samba - Feb 2007 - sambas gone wild! or why'd this happen?

Hi,
One of my samba machines had it's load average shoot through the roof  
today and had to be hard rebooted and /var/log/messages shows me core  
dumps for samba around this time. samba is almost the only thing  
running on this machine.

What could possibly cause set uid of -1501 on the 2nd line?

Just trying to figure out what happened here,
thanks for any help.


# smbd -V
Version 3.0.23c-2

here is one of 352 similar syslog messages:

Feb  3 16:12:56 hsc58 smbd[11255]: [2007/02/03 16:12:56, 0]  
lib/util_sec.c:asser
t_uid(95)
Feb  3 16:12:56 hsc58 smbd[11255]:   Failed to set uid privileges to  
(-1,501) no
w set to (0,0)
Feb  3 16:12:56 hsc58 smbd[11255]: [2007/02/03 16:12:56, 0]  
lib/util.c:smb_panic
(1614)
Feb  3 16:12:56 hsc58 smbd[11255]:   PANIC (pid 11255): failed to set uid
Feb  3 16:12:56 hsc58 smbd[11255]:
Feb  3 16:12:56 hsc58 smbd[11255]: [2007/02/03 16:12:56, 0]  
lib/util.c:log_stack
_trace(1721)
Feb  3 16:12:56 hsc58 smbd[11255]:   BACKTRACE: 14 stack frames:
Feb  3 16:12:56 hsc58 smbd[11255]:    #0 smbd(log_stack_trace+0x2d) [0x4b525d]
Feb  3 16:12:56 hsc58 smbd[11255]:    #1 smbd(smb_panic+0x5d) [0x4b538d]
Feb  3 16:12:56 hsc58 smbd[11255]:    #2 smbd [0x4bb49e]
Feb  3 16:12:56 hsc58 smbd[11255]:    #3 smbd [0x33747c]
Feb  3 16:12:56 hsc58 smbd[11255]:    #4 smbd(set_sec_ctx+0x110) [0x337820]
Feb  3 16:12:56 hsc58 smbd[11255]:    #5 smbd(change_to_user+0x3b2) [0x32ce22]
Feb  3 16:12:56 hsc58 smbd[11255]:    #6 smbd [0x34c4a8]
Feb  3 16:12:56 hsc58 smbd[11255]:    #7 smbd(make_connection+0x194)  
[0x34d914]
Feb  3 16:12:56 hsc58 smbd[11255]:    #8 smbd(reply_tcon_and_X+0x217)  
[0x3111d7]

Feb  3 16:12:56 hsc58 smbd[11255]:    #9 smbd [0x348a70]
Feb  3 16:12:56 hsc58 smbd[11255]:    #10 smbd(smbd_process+0x7ab) [0x349b9b]
Feb  3 16:12:56 hsc58 smbd[11255]:    #11 smbd(main+0xbd0) [0x5638e0]
Feb  3 16:12:56 hsc58 smbd[11255]:    #12  
/lib/libc.so.6(__libc_start_main+0xdc)
  [0x6a2f2c]
Feb  3 16:12:56 hsc58 smbd[11255]:    #13 smbd [0x2d3fb1]
Feb  3 16:12:56 hsc58 smbd[11255]: [2007/02/03 16:12:56, 0]  
lib/fault.c:dump_cor
e(173)
Feb  3 16:12:56 hsc58 smbd[11255]:   dumping core in /var/log/samba/cores/smbd

> What could possibly cause set uid of -1501 on the 2nd line?
> 
> Feb  3 16:12:56 hsc58 smbd[11255]:   Failed to set uid privileges to  
> (-1,501) now set to (0,0)
I'm guessing that means UID -1, GID 501.  Maybe some user connected and
they were somehow mapped to UID -1?  Do you have any weird numbers
in /etc/password? (Maybe to disable certain accounts.)

Cheers,
Adam.