Red Hat Bugzilla – Bug 150582
nmbd dies when windows client requests browse list
Last modified: 2014-08-31 19:27:23 EDT
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.6)
Gecko/20050224 Firefox/1.0.1 Fedora/1.0.1-1.3.1
Description of problem:
nmbd dies a random interval after starting. Usually when a windows
client tries to browse the net.
The samba server is the local browse master, and a domain member
server, but not a PDC. The PDC is on another subnet, outside of a
firewall. Error does not occur when the samba server is not the local
iptables is stopped and SELinux is disabled. Problem still occurs.
The nmbd log states :
[2005/03/08 11:32:34, 0] nmbd/nmbd.c:main(669)
Netbios nameserver version 3.0.10-1.4E started.
Copyright Andrew Tridgell and the Samba Team 1994-2004
[2005/03/08 11:32:57, 0]
Samba name server TME is now a local master browser for workgroup
SPENG on sub
[2005/03/08 11:46:48, 0] lib/fault.c:fault_report(36)
[2005/03/08 11:46:48, 0] lib/fault.c:fault_report(37)
INTERNAL ERROR: Signal 11 in pid 5724 (3.0.10-1.4E)
Please read the appendix Bugs of the Samba HOWTO collection
[2005/03/08 11:46:48, 0] lib/fault.c:fault_report(39)
[2005/03/08 11:46:48, 0] lib/util.c:smb_panic2(1504)
PANIC: internal error
[2005/03/08 11:46:48, 0] lib/util.c:smb_panic2(1512)
BACKTRACE: 7 stack frames:
#0 nmbd(smb_panic2+0x6e) [0x552ab3d54e]
#1 nmbd [0x552ab2b851]
#2 /lib64/tls/libc.so.6 [0x2a962f9570]
#3 nmbd(expire_workgroups_and_servers+0x36) [0x552aaeba26]
#4 nmbd(main+0x597) [0x552aad3897]
#5 /lib64/tls/libc.so.6(__libc_start_main+0xea) [0x2a962e74ca]
#6 nmbd [0x552aad232a]
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Make samba server local browse master, pdc on other subnet, no pdc
or bdc on subnet
Actual Results: smb status reports
nmbd dead but pid file exists
Expected Results: smb status should report
nmbd (pid 5724) is running...
relevant lines from smb.conf
remote browse sync = four separate ip adresses, removed
local master = yes
preferred master = yes
os level = 65
security = domain
I searched for a similar error being reported, but didn't find any.
Everyonce in a while, this also appears in the log file, right after
*** glibc detected *** free(): invalid next size (fast):
*** Bug 150583 has been marked as a duplicate of this bug. ***
I have the same problem on x86 machine. Samba dies with error message from
comment #2. This makes Samba PDC on RHEL4 unusable at all.
The question is if this is a Samba or Glibc bug.
Sorry for the mistake. Same problem as comment #1. The log
*** glibc detected *** free(): invalid next size (fast): 0x08bfc970 ***
After this no new logon to the domain (Samba is a PDC here) is impossible. The
nmbd process did not died though.
I tryed to compile latest devel package (samba-3.0.11-5) from Fedora devel and
the problem is the same as above. So it seems to be a glibc related problem.
According to bug #150647 this is a serious bug (potentionaly exploitable) in
Samba so I raising severity of this bug. However as Samba is PIC executable I
think that there will be no easy exploit.
I'll try to use RHEL3's samba under RHEL4 as it seems that this bug is caused by
W'98 clients (and not by XP clients). I was unable to test it well as the server
is a production one and should work for now with RHEL3's system.
This may possibly be two separate issues. When I get the glibc error,
the nmbd does not become the local master browser. It hangs, and
eventually dies. It lives longer than the other problem, though. When
I do not get that error, nmbd becomes the local master browser and
dies when a Win2k client requests a browse list.
Added external reference to Samba's Bugzilla.
