segfault when tdb_mutex_unlock

[chin housin]

Server runs samba for months,suddenly the share can't access,but ' systemctl  status ' sees samba.service running and winbind.service running。Finally restart samba and winbind fixed the issue.The samba version 4.15.8,glibc version 2.28
During the time can't access share before restart, system log shows below:
1、net ads join continuing success
2、smbd coredump many times
3、winbind logs full of :  check_winbind_security: winbindd not running - but required as domain member: NT_STATUS_NO_LOGON_SERVERS

Here is the smb.conf:

[global]
   realm = ns.com
   security = ads
   server string = ""
   getwd cache = no
   workgroup = ns
   idmap gid = 1000000-2000000
   idmap uid = 1000000-2000000
   log file = /var/log/samba/log.%m
   max log size = 50
   cache directory = /dev/shm/samba
   state directory = /var/lib/samba
   lock directory = /dev/shm/samba
   idmap backend = tdb2
   winbind separator = /
   winbind use default domain = true
   winbind offline logon = false
   winbind enum users = yes
   winbind enum groups = yes
   passdb backend = tdbsam
   get quota command = /quota_get.sh %U %G %d
   nt acl support = yes
   lanman auth = yes
   ntlm auth = yes
   wide links = no
   disable spoolss = yes
   template shell = /bin/bash
   private dir = /var/lib/samba/private
   rpc_server:netlogon = disabled
   root preexec = /quota.sh %u %g %d %I
   server min protocol = NT1
   client min protocol = NT1
   winbind max clients = 2000

[share1]
   comment = ""
   path = /share1
   read only = no
   writable = yes
   browseable = yes
   valid users =ns1/u1, @ns/u2, ns/u3, @ns/u4
   write list = ns/u1, ns/u2, @ns/u3
   create mask = 0777
   directory mask = 0777
   read list = @ns/u4
   oplocks = yes
   store dos attributes = yes
   access based share enum = no

Here is the coredumps ( #0 ~ #18 is the same,segfault in #7):

coredump1(with gdb):
#0  0x00007f7e2c4197ff in raise () from /lib64/libc.so.6
#1  0x00007f7e2c403c35 in abort () from /lib64/libc.so.6
#2  0x00007f7e2e2a1589 in dump_core () at ../../source3/lib/dumpcore.c:338
#3  0x00007f7e2e2b410c in smb_panic_s3 (why=0x7ffd55c954d0 "Signal 11: Segmentation fault") at ../../source3/lib/util.c
#4  0x00007f7e3017cadf in smb_panic (why=0x7ffd55c954d0 "Signal 11: Segmentation fault") at ../../lib/util/fault.c:197
#5  0x00007f7e3017c5f8 in fault_report (sig=11) at ../../lib/util/fault.c:81
#6  0x00007f7e3017c60d in sig_fault (sig=11) at ../../lib/util/fault.c:92
#7  <signal handler called>
#8  0x00007f7e2c7b0e6c in __pthread_mutex_unlock_full () from /lib64/libpthread.so.0
#9  0x00007f7e29be1294 in tdb_mutex_unlock (tdb=0x556b2a2ddf10, rw=0, off=17388, len=1, pret=0x7ffd55c95bcc) at ../../l
#10 0x00007f7e29bd5a15 in fcntl_unlock (tdb=0x556b2a2ddf10, rw=0, off=17388, len=1) at ../../lib/tdb/common/lock.c:125
#11 0x00007f7e29bd5c1b in tdb_brunlock (tdb=0x556b2a2ddf10, rw_type=0, offset=17388, len=1) at ../../lib/tdb/common/loc
#12 0x00007f7e29bd655c in tdb_nest_unlock (tdb=0x556b2a2ddf10, offset=17388, ltype=0, mark_lock=false) at ../../lib/tdb
#13 0x00007f7e29bd6623 in tdb_unlock (tdb=0x556b2a2ddf10, list=4305, ltype=0) at ../../lib/tdb/common/lock.c:579
#14 0x00007f7e29bd3040 in tdb_parse_record (tdb=0x556b2a2ddf10, key=..., parser=0x7f7e2e2a8cc6 <gencache_parse_fn>, pri
    at ../../lib/tdb/common/tdb.c:331
#15 0x00007f7e2e2a8e02 in gencache_parse (keystr=0x556b2a297c00 "IDMAP/SID2XID/S-1-5-21-3114039025-1376293423-562224231
    parser=0x7f7e2e2a8f07 <gencache_get_data_blob_parser>, private_data=0x7ffd55c95da0) at ../../source3/lib/gencache.c
#16 0x00007f7e2e2a900f in gencache_get_data_blob (keystr=0x556b2a297c00 "IDMAP/SID2XID/S-1-5-21-3114039025-1376293423-5
    mem_ctx=0x556b2a339890, blob=0x7ffd55c95e10, timeout=0x7ffd55c95e68, was_expired=0x0) at ../../source3/lib/gencache
#17 0x00007f7e2e2a90e3 in gencache_get (keystr=0x556b2a297c00 "IDMAP/SID2XID/S-1-5-21-3114039025-1376293423-562224231-5
    value=0x7ffd55c95e78, ptimeout=0x7ffd55c95e68) at ../../source3/lib/gencache.c:563
#18 0x00007f7e2e2aca02 in idmap_cache_find_sid2unixid (sid=0x556b2a3119b0, id=0x7ffd55c95f90, expired=0x7ffd55c9608a)
    at ../../source3/lib/idmap_cache.c:53

