samba - Sep 2004 - 3.0.7: PANIC: deferred_open_entries_identical: logic error

After upgrading to 3.0.7 we've had 4 panics, all within seconds of each
other.
Unfortunately I'm not sure what users were doing at that time.  I didn't
notice this until reviewing the logs later.  From the time, I would guess this
happened as people were logging in.

Here's a copy of one of the logs.  The other three are identical except for
the
time and PID.

Sep 17 08:52:45 c smbd[29165]: [2004/09/17 08:52:45, 0]
lib/util.c:smb_panic2(1403)
Sep 17 08:52:45 c smbd[29165]:   PANIC: PANIC: deferred_open_entries_identical:
logic error.
Sep 17 08:52:45 c smbd[29165]:
Sep 17 08:52:45 c smbd[29165]: [2004/09/17 08:52:45, 0]
lib/util.c:smb_panic2(1411)
Sep 17 08:52:45 c smbd[29165]:   BACKTRACE: 14 stack frames:
Sep 17 08:52:45 c smbd[29165]:    #0 smbd(smb_panic2+0x120) [0xad4d50]
Sep 17 08:52:45 c smbd[29165]:    #1 smbd(smb_panic+0x28) [0xad4c28]
Sep 17 08:52:45 c smbd[29165]:    #2 smbd [0xa9032d]
Sep 17 08:52:45 c smbd[29165]:    #3 smbd(delete_deferred_open_entry+0xdf)
[0xa9043f]
Sep 17 08:52:45 c smbd[29165]:    #4 smbd [0x9a045e]
Sep 17 08:52:45 c smbd[29165]:    #5 smbd(open_file_shared1+0x1dc) [0x9a0b8c]
Sep 17 08:52:45 c smbd[29165]:    #6 smbd(reply_ntcreate_and_X+0xbd5) [0x975ac5]
Sep 17 08:52:45 c smbd[29165]:    #7 smbd [0x9b35cc]
Sep 17 08:52:45 c smbd[29165]:    #8 smbd [0x9b3883]
Sep 17 08:52:45 c smbd[29165]:    #9 smbd(process_smb+0xa4) [0x9b3ad4]
Sep 17 08:52:45 c smbd[29165]:    #10 smbd(smbd_process+0x1ac) [0x9b491c]
Sep 17 08:52:45 c smbd[29165]:    #11 smbd(main+0x519) [0xb53ae9]
Sep 17 08:52:45 c smbd[29165]:    #12 /lib/tls/libc.so.6(__libc_start_main+0xe4)
[0x365ad4]
Sep 17 08:52:45 c smbd[29165]:    #13 smbd [0x951202]


-- 
Matt Phillips <matt.phillips@ict.om.org>
International Coordinating Team, Operation Mobilisation
Public PGP Key: http://moses.om.org/~mattp/gpg.asc

On Sat, Sep 18, 2004 at 09:23:41AM -0400, Matt Phillips
wrote:
> After upgrading to 3.0.7 we've had 4 panics, all within seconds of each
other.
> Unfortunately I'm not sure what users were doing at that time.  I
didn't
> notice this until reviewing the logs later.  From the time, I would guess
this
> happened as people were logging in.
Yeah, the backtraces will be identical as it's smbd catching
an internal logic error. Any chance of working out what might
reproduce this and getting a debug level 10 ? As it happened
in login it's unlikely to be shared file access causing it so
it shouldn't be dependent upon simultaneous access,
can you try running one person at debug 10 and seeing if
you can reproduce it with a full log ?

Jeremy.

On Sat, Sep 18, 2004 at 09:23:41AM -0400, Matt Phillips
wrote:
> After upgrading to 3.0.7 we've had 4 panics, all within seconds of each
other.
> Unfortunately I'm not sure what users were doing at that time.  I
didn't
> notice this until reviewing the logs later.  From the time, I would guess
this
> happened as people were logging in.
> 
> Here's a copy of one of the logs.  The other three are identical except
for the
> time and PID.
Arggg. Stupid, stupid, stupid me ! I added a paranoia test
case when I was developing the deferred open case and made it
too tight. It will fire (incorrectly) and panic when a client
does a second open for a file with a different mid (multiplex-id)
request. Doh ! This is a perfectly valid thing for a client to
do (have two pending opens with different mids outstanding on
the same file) and currently when the first pending open expires
with a share violation the paranoia code will panic smbd.

It's a rare condition, but obvious now I'lve looked at the
code.

Here is the patch. Sorry for that bug.

Jeremy.
-------------- next part --------------
Index: locking/locking.c
==================================================================---
locking/locking.c	(revision 2411)
+++ locking/locking.c	(working copy)
@@ -1043,18 +1043,6 @@
 
 static BOOL deferred_open_entries_identical( deferred_open_entry *e1,
deferred_open_entry *e2)
 {
-#if 1 /* JRA PARANOIA TEST - REMOVE LATER */
-	if (e1->pid == e2->pid &&
-		e1->port == e2->port &&
-		e1->dev == e2->dev &&
-		e1->inode == e2->inode &&
-		((e1->time.tv_sec != e2->time.tv_sec) ||
-		 (e1->time.tv_usec != e2->time.tv_usec) ||
-		 (e1->mid != e2->mid))) {
-		smb_panic("PANIC: deferred_open_entries_identical: logic
error.\n");
-	}
-#endif
-
 	return (e1->pid == e2->pid &&
 		e1->mid == e2->mid &&
 		e1->port == e2->port &&
@@ -1064,7 +1052,6 @@
 		e1->time.tv_usec == e2->time.tv_usec);
 }
 
-
 /*******************************************************************
  Delete a specific deferred open entry.
  Ignore if no entry deleted.