#8849 [Tracker] winbind crash on Samba 4.14.2+
Opened 3 years ago by slev. Modified 3 years ago

Though it is related to Samba, I open issue there to inform members.
Related to Samba 4.14.2+.

During the testing of ipatests/test_integration/test_adtrust_install.py winbind time to time crashed on Azure, but test result - PASS:

GNU gdb (GDB) 10.1-alt1 (ALT Sisyphus)
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-alt-linux".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/lib64/samba/sbin/winbindd...
Reading symbols from /usr/lib/debug/usr/lib64/samba/sbin/winbindd.debug...

warning: Can't open file /var/lib/samba/winbindd_cache.tdb during file-backed mapping note processing

warning: Can't open file /var/lib/sss/mc/passwd during file-backed mapping note processing

warning: Can't open file /var/lib/samba/names.tdb during file-backed mapping note processing

warning: Can't open file /var/lib/samba/netsamlogon_cache.tdb during file-backed mapping note processing

warning: Can't open file /var/lib/samba/private/netlogon_creds_cli.tdb during file-backed mapping note processing

warning: Can't open file /var/lib/samba/private/secrets.tdb during file-backed mapping note processing

warning: Can't open file /var/lib/samba/registry.tdb during file-backed mapping note processing
[New LWP 6456]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Missing separate debuginfo for /usr/lib64/sasl2-3/libgssapiv2.so
Try to install the hash file /usr/lib/debug/.build-id/e2/1b1059fcfd50ffc7a6cf628a09e91a875c3ca6.debug
Core was generated by `/usr/sbin/winbindd --no-process-group'.
Program terminated with signal SIGABRT, Aborted.
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:49
49    return ret;