#19 0x00007f7e2e2acf70 in idmap_cache_find_sid2gid (sid=0x556b2a3119b0, pgid=0x7ffd55c96410, expired=0x7ffd55c9608a)
    at ../../source3/lib/idmap_cache.c:180
#20 0x00007f7e2d5ac035 in sid_to_gid (psid=0x556b2a3119b0, pgid=0x7ffd55c96410) at ../../source3/passdb/lookup_sid.c:15
#21 0x00007f7e2faaabf3 in unpack_nt_owners (conn=0x556b2a306ff0, puser=0x7ffd55c96414, pgrp=0x7ffd55c96410, security_in
    psd=0x556b2a3e72a0) at ../../source3/smbd/posix_acls.c:1133
#22 0x00007f7e2fab15a2 in set_nt_acl (fsp=0x556b2a3c85e0, security_info_sent=7, psd_orig=0x556b2a3765c0) at ../../sourc
#23 0x00007f7e2fb6ba4a in vfswrap_fset_nt_acl (handle=0x556b2a306970, fsp=0x556b2a3c85e0, security_info_sent=7, psd=0x5
    at ../../source3/modules/vfs_default.c:3402
#24 0x00007f7e2faa59ab in smb_vfs_call_fset_nt_acl (handle=0x556b2a306970, fsp=0x556b2a3c85e0, security_info_sent=7, ps
    at ../../source3/smbd/vfs.c:2558
#25 0x00007f7e2fb63995 in set_underlying_acl (handle=0x556b2a2fc160, fsp=0x556b2a3c85e0, psd=0x556b2a3765c0, security_i
    chown_needed=false) at ../../source3/modules/vfs_acl_common.c:737
#26 0x00007f7e2fb641d1 in fset_nt_acl_common (fget_acl_blob_fn=0x7f7e151b6244 <fget_acl_blob>,
    store_acl_blob_fsp_fn=0x7f7e151b63df <store_acl_blob_fsp>, module_name=0x7f7e151b6e4a "acl_xattr", handle=0x556b2a2
    security_info_sent=7, orig_psd=0x556b2a2ab620) at ../../source3/modules/vfs_acl_common.c:925
#27 0x00007f7e151b6cb9 in acl_xattr_fset_nt_acl (handle=0x556b2a2fc160, fsp=0x556b2a3c85e0, security_info_sent=7, psd=0
    at ../../source3/modules/vfs_acl_xattr.c:291
#28 0x00007f7e2faa59ab in smb_vfs_call_fset_nt_acl (handle=0x556b2a2fc160, fsp=0x556b2a3c85e0, security_info_sent=7, ps
    at ../../source3/smbd/vfs.c:2558
#29 0x00007f7e2fa96312 in inherit_new_acl (parent_dir_fname=0x556b2a3faf70, fsp=0x556b2a3c85e0) at ../../source3/smbd/o
#30 0x00007f7e2fa97c4a in create_file_unixpath (conn=0x556b2a306ff0, req=0x556b2a4152e0, smb_fname=0x556b2a3c9390, acce
    share_access=0, create_disposition=2, create_options=68, file_attributes=32, oplock_request=256, lease=0x556b2a4150
    private_flags=0, sd=0x0, ea_list=0x0, result=0x7ffd55c96b30, pinfo=0x7ffd55c96b3c) at ../../source3/smbd/open.c:608
#31 0x00007f7e2fa983e0 in create_file_default (conn=0x556b2a306ff0, req=0x556b2a4152e0, smb_fname=0x556b2a3c9390, acces
    share_access=0, create_disposition=2, create_options=68, file_attributes=32, oplock_request=256, lease=0x556b2a4150
    private_flags=0, sd=0x0, ea_list=0x0, result=0x556b2a414fd8, pinfo=0x556b2a414fec, in_context_blobs=0x7ffd55c96e78,
    out_context_blobs=0x556b2a415200) at ../../source3/smbd/open.c:6278
#32 0x00007f7e2fb661f8 in vfswrap_create_file (handle=0x556b2a306970, req=0x556b2a4152e0, smb_fname=0x556b2a3c9390, acc
    share_access=0, create_disposition=2, create_options=68, file_attributes=32, oplock_request=256, lease=0x556b2a4150
    private_flags=0, sd=0x0, ea_list=0x0, result=0x556b2a414fd8, pinfo=0x556b2a414fec, in_context_blobs=0x7ffd55c96e78,
    out_context_blobs=0x556b2a415200) at ../../source3/modules/vfs_default.c:755
#33 0x00007f7e2faa3a6b in smb_vfs_call_create_file (handle=0x556b2a306970, req=0x556b2a4152e0, smb_fname=0x556b2a3c9390
    share_access=0, create_disposition=2, create_options=68, file_attributes=32, oplock_request=256, lease=0x556b2a4150
    private_flags=0, sd=0x0, ea_list=0x0, result=0x556b2a414fd8, pinfo=0x556b2a414fec, in_context_blobs=0x7ffd55c96e78,
    out_context_blobs=0x556b2a415200) at ../../source3/smbd/vfs.c:1714

