Bug 1033595

Summary: [abrt] samba-winbind-4.1.0-0.6.rc2.fc20: dump_core: Process /usr/sbin/winbindd was killed by signal 6 (SIGABRT)
Product: [Fedora] Fedora Reporter: s-worm
Component: sambaAssignee: Guenther Deschner <gdeschner>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 20CC: abokovoy, acooks, ajsfedora, alpaslan.yolcu, andy, asn, brian.murrell, dwmw2, easdue, fralaltro, gdeschner, geoffroy.vancutsem, jesse.brandeburg, jra, nixbugz, sbose, sgraf, ssorce, steved
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
URL: https://retrace.fedoraproject.org/faf/reports/bthash/5346515406f0a16b5b35c7a272cb9d6969772931
Whiteboard: abrt_hash:417cbecd0f63150e4b4626afbe815e5670e78936
Fixed In Version: samba-4.1.12-5.fc21 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-10-11 06:51:33 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: backtrace
none
File: cgroup
none
File: core_backtrace
none
File: dso_list
none
File: environ
none
File: limits
none
File: maps
none
File: open_fds
none
File: proc_pid_status
none
File: var_log_messages
none
requested none

Description s-worm 2013-11-22 12:55:53 UTC
Version-Release number of selected component:
samba-winbind-4.1.0-0.6.rc2.fc20

Additional info:
reporter:       libreport-2.1.9
backtrace_rating: 4
cmdline:        /usr/sbin/winbindd
crash_function: dump_core
executable:     /usr/sbin/winbindd
kernel:         3.11.2-301.fc20.x86_64
runlevel:       unknown
type:           CCpp
uid:            0

Truncated backtrace:
Thread no. 1 (10 frames)
 #2 dump_core at ../source3/lib/dumpcore.c:336
 #3 smb_panic_s3 at ../source3/lib/util.c:833
 #4 smb_panic at ../lib/util/fault.c:159
 #5 pdb_get_methods at ../source3/passdb/pdb_interface.c:226
 #6 pdb_is_responsible_for_builtin at ../source3/passdb/pdb_interface.c:2424
 #7 sid_check_is_for_passdb at ../source3/lib/util_sid_passdb.c:74
 #8 idmap_find_domain_with_sid at ../source3/winbindd/idmap.c:431
 #9 _wbint_Sids2UnixIDs at ../source3/winbindd/winbindd_dual_srv.c:126
 #10 api_wbint_Sids2UnixIDs at default/source3/librpc/gen_ndr/srv_wbint.c:391
 #11 winbindd_dual_ndrcmd at ../source3/winbindd/winbindd_dual_ndr.c:322

Potential duplicate: bug 893121

Comment 1 s-worm 2013-11-22 12:56:04 UTC
Created attachment 827753 [details]
File: backtrace

Comment 2 s-worm 2013-11-22 12:56:09 UTC
Created attachment 827755 [details]
File: cgroup

Comment 3 s-worm 2013-11-22 12:56:14 UTC
Created attachment 827756 [details]
File: core_backtrace

Comment 4 s-worm 2013-11-22 12:56:19 UTC
Created attachment 827757 [details]
File: dso_list

Comment 5 s-worm 2013-11-22 12:56:23 UTC
Created attachment 827758 [details]
File: environ

Comment 6 s-worm 2013-11-22 12:56:27 UTC
Created attachment 827759 [details]
File: limits

Comment 7 s-worm 2013-11-22 12:56:32 UTC
Created attachment 827760 [details]
File: maps

Comment 8 s-worm 2013-11-22 12:56:36 UTC
Created attachment 827761 [details]
File: open_fds

Comment 9 s-worm 2013-11-22 12:56:41 UTC
Created attachment 827763 [details]
File: proc_pid_status

Comment 10 s-worm 2013-11-22 12:56:45 UTC
Created attachment 827764 [details]
File: var_log_messages

Comment 11 Alexander Bokovoy 2013-11-22 13:23:33 UTC
Can we see /var/log/audit/audit.log too?

Comment 12 s-worm 2013-11-22 13:35:03 UTC
Created attachment 827770 [details]
requested

Comment 13 s-worm 2013-11-22 13:35:42 UTC
Comment on attachment 827770 [details]
requested

audit.log

Comment 14 Alexander Bokovoy 2013-11-22 13:56:06 UTC
Thanks, so there is nothing on SELinux level blocking access to /usr/lib64/samba/pdb/tdbsam.so. Do you have this file?

Can you reproduce the crash? If so, please put 'log level = 5' to /etc/samba/smb.conf (in global section) and make /var/log/samba/log* available.

