[Bug 1100787] Re: Samba 3.6.3 segfault or panic.

Fri Jan 25 10:52:17 UTC 2013

Had two crashes today so far and I've managed to pull some more info
from the logs and reports.

We use the squid Kerberos authentication plugin to authenticate the user
and their password, then we use the wbinfo_group.pl script to check the
users membership of an AD group. It appears that the checking for a
group stage is where winbind crashes.

Interestingly the Kerberos authentication stage carries on authenticating users properly even after the crash.
Users that have had their authentication cached by squid can carry on accessing the internet as normal for a short time. Any new authentication attempts fail.

The SID in each initial segfault report was the SID for the "Domain
Users" group. The SIDs in the following segfaults are a mix of random
groups and users, different after each crash.

The last successful user to be looked up before each crash was also
different.

After the first segfault I had to force a server restart as it became totally unresponsive. The second time I managed to kill the Winbind service and restart it. 
No other faults so far but it does seem to be a quiet period at the moment, so the server isn't under a lot of load.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to samba in Ubuntu.
https://bugs.launchpad.net/bugs/1100787

Title:
  Samba 3.6.3 segfault or panic.

Status in “samba” package in Ubuntu:
  New

Bug description:
  We use squid3 and samba to authenticate users access to the internet.
  For the past month Winbind has been crashing intermittently several times a day.
  Once it crashes the first time it seems to try and restart itself but fail and panic immediately again. This happens several times a second and causes the server to grind to a halt.
  Restarting the server fixes the problem for a short time but then it crashes again after a seemingly random amount of time.

  The samba server is attached as a member server in a Windows 2008
  domain.

  Below is the panic or segfault email after installing the samba-dbg
  package:

  -------------------------------------------------
  The Samba 'panic action' script, /usr/share/samba/panic-action,
  was called for PID 9031 (/usr/sbin/winbindd).

  This means there was a problem with the program, such as a segfault.
  Below is a backtrace for this process generated with gdb, which shows
  the state of the program at the time the error occurred.  The Samba log
  files may contain additional information about the problem.

  If the problem persists, you are encouraged to first install the
  samba-dbg package, which contains the debugging symbols for the Samba
  binaries.  Then submit the provided information as a bug report to
  Ubuntu by visiting this link:
  https://launchpad.net/ubuntu/+source/samba/+filebug

  [Thread debugging using libthread_db enabled]
  Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
  0x00007f497d35343e in waitpid () from /lib/x86_64-linux-gnu/libc.so.6
  #0  0x00007f497d35343e in waitpid () from /lib/x86_64-linux-gnu/libc.so.6
  #1  0x00007f497d2d929e in ?? () from /lib/x86_64-linux-gnu/libc.so.6
  #2  0x00007f497fe5446c in smb_panic (why=<optimised out>) at lib/util.c:1123
  #3  0x00007f497fe45708 in fault_report (sig=7) at lib/fault.c:53
  #4  sig_fault (sig=7) at lib/fault.c:76
  #5  <signal handler called>
  #6  0x00007f497d31fad0 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
  #7  0x00007f497da7f042 in ?? () from /usr/lib/x86_64-linux-gnu/libtdb.so.1
  #8  0x00007f497da80bc4 in ?? () from /usr/lib/x86_64-linux-gnu/libtdb.so.1
  #9  0x00007f497da7e664 in ?? () from /usr/lib/x86_64-linux-gnu/libtdb.so.1
  #10 0x00007f497da7f3db in ?? () from /usr/lib/x86_64-linux-gnu/libtdb.so.1
  #11 0x00007f497da7e9d9 in ?? () from /usr/lib/x86_64-linux-gnu/libtdb.so.1
  #12 0x00007f497da7ba5c in ?? () from /usr/lib/x86_64-linux-gnu/libtdb.so.1
  #13 0x00007f497da7bd07 in tdb_store () from /usr/lib/x86_64-linux-gnu/libtdb.so.1
  #14 0x00007f497fe625ba in stabilize_fn (tdb=<optimised out>, key=..., val=..., priv=0x7fff693c3580)
  at lib/gencache.c:561
  #15 0x00007f497da7c7bc in ?? () from /usr/lib/x86_64-linux-gnu/libtdb.so.1
  #16 0x00007f497da7c9d6 in tdb_traverse () from /usr/lib/x86_64-linux-gnu/libtdb.so.1
  #17 0x00007f497fe6282c in gencache_stabilize () at lib/gencache.c:494
  #18 gencache_stabilize () at lib/gencache.c:457
  #19 0x00007f497fe62df2 in gencache_set_data_blob (keystr=<optimised out>, blob=<optimised
  out>, timeout=1359032382) at lib/gencache.c:222
  #20 0x00007f497fe62ee3 in gencache_set (keystr=0x7fff693c3790 "IDMAP/SID2GID/S-1-5-21-1152652908-1908898795-1555891258-512",
  value=0x7fff693c3890 "10512", timeout=1359032382) at lib/gencache.c:641
  #21 0x00007f497fe81437 in idmap_cache_set_sid2gid (sid=0x7f49828814f0, gid=10512)
  at lib/idmap_cache.c:247
  #22 0x00007f498013f353 in idmap_gid_to_sid (domname=<optimised out>, sid=0x7f49828814f0,
  gid=10512) at winbindd/idmap_util.c:143
  #23 0x00007f497fda86f5 in _wbint_Gid2Sid (p=<optimised out>, r=<optimised out>) at
  winbindd/winbindd_dual_srv.c:239
  #24 0x00007f497fdb3c84 in api_wbint_Gid2Sid (p=0x7fff693c3ac0) at librpc/gen_ndr/srv_wbint.c:711
  #25 0x00007f497fda7f6c in winbindd_dual_ndrcmd (domain=<optimised out>, state=0x7fff693c3c30)
  at winbindd/winbindd_dual_ndr.c:322
  #26 0x00007f497fda6cb4 in child_process_request (state=0x7fff693c3c30, child=<optimised
  out>) at winbindd/winbindd_dual.c:440
  #27 fork_domain_child (child=0x7f4980620680) at winbindd/winbindd_dual.c:1554
  #28 0x00007f497fda7765 in wb_child_request_trigger (req=0x7f49824c8fb0, private_data=<optimised
  out>) at winbindd/winbindd_dual.c:145
  #29 0x00007f497fe65d32 in tevent_common_loop_immediate (ev=0x7f49823a8c70) at ../lib/tevent/tevent_immediate.c:135
  #30 0x00007f497fe63e28 in run_events_poll (ev=0x7f49823a8c70, pollrtn=0, pfds=0x0,
  num_pfds=0) at lib/events.c:198
  #31 0x00007f497fe64246 in s3_event_loop_once (ev=0x7f49823a8c70, location=<optimised
  out>) at lib/events.c:331
  #32 0x00007f497fe64e50 in _tevent_loop_once (ev=0x7f49823a8c70, location=0x7f49801c4f01
  "winbindd/winbindd.c:1439") at ../lib/tevent/tevent.c:494
  #33 0x00007f497fd7da3b in main (argc=<optimised out>, argv=<optimised out>, envp=<optimised
  out>) at winbindd/winbindd.c:1439
  A debugging session is active.

          Inferior 1 [process 9031] will be detached.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1100787/+subscriptions