Thread 1 (Thread 0x7f859419fb00 (LWP 6456)):
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:49
        set = {__val = {1024, 0, 0, 0, 0, 94538330162768, 140211760956208, 335544320, 140211750517248, 32, 94538330162868, 94538330162768, 94538330162868, 0, 0, 0}}
        pid = <optimized out>
        tid = <optimized out>
        ret = <optimized out>
#1  0x00007f85973cc538 in __GI_abort () at abort.c:79
        save_stage = 1
        act = {__sigaction_handler = {sa_handler = 0x55fb6b9646b4, sa_sigaction = 0x55fb6b9646b4}, sa_mask = {__val = {0, 0, 0, 0, 0, 2543330829, 140211750734231, 140211750699008, 10974352514185305344, 140211692108336, 140735702632992, 140211758245664, 10974352512106102784, 140211750517248, 10974352514185305344, 0}}, sa_flags = 0, sa_restorer = 0x55fb6b9724f0}
        sigs = {__val = {32, 0, 0, 0, 0, 0, 0, 0, 0, 268435456, 0, 140735702633280, 140211760956208, 32, 94538330162868, 94538330162768}}
#2  0x00007f8597fb9f40 in dump_core () at ../../source3/lib/dumpcore.c:338
        called = true
        __FUNCTION__ = "dump_core"
#3  0x00007f8597fc8d41 in smb_panic_s3 (why=<optimized out>) at ../../source3/lib/util.c:850
        lp_sub = <optimized out>
        cmd = <optimized out>
        result = <optimized out>
        __FUNCTION__ = "smb_panic_s3"
#4  0x00007f859834831a in smb_panic (why=why@entry=0x7fff95900b90 "Signal 11: Segmentation fault") at ../../lib/util/fault.c:197
No locals.
#5  0x00007f85983483a1 in fault_report (sig=11) at ../../lib/util/fault.c:81
        signal_string = "Signal 11: Segmentation fault\000\000\000\370\237I\316\000\000\000\000 \f\220\225\377\177\000\000\317\021\220\225\377\177\000\000\000\035\356\217w\273L\230\320\r\220\225\377\177\000\000\002\000\000\000\000\000\000\000\320\r\220\225\377\177\000\000\377\003\000\000\000\000\000\000 \f\220\225\377\177\000\000\064N(j\373U\000\000\270\r\220\225\377\177\000\000\026AB\227\205\177\000"
        counter = 1
        signal_string = {<optimized out> <repeats 128 times>}
#6  sig_fault (sig=11) at ../../lib/util/fault.c:92
No locals.
#7  <signal handler called>
No locals.
#8  0x00007f859895b512 in dcerpc_binding_handle_call_send (mem_ctx=<optimized out>, ev=ev@entry=0x55fb6b929140, h=h@entry=0x0, object=object@entry=0x0, table=0x7f8598304660 <ndr_table_winbind>, opnum=opnum@entry=7, r_mem=0x55fb6b9694a0, r_ptr=0x55fb6b9794c0) at ../../librpc/rpc/binding_handle.c:376
        req = 0x55fb6b979d80
        state = 0x55fb6b979f30
        subreq = <optimized out>
        ndr_err = <optimized out>
#9  0x00007f859857ca9f in dcerpc_wbint_AllocateGid_r_send (mem_ctx=<optimized out>, ev=ev@entry=0x55fb6b929140, h=h@entry=0x0, r=0x55fb6b9794c0) at librpc/gen_ndr/ndr_winbind_c.c:1639
        req = 0x55fb6b979a50
        state = 0x55fb6b979c00
        subreq = <optimized out>
#10 0x00007f859857cd66 in dcerpc_wbint_AllocateGid_send (mem_ctx=<optimized out>, ev=ev@entry=0x55fb6b929140, h=0x0, _gid=<optimized out>) at librpc/gen_ndr/ndr_winbind_c.c:1736
        req = 0x55fb6b979300
        state = 0x55fb6b9794b0
        subreq = <optimized out>
#11 0x000055fb6a271ef5 in winbindd_allocate_gid_send (mem_ctx=<optimized out>, ev=0x55fb6b929140, cli=<optimized out>, request=<optimized out>) at ../../source3/winbindd/winbindd_allocate_gid.c:49
        req = 0x55fb6b979720
        subreq = <optimized out>
        state = 0x55fb6b9798d0
        child_binding_handle = <optimized out>
        __FUNCTION__ = "winbindd_allocate_gid_send"
#12 0x000055fb6a205385 in process_request_send (cli_state=0x55fb6b978e00, ev=0x55fb6b929140, mem_ctx=0x55fb6b978e00) at ../../source3/winbindd/winbindd.c:740
        subreq = <optimized out>
        state = 0x55fb6b978ca0
        i = <optimized out>
        ok = <optimized out>
        req = 0x55fb6b978af0
        atable = 0x55fb6a2e2040 <async_priv_table+32>
        cmd = WINBINDD_ALLOCATE_GID
        req = <optimized out>
        subreq = <optimized out>
        state = <optimized out>
        atable = <optimized out>
        cmd = <optimized out>
        i = <optimized out>
        ok = <optimized out>
        __FUNCTION__ = "process_request_send"
        __func__ = "process_request_send"
#13 winbind_client_request_read (req=<optimized out>) at ../../source3/winbindd/winbindd.c:988
        state = 0x55fb6b978e00
        ret = <optimized out>
        err = 32645
        __FUNCTION__ = "winbind_client_request_read"
        __func__ = "winbind_client_request_read"
#14 0x000055fb6a27c63b in wb_req_read_done (subreq=<optimized out>) at ../../nsswitch/wb_reqtrans.c:126
