Bug 150582 - nmbd dies when windows client requests browse list
Summary: nmbd dies when windows client requests browse list
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: samba
Version: 4.0
Hardware: All
OS: Linux
high
medium
Target Milestone: ---
: ---
Assignee: Jay Fenlason
QA Contact:
URL:
Whiteboard:
: 150583 (view as bug list)
Depends On:
Blocks: 156322
TreeView+ depends on / blocked
 
Reported: 2005-03-08 17:34 UTC by Jerry U. "
Modified: 2014-08-31 23:27 UTC (History)
10 users (show)

Fixed In Version: RHBA-2005-629
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2005-10-05 15:33:36 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2005:629 0 qe-ready SHIPPED_LIVE Updated Samba packages 2005-10-05 04:00:00 UTC
Samba Project 2449 0 None None None Never

Description Jerry U. " 2005-03-08 17:34:52 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.6)
Gecko/20050224 Firefox/1.0.1 Fedora/1.0.1-1.3.1

Description of problem:
nmbd dies a random interval after starting. Usually when a windows
client tries to browse the net.

The samba server is the local browse master, and a domain member
server, but not a PDC. The PDC is on another subnet, outside of a
firewall. Error does not occur when the samba server is not the local
browse master. 

iptables is stopped and SELinux is disabled. Problem still occurs.

The nmbd log states :
[2005/03/08 11:32:34, 0] nmbd/nmbd.c:main(669)
  Netbios nameserver version 3.0.10-1.4E started.
  Copyright Andrew Tridgell and the Samba Team 1994-2004
[2005/03/08 11:32:57, 0]
nmbd/nmbd_become_lmb.c:become_local_master_stage2(396)
  *****

  Samba name server TME is now a local master browser for workgroup
SPENG on sub
net 192.168.35.40

  *****
[2005/03/08 11:46:48, 0] lib/fault.c:fault_report(36)
  ===============================================================
[2005/03/08 11:46:48, 0] lib/fault.c:fault_report(37)
  INTERNAL ERROR: Signal 11 in pid 5724 (3.0.10-1.4E)
  Please read the appendix Bugs of the Samba HOWTO collection
[2005/03/08 11:46:48, 0] lib/fault.c:fault_report(39)
  ===============================================================
[2005/03/08 11:46:48, 0] lib/util.c:smb_panic2(1504)
  PANIC: internal error
[2005/03/08 11:46:48, 0] lib/util.c:smb_panic2(1512)
  BACKTRACE: 7 stack frames:
   #0 nmbd(smb_panic2+0x6e) [0x552ab3d54e]
   #1 nmbd [0x552ab2b851]
   #2 /lib64/tls/libc.so.6 [0x2a962f9570]
   #3 nmbd(expire_workgroups_and_servers+0x36) [0x552aaeba26]
   #4 nmbd(main+0x597) [0x552aad3897]
   #5 /lib64/tls/libc.so.6(__libc_start_main+0xea) [0x2a962e74ca]
   #6 nmbd [0x552aad232a]




Version-Release number of selected component (if applicable):
samba-3.0.10-1.4E

How reproducible:
Always

Steps to Reproduce:
1. Make samba server local browse master, pdc on other subnet, no pdc
or bdc on subnet
2.
3.
    

Actual Results:  smb status reports
nmbd dead but pid file exists


Expected Results:  smb status should report
nmbd (pid 5724) is running...

Additional info:

relevant lines from smb.conf
    remote browse sync = four separate ip adresses, removed
   local master = yes
   preferred master = yes
    os level = 65


   security = domain


I searched for a similar error being reported, but didn't find any.

Comment 1 Jerry U. " 2005-03-08 18:52:33 UTC
Everyonce in a while, this also appears in the log file, right after
startup.

*** glibc detected *** free(): invalid next size (fast):
0x000000552acff4a0 ***


Comment 2 Jay Fenlason 2005-03-08 21:05:54 UTC
*** Bug 150583 has been marked as a duplicate of this bug. ***

Comment 3 Milan Kerslager 2005-03-09 08:44:37 UTC
I have the same problem on x86 machine. Samba dies with error message from
comment #2. This makes Samba PDC on RHEL4 unusable at all.

The question is if this is a Samba or Glibc bug.

