[Bugs] [Bug 1403599] New: Samba crashes with 3.9 and VFS module

[bugzilla at redhat.com]

https://bugzilla.redhat.com/show_bug.cgi?id=1403599

            Bug ID: 1403599
           Summary: Samba crashes with 3.9 and VFS module
           Product: GlusterFS
           Version: 3.9
         Component: gluster-smb
          Severity: high
          Assignee: bugs at gluster.org
          Reporter: denis.lambolez at gmail.com
                CC: bugs at gluster.org



Created attachment 1230656
  --> https://bugzilla.redhat.com/attachment.cgi?id=1230656&action=edit
Samba log file (for one client)

Description of problem:
After upgrading to "3.9.0-ubuntu1~xenial5" for GlusterFS and
"2:4.3.11+dfsg-0ubuntu0.16.04.2glusterfs3.9.0xenial1" for the Samba VFS Module,
I'm experiencing crashes of the smbd deamon. System was working fine with 3.7.x

Version-Release number of selected component (if applicable):
GlusterFS: 3.9.0-ubuntu1~xenial5
Samba: 2:4.3.11+dfsg-0ubuntu0.16.04.2glusterfs3.9.0xenial1 from Andre Bauer PPA
( http://ppa.launchpad.net/monotek/samba-glusterfs-3.9/ubuntu xenial/main amd64
Packages)

How reproducible: 
Crash is immediate, as soon as the user access the Samba share exposed through
VFS 

Steps to Reproduce:
1. Expose a samba share (stored in a GlusterFS volume) through Gluster VFS in
smb.conf: 
   path = /share
   kernel share modes = no
   vfs objects = glusterfs
   glusterfs:volfile_server = localhost
   glusterfs:volume = smbshare
2. Access the share from a samba or windows client
3.

Actual results:
smbd daemon crashes.
Here is the dump of the samba panic action script.
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
0x00007fe9d59f651b in __GI___waitpid (pid=3746,
stat_loc=stat_loc at entry=0x7ffd24482ed0, options=options at entry=0) at
../sysdeps/unix/sysv/linux/waitpid.c:29
#0  0x00007fe9d59f651b in __GI___waitpid (pid=3746,
stat_loc=stat_loc at entry=0x7ffd24482ed0, options=options at entry=0) at
../sysdeps/unix/sysv/linux/waitpid.c:29
#1  0x00007fe9d596ffbb in do_system (line=<optimized out>) at
../sysdeps/posix/system.c:148
#2  0x00007fe9d841a841 in smb_panic_s3 () from
/usr/lib/x86_64-linux-gnu/samba/libsmbregistry.so.0
#3  0x00007fe9d918df1f in smb_panic () from
/usr/lib/x86_64-linux-gnu/libsamba-util.so.0
#4  0x00007fe9d918e136 in ?? () from
/usr/lib/x86_64-linux-gnu/libsamba-util.so.0
#5  <signal handler called>
#6  0x00007fe9d5960428 in __GI_raise (sig=sig at entry=6) at
../sysdeps/unix/sysv/linux/raise.c:54
#7  0x00007fe9d596202a in __GI_abort () at abort.c:89
#8  0x00007fe9d59a27ea in __libc_message (do_abort=do_abort at entry=2,
fmt=fmt at entry=0x7fe9d5abb2e0 "*** Error in `%s': %s: 0x%s ***\n") at
../sysdeps/posix/libc_fatal.c:175
#9  0x00007fe9d59aae0a in malloc_printerr (ar_ptr=<optimized out>,
ptr=<optimized out>, str=0x7fe9d5ab80b2 "free(): invalid pointer", action=3) at
malloc.c:5004
#10 _int_free (av=<optimized out>, p=<optimized out>, have_lock=0) at
malloc.c:3865
#11 0x00007fe9d59ae98c in __GI___libc_free (mem=<optimized out>) at
malloc.c:2966
#12 0x00007fe9d8d5ff65 in ?? () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd-base.so.0
#13 0x00007fe9d8d60ec7 in ?? () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd-base.so.0
#14 0x00007fe9d8d61a11 in ?? () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd-base.so.0
#15 0x00007fe9d8d61f10 in make_connection () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd-base.so.0
#16 0x00007fe9d8d103f2 in reply_tcon_and_X () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd-base.so.0
#17 0x00007fe9d8d5b1d7 in ?? () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd-base.so.0
#18 0x00007fe9d8d5cf23 in ?? () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd-base.so.0
#19 0x00007fe9d8d5e58c in ?? () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd-base.so.0
#20 0x00007fe9d70ad917 in run_events_poll () from
/usr/lib/x86_64-linux-gnu/libsmbconf.so.0
#21 0x00007fe9d70adb77 in ?? () from /usr/lib/x86_64-linux-gnu/libsmbconf.so.0
#22 0x00007fe9d5cf7d3d in _tevent_loop_once () from
/usr/lib/x86_64-linux-gnu/libtevent.so.0
#23 0x00007fe9d5cf7edb in tevent_common_loop_wait () from
/usr/lib/x86_64-linux-gnu/libtevent.so.0
#24 0x00007fe9d8d5f8e8 in smbd_process () from
/usr/lib/x86_64-linux-gnu/samba/libsmbd-base.so.0
#25 0x000055b1383f8e12 in ?? ()
#26 0x00007fe9d70ad917 in run_events_poll () from
/usr/lib/x86_64-linux-gnu/libsmbconf.so.0
#27 0x00007fe9d70adb77 in ?? () from /usr/lib/x86_64-linux-gnu/libsmbconf.so.0
#28 0x00007fe9d5cf7d3d in _tevent_loop_once () from
/usr/lib/x86_64-linux-gnu/libtevent.so.0
#29 0x00007fe9d5cf7edb in tevent_common_loop_wait () from
/usr/lib/x86_64-linux-gnu/libtevent.so.0
#30 0x000055b1383f7099 in main ()

Expected results:
No crash of smbd

Additional info:
Shares are stored on a GlusterFS replicated volume and are exposed through
Samba VFS module.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.