        req = 0x55fb6b978fc0
        state = 0x55fb6b979170
        err = 32645
        buf = 0x55fb6b977ee0 "P\b"
#15 0x00007f859798260d in tevent_common_invoke_fd_handler (fde=fde@entry=0x55fb6b979630, flags=1, removed=removed@entry=0x0) at ../../tevent_fd.c:138
        handler_ev = 0x55fb6b929140
#16 0x00007f8597988997 in epoll_event_loop (tvalp=0x7fff95901400, epoll_ev=0x55fb6b93d060) at ../../tevent_epoll.c:736
        fde = 0x55fb6b979630
        flags = <optimized out>
        mpx_fde = <optimized out>
        ret = 1
        i = 0
        timeout = <optimized out>
        wait_errno = <optimized out>
        events = {{events = 1, data = {ptr = 0x55fb6b979630, fd = 1805096496, u32 = 1805096496, u64 = 94538330248752}}}
        ret = <optimized out>
        i = <optimized out>
        events = {{events = <optimized out>, data = {ptr = <optimized out>, fd = <optimized out>, u32 = <optimized out>, u64 = <optimized out>}}}
        timeout = <optimized out>
        wait_errno = <optimized out>
        fde = <optimized out>
        flags = <optimized out>
        mpx_fde = <optimized out>
        handled_fde = <optimized out>
        handled_mpx = <optimized out>
#17 epoll_event_loop_once (ev=<optimized out>, location=<optimized out>) at ../../tevent_epoll.c:937
        epoll_ev = 0x55fb6b93d060
        tval = {tv_sec = 4, tv_usec = 947993}
        panic_triggered = false
#18 0x00007f8597986b17 in std_event_loop_once (ev=0x55fb6b929140, location=0x55fb6a2877f0 "../../source3/winbindd/winbindd.c:2009") at ../../tevent_standard.c:110
        glue_ptr = <optimized out>
        glue = 0x55fb6b93cfd0
        ret = <optimized out>
#19 0x00007f8597981cb4 in _tevent_loop_once (ev=0x55fb6b929140, location=location@entry=0x55fb6a2877f0 "../../source3/winbindd/winbindd.c:2009") at ../../tevent.c:772
        ret = <optimized out>
        nesting_stack_ptr = 0x0
#20 0x000055fb6a1ffd7c in main (argc=<optimized out>, argv=<optimized out>) at ../../source3/winbindd/winbindd.c:2009
        is_daemon = false
        Fork = true
        log_stdout = false
        no_process_group = true
        OPT_DAEMON = OPT_DAEMON
        OPT_FORK = OPT_FORK
        OPT_NO_PROCESS_GROUP = OPT_NO_PROCESS_GROUP
        OPT_LOG_STDOUT = OPT_LOG_STDOUT
        long_options = {{longName = 0x0, shortName = 0 '\000', argInfo = 4, arg = 0x7f859793f3e0 <poptHelpOptions>, val = 0, descrip = 0x55fb6a284fdb "Help options:", argDescrip = 0x0}, {longName = 0x55fb6a284ff0 "stdout", shortName = 83 'S', argInfo = 0, arg = 0x0, val = 1003, descrip = 0x55fb6a284fe9 "Log to stdout", argDescrip = 0x0}, {longName = 0x55fb6a284ff7 "foreground", shortName = 70 'F', argInfo = 0, arg = 0x0, val = 1001, descrip = 0x55fb6a285002 "Daemon in foreground mode", argDescrip = 0x0}, {longName = 0x55fb6a28501c "no-process-group", shortName = 0 '\000', argInfo = 0, arg = 0x0, val = 1002, descrip = 0x55fb6a286b20 "Don't create a new process group", argDescrip = 0x0}, {longName = 0x55fb6a2c7791 "daemon", shortName = 68 'D', argInfo = 0, arg = 0x0, val = 1000, descrip = 0x55fb6a28502d "Become a daemon (default)", argDescrip = 0x0}, {longName = 0x55fb6a285047 "interactive", shortName = 105 'i', argInfo = 0, arg = 0x0, val = 105, descrip = 0x55fb6a285053 "Interactive mode", argDescrip = 0x0}, {longName = 0x55fb6a285064 "no-caching", shortName = 110 'n', argInfo = 0, arg = 0x0, val = 110, descrip = 0x55fb6a28506f "Disable caching", argDescrip = 0x0}, {longName = 0x0, shortName = 0 '\000', argInfo = 4, arg = 0x7f8598545280 <popt_common_samba>, val = 0, descrip = 0x55fb6a28507f "Common samba options:", argDescrip = 0x0}, {longName = 0x0, shortName = 0 '\000', argInfo = 0, arg = 0x0, val = 0, descrip = 0x0, argDescrip = 0x0}}
        lp_sub = <optimized out>
        pc = <optimized out>
        opt = <optimized out>
        frame = 0x55fb6b96aaf0
        status = {v = <optimized out>}
        ok = <optimized out>
        ep_server = <optimized out>
        dce_ctx = <optimized out>
        __FUNCTION__ = "main"
        __func__ = "main"

My colleagues find out that it's https://bugzilla.samba.org/show_bug.cgi?id=14678
https://git.samba.org/?p=samba.git;a=commitdiff;h=2e608468595d748f506a059811231c5572976157;hp=4288319770bc1bde28b1e9ac4bb287e29853378d

The patch fixed winbind crash.
I see that only F34 has affected samba-4.14.4-0.fc34. Also I don't know whether PR-CI post-check crashes or not. So, just heads up.


Metadata Update from @frenaud:
- Issue tagged with: tracker

3 years ago

Log in to comment on this ticket.

Metadata