samba - Dec 2013 - Samba 4.0.13+dfsg-1 (occasionally) coredumps when copying files

Hello,

 

Submitting a bug report for Samba crashing on occasion when copying files
(also submitted a bug report w/Debian).

 

Package: samba

Version: 4.0.13+dfsg-1

 

While copying files from Linux(SAMBA) -> to a Windows 7 host using Debian
Testing (x86_64) w/ distribution's Samba version (4.0.13+dfsg-1):

 

Cores:

# ls -ltr *smb*

-rw------- 1 root root 2764800 Nov 10 12:30 core.smbd.30179

-rw------- 1 root root 2801664 Dec 22 06:25 core.smbd.12767

-rw------- 1 root root 2801664 Dec 22 06:25 core.smbd.12771

-rw------- 1 root root 2801664 Dec 22 07:10 core.smbd.17141

-rw------- 1 root root 2801664 Dec 22 07:10 core.smbd.17543

-rw------- 1 root root 2801664 Dec 22 07:53 core.smbd.10451

-rw------- 1 root root 2801664 Dec 22 07:53 core.smbd.10452

-rw------- 1 root root 2801664 Dec 22 08:59 core.smbd.15403

-rw------- 1 root root 2801664 Dec 22 08:59 core.smbd.15404

-rw------- 1 root root 2801664 Dec 22 14:41 core.smbd.30674

-rw------- 1 root root 2801664 Dec 22 14:41 core.smbd.30675

-rw------- 1 root root 2801664 Dec 22 15:09 core.smbd.12563

-rw------- 1 root root 2801664 Dec 22 15:09 core.smbd.12564

-rw------- 1 root root 2801664 Dec 22 16:33 core.smbd.16004

-rw------- 1 root root 2801664 Dec 22 16:33 core.smbd.16005

-rw------- 1 root root 2801664 Dec 23 04:02 core.smbd.12703

-rw------- 1 root root 2801664 Dec 23 04:02 core.smbd.12706

-rw------- 1 root root 2801664 Dec 23 05:07 core.smbd.1252

-rw------- 1 root root 2801664 Dec 23 05:07 core.smbd.1253

-rw------- 1 root root 2801664 Dec 23 05:51 core.smbd.11221

-rw------- 1 root root 2801664 Dec 23 05:51 core.smbd.11381

 

Messages:

Dec 23 05:51:25 atom smbd[11221]: [2013/12/23 05:51:25.476826,  0]
../source3/lib/util.c:810(smb_panic_s3) 

Dec 23 05:51:25 atom smbd[11221]:   PANIC (pid 11221): num_bytes too large:
4294966797 

Dec 23 05:51:25 atom smbd[11221]: [2013/12/23 05:51:25.477868,  0]
../source3/lib/util.c:921(log_stack_trace) 

Dec 23 05:51:25 atom smbd[11221]:   BACKTRACE: 23 stack frames: 

Dec 23 05:51:25 atom smbd[11221]:    #0
/usr/lib/x86_64-linux-gnu/libsmbconf.so.0(log_stack_trace+0x1a)
[0x7ff9f75aceda] 

Dec 23 05:51:25 atom smbd[11221]:    #1
/usr/lib/x86_64-linux-gnu/libsmbconf.so.0(smb_panic_s3+0x20)
[0x7ff9f75acfb0] 

Dec 23 05:51:25 atom smbd[11221]:    #2
/usr/lib/x86_64-linux-gnu/libsamba-util.so.0(smb_panic+0x2f)
[0x7ff9f8afb0ff] 

Dec 23 05:51:25 atom smbd[11221]:    #3
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0(+0x1217f5)
[0x7ff9f86e77f5] 

Dec 23 05:51:25 atom smbd[11221]:    #4
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0(reply_outbuf+0x20)
[0x7ff9f86e89c0] 

Dec 23 05:51:25 atom smbd[11221]:    #5
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0(send_trans_reply+0xee)
[0x7ff9f86829fe] 

Dec 23 05:51:25 atom smbd[11221]:    #6
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0(api_reply+0x377)
[0x7ff9f8691d07] 

Dec 23 05:51:25 atom smbd[11221]:    #7
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0(+0xbd933) [0x7ff9f8683933]


Dec 23 05:51:25 atom smbd[11221]:    #8
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0(reply_trans+0x5b9)
[0x7ff9f86841c9] 

Dec 23 05:51:25 atom smbd[11221]:    #9
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0(+0x122cd1)
[0x7ff9f86e8cd1] 

Dec 23 05:51:25 atom smbd[11221]:    #10
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0(+0x123d9f)
[0x7ff9f86e9d9f] 

Dec 23 05:51:25 atom smbd[11221]:    #11
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0(+0x124370)
[0x7ff9f86ea370] 