Comment 15 Stanislav Graf 2014-01-12 22:15:16 UTC
(In reply to Alexander Bokovoy from comment #14)

ABRT says I hit this bug today. In my case ausearch doesn't show any AVC at the time of crash. I don't know what caused the issue.

In the log file (/var/log/samba/log*) of one client I have found (time coresponds to crash+2min):
[2014/01/12 19:46:00.552289,  0] ../source3/lib/util.c:785(smb_panic_s3)
  PANIC (pid 4934): ndr_push_share_mode_lock failed
[2014/01/12 19:46:00.554888,  0] ../source3/lib/util.c:896(log_stack_trace)
  BACKTRACE: 27 stack frames:
   #0 /lib64/libsmbconf.so.0(log_stack_trace+0x1a) [0x7f096049ed5a]
   #1 /lib64/libsmbconf.so.0(smb_panic_s3+0x20) [0x7f096049ee30]
   #2 /lib64/libsamba-util.so.0(smb_panic+0x2f) [0x7f0961a0023f]
   #3 /usr/lib64/samba/libsmbd_base.so(+0x1950bc) [0x7f09616500bc]
   #4 /lib64/libtalloc.so.2(+0x601d) [0x7f095f0c001d]
   #5 /lib64/libtalloc.so.2(+0x5d5b) [0x7f095f0bfd5b]
   #6 /lib64/libtalloc.so.2(_talloc_free+0x113) [0x7f095f0bc413]
   #7 /usr/lib64/samba/libsmbd_base.so(+0x1103fb) [0x7f09615cb3fb]
   #8 /usr/lib64/samba/libsmbd_base.so(+0x112ef2) [0x7f09615cdef2]
   #9 /usr/lib64/samba/libsmbd_base.so(create_file_default+0x1ba) [0x7f09615cef4a]
   #10 /usr/lib64/samba/libsmbd_base.so(+0x1e1dab) [0x7f096169cdab]
   #11 /usr/lib64/samba/libsmbd_base.so(smb_vfs_call_create_file+0xa5) [0x7f09615d5535]
   #12 /usr/lib64/samba/libsmbd_base.so(reply_ntcreate_and_X+0x486) [0x7f096158eeb6]
   #13 /usr/lib64/samba/libsmbd_base.so(+0x12c579) [0x7f09615e7579]
   #14 /usr/lib64/samba/libsmbd_base.so(+0x12d64f) [0x7f09615e864f]
   #15 /usr/lib64/samba/libsmbd_base.so(+0x12dc20) [0x7f09615e8c20]
   #16 /lib64/libsmbconf.so.0(run_events_poll+0x16c) [0x7f09604bc94c]
   #17 /lib64/libsmbconf.so.0(+0x42ba0) [0x7f09604bcba0]
   #18 /lib64/libtevent.so.0(_tevent_loop_once+0x8d) [0x7f095eeaff2d]
   #19 /usr/lib64/samba/libsmbd_base.so(smbd_process+0xb10) [0x7f09615e9e80]
   #20 /usr/sbin/smbd(+0xa254) [0x7f0962065254]
   #21 /lib64/libsmbconf.so.0(run_events_poll+0x16c) [0x7f09604bc94c]
   #22 /lib64/libsmbconf.so.0(+0x42ba0) [0x7f09604bcba0]
   #23 /lib64/libtevent.so.0(_tevent_loop_once+0x8d) [0x7f095eeaff2d]
   #24 /usr/sbin/smbd(main+0x12ed) [0x7f0962061c2d]
   #25 /lib64/libc.so.6(__libc_start_main+0xf5) [0x7f095eb0ed65]
   #26 /usr/sbin/smbd(+0x71a1) [0x7f09620621a1]
[2014/01/12 19:46:00.564661,  0] ../source3/lib/dumpcore.c:317(dump_core)
  dumping core in /var/log/samba/cores/smbd

Comment 16 ajs 2014-01-26 23:01:54 UTC
Another user experienced a similar problem:

Not sure what caused this.  I left my laptop on over night and had 3 ABRT notices in the morning.  This was one.

reporter:       libreport-2.1.11
backtrace_rating: 4
cmdline:        /usr/sbin/winbindd
crash_function: dump_core
executable:     /usr/sbin/winbindd
kernel:         3.12.8-300.fc20.x86_64
package:        samba-winbind-4.1.3-2.fc20
reason:         winbindd killed by SIGABRT
runlevel:       N 5
type:           CCpp
uid:            0

Comment 17 David Woodhouse 2014-02-03 12:31:36 UTC
Another user experienced a similar problem:

