samba - Jun 2005 - Crashing Suse 9.2 box - Samba prime suspect

I'm running Suse 9.2, up to date via Yast, samba 3.0.9-2.3, openssh 
3.9p1-3.2.

I had two hard crashes on my Suse 9.2 server in the last four days since 
I mounted two Windows server shares to the Linux box. Prior to that, 
machine has been stable for several months. Primary use is cvs server 
with ssh tunnelling pserver from PuTTY.

Crash 1:
I connected in from home using WSFTP Pro 9.01 in FTP/SSH mode to 
download a Windows directory tree mounted to the Suse server via smbmount.

After transfer was successfully completed, Linux went down hard as I 
tried to start another transfer.

I repeated process using direct a LAN connection with the same result.

The "messages" log shows :
May 29 01:27:40 engsrv sshd[13206]: Accepted publickey for <my name 
deleted> from <my IP deleted> port 12690 ssh2
May 29 01:27:40 engsrv pure-ftpd: (?@localhost) [INFO] New connection 
from local
host
May 29 01:27:40 engsrv pure-ftpd: (?@localhost) [INFO] Logout.
May 29 01:27:41 engsrv sshd[13209]: subsystem request for sftp
May 29 11:50:29 engsrv syslogd 1.4.1: restart.

text in <> is my comment.

I deduce from the timestamps that the "subsystem request for sftp"
line
is the last thing written before the crash.

Crash 2:
User using ssh shell on local lan does a "find", and the server
crashes.

I see in the messages logfile a string of errors like this :
Jun  2 07:50:19 engsrv kernel: smb_proc_readdir_long: dirent pointer 
outside buffer! c084bba3  7923@c084000a

followed by a restart entry.

As these two error events both relate to samba, I thought this would be 
a place to ask for help. Can anyone offer any clues or suggestions?

Cheers,

julian.

Julian Opificius schrieb:
> I'm running Suse 9.2, up to date via Yast, samba 3.0.9-2.3, openssh 
> 3.9p1-3.2.
>
> I had two hard crashes on my Suse 9.2 server in the last four days 
> since I mounted two Windows server shares to the Linux box. Prior to 
> that, machine has been stable for several months. Primary use is cvs 
> server with ssh tunnelling pserver from PuTTY.
>
> Crash 1:
> I connected in from home using WSFTP Pro 9.01 in FTP/SSH mode to 
> download a Windows directory tree mounted to the Suse server via 
> smbmount.
>
> After transfer was successfully completed, Linux went down hard as I 
> tried to start another transfer.
>
> I repeated process using direct a LAN connection with the same result.
>
> The "messages" log shows :
> May 29 01:27:40 engsrv sshd[13206]: Accepted publickey for <my name 
> deleted> from <my IP deleted> port 12690 ssh2
> May 29 01:27:40 engsrv pure-ftpd: (?@localhost) [INFO] New connection 
> from local
> host
> May 29 01:27:40 engsrv pure-ftpd: (?@localhost) [INFO] Logout.
> May 29 01:27:41 engsrv sshd[13209]: subsystem request for sftp
> May 29 11:50:29 engsrv syslogd 1.4.1: restart.
>
> text in <> is my comment.
>
> I deduce from the timestamps that the "subsystem request for
sftp"
> line is the last thing written before the crash.
>
> Crash 2:
> User using ssh shell on local lan does a "find", and the server
crashes.
>
> I see in the messages logfile a string of errors like this :
> Jun  2 07:50:19 engsrv kernel: smb_proc_readdir_long: dirent pointer 
> outside buffer! c084bba3  7923@c084000a
>
> followed by a restart entry.
>
> As these two error events both relate to samba, I thought this would 
> be a place to ask for help. Can anyone offer any clues or suggestions?
>
> Cheers,
>
> julian.
>
Hi , i did a full upgrade via yast ( suse 9.2 ) too ( but i have no ftp 
server running )
and had no Problems.
But i am using the latest samba rpms from ftp.suse.com
so do a update and recheck your logs
Regards