Comment 4 Milan Kerslager 2005-03-09 09:01:26 UTC
Sorry for the mistake. Same problem as comment #1. The log
/var/log/samba/nmbd.log contain:

*** glibc detected *** free(): invalid next size (fast): 0x08bfc970 ***

After this no new logon to the domain (Samba is a PDC here) is impossible. The
nmbd process did not died though.

I tryed to compile latest devel package (samba-3.0.11-5) from Fedora devel and
the problem is the same as above. So it seems to be a glibc related problem.

Comment 5 Milan Kerslager 2005-03-09 10:29:30 UTC
According to bug #150647 this is a serious bug (potentionaly exploitable) in
Samba so I raising severity of this bug. However as Samba is PIC executable I
think that there will be no easy exploit.

I'll try to use RHEL3's samba under RHEL4 as it seems that this bug is caused by
W'98 clients (and not by XP clients). I was unable to test it well as the server
is a production one and should work for now with RHEL3's system.

Comment 6 Jerry U. " 2005-03-09 14:58:16 UTC
This may possibly be two separate issues. When I get the glibc error,
the nmbd does not become the local master browser. It hangs, and
eventually dies. It lives longer than the other problem, though.  When
I do not get that error, nmbd becomes the local master browser and
dies when a Win2k client requests a browse list.

Comment 7 Milan Kerslager 2005-03-15 09:34:16 UTC
Added external reference to Samba's Bugzilla.

Comment 8 Jay Fenlason 2005-03-30 21:43:16 UTC
I've put untested rpms of Samba 3.0.13 up at 
http://people.redhat.com/fenlason/.samba/samba*-3.0.13-1.4E.1.i386.rpm  One 
user has reported that they fix all his nmbd problems.  Please test them and 
let me know if they work for you, too. 

Comment 9 Jerry U. " 2005-03-31 12:43:25 UTC
I can't install it, as I'm running a in 64bit mode (EM64T), as I originally
stated before this was elevated to all platforms.

Comment 10 Jay Fenlason 2005-03-31 14:39:13 UTC
I don't have convenient access to an x86_64 machine, but I'll try to scare one 
up.  In the mean time, the .src.rpm is at 
http://people.redhat.com/fenlason/.samba/samba-3.0.13-1.4E.1.src.rpm if you 
want to grab it and do an rpmbuild --rebuild on it. 

Comment 11 Jerry U. " 2005-03-31 15:10:41 UTC
I didn't notice the source rpm, thanks. I've rebuilt, installed, and am testing
them. If there's a way to send the rpms to you, I will. 

Comment 12 Rainer Traut 2005-04-05 13:06:54 UTC
I have tried the beta rpms, works so far but breaks smbclient -M:

[root@jupiter ~]# cat foo | smbclient -M io
message start: Call timed out: server did not respond after 20000 milliseconds

This has worked before, just checked.


Comment 13 Jerry U. " 2005-04-05 13:21:37 UTC
It's working. It seems to have solved the problem.

Comment 14 Jay Fenlason 2005-04-05 18:45:54 UTC
I've updated the rpms at people.redhat.com to samba*-3.0.13-1.4E.2.*.rpm which 
include two new patches.  One fixes the smbclient -M problem and the other 
fixes a problem with winbindd and Win2K3SP1.  Do they work better? 

Comment 15 Rainer Traut 2005-04-06 08:28:09 UTC
Thx, smblient -M works.

Comment 16 Mike A. Harris 2005-05-02 19:31:42 UTC
For others reading this bug report..  I'd like to confirm the same problem
on Windows XP Professional, with all service packs and security updates applied
as of today.

It's happened for a few weeks, maybe a few months, not sure when it started
as I blamed the problem on Windows for a while.  ;o)

I've downloaded the src.rpm referenced above, and am rebuilding it on my
test system.  I'll try to provide an update here either way once I've had
a chance to test.  If I don't comment again however, assume it fixes the
problem for me.  ;)

Comment 18 Mike A. Harris 2005-05-05 09:23:53 UTC
Bug also affects FC1, FC2, FC3, RHEL3 on my test systems.  The fix seems
to solve the problem on all of these releases (I built my own rpms).

Hope this helps.

Comment 19 Mike A. Harris 2005-05-20 23:51:57 UTC
Update: It's been 2 weeks since my last update, and smbd/nmbd have been
running like a kitten.  No crashes since updating to the fixed version.