Changed wireless network (hence falling off VPN).

reporter:       libreport-2.1.11
backtrace_rating: 4
cmdline:        /usr/sbin/winbindd
crash_function: dump_core
executable:     /usr/sbin/winbindd
kernel:         3.12.8-300.fc20.x86_64
package:        samba-winbind-4.1.3-2.fc20
reason:         winbindd killed by SIGABRT
runlevel:       N 5
type:           CCpp
uid:            0

Comment 18 Stuart Rothrock 2014-04-11 09:38:45 UTC
Another user experienced a similar problem:

I don't know what percceeded the crash.

reporter:       libreport-2.2.0
backtrace_rating: 4
cmdline:        /usr/sbin/smbd
crash_function: dump_core
executable:     /usr/sbin/smbd
kernel:         3.13.7-200.fc20.x86_64
package:        samba-4.1.6-1.fc20
reason:         smbd killed by SIGABRT
runlevel:       N 5
type:           CCpp
uid:            0

Comment 19 David Woodhouse 2014-07-16 08:32:30 UTC
Seen again on a shiny new install of F20+updates, the first time I joined the VPN and then dropped off it again.

#0  0x00007fe0bd05ac39 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007fe0bd05c348 in __GI_abort () at abort.c:89
#2  0x00007fe0bf3e5a1b in dump_core () at ../source3/lib/dumpcore.c:336
#3  0x00007fe0bf3d00d7 in smb_panic_s3 (why=<optimized out>) at ../source3/lib/util.c:808
#4  0x00007fe0c36c044f in smb_panic (why=why@entry=0x7fe0c36cdcd4 "internal error") at ../lib/util/fault.c:159
#5  0x00007fe0c36c0666 in fault_report (sig=<optimized out>) at ../lib/util/fault.c:77
#6  sig_fault (sig=<optimized out>) at ../lib/util/fault.c:88
#7  <signal handler called>
#8  0x00007fe0bd1392b4 in inet_pton4 (dst=0x7fffb021a580 "ȥ!\260\377\177", 
    src=0x1 <error: Cannot access memory at address 0x1>) at inet_pton.c:93
#9  __GI_inet_pton (af=af@entry=2, src=src@entry=0x0, dst=dst@entry=0x7fffb021a580) at inet_pton.c:59
#10 0x00007fe0c36bcab4 in is_ipaddress_v4 (str=str@entry=0x0) at ../lib/util/util_net.c:316
#11 0x00007fe0c36bcd59 in is_ipaddress (str=str@entry=0x0) at ../lib/util/util_net.c:366
#12 0x00007fe0c0a6f9a3 in internal_resolve_name (name=name@entry=0x0, name_type=name_type@entry=28, 
    sitename=sitename@entry=0x7fe0c5eaa4a0 "IR-Ireland", return_iplist=return_iplist@entry=0x7fffb021a768, 
    return_count=return_count@entry=0x7fffb021a754, 
    resolve_order=resolve_order@entry=0x7fe0c0c83020 <ads_order>) at ../source3/libsmb/namequery.c:2600
#13 0x00007fe0c0a70b09 in get_dc_list (domain=domain@entry=0x0, 
    sitename=sitename@entry=0x7fe0c5eaa4a0 "IR-Ireland", ip_list=ip_list@entry=0x7fffb021a920, 
    count=count@entry=0x7fffb021a91c, lookup_type=lookup_type@entry=DC_ADS_ONLY, 
    ordered=ordered@entry=0x7fffb021a88f) at ../source3/libsmb/namequery.c:3114
#14 0x00007fe0c0a71a3f in get_sorted_dc_list (domain=0x0, 
    sitename=sitename@entry=0x7fe0c5eaa4a0 "IR-Ireland", ip_list=ip_list@entry=0x7fffb021a920, 
    count=count@entry=0x7fffb021a91c, ads_only=ads_only@entry=true) at ../source3/libsmb/namequery.c:3295
#15 0x00007fe0c3f657cd in get_dcs (mem_ctx=0x7fe0c5ec0150, domain=domain@entry=0x7fe0c5ebf850, 
    dcs=dcs@entry=0x7fffb021ab70, num_dcs=num_dcs@entry=0x7fffb021ab6c)