Dec 23 05:51:25 atom smbd[11221]:    #12
/usr/lib/x86_64-linux-gnu/libsmbconf.so.0(run_events_poll+0x16c)
[0x7ff9f75cb7ec] 

Dec 23 05:51:25 atom smbd[11221]:    #13
/usr/lib/x86_64-linux-gnu/libsmbconf.so.0(+0x43a40) [0x7ff9f75cba40] 

Dec 23 05:51:25 atom smbd[11221]:    #14
/usr/lib/x86_64-linux-gnu/libtevent.so.0(_tevent_loop_once+0x8d)
[0x7ff9f5f93c0d] 

Dec 23 05:51:25 atom smbd[11221]:    #15
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0(smbd_process+0xbac)
[0x7ff9f86eb66c] 

Dec 23 05:51:25 atom smbd[11221]:    #16 /usr/sbin/smbd(+0x9ce4)
[0x7ff9f915bce4] 

Dec 23 05:51:25 atom smbd[11221]:    #17
/usr/lib/x86_64-linux-gnu/libsmbconf.so.0(run_events_poll+0x16c)
[0x7ff9f75cb7ec] 

Dec 23 05:51:25 atom smbd[11221]:    #18
/usr/lib/x86_64-linux-gnu/libsmbconf.so.0(+0x43a40) [0x7ff9f75cba40] 

Dec 23 05:51:25 atom smbd[11221]:    #19
/usr/lib/x86_64-linux-gnu/libtevent.so.0(_tevent_loop_once+0x8d)
[0x7ff9f5f93c0d] 

Dec 23 05:51:25 atom smbd[11221]:    #20 /usr/sbin/smbd(main+0x1401)
[0x7ff9f9158c01] 

Dec 23 05:51:25 atom smbd[11221]:    #21
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5) [0x7ff9f5c05995] 

Dec 23 05:51:25 atom smbd[11221]:    #22 /usr/sbin/smbd(+0x6f93)
[0x7ff9f9158f93] 

Dec 23 05:51:25 atom smbd[11221]: [2013/12/23 05:51:25.479000,  0]
../source3/lib/dumpcore.c:317(dump_core) 

Dec 23 05:51:25 atom smbd[11221]:   dumping core in /local/cores 

Dec 23 05:51:25 atom smbd[11221]: 

Dec 23 05:51:27 atom smbd[11381]: [2013/12/23 05:51:27.759581,  0]
../source3/lib/util.c:810(smb_panic_s3) 

Dec 23 05:51:27 atom smbd[11381]:   PANIC (pid 11381): num_bytes too large:
4294966797 

Dec 23 05:51:27 atom smbd[11381]: [2013/12/23 05:51:27.760276,  0]
../source3/lib/util.c:921(log_stack_trace) 

Dec 23 05:51:27 atom smbd[11381]:   BACKTRACE: 23 stack frames: 

Dec 23 05:51:27 atom smbd[11381]:    #0
/usr/lib/x86_64-linux-gnu/libsmbconf.so.0(log_stack_trace+0x1a)
[0x7ff9f75aceda] 

Dec 23 05:51:27 atom smbd[11381]:    #1
/usr/lib/x86_64-linux-gnu/libsmbconf.so.0(smb_panic_s3+0x20)
[0x7ff9f75acfb0] 

Dec 23 05:51:27 atom smbd[11381]:    #2
/usr/lib/x86_64-linux-gnu/libsamba-util.so.0(smb_panic+0x2f)
[0x7ff9f8afb0ff] 

Dec 23 05:51:27 atom smbd[11381]:    #3
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0(+0x1217f5)
[0x7ff9f86e77f5] 

Dec 23 05:51:27 atom smbd[11381]:    #4
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0(reply_outbuf+0x20)
[0x7ff9f86e89c0] 

Dec 23 05:51:27 atom smbd[11381]:    #5
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0(send_trans_reply+0xee)
[0x7ff9f86829fe] 

Dec 23 05:51:27 atom smbd[11381]:    #6
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0(api_reply+0x377)
[0x7ff9f8691d07] 

Dec 23 05:51:27 atom smbd[11381]:    #7
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0(+0xbd933) [0x7ff9f8683933]


Dec 23 05:51:27 atom smbd[11381]:    #8
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0(reply_trans+0x5b9)
[0x7ff9f86841c9] 

Dec 23 05:51:27 atom smbd[11381]:    #9
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0(+0x122cd1)
[0x7ff9f86e8cd1] 

Dec 23 05:51:27 atom smbd[11381]:    #10
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0(+0x123d9f)
[0x7ff9f86e9d9f] 

Dec 23 05:51:27 atom smbd[11381]:    #11
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0(+0x124370)
[0x7ff9f86ea370] 