Just wanted to provide a useful stability feedback datapoint for reference.

Thanks again.

Comment 27 Milan Kerslager 2005-09-08 17:58:22 UTC
RHEL4 U1 has stable samba as far as I can tell. I have PDC on Samba with 100+
online clients authorized to the domain (2000+ joining and leaving the domain,
other groups, many votings to be a master browser etc).

So I'm suggesting to close this bug as ERRATA or CURRENTRELEASE.

I had some troubles with cups printing on current U1 system too. They seems to
be solved by updating to the latest samba-3.0.10-1.4E.2 from the current U2 Beta
channel (just FYI).

Comment 28 Red Hat Bugzilla 2005-10-05 15:33:36 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2005-629.html


Comment 29 Frédéric BERNOUD 2005-10-18 15:38:14 UTC
I've got the same bug with the latest samba-3.0.10-1.4E.2. Can you re-open the ticket.

Best regards,

Fred
 
(In reply to comment #28)
> 
> An advisory has been issued which should help the problem
> described in this bug report. This report is therefore being
> closed with a resolution of ERRATA. For more information
> on the solution and/or where to find the updated files,
> please follow the link below. You may reopen this bug report
> if the solution does not work for you.
> 
> http://rhn.redhat.com/errata/RHBA-2005-629.html
> 



Comment 30 Adam Thompson 2005-11-08 16:19:28 UTC
Confirming that the nmbd bug still occurs with samba-3.0.10-1.4E.2 under RHEL4.

I'm running a PDC supporting >200 users, so of course it's a bit critical when 
this happens.

Comment 31 Adam Thompson 2005-11-09 17:25:24 UTC
Two things, FYI:
 1) as a workaround, to allow users to keep logging in to the PDC, I used this:

while sleep 5; do smbcontrol -t 1 nmbd ping; if [ $? = 0 ]; then echo "still
alive"; else killall -9 nmbd ; nmbd -d3 -D; sleep 10; fi ; done

...which polls nmbd every 5 seconds, and takes care of both cases, where it has
exited and where it has stopped responding.  Obviously this causes massive
amounts of LMB election traffic, but it allowed our users to at least find the
server more or less all the time.


 2) samba-3.0.20b-1 [S]RPM from www.samba.org upgrades the RHEL4 package fairly
cleanly, and seems to work fine.  Be warned that installing this package moves
some files around and may actually prevent you from ever "upgrading" back into
the RHEL4 rpm stream.


Comment 32 Ole Holm Nielsen 2006-02-03 08:49:39 UTC
We have been sorely bitten by this bug as well :-(
Our Microsoft Networking browse servers are exclusively Redhat RHEL3/4 servers.
We moved the SAMBA "wins server" (Domain Master Browser) function from an old
RHEL3 server to a new RHEL4-U2 (all patches installed) server.
Immediately our Windows network browsing came to a grinding halt :-(

The last line seen in /var/log/samba/nmbd.log is:
*** glibc detected *** free(): invalid next size (fast): 0x09023558 ***
and although the nmbd process is still running, nmbd has ceased responding
to "smbclient -L <servername>".

This seems to be the same bug as reported in 150583 and 150582 almost one
year ago.

We're greatly surprised that such a fundamental bug in SAMBA functionality
(remember, we're an RHEL only shop, no MS-Windows servers here) has
been allowed to exist through several versions of RHEL4.

Could you please advise: Should we uninstall Redhat's SAMBA RPMs and 
switch to the SAMBA 3.0.21b RPM from samba.org (and become responsible ourselves
for updating SAMBA manually), or can we expect a timely bug fix from Redhat ?

Comment 33 Milan Kerslager 2006-02-03 09:38:51 UTC
I have no problem on RHEL4 on x86_64 platform (PDC for ~ 200 PC with ~ 750 users
in the school). There are Win XP and Win 98 too.

Try to use the latest package from RHN Beta channel (samba-3.0.10-1.4E.3) please.

Comment 34 Ole Holm Nielsen 2006-02-03 11:54:05 UTC
I see that this bug is supposed to have been fixed in Bug Fix RHBA-2005:629
which is contained in the package samba-3.0.10-1.4E.2.i386.rpm.
However, our server *was* running samba-3.0.10-1.4E.2 when the problem occurred !
As you see above, other users still see this problem with samba-3.0.10-1.4E.2.

