Guenther Deschner 2010-07-01 07:12:41 UTC
got it reproduced
Comment 5 Guenther Deschner 2010-07-01 07:21:12 UTC
Created attachment 5817 [details]
patch for 3.5
Comment 6 Guenther Deschner 2010-07-01 07:22:29 UTC
Created attachment 5818 [details]
patch for 3.4
Comment 7 Guenther Deschner 2010-07-01 07:51:24 UTC
Karolin, can you please pick for 3.4 and 3.5 ?
Comment 8 Karolin Seeger 2010-07-05 00:35:05 UTC
(In reply to comment #7)
> Karolin, can you please pick for 3.4 and 3.5 ?
> 

Pushed to v3-5-test and v3-4-test.
Closing out bug report.

Thanks!