I've put untested rpms of Samba 3.0.13 up at
user has reported that they fix all his nmbd problems. Please test them and
let me know if they work for you, too.
I can't install it, as I'm running a in 64bit mode (EM64T), as I originally
stated before this was elevated to all platforms.
I don't have convenient access to an x86_64 machine, but I'll try to scare one
up. In the mean time, the .src.rpm is at
http://people.redhat.com/fenlason/.samba/samba-3.0.13-1.4E.1.src.rpm if you
want to grab it and do an rpmbuild --rebuild on it.
I didn't notice the source rpm, thanks. I've rebuilt, installed, and am testing
them. If there's a way to send the rpms to you, I will.
I have tried the beta rpms, works so far but breaks smbclient -M:
[root@jupiter ~]# cat foo | smbclient -M io
message start: Call timed out: server did not respond after 20000 milliseconds
This has worked before, just checked.
It's working. It seems to have solved the problem.
I've updated the rpms at people.redhat.com to samba*-3.0.13-1.4E.2.*.rpm which
include two new patches. One fixes the smbclient -M problem and the other
fixes a problem with winbindd and Win2K3SP1. Do they work better?
Thx, smblient -M works.
For others reading this bug report.. I'd like to confirm the same problem
on Windows XP Professional, with all service packs and security updates applied
as of today.
It's happened for a few weeks, maybe a few months, not sure when it started
as I blamed the problem on Windows for a while. ;o)
I've downloaded the src.rpm referenced above, and am rebuilding it on my
test system. I'll try to provide an update here either way once I've had
a chance to test. If I don't comment again however, assume it fixes the
problem for me. ;)
Bug also affects FC1, FC2, FC3, RHEL3 on my test systems. The fix seems
to solve the problem on all of these releases (I built my own rpms).
Hope this helps.
Update: It's been 2 weeks since my last update, and smbd/nmbd have been
running like a kitten. No crashes since updating to the fixed version.
Just wanted to provide a useful stability feedback datapoint for reference.
RHEL4 U1 has stable samba as far as I can tell. I have PDC on Samba with 100+
online clients authorized to the domain (2000+ joining and leaving the domain,
other groups, many votings to be a master browser etc).
So I'm suggesting to close this bug as ERRATA or CURRENTRELEASE.
I had some troubles with cups printing on current U1 system too. They seems to
be solved by updating to the latest samba-3.0.10-1.4E.2 from the current U2 Beta
channel (just FYI).
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.
I've got the same bug with the latest samba-3.0.10-1.4E.2. Can you re-open the ticket.
(In reply to comment #28)
> An advisory has been issued which should help the problem
> described in this bug report. This report is therefore being
> closed with a resolution of ERRATA. For more information
> on the solution and/or where to find the updated files,
> please follow the link below. You may reopen this bug report
> if the solution does not work for you.
Confirming that the nmbd bug still occurs with samba-3.0.10-1.4E.2 under RHEL4.
I'm running a PDC supporting >200 users, so of course it's a bit critical when
Two things, FYI:
1) as a workaround, to allow users to keep logging in to the PDC, I used this:
while sleep 5; do smbcontrol -t 1 nmbd ping; if [ $? = 0 ]; then echo "still
alive"; else killall -9 nmbd ; nmbd -d3 -D; sleep 10; fi ; done
...which polls nmbd every 5 seconds, and takes care of both cases, where it has
exited and where it has stopped responding. Obviously this causes massive
amounts of LMB election traffic, but it allowed our users to at least find the
server more or less all the time.
2) samba-3.0.20b-1 [S]RPM from www.samba.org upgrades the RHEL4 package fairly
cleanly, and seems to work fine. Be warned that installing this package moves
some files around and may actually prevent you from ever "upgrading" back into
the RHEL4 rpm stream.
We have been sorely bitten by this bug as well :-(
Our Microsoft Networking browse servers are exclusively Redhat RHEL3/4 servers.
