Created attachment 7056 [details]
smb.conf

I tried upgrading our EL5 samba PDC from 3.5.10 to 3.6.1 but smbd crashes with the following panic:

[2011/11/02 15:49:32.811693,  1] param/loadparm.c:7992(lp_do_parameter)
  WARNING: The "idmap uid" option is deprecated
[2011/11/02 15:49:32.811940,  1] param/loadparm.c:7992(lp_do_parameter)
  WARNING: The "idmap gid" option is deprecated
[2011/11/02 15:49:34.183393,  0] lib/fault.c:47(fault_report)
  ===============================================================
[2011/11/02 15:49:34.184173,  0] lib/fault.c:48(fault_report)
  INTERNAL ERROR: Signal 11 in pid 6788 (3.6.1)
  Please read the Trouble-Shooting section of the Samba3-HOWTO
[2011/11/02 15:49:34.184625,  0] lib/fault.c:50(fault_report)
  
  From: http://www.samba.org/samba/docs/Samba3-HOWTO.pdf
[2011/11/02 15:49:34.185078,  0] lib/fault.c:51(fault_report)
  ===============================================================
[2011/11/02 15:49:34.185388,  0] lib/util.c:1117(smb_panic)
  PANIC (pid 6788): internal error
[2011/11/02 15:49:34.190731,  0] lib/util.c:1221(log_stack_trace)
  BACKTRACE: 13 stack frames:
   #0 smbd(log_stack_trace+0x2d) [0x84531d]
   #1 smbd(smb_panic+0x31) [0x845421]
   #2 smbd [0x834076]
   #3 [0x12d420]
   #4 smbd(dom_sid_compare+0x4b) [0x877c0b]
   #5 smbd(add_sid_to_array_unique+0x46) [0x879c86]
   #6 smbd(create_token_from_username+0x51b) [0x8a73cb]
   #7 smbd(create_local_token+0x89) [0x8a4d19]
   #8 smbd(make_serverinfo_from_username+0x9b) [0x8a52cb]
   #9 smbd(init_system_info+0x8f) [0x8a53cf]
   #10 smbd(main+0x82b) [0xb06c4b]
   #11 /lib/libc.so.6(__libc_start_main+0xdc) [0xe9be9c]
   #12 smbd [0x4bb8c1]
[2011/11/02 15:49:34.192642,  0] lib/fault.c:372(dump_core)
  dumping core in /var/log/samba/cores/smbd

gdb session:
(gdb) bt
#0  0x0012d402 in __kernel_vsyscall ()
#1  0x00eaedf0 in raise () from /lib/libc.so.6
#2  0x00eb0701 in abort () from /lib/libc.so.6
#3  0x00833a0c in dump_core () at lib/fault.c:391
#4  0x00845437 in smb_panic (why=0xc5d38e "internal error") at lib/util.c:1133
#5  0x00834076 in fault_report (sig=11) at lib/fault.c:53
#6  sig_fault (sig=11) at lib/fault.c:76
#7  <signal handler called>
#8  0x00877c0b in dom_sid_compare (sid1=0xbfdee670, sid2=0x8440010)
    at ../libcli/security/dom_sid.c:69
#9  0x00879c86 in add_sid_to_array_unique (mem_ctx=0x8418a98, sid=0xbfdee670, sids=0xbfdee664, 
    num_sids=0xbfdee660) at ../libcli/security/util_sid.c:318
#10 0x008a73cb in create_token_from_username (mem_ctx=0x84193b0, username=0x8418c98 "root", 
    is_guest=false, uid=0x84193b4, gid=0x84193b8, found_username=0x8419468, token=0x84193c4)
    at auth/token_util.c:776
#11 0x008a4d19 in create_local_token (server_info=0x84193b0) at auth/auth_util.c:460
#12 0x008a52cb in make_serverinfo_from_username (mem_ctx=0x0, username=0x8417b88 "root", 
    is_guest=false, presult=0xda8634) at auth/auth_util.c:834
#13 0x008a53cf in make_new_session_info_system () at auth/auth_util.c:782
#14 init_system_info () at auth/auth_util.c:945
#15 0x00b06c4b in main (argc=Cannot access memory at address 0x0
) at smbd/server.c:1220
(gdb) up 8
#8  0x00877c0b in dom_sid_compare (sid1=0xbfdee670, sid2=0x8440010)
    at ../libcli/security/dom_sid.c:69
69              if (sid1->num_auths != sid2->num_auths)
(gdb) list
64                      return -1;
65              if (!sid2)
66                      return 1;
67
68              /* Compare most likely different rids, first: i.e start at end */
69              if (sid1->num_auths != sid2->num_auths)
70                      return sid1->num_auths - sid2->num_auths;
71
72              for (i = sid1->num_auths-1; i >= 0; --i)
73                      if (sid1->sub_auths[i] != sid2->sub_auths[i])
(gdb) print sid1
$1 = (const struct dom_sid *) 0xbfdee670
(gdb) print sid2
$2 = (const struct dom_sid *) 0x8440010
(gdb) print *sid1
$3 = {sid_rev_num = 1 '\001', num_auths = 2 '\002', id_auth = "\000\000\000\000\000\026", 
  sub_auths = {2, 0 <repeats 14 times>}}
(gdb) print *sid2
Cannot access memory at address 0x8440010
(gdb) up
#9  0x00879c86 in add_sid_to_array_unique (mem_ctx=0x8418a98, sid=0xbfdee670, sids=0xbfdee664, 
    num_sids=0xbfdee660) at ../libcli/security/util_sid.c:318
318                     if (dom_sid_compare(sid, &(*sids)[i]) == 0)
(gdb) print i
$4 = 2236
(gdb) list
313                                      struct dom_sid **sids, uint32_t *num_sids)
314     {
315             uint32_t i;
316
317             for (i=0; i<(*num_sids); i++) {
318                     if (dom_sid_compare(sid, &(*sids)[i]) == 0)
319                             return NT_STATUS_OK;
320             }
321
322             return add_sid_to_array(mem_ctx, sid, sids, num_sids);
(gdb) print *num_sids
$7 = 138514344
(gdb) up
#10 0x008a73cb in create_token_from_username (mem_ctx=0x84193b0, username=0x8418c98 "root", 
    is_guest=false, uid=0x84193b4, gid=0x84193b8, found_username=0x8419468, token=0x84193c4)
    at auth/token_util.c:776
776                     result = add_sid_to_array_unique(tmp_ctx, &unix_group_sid,
(gdb) list
771                     if ( lp_idmap_gid(&low, &high) && (gids[i] >= low) && (gids[i] <= high) )
772                             continue;
773
774                     gid_to_unix_groups_sid(gids[i], &unix_group_sid);
775
776                     result = add_sid_to_array_unique(tmp_ctx, &unix_group_sid,
777                                                      &group_sids, &num_group_sids);
778                     if (!NT_STATUS_IS_OK(result)) {
779                             goto done;
780                     }
(gdb) print num_group_sids
$8 = 138514344
(gdb) print unix_group_sid
$11 = {sid_rev_num = 1 '\001', num_auths = 2 '\002', id_auth = "\000\000\000\000\000\026", 
  sub_auths = {2, 0 <repeats 14 times>}}

That seems like a few too many group_sids.  Hmm, I think I'll try commenting out the idmap entries.