[Bug 1342574] Re: Samba crashing on null path in cleanup_tmp_files

[Samuel D. Leslie]

Seeing the exact same issue here. I also note that the crash seems to be
from starting smbd with the '-D' parameter by samba-ad-dc, however, it
shouldn't even be trying to run this from what I can see. The system is
running a fresh installation of Samba with a vanilla configuration and
as such is not configured to function as a domain controller. The init.d
script for samba-ad-dc contains this excerpt:

start)
                SERVER_ROLE=`samba-tool testparm --parameter-name="server role"  2>/dev/null | tail -1`
                if [ "$SERVER_ROLE" != "active directory domain controller" ]; then
                    exit 0
                fi

However, the upstart script performs no such check and simply attempts
to start it unconditionally. I'm not sure if this is related to the
behaviour we see here (expecting configuration parameters that aren't
present?) or is a separate issue.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to samba in Ubuntu.
https://bugs.launchpad.net/bugs/1342574

Title:
  Samba crashing on null path in cleanup_tmp_files

Status in samba package in Ubuntu:
  Confirmed

Bug description:
  Hi Everyone,

  I'm running Ubuntu 14.04, and the samba package from the repos, and am
  getting the following panic-action email when the system starts up.
  I'm also not able to start samba manually after boot either.

  Here's a back-trace:

  [Thread debugging using libthread_db enabled]
  Using host libthread_db library "/lib/i386-linux-gnu/libthread_db.so.1".
  0xb7707424 in __kernel_vsyscall ()
  #0  0xb7707424 in __kernel_vsyscall ()
  #1  0xb6f08e53 in __waitpid_nocancel () at ../sysdeps/unix/syscall-template.S:81
  #2  0xb6e92fcd in do_system (line=line at entry=0xbfa71a64 "/usr/share/samba/panic-action 1001") at ../sysdeps/posix/system.c:148
  #3  0xb6e933d0 in __libc_system (line=line at entry=0xbfa71a64 "/usr/share/samba/panic-action 1001") at ../sysdeps/posix/system.c:184
  #4  0xb76d810b in system (line=line at entry=0xbfa71a64 "/usr/share/samba/panic-action 1001") at pt-system.c:28
  #5  0xb76af3bd in smb_panic_default (why=0xb76bc552 "internal error") at ../lib/util/fault.c:134
  #6  smb_panic (why=why at entry=0xb76bc552 "internal error") at ../lib/util/fault.c:162
  #7  0xb76af551 in fault_report (sig=11) at ../lib/util/fault.c:77
  #8  sig_fault (sig=11) at ../lib/util/fault.c:88
  #9  <signal handler called>
  #10 __opendirat (dfd=dfd at entry=-100, name=name at entry=0x0) at ../sysdeps/posix/opendir.c:91
  #11 0xb6f04a7d in __opendir (name=0x0) at ../sysdeps/posix/opendir.c:160
  #12 0xb773253f in recursive_delete (path=0x0) at ../source4/smbd/server.c:56
  #13 0xb7732e6c in cleanup_tmp_files (lp_ctx=0xb77e1018) at ../source4/smbd/server.c:102
  #14 binary_smbd_main (argc=<optimized out>, argv=<optimized out>, binary_name=0xb77362e2 "samba") at ../source4/smbd/server.c:385
  #15 0xb772e431 in main (argc=2, argv=0xbfa724b4) at ../source4/smbd/server.c:514
  A debugging session is active.

          Inferior 1 [process 1001] will be detached.

  If I'm interpreting right, the recursive_delete is getting a null path
  which is causing the problems.

  Other information:

  $ lsb_release -rd
  Description:	Ubuntu 14.04 LTS
  Release:	14.04

  $ apt-cache policy samba
  samba:
    Installed: 2:4.1.6+dfsg-1ubuntu2.14.04.2
    Candidate: 2:4.1.6+dfsg-1ubuntu2.14.04.2
    Version table:
   *** 2:4.1.6+dfsg-1ubuntu2.14.04.2 0
          500 mirror://mirrors.ubuntu.com/mirrors.txt/ trusty-updates/main i386 Packages
          500 mirror://mirrors.ubuntu.com/mirrors.txt/ trusty-security/main i386 Packages
          100 /var/lib/dpkg/status
       2:4.1.6+dfsg-1ubuntu2 0
          500 mirror://mirrors.ubuntu.com/mirrors.txt/ trusty/main i386 Packages

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1342574/+subscriptions