thr3ads.net - samba - [Samba] Segfaults: PANIC: Bad talloc magic value

If this information is useful, please help other people find it:
Share via:

Marc Muehlfeld

2013-Nov-14 18:10 UTC

[Samba] Segfaults: PANIC: Bad talloc magic value - access after free

Hello,

I switched the first member server in production from 3.6 to 4.1. But 
since that, several times per day, smbd processes are crashing on that 
machine. Has anybody encountered this, too?

[2013/11/05 04:14:43.532768,  0, pid=91892]
../source3/lib/popt_common.c:67(popt_s3_talloc_log_fn)
   talloc: access after free error - first free may be at
../source3/smbd/open.c:1529
[2013/11/05 04:14:43.532916,  0, pid=91892]
../source3/lib/popt_common.c:67(popt_s3_talloc_log_fn)
   Bad talloc magic value - access after free
[2013/11/05 04:14:43.532976,  0, pid=91892]
../source3/lib/util.c:785(smb_panic_s3)
   PANIC (pid 91892): Bad talloc magic value - access after free
[2013/11/05 04:14:43.533704,  0, pid=91892]
../source3/lib/util.c:896(log_stack_trace)
   BACKTRACE: 22 stack frames:
    #0 /usr/local/samba/lib/libsmbconf.so.0(log_stack_trace+0x1f)
[0x7f2db6366c06]
    #1 /usr/local/samba/lib/libsmbconf.so.0(smb_panic_s3+0x6d) 
[0x7f2db6366a75]
    #2 /usr/local/samba/lib/libsamba-util.so.0(smb_panic+0x28) 
[0x7f2db81d3cfb]
    #3 /usr/local/samba/lib/samba/libtalloc.so.2(+0x20a9) [0x7f2db760d0a9]
    #4 /usr/local/samba/lib/samba/libtalloc.so.2(+0x2125) [0x7f2db760d125]
    #5 /usr/local/samba/lib/samba/libtalloc.so.2(+0x21a3) [0x7f2db760d1a3]
    #6 /usr/local/samba/lib/samba/libtalloc.so.2(talloc_get_name+0x18)
[0x7f2db760ec83]
    #7 
/usr/local/samba/lib/samba/libtalloc.so.2(_talloc_get_type_abort+0x4c)
[0x7f2db760ee03]
    #8 /usr/local/samba/lib/libsmbconf.so.0(+0x31767) [0x7f2db6372767]
    #9
/usr/local/samba/lib/samba/libtevent.so.0(tevent_common_loop_immediate+0x1f9)
[0x7f2db73feee4]
    #10 /usr/local/samba/lib/libsmbconf.so.0(run_events_poll+0x57)
[0x7f2db638319b]
    #11 /usr/local/samba/lib/libsmbconf.so.0(+0x42848) [0x7f2db6383848]
    #12 /usr/local/samba/lib/samba/libtevent.so.0(_tevent_loop_once+0xfc)
[0x7f2db73fdfa9]
    #13 /usr/local/samba/lib/samba/libsmbd_base.so(smbd_process+0x1321)
[0x7f2db7977a1e]
    #14 /usr/sbin/smbd(+0x9c38) [0x7f2db883cc38]
    #15 /usr/local/samba/lib/libsmbconf.so.0(run_events_poll+0x544)
[0x7f2db6383688]
    #16 /usr/local/samba/lib/libsmbconf.so.0(+0x4295e) [0x7f2db638395e]
    #17 /usr/local/samba/lib/samba/libtevent.so.0(_tevent_loop_once+0xfc)
[0x7f2db73fdfa9]
    #18 /usr/sbin/smbd(+0xa8d7) [0x7f2db883d8d7]
    #19 /usr/sbin/smbd(main+0x15d1) [0x7f2db883eff9]
    #20 /lib64/libc.so.6(__libc_start_main+0xfd) [0x7f2db4bfbcdd]
    #21 /usr/sbin/smbd(+0x5809) [0x7f2db8838809]
[2013/11/05 04:14:43.534362,  0, pid=91892]
../source3/lib/util.c:797(smb_panic_s3)
   smb_panic(): calling panic action [/usr/local/bin/panic-action 91892]
[2013/11/05 04:14:44.128587,  0, pid=91892]
../source3/lib/util.c:805(smb_panic_s3)
   smb_panic(): action returned status 0
[2013/11/05 04:14:44.128711,  0, pid=91892]
../source3/lib/dumpcore.c:317(dump_core)
   dumping core in /var/log/samba//cores/smbd



I also had already opened a bug report:
https://bugzilla.samba.org/show_bug.cgi?id=10250


Regards,
Marc

Nick Semenkovich

2013-Nov-14 19:07 UTC

head link

[Samba] Segfaults: PANIC: Bad talloc magic value - access after free

I'd seen something similar (I think):
https://bugzilla.samba.org/show_bug.cgi?id=9903

However, I haven't seen that in a few months (I run Samba from ~recent GIT
commits) -- maybe it was fixed after 4.1.0pre1-GIT-1c9ef67?

