Bug 913614

Can you install samba-debuginfo and run with gdb instead of valgrind to get a full backtrace?

Also please post your nsswitch.conf and smb.conf.

$ grep ^hosts /etc/nsswitch.conf
hosts:      files wins dns myhostname

(gdb) bt
#0  0x41b8f8f2 in load_interfaces () at ../source3/lib/interface.c:524
#1  0xb7ba901c in nss_wins_init () at ../nsswitch/wins.c:57
#2  lookup_byname_backend (count=0xbfffd230, 
    name=0xbfffd2bc "no.such.address.") at ../nsswitch/wins.c:69
#3  _nss_wins_gethostbyname_r (
    hostname=hostname@entry=0xbfffdbe7 "no.such.address.", 
    he=he@entry=0xbfffd93c, buffer=buffer@entry=0xbfffd4b0 "\177", 
    buflen=buflen@entry=916, h_errnop=h_errnop@entry=0xb7bc9708)
    at ../nsswitch/wins.c:303
#4  0xb7ba9253 in _nss_wins_gethostbyname2_r (
    name=0xbfffdbe7 "no.such.address.", af=2, he=0xbfffd93c, 
    buffer=0xbfffd4b0 "\177", buflen=916, h_errnop=0xb7bc9708)
    at ../nsswitch/wins.c:400
#5  0x4112dd04 in __gethostbyname2_r (
    name=name@entry=0xbfffdbe7 "no.such.address.", af=af@entry=2, 
    resbuf=resbuf@entry=0xbfffd93c, buffer=0xbfffd4b0 "\177", 
    buflen=buflen@entry=916, result=0xbfffd938, 
    h_errnop=h_errnop@entry=0xbfffd934) at ../nss/getXXbyYY_r.c:255
#6  0x410f886a in gaih_inet (name=name@entry=0xbfffdbe7 "no.such.address.", 
    service=0xbfffd4b0, req=req@entry=0xbfffdaf8, pai=pai@entry=0xbfffd9e0, 
    naddrs=naddrs@entry=0xbfffd9f0) at ../sysdeps/posix/getaddrinfo.c:584
#7  0x410fb4bb in __GI_getaddrinfo (name=0xbfffdbe7 "no.such.address.", 
    service=<optimized out>, hints=0xbfffdaf8, pai=0xbfffdb18)
    at ../sysdeps/posix/getaddrinfo.c:2359
#8  0xb7c34bba in netsnmp_getaddrinfo () from snmplib/.libs/libnetsnmp.so.30
#9  0xb7c34939 in netsnmp_gethostbyname_v4 ()
   from snmplib/.libs/libnetsnmp.so.30
#10 0xb7c6dd6a in netsnmp_udp_parse_security ()
   from snmplib/.libs/libnetsnmp.so.30
#11 0xb7c39b51 in run_config_handler () from snmplib/.libs/libnetsnmp.so.30
#12 0xb7c3afd7 in read_config () from snmplib/.libs/libnetsnmp.so.30
#13 0xb7c39880 in read_config_with_type_when ()
   from snmplib/.libs/libnetsnmp.so.30
#14 0xb7c3b366 in read_configs_optional () from snmplib/.libs/libnetsnmp.so.30
#15 0xb7c3b4ef in read_configs () from snmplib/.libs/libnetsnmp.so.30
#16 0xb7c15083 in init_snmp () from snmplib/.libs/libnetsnmp.so.30
#17 0x0804b6e9 in main ()

Created attachment 700644 [details]
/etc/samba/smb.conf

This is really strange. We probe the kernel for the interfaces, then duplicate the memory with and crash when accessing an entry.

523 for (i=0;i<total_probed;i++) {                            
524     if (probed_ifaces[i].flags & IFF_BROADCAST) {

Here we crash.

