Bug 53540 - smbd core dump on memberserver - smbXsrv_session_logoff failed: NT_STATUS_INTERNAL_ERROR
smbd core dump on memberserver - smbXsrv_session_logoff failed: NT_STATUS_INT...
Status: NEW
Product: UCS
Classification: Unclassified
Component: Samba
UCS 4.4
Other Linux
: P5 normal (vote)
: ---
Assigned To: Samba maintainers
Samba maintainers
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2021-07-01 19:50 CEST by Arvid Requate
Modified: 2021-07-12 13:21 CEST (History)
1 user (show)

See Also:
What kind of report is it?: Bug Report
What type of bug is this?: 1: Cosmetic issue or missing function but workaround exists
Who will be affected by this bug?: 1: Will affect a very few installed domains
How will those affected feel about the bug?: 2: A Pain – users won’t like this once they notice it
User Pain: 0.011
Enterprise Customer affected?: Yes
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number: 2020122221000298, 2021032421000031, 2021061821000191
Bug group (optional):
Max CVSS v3 score:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Arvid Requate univentionstaff 2021-07-01 19:50:07 CEST
A customer reports repeated core dumps on his UCS 4.4-7-877 memberserver. The "log.$IP" files show sections like the following:

------------------------------------------------------------------------
log.10.0.160.33-[2020/11/12 12:55:11.999242,  0] ../../source3/smbd/smbXsrv_tcon.c:917(smbXsrv_tcon_disconnect)
log.10.0.160.33-  smbXsrv_tcon_disconnect(0xc9dab620, 'elan'): chdir_current_service() failed: NT_STATUS_INTERNAL_ERROR
log.10.0.160.33-[2020/11/12 12:55:12.000111,  0] ../../source3/smbd/smbXsrv_tcon.c:1028(smbXsrv_tcon_disconnect_all)
log.10.0.160.33-  smbXsrv_tcon_disconnect_all: count[1] errors[1] first[NT_STATUS_INTERNAL_ERROR]
log.10.0.160.33-[2020/11/12 12:55:12.000129,  0] ../../source3/smbd/smbXsrv_session.c:1685(smbXsrv_session_logoff)
log.10.0.160.33-  smbXsrv_session_logoff(0x0c7674a0): smb2srv_tcon_disconnect_all() failed: NT_STATUS_INTERNAL_ERROR
log.10.0.160.33-[2020/11/12 12:55:12.010872,  0] ../../source3/smbd/smbXsrv_session.c:435(smbXsrv_session_close_shutdown_done)
log.10.0.160.33-  smbXsrv_session_close_loop: smbXsrv_session_logoff(209089696) failed: NT_STATUS_INTERNAL_ERROR
------------------------------------------------------------------------