Comment 20 David Woodhouse 2014-07-16 08:36:43 UTC
(gdb) up 15
#15 0x00007fe0c3f657cd in get_dcs (mem_ctx=0x7fe0c5ec0150, domain=domain@entry=0x7fe0c5ebf850, 
    dcs=dcs@entry=0x7fffb021ab70, num_dcs=num_dcs@entry=0x7fffb021ab6c)
    at ../source3/winbindd/winbindd_cm.c:1348
1348				get_sorted_dc_list(domain->alt_name, sitename, &ip_list,
(gdb) p domain
$1 = (struct winbindd_domain *) 0x7fe0c5ebf850
(gdb) p *domain
$2 = {name = 0x7fe0c5ebf3b0 "IRRDM01", alt_name = 0x0, forest_name = 0x0, sid = {sid_rev_num = 1 '\001', 
    num_auths = 4 '\004', id_auth = "\000\000\000\000\000\005", sub_auths = {21, 984154414, 1598771514, 
      316617838, 0 <repeats 11 times>}}, domain_flags = 0, domain_type = 0, domain_trust_attribs = 0, 
  initialized = false, native_mode = false, active_directory = false, primary = false, internal = false, 
  online = false, startup_time = 413, startup = true, can_do_samlogon_ex = false, 
  can_do_ncacn_ip_tcp = false, can_do_validation6 = false, methods = 0x7fe0c42376c0 <cache_methods>, 
  backend = 0x0, private_data = 0x0, have_idmap_config = false, id_range_low = 0, id_range_high = 0, 
  dc_probe_pid = 0, dcname = 0x0, dcaddr = {ss_family = 0, __ss_align = 0, 
    __ss_padding = '\000' <repeats 111 times>}, last_seq_check = 0, sequence_number = 4294967295, 
  last_status = {v = 0}, conn = {cli = 0x0, samr_pipe = 0x0, sam_connect_handle = {handle_type = 0, uuid = {
        time_low = 0, time_mid = 0, time_hi_and_version = 0, clock_seq = "\000", 
        node = "\000\000\000\000\000"}}, sam_domain_handle = {handle_type = 0, uuid = {time_low = 0, 
        time_mid = 0, time_hi_and_version = 0, clock_seq = "\000", node = "\000\000\000\000\000"}}, 
    lsa_pipe = 0x0, lsa_pipe_tcp = 0x0, lsa_policy = {handle_type = 0, uuid = {time_low = 0, time_mid = 0, 
        time_hi_and_version = 0, clock_seq = "\000", node = "\000\000\000\000\000"}}, netlogon_pipe = 0x0}, 
  children = 0x7fe0c5ebfa90, check_online_timeout = 0, check_online_event = 0x0, prev = 0x7fe0c5ebe4d0, 
  next = 0x7fe0c5ebfbf0}
(gdb) p domain->alt_name
$3 = 0x0

Comment 21 Jeremy Allison 2014-07-16 19:47:44 UTC
I just posted an upstream patch to the samba bugzilla. Please test and let me know if it fixes the issue. Thanks !
Jeremy.

Comment 22 aquinashub 2014-07-22 16:49:36 UTC
Another user experienced a similar problem:

The error appears on first boot.

reporter:       libreport-2.2.3
backtrace_rating: 4
cmdline:        /usr/sbin/winbindd
crash_function: dump_core
executable:     /usr/sbin/winbindd
kernel:         3.15.6-200.fc20.x86_64
package:        samba-winbind-4.1.9-3.fc20
reason:         winbindd killed by SIGABRT
runlevel:       N 5
type:           CCpp
uid:            0

Comment 23 Alexander Bokovoy 2014-07-31 04:30:49 UTC
Jeremy, I believe the issues we see in the original bug (comment 1) and by David (comment 17) are different. The one in winbindd looks nailed down, however, the issue with PASSDB module loading has nothing to do with altname being NULL in winbindd as there is smbd crash.

Comment 24 David Woodhouse 2014-10-03 09:06:22 UTC
Fix committed to v4-1-test at https://git.samba.org/?p=samba.git;a=commitdiff;h=6b1091dc

Affecting F21 also.

Comment 25 Fedora Update System 2014-10-07 17:40:39 UTC
samba-4.1.12-5.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/samba-4.1.12-5.fc21

Comment 26 Fedora Update System 2014-10-07 18:55:17 UTC
samba-4.1.12-5.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/samba-4.1.12-5.fc20

Comment 27 Fedora Update System 2014-10-08 18:55:28 UTC
Package samba-4.1.12-5.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing samba-4.1.12-5.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-12296/samba-4.1.12-5.fc20
then log in and leave karma (feedback).

Comment 28 Fedora Update System 2014-10-11 06:51:33 UTC
samba-4.1.12-5.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 29 Fedora Update System 2014-10-11 07:01:46 UTC
samba-4.1.12-5.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.