- Nick


On Thu, Nov 14, 2013 at 12:10 PM, Marc Muehlfeld <samba at
marc-muehlfeld.de>wrote:
> Hello,
>
> I switched the first member server in production from 3.6 to 4.1. But
> since that, several times per day, smbd processes are crashing on that
> machine. Has anybody encountered this, too?
>
> [2013/11/05 04:14:43.532768,  0, pid=91892]
> ../source3/lib/popt_common.c:67(popt_s3_talloc_log_fn)
>   talloc: access after free error - first free may be at
> ../source3/smbd/open.c:1529
> [2013/11/05 04:14:43.532916,  0, pid=91892]
> ../source3/lib/popt_common.c:67(popt_s3_talloc_log_fn)
>   Bad talloc magic value - access after free
> [2013/11/05 04:14:43.532976,  0, pid=91892]
> ../source3/lib/util.c:785(smb_panic_s3)
>   PANIC (pid 91892): Bad talloc magic value - access after free
> [2013/11/05 04:14:43.533704,  0, pid=91892]
> ../source3/lib/util.c:896(log_stack_trace)
>   BACKTRACE: 22 stack frames:
>    #0 /usr/local/samba/lib/libsmbconf.so.0(log_stack_trace+0x1f)
> [0x7f2db6366c06]
>    #1 /usr/local/samba/lib/libsmbconf.so.0(smb_panic_s3+0x6d)
> [0x7f2db6366a75]
>    #2 /usr/local/samba/lib/libsamba-util.so.0(smb_panic+0x28)
> [0x7f2db81d3cfb]
>    #3 /usr/local/samba/lib/samba/libtalloc.so.2(+0x20a9) [0x7f2db760d0a9]
>    #4 /usr/local/samba/lib/samba/libtalloc.so.2(+0x2125) [0x7f2db760d125]
>    #5 /usr/local/samba/lib/samba/libtalloc.so.2(+0x21a3) [0x7f2db760d1a3]
>    #6 /usr/local/samba/lib/samba/libtalloc.so.2(talloc_get_name+0x18)
> [0x7f2db760ec83]
>    #7 /usr/local/samba/lib/samba/libtalloc.so.2(_talloc_get_
> type_abort+0x4c)
> [0x7f2db760ee03]
>    #8 /usr/local/samba/lib/libsmbconf.so.0(+0x31767) [0x7f2db6372767]
>    #9
> /usr/local/samba/lib/samba/libtevent.so.0(tevent_common_
> loop_immediate+0x1f9)
> [0x7f2db73feee4]
>    #10 /usr/local/samba/lib/libsmbconf.so.0(run_events_poll+0x57)
> [0x7f2db638319b]
>    #11 /usr/local/samba/lib/libsmbconf.so.0(+0x42848) [0x7f2db6383848]
>    #12 /usr/local/samba/lib/samba/libtevent.so.0(_tevent_loop_once+0xfc)
> [0x7f2db73fdfa9]
>    #13 /usr/local/samba/lib/samba/libsmbd_base.so(smbd_process+0x1321)
> [0x7f2db7977a1e]
>    #14 /usr/sbin/smbd(+0x9c38) [0x7f2db883cc38]
>    #15 /usr/local/samba/lib/libsmbconf.so.0(run_events_poll+0x544)
> [0x7f2db6383688]
>    #16 /usr/local/samba/lib/libsmbconf.so.0(+0x4295e) [0x7f2db638395e]
>    #17 /usr/local/samba/lib/samba/libtevent.so.0(_tevent_loop_once+0xfc)
> [0x7f2db73fdfa9]
>    #18 /usr/sbin/smbd(+0xa8d7) [0x7f2db883d8d7]
>    #19 /usr/sbin/smbd(main+0x15d1) [0x7f2db883eff9]
>    #20 /lib64/libc.so.6(__libc_start_main+0xfd) [0x7f2db4bfbcdd]
>    #21 /usr/sbin/smbd(+0x5809) [0x7f2db8838809]
> [2013/11/05 04:14:43.534362,  0, pid=91892]
> ../source3/lib/util.c:797(smb_panic_s3)
>   smb_panic(): calling panic action [/usr/local/bin/panic-action 91892]
> [2013/11/05 04:14:44.128587,  0, pid=91892]
> ../source3/lib/util.c:805(smb_panic_s3)
>   smb_panic(): action returned status 0
> [2013/11/05 04:14:44.128711,  0, pid=91892]
> ../source3/lib/dumpcore.c:317(dump_core)
>   dumping core in /var/log/samba//cores/smbd
>
>
>
> I also had already opened a bug report:
> https://bugzilla.samba.org/show_bug.cgi?id=10250
>
>
> Regards,
> Marc
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

samba - Nov 2013 - Segfaults: PANIC: Bad talloc magic value - access after free

[Samba] Segfaults: PANIC: Bad talloc magic value - access after free

[Samba] Segfaults: PANIC: Bad talloc magic value - access after free