Another user suggests using the Beta samba-3.0.10-1.4E.3 package, but is there
any documentation that this Beta version fixes the problem ?

IMHO, Bug 150582 needs to be reopened - is that possible, or should we submit it
as a new bug ?

Comment 35 Ole Holm Nielsen 2006-02-03 12:26:19 UTC
Please see also this ASSIGNED bug:
https://bugzilla.redhat.com/bugzilla/process_bug.cgi

Comment 36 Ole Holm Nielsen 2006-02-03 15:27:48 UTC
Oops, the above ASSIGNED bug should read Bug 172713

Comment 37 John Smith 2006-02-13 10:43:05 UTC
Using samba-3.0.10-1.4E.2

Switching off "wins proxy" seems to solve this - however i need its functionality.

Comment 38 Mark Smith 2006-08-15 02:32:41 UTC
Just a comment to let others know the current status of this bug, as I see it.

I'm running AS4 U3 i386 which I believe is Samba 3.0.10-1.4E.6 which still has
this problem.  The solution for me was to disable "wins proxy" (which I don't
think I care about anyway.)  So, thanks to John Smith for making it so I can go
home after a 40 hour weekend.  :)

Comment 39 Mark Smith 2006-08-15 02:33:11 UTC
Just a comment to let others know the current status of this bug, as I see it.

I'm running AS4 U3 i386 which I believe is Samba 3.0.10-1.4E.6 which still has
this problem.  The solution for me was to disable "wins proxy" (which I don't
think I care about anyway.)  So, thanks to John Smith for making it so I can go
home after a 40 hour weekend.  :)

Comment 40 Ole Holm Nielsen 2006-08-15 06:38:45 UTC
We've abandoned RHEL4's Samba RPMs altogether because of this severe bug.

It's actually very simple to build RHEL-compatible Samba RPMs by downloading
the the latest source code from www.samba.org.  You simply do:
# cd packaging/RHEL
# sh makerpms.sh
and then you get drop-in RPMs to upgrade with.  We've been using the samba.org
RPMs for 6 months now and we haven't had a single problem with them.

Comment 41 Milan Kerslager 2006-08-15 07:17:40 UTC
I have a yum repository for 32 & 64 bit Samba on RHEL4 for similar reason:

[latest-samba]
name=Latest Samba
baseurl=ftp://ftp.pslib.cz/pub/users/Milan.Kerslager/RHEL-4/testing.samba
        ftp://ftp.vslib.cz/pub/local/milan.kerslager/RHEL-4/testing.samba
gpgcheck=1
enabled=1
gpgkey=http://ftp.pslib.cz/pub/users/Milan.Kerslager/Milan.Kerslager-GPG-KEY-0x46B66BCA.asc

This could be worth to have U5 with more recent Samba. Please reopen this bug or
better file new bug with link to this bug.

Comment 42 Nalin Dahyabhai 2006-08-31 22:04:15 UTC
(In reply to comment #39)
> Just a comment to let others know the current status of this bug, as I see it.
> 
> I'm running AS4 U3 i386 which I believe is Samba 3.0.10-1.4E.6 which still has
> this problem.  The solution for me was to disable "wins proxy" (which I don't
> think I care about anyway.)  So, thanks to John Smith for making it so I can go
> home after a 40 hour weekend.  :)

Mark: I think we've had multiple specific bugs all being tracked in this one bug
report, and I think the combination of "wins server" and "wins proxy" is the big
one that remains unsolved (also filed separately as bug #175707).  Do you have
more details about your setup?  That should help us reproduce it here (a trivial
"turn those settings on and restart" didn't do it for me).  (If you can verify
that it's the same problem, please follow up in #175707, which is still unclosed.)

Comment 43 Ole Holm Nielsen 2006-09-01 07:34:51 UTC
Nalin, please note that the upstream Samba versions have fixed this bug,
so it might pay to look into a recent Samba Changelog.

I know it's fixed in Samba because we've dropped RedHat's Samba and now
build our own Samba RPMs from the source from samba.org, and the bug seems
to have been resolved a long time ago.


Note You need to log in before you can comment on or make changes to this bug.