Bug 8334 - smb2: smbd logs Invalid SMB packet: first request: 0x0008 and crashes
smb2: smbd logs Invalid SMB packet: first request: 0x0008 and crashes
Status: RESOLVED FIXED
Product: Samba 3.6
Classification: Unclassified
Component: SMB2
3.6.0rc3
All All
: P5 major
: ---
Assigned To: Karolin Seeger
Samba QA Contact
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2011-07-28 16:39 UTC by Christian Ambach
Modified: 2011-09-15 18:32 UTC (History)
0 users

See Also:


Attachments
backtrace full (6.56 KB, text/plain)
2011-07-28 16:39 UTC, Christian Ambach
no flags Details
Sceenshot showing test setup (57.26 KB, image/png)
2011-07-29 11:03 UTC, Christian Ambach
no flags Details
Patch (1.33 KB, patch)
2011-08-31 13:31 UTC, Volker Lendecke
jra: review+
Details
Patch (3.95 KB, patch)
2011-09-02 11:06 UTC, Volker Lendecke
jra: review+
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Christian Ambach 2011-07-28 16:39:27 UTC
Created attachment 6726 [details]
backtrace full

While running two copy jobs from a Windows 2008R2 client, connection aborted and smbd had crashed

Last message was:

smbd[2241033]: [2011/07/28 17:51:57.259938,  0] smbd/smb2_server.c:243(smbd_smb2_request_create)
smbd[2241033]:   Invalid SMB packet: first request: 0x0008

Will attach backtrace full output (unfortunately, it was compiled with optimizations)
Comment 1 Jeremy Allison 2011-07-28 17:42:50 UTC
Unfortunately this backtrace doesn't tell me much except we crashed in shutting down the sconn->smb2.sessions.idtree struct.

This message:

"Invalid SMB packet: first request: 0x0008"

means we thought we should be trying to process an initial SMB2 negprot, but got an SMB2 read packet instead.

I really need to see the wireshark capture trace from this, or be given a reliable method of recreating this.

I need to know:

a). client type (including service pack number).
b). smb.conf
c). *Exact* method of reproduction - meaning share names, file names, command in progress etc.

The text "running two copy jobs from a Windows 2008R2 client" simply doesn't give me enough information to do any of this :-(. Better initial bug reports please ! :-).

Jeremy.
Comment 2 Christian Ambach 2011-07-29 11:03:55 UTC
Created attachment 6729 [details]
Sceenshot showing test setup

Hi Jeremy,

I attached a screenshot that shows my test setup (including the cmd windows in which I entered the commands).

It does not trigger very often, key requirement for it to trigger seems to be the multiple connect and the multiple processes accessing files.

I'll try to get tcpdumps of workload that triggers it.
Comment 3 Jeremy Allison 2011-07-29 19:53:00 UTC
Thanks - at least I know it's W2K8R2. Can you post your smb.conf - and also the other things I'll need to debug (a non-optimized backtrace would help a lot).

I'm going to downgrade this from "blocker" to "major", as it's hard to reproduce and hasn't been reported by other heavy testers in SMB2.

Jeremy.
Comment 4 Volker Lendecke 2011-08-31 13:31:18 UTC
Created attachment 6844 [details]
Patch

This fixes the panic condition for me. It does not really fix the crash yet.
Comment 5 Jeremy Allison 2011-08-31 16:48:54 UTC
Comment on attachment 6844 [details]
Patch

Great catch. Confirmed for 3.6.1.
Comment 6 Jeremy Allison 2011-08-31 16:49:14 UTC
Re-assigning to Karolin for inclusion in 3.6.1.
Jeremy.
Comment 7 Karolin Seeger 2011-09-01 19:09:07 UTC
Patch does not apply:

--- snip ---
user@host:/data/git/samba/v3-6-test> git reset --hard origin/v3-6-test
HEAD is now at fc8c588 s3:smb2 fix Bug 8428 - wrong reply to DHnC (durable handle reconnect)
user@host:/data/git/samba/v3-6-test> git am 8334.patch
Applying: s3: Do not fork the echo handler for smb2
error: patch failed: source3/smbd/negprot.c:743
error: source3/smbd/negprot.c: patch does not apply
Patch failed at 0001 s3: Do not fork the echo handler for smb2
--- snap ---
Comment 8 Volker Lendecke 2011-09-02 11:06:03 UTC
Created attachment 6850 [details]
Patch
Comment 9 Volker Lendecke 2011-09-02 11:06:49 UTC
Comment on attachment 6850 [details]
Patch

8a2eff8 from master was missing.
Comment 10 Jeremy Allison 2011-09-02 17:04:24 UTC
Comment on attachment 6850 [details]
Patch

This applies (tested that :-).
Comment 11 Jeremy Allison 2011-09-02 17:05:21 UTC
Re-assigning to Karolin for inclusion in 3.6.1.
Jeremy.
Comment 12 Karolin Seeger 2011-09-15 18:32:16 UTC
Pushed to v3-6-test.
Closing out bug report.

Thanks!