Dec 23 05:51:27 atom smbd[11381]:    #12
/usr/lib/x86_64-linux-gnu/libsmbconf.so.0(run_events_poll+0x16c)
[0x7ff9f75cb7ec] 

Dec 23 05:51:27 atom smbd[11381]:    #13
/usr/lib/x86_64-linux-gnu/libsmbconf.so.0(+0x43a40) [0x7ff9f75cba40] 

Dec 23 05:51:27 atom smbd[11381]:    #14
/usr/lib/x86_64-linux-gnu/libtevent.so.0(_tevent_loop_once+0x8d)
[0x7ff9f5f93c0d] 

Dec 23 05:51:27 atom smbd[11381]:    #15
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0(smbd_process+0xbac)
[0x7ff9f86eb66c] 

Dec 23 05:51:27 atom smbd[11381]:    #16 /usr/sbin/smbd(+0x9ce4)
[0x7ff9f915bce4] 

Dec 23 05:51:27 atom smbd[11381]:    #17
/usr/lib/x86_64-linux-gnu/libsmbconf.so.0(run_events_poll+0x16c)
[0x7ff9f75cb7ec] 

Dec 23 05:51:27 atom smbd[11381]:    #18
/usr/lib/x86_64-linux-gnu/libsmbconf.so.0(+0x43a40) [0x7ff9f75cba40] 

Dec 23 05:51:27 atom smbd[11381]:    #19
/usr/lib/x86_64-linux-gnu/libtevent.so.0(_tevent_loop_once+0x8d)
[0x7ff9f5f93c0d] 

Dec 23 05:51:27 atom smbd[11381]:    #20 /usr/sbin/smbd(main+0x1401)
[0x7ff9f9158c01] 

Dec 23 05:51:27 atom smbd[11381]:    #21
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5) [0x7ff9f5c05995] 

Dec 23 05:51:27 atom smbd[11381]:    #22 /usr/sbin/smbd(+0x6f93)
[0x7ff9f9158f93] 

Dec 23 05:51:27 atom smbd[11381]: [2013/12/23 05:51:27.761184,  0]
../source3/lib/dumpcore.c:317(dump_core) 

Dec 23 05:51:27 atom smbd[11381]:   dumping core in /local/cores 

Dec 23 05:51:27 atom smbd[11381]:

 

 

Backtrace:

# gdb /usr/sbin/smbd ./core.smbd.11381 

GNU gdb (GDB) 7.6.1 (Debian 7.6.1-1)

Copyright (C) 2013 Free Software Foundation, Inc.

License GPLv3+: GNU GPL version 3 or later
<http://gnu.org/licenses/gpl.html>

This is free software: you are free to change and redistribute it.

There is NO WARRANTY, to the extent permitted by law.  Type "show
copying"

and "show warranty" for details.

This GDB was configured as "x86_64-linux-gnu".

For bug reporting instructions, please see:

<http://www.gnu.org/software/gdb/bugs/>...

Reading symbols from /usr/sbin/smbd...(no debugging symbols found)...done.

[New LWP 11381]

 

warning: .dynamic section for
"/usr/lib/x86_64-linux-gnu/libsqlite3.so.0" is
not at the expected address (wrong library or version mismatch?)

 

warning: Could not load shared library symbols for linux-vdso.so.1.

Do you need "set solib-search-path" or "set sysroot"?

[Thread debugging using libthread_db enabled]

Using host libthread_db library
"/lib/x86_64-linux-gnu/libthread_db.so.1".

Core was generated by `/usr/sbin/smbd -D'.

Program terminated with signal 6, Aborted.

#0  0x00007ff9f5c191d5 in __GI_raise (sig=sig at entry=6) at
../nptl/sysdeps/unix/sysv/linux/raise.c:56

56      ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.

(gdb) bt

#0  0x00007ff9f5c191d5 in __GI_raise (sig=sig at entry=6) at
../nptl/sysdeps/unix/sysv/linux/raise.c:56

#1  0x00007ff9f5c1c388 in __GI_abort () at abort.c:90

#2  0x00007ff9f75c363b in dump_core () from
/usr/lib/x86_64-linux-gnu/libsmbconf.so.0

#3  0x00007ff9f75ad017 in smb_panic_s3 () from
/usr/lib/x86_64-linux-gnu/libsmbconf.so.0

#4  0x00007ff9f8afb0ff in smb_panic () from
/usr/lib/x86_64-linux-gnu/libsamba-util.so.0

#5  0x00007ff9f86e77f5 in ?? () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0

#6  0x00007ff9f86e89c0 in reply_outbuf () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0

#7  0x00007ff9f86829fe in send_trans_reply () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0

#8  0x00007ff9f8691d07 in api_reply () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0

#9  0x00007ff9f8683933 in ?? () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0