We moved the SAMBA "wins server" (Domain Master Browser) function from an old
RHEL3 server to a new RHEL4-U2 (all patches installed) server.
Immediately our Windows network browsing came to a grinding halt :-(
The last line seen in /var/log/samba/nmbd.log is:
*** glibc detected *** free(): invalid next size (fast): 0x09023558 ***
and although the nmbd process is still running, nmbd has ceased responding
to "smbclient -L <servername>".
This seems to be the same bug as reported in 150583 and 150582 almost one
We're greatly surprised that such a fundamental bug in SAMBA functionality
(remember, we're an RHEL only shop, no MS-Windows servers here) has
been allowed to exist through several versions of RHEL4.
Could you please advise: Should we uninstall Redhat's SAMBA RPMs and
switch to the SAMBA 3.0.21b RPM from samba.org (and become responsible ourselves
for updating SAMBA manually), or can we expect a timely bug fix from Redhat ?
I have no problem on RHEL4 on x86_64 platform (PDC for ~ 200 PC with ~ 750 users
in the school). There are Win XP and Win 98 too.
Try to use the latest package from RHN Beta channel (samba-3.0.10-1.4E.3) please.
I see that this bug is supposed to have been fixed in Bug Fix RHBA-2005:629
which is contained in the package samba-3.0.10-1.4E.2.i386.rpm.
However, our server *was* running samba-3.0.10-1.4E.2 when the problem occurred !
As you see above, other users still see this problem with samba-3.0.10-1.4E.2.
Another user suggests using the Beta samba-3.0.10-1.4E.3 package, but is there
any documentation that this Beta version fixes the problem ?
IMHO, Bug 150582 needs to be reopened - is that possible, or should we submit it
as a new bug ?
Please see also this ASSIGNED bug:
Oops, the above ASSIGNED bug should read Bug 172713
Switching off "wins proxy" seems to solve this - however i need its functionality.
Just a comment to let others know the current status of this bug, as I see it.
I'm running AS4 U3 i386 which I believe is Samba 3.0.10-1.4E.6 which still has
this problem. The solution for me was to disable "wins proxy" (which I don't
think I care about anyway.) So, thanks to John Smith for making it so I can go
home after a 40 hour weekend. :)
We've abandoned RHEL4's Samba RPMs altogether because of this severe bug.
It's actually very simple to build RHEL-compatible Samba RPMs by downloading
the the latest source code from www.samba.org. You simply do:
# cd packaging/RHEL
# sh makerpms.sh
and then you get drop-in RPMs to upgrade with. We've been using the samba.org
RPMs for 6 months now and we haven't had a single problem with them.
I have a yum repository for 32 & 64 bit Samba on RHEL4 for similar reason:
This could be worth to have U5 with more recent Samba. Please reopen this bug or
better file new bug with link to this bug.
(In reply to comment #39)
> Just a comment to let others know the current status of this bug, as I see it.
> I'm running AS4 U3 i386 which I believe is Samba 3.0.10-1.4E.6 which still has
> this problem. The solution for me was to disable "wins proxy" (which I don't
> think I care about anyway.) So, thanks to John Smith for making it so I can go
> home after a 40 hour weekend. :)
Mark: I think we've had multiple specific bugs all being tracked in this one bug
report, and I think the combination of "wins server" and "wins proxy" is the big
one that remains unsolved (also filed separately as bug #175707). Do you have
more details about your setup? That should help us reproduce it here (a trivial
"turn those settings on and restart" didn't do it for me). (If you can verify
that it's the same problem, please follow up in #175707, which is still unclosed.)
Nalin, please note that the upstream Samba versions have fixed this bug,
so it might pay to look into a recent Samba Changelog.
I know it's fixed in Samba because we've dropped RedHat's Samba and now
build our own Samba RPMs from the source from samba.org, and the bug seems
to have been resolved a long time ago.