Earlier we do:

total_probed = get_interfaces(talloc_tos(), ifaces);
if (total_probed > 0) {                                       
    probed_ifaces = (struct iface_struct )memdup(ifaces, sizeof(ifaces[0])*total_probed);

Maybe on your system sizeof(ifaces[0]) * total_probed results in -1095427497

Can you set a breakpoint at load_interfaces() and after line 503 print the values:

p total_probed
p ifaces[0]
p sizeof(ifaces[0])

Interface information:

$ ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 52:54:00:7a:8b:d3 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.102/24 brd 192.168.1.255 scope global eth0
    inet6 fe80::5054:ff:fe7a:8bd3/64 scope link 
       valid_lft forever preferred_lft forever

And the gdb output:

$ LD_LIBRARY_PATH=agent/.libs:snmplib/.libs gdb agent/.libs/snmpd
(gdb) break load_interfaces
Function "load_interfaces" not defined.
Make breakpoint pending on future shared library load? (y or [n]) y
Breakpoint 1 (load_interfaces) pending.
(gdb) run -Mmibs -f -d -r -U -Lo  -C -c snmpd.conf udp:127.0.0.1:8794
(gdb) Breakpoint 1, load_interfaces () at ../source3/lib/interface.c:495
495     {
(gdb) next
496             struct iface_struct *ifaces = NULL;
(gdb) next
497             const char **ptr = lp_interfaces();
(gdb) next
500             gfree_interfaces();
(gdb) print ptr
$2 = (const char **) 0x0
(gdb) next
503             total_probed = get_interfaces(talloc_tos(), &ifaces);
(gdb) next
505             if (total_probed > 0) {
(gdb) print ifaces[0]
$2 = {name = "lo", '\000' <repeats 13 times>, flags = 65609, ip = {
    ss_family = 10, __ss_align = 0, 
    __ss_padding = '\000' <repeats 15 times>, "\001", '\000' <repeats 103 times>}, netmask = {ss_family = 10, __ss_align = 0, 
    __ss_padding = "\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", '\000' <repeats 103 times>}, bcast = {ss_family = 10, __ss_align = 0, 
    __ss_padding = '\000' <repeats 15 times>, "\001", '\000' <repeats 103 times>}}
(gdb) print sizeof(ifaces[0])
$3 = 404
(gdb) next
503             total_probed = get_interfaces(talloc_tos(), &ifaces);
(gdb) next
505             if (total_probed > 0) {
(gdb) next
506                     probed_ifaces = (struct iface_struct *)memdup(ifaces,
(gdb) next
508                     if (!probed_ifaces) {
(gdb) print probed_ifaces
$10 = (struct iface_struct *) 0x0
(gdb) next
506                     probed_ifaces = (struct iface_struct *)memdup(ifaces,
(gdb) next
508                     if (!probed_ifaces) {
(gdb) print probed_ifaces
$11 = (struct iface_struct *) 0xffffffff
(gdb) next
513             TALLOC_FREE(ifaces);
(gdb) next
517             if (!ptr || !*ptr || !**ptr) {
(gdb) next
513             TALLOC_FREE(ifaces);
(gdb) next
517             if (!ptr || !*ptr || !**ptr) {
(gdb) next
518                     if (total_probed <= 0) {
(gdb) next
524                             if (probed_ifaces[i].flags & IFF_BROADCAST) {
(gdb) print i
$4 = 0
(gdb) print probed_ifaces
$5 = (struct iface_struct *) 0xffffffff
(gdb) next
Program received signal SIGSEGV, Segmentation fault.
0x41b8f8f2 in load_interfaces () at ../source3/lib/interface.c:524
524                             if (probed_ifaces[i].flags & IFF_BROADCAST) {

This is really strange. I will try to reproduce it here. This is a F18 with all the latest updates?

That's correct, this has been observed on up to date F18 system. I had run "yum update -y" shortly before I ran this test.

This could be related https://bugzilla.samba.org/show_bug.cgi?id=9666

Probably the same issue as https://bugzilla.redhat.com/show_bug.cgi?id=1000780.

Candidate fix: http://sourceforge.net/p/net-snmp/mailman/message/31405941/.

*** Bug 1000780 has been marked as a duplicate of this bug. ***

This message is a reminder that Fedora 18 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 18. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '18'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 18's end of life.

Thank you for reporting this issue and we are sorry that we may not be 
able to fix it before Fedora 18 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior to Fedora 18's end of life.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Fedora 18 changed to end-of-life (EOL) status on 2014-01-14. Fedora 18 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.