Sometimes followed a bit later by:
------------------------------------------------------------------------
log.10.0.160.33-[2020/11/12 13:11:18.327191,  0] ../../lib/util/fault.c:79(fault_report)
log.10.0.160.33-  ===============================================================
log.10.0.160.33-[2020/11/12 13:11:18.327242,  0] ../../lib/util/fault.c:80(fault_report)
log.10.0.160.33-  INTERNAL ERROR: Signal 11 in pid 3251 (4.10.1-Univention)
log.10.0.160.33-  Please read the Trouble-Shooting section of the Samba HOWTO
log.10.0.160.33-[2020/11/12 13:11:18.327266,  0] ../../lib/util/fault.c:82(fault_report)
log.10.0.160.33-  ===============================================================
log.10.0.160.33-[2020/11/12 13:11:18.327279,  0] ../../source3/lib/util.c:824(smb_panic_s3)
log.10.0.160.33-  PANIC (pid 3251): internal error
log.10.0.160.33-[2020/11/12 13:11:18.328092,  0] ../../lib/util/fault.c:261(log_stack_trace)
log.10.0.160.33:  BACKTRACE: 27 stack frames:
log.10.0.160.33-   #0 /usr/lib/x86_64-linux-gnu/libsamba-util.so.0(log_stack_trace+0x2d) [0x7f03bc0a7ffd]
log.10.0.160.33-   #1 /usr/lib/x86_64-linux-gnu/libsmbconf.so.0(smb_panic_s3+0x18) [0x7f03bb8b86d8]
log.10.0.160.33-   #2 /usr/lib/x86_64-linux-gnu/libsamba-util.so.0(smb_panic+0x2d) [0x7f03bc0a80fd]
log.10.0.160.33-   #3 /usr/lib/x86_64-linux-gnu/libsamba-util.so.0(+0x1a35d) [0x7f03bc0a835d]
log.10.0.160.33-   #4 /lib/x86_64-linux-gnu/libpthread.so.0(+0x110e0) [0x7f03ab7ae0e0]
log.10.0.160.33-   #5 /usr/lib/x86_64-linux-gnu/samba/libsmbd-base.so.0(dptr_idlecnum+0x12) [0x7f03bbc45bb2]
log.10.0.160.33-   #6 /usr/lib/x86_64-linux-gnu/samba/libsmbd-base.so.0(conn_idle_all+0x9f) [0x7f03bbc494af]
log.10.0.160.33-   #7 /usr/lib/x86_64-linux-gnu/samba/libsmbd-base.so.0(+0x1a2374) [0x7f03bbcb2374]
log.10.0.160.33-   #8 /usr/lib/x86_64-linux-gnu/libsmbconf.so.0(+0x5d8b5) [0x7f03bb8d38b5]
log.10.0.160.33-   #9 /usr/lib/x86_64-linux-gnu/libtevent.so.0(tevent_common_invoke_timer_handler+0xf5) [0x7f03ab9c5a45]
log.10.0.160.33-   #10 /usr/lib/x86_64-linux-gnu/libtevent.so.0(tevent_common_loop_timer_delay+0x5a) [0x7f03ab9c5bca]
log.10.0.160.33-   #11 /usr/lib/x86_64-linux-gnu/libtevent.so.0(+0xd0d9) [0x7f03ab9c70d9]
log.10.0.160.33-   #12 /usr/lib/x86_64-linux-gnu/libtevent.so.0(+0xafd7) [0x7f03ab9c4fd7]
log.10.0.160.33-   #13 /usr/lib/x86_64-linux-gnu/libtevent.so.0(_tevent_loop_once+0xbd) [0x7f03ab9c023d]
log.10.0.160.33-   #14 /usr/lib/x86_64-linux-gnu/libtevent.so.0(tevent_common_loop_wait+0x1b) [0x7f03ab9c049b]
log.10.0.160.33-   #15 /usr/lib/x86_64-linux-gnu/libtevent.so.0(+0xaf77) [0x7f03ab9c4f77]
log.10.0.160.33-   #16 /usr/lib/x86_64-linux-gnu/samba/libsmbd-base.so.0(smbd_process+0x6af) [0x7f03bbcb84bf]
log.10.0.160.33-   #17 /usr/sbin/smbd(+0xe224) [0x55c68b3db224]
log.10.0.160.33-   #18 /usr/lib/x86_64-linux-gnu/libtevent.so.0(tevent_common_invoke_fd_handler+0x80) [0x7f03ab9c0ae0]
log.10.0.160.33-   #19 /usr/lib/x86_64-linux-gnu/libtevent.so.0(+0xcfe7) [0x7f03ab9c6fe7]
------------------------------------------------------------------------

The NT_STATUS_INTERNAL_ERROR during smbXsrv_session_logoff appears frequently in the "log.$IP" files of the customer, the PANIC seems less frequent.

Looks a bit like a newer version of Bug #39802, but the stack trace is a bit different (maybe due to newer samba version?)
Comment 1 Arvid Requate univentionstaff 2021-07-01 19:55:01 CEST
The three tickets 2020122221000298, 2021032421000031, 2021061821000191 belong to the same customer

One additional peculiarity is that memberserver re-exports directories as samba shares that have been mounted via NFS from a NAS. And root squash is on, which may be the cause of repeated messaged like these in log.smbd (not in the log.$IP files):
---------------------------------------------------------------------------
[2021/03/26 09:17:31.567383,  1] ../../source3/smbd/notify_inotify.c:442(inotify_watch)
  inotify_add_watch returned Keine Berechtigung
[2021/03/26 09:17:31.567451,  1] ../../source3/smbd/notifyd/notifyd.c:473(notifyd_apply_rec_change)
  notifyd_apply_rec_change: sys_notify_watch for [/mnt/isilon/share/path/to/some/file] returned Keine Berechtigung
---------------------------------------------------------------------------

But that may be a separate story, unrelated to the core dumps of the client specific smbd processes.