#10 0x00007ff9f86841c9 in reply_trans () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0

#11 0x00007ff9f86e8cd1 in ?? () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0

#12 0x00007ff9f86e9d9f in ?? () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0

#13 0x00007ff9f86ea370 in ?? () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0

#14 0x00007ff9f75cb7ec in run_events_poll () from
/usr/lib/x86_64-linux-gnu/libsmbconf.so.0

#15 0x00007ff9f75cba40 in ?? () from
/usr/lib/x86_64-linux-gnu/libsmbconf.so.0

#16 0x00007ff9f5f93c0d in _tevent_loop_once () from
/usr/lib/x86_64-linux-gnu/libtevent.so.0

#17 0x00007ff9f86eb66c in smbd_process () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0

#18 0x00007ff9f915bce4 in ?? ()

#19 0x00007ff9f75cb7ec in run_events_poll () from
/usr/lib/x86_64-linux-gnu/libsmbconf.so.0

#20 0x00007ff9f75cba40 in ?? () from
/usr/lib/x86_64-linux-gnu/libsmbconf.so.0

#21 0x00007ff9f5f93c0d in _tevent_loop_once () from
/usr/lib/x86_64-linux-gnu/libtevent.so.0

#22 0x00007ff9f9158c01 in main ()

(gdb) bt full

#0  0x00007ff9f5c191d5 in __GI_raise (sig=sig at entry=6) at
../nptl/sysdeps/unix/sysv/linux/raise.c:56

        resultvar = 0

        pid = 11381

        selftid = 11381

#1  0x00007ff9f5c1c388 in __GI_abort () at abort.c:90

        save_stage = 2

        act = {__sigaction_handler = {sa_handler = 0x14, sa_sigaction 0x14},
sa_mask = {__val = {4294966797, 140711598038336, 140711600307605, 1,
0, 17179869185, 140711546498280, 65534, 140711598038336, 10,
140711600333317, 140711595848416, 140711598101269, 140711598101008,
140734860130608, 6}}, 

          sa_flags = 1666743072, sa_restorer = 0x7ff9f5f896a0
<_IO_file_jumps>}

        sigs = {__val = {32, 0 <repeats 15 times>}}

#2  0x00007ff9f75c363b in dump_core () from
/usr/lib/x86_64-linux-gnu/libsmbconf.so.0

No symbol table info available.

#3  0x00007ff9f75ad017 in smb_panic_s3 () from
/usr/lib/x86_64-linux-gnu/libsmbconf.so.0

No symbol table info available.

#4  0x00007ff9f8afb0ff in smb_panic () from
/usr/lib/x86_64-linux-gnu/libsamba-util.so.0

No symbol table info available.

#5  0x00007ff9f86e77f5 in ?? () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0

No symbol table info available.

#6  0x00007ff9f86e89c0 in reply_outbuf () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0

No symbol table info available.

#7  0x00007ff9f86829fe in send_trans_reply () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0

No symbol table info available.

#8  0x00007ff9f8691d07 in api_reply () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0

No symbol table info available.

#9  0x00007ff9f8683933 in ?? () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0

No symbol table info available.

#10 0x00007ff9f86841c9 in reply_trans () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0

No symbol table info available.

#11 0x00007ff9f86e8cd1 in ?? () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0

No symbol table info available.

#12 0x00007ff9f86e9d9f in ?? () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0

No symbol table info available.

#13 0x00007ff9f86ea370 in ?? () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0

No symbol table info available.

#14 0x00007ff9f75cb7ec in run_events_poll () from
/usr/lib/x86_64-linux-gnu/libsmbconf.so.0

No symbol table info available.

#15 0x00007ff9f75cba40 in ?? () from
/usr/lib/x86_64-linux-gnu/libsmbconf.so.0

No symbol table info available.

#16 0x00007ff9f5f93c0d in _tevent_loop_once () from
/usr/lib/x86_64-linux-gnu/libtevent.so.0

No symbol table info available.

#17 0x00007ff9f86eb66c in smbd_process () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd_base.so.0

No symbol table info available.

#18 0x00007ff9f915bce4 in ?? ()

No symbol table info available.

#19 0x00007ff9f75cb7ec in run_events_poll () from
/usr/lib/x86_64-linux-gnu/libsmbconf.so.0

No symbol table info available.

#20 0x00007ff9f75cba40 in ?? () from
/usr/lib/x86_64-linux-gnu/libsmbconf.so.0

No symbol table info available.

#21 0x00007ff9f5f93c0d in _tevent_loop_once () from
/usr/lib/x86_64-linux-gnu/libtevent.so.0

No symbol table info available.

#22 0x00007ff9f9158c01 in main ()

No symbol table info available.

(gdb)

 

Justin.