coredump2(sorry for spelling mistakes ):
#6 0x00007f65dd73e60d in sig_ fault () from /usr/lib64/libsamba-util.so.0
#7 <s ignal handler called>
#8 0x0007f65d9d72e6c in_ pthread_ mutex_ unlock_ full ( ) from /usr/lib64/libpthread.so.0
#9 0x0007f65d71a3294 in tdb_ mutex_ unlock ( ) from /usr/lib64/samba/libtdb .so.1
#10 0x00007 f65d7197a15 in fcntl_ unLock ( ) from /usr/lib64/s amba/libtdb.so.
#11 0x00007f65d7197c1b in tdb_ brunlock from /usr/lib64/samba/libtdb.so.1
#12 0x00007f65d719855c in tdb_ nest_ unlock ( ) from /usr/ ib64/samba/libtdb.so.1
#13 0x0007f65d7198623 in tdb_ unlock ( ) from /usr/l ib64/samba/libtdb.so.1
#14 0x00007 f65d7 195040 in tdb_ parse_ record ( ) from /usr/l ib64/samba/ libtdb.so.1
#15 0x00007 f65db86ae02 in gencache_ parse ( ) from /lib64/libsmbconf .50.0
#16 0x0007f65db86b0Of in gencache_ get_ data_ blob_ ( ) from /lib64/libsmbconf.so.0
#17 0x00007f65db86b0e3 in gencache_ get ( ) from /lib64/libsmbconf .so.0
#18 0x00007 f65db86ea02 in idmap_ cache_ f ind_ sid2unixid ( ) from /libib64/libsmbconf .s0.0

#19 0x00007 f65dab6d5c1 in sids_ to_ unixids ( ) from /lib64/libsamba-passdb.so.0
#20 0x00007f65da5ce8d9 in create_ local_ token ( ) from /usr/lib64/samba/l ibauth- samba4.so
#21 0x00007 f65da5c6ca3 in auth3_ generate_ session_ info ( ) from /usr/lib64/samba/libauth-samba4. so
#22 0x00007 f65d49ecd52 in gensec_ ntlmssp_ session_ info ( ) from /usr/lib64/samba/libgensec -samba4. so
#23 0x00007 f65d49f66c0 in gensec_ session_ info ( ) from /usr/lib64/samba/libgensec-samba4. so
#24 0x00007f65d49fa5b6 in gensec_ child_ session_ info from /usr/lib64/ samba/libgensec - samba4.so
#25 0x00007f65d49f66c0 in gensec session_ info () from /usr/l ib64/s amba/l ibgensec-samba4. so
#26 0x00007 f65ddoa5bc1 in smbd_ smb2_ session_ setup_ gensec_ done ( ) from /usr/lib64/ samba/libsmbd-base-samba4.
#27 0x00007f65dc4cf4d2 in_ tevent_ req_ notify_ callback ( ) from /usr/lib64/samba/libtevent.so.0
#28 0x00007 f65dc4cf631 in tevent_ req_ finish ( ) from /usr/lib64/samba/libtevent.so.0
#29 0x00007f65dc4cf65d in_ tevent_ req_ done ( ) from /usr/lib64/samba/libtevent.so.0
#30 0x00007f65d49f714e in gensec_ update_ done ( ) from /usr/lib64/samba/libgensec -samba4.so
#31 0x0007f65dc4cf4d2 in_ tevent_ req_ notify_ callback ( ) from /usr/lib64/samba/libtevent .so.0
#32 0x00007f65dc4cf631 in tevent_ req_ finish ( ) from /usr/lib64/samba/libtevent.so.0
#33 0x00007f65dc4cf65d in_ tevent_ req_ done ( ) from /usr/lib64/s amba/libtevent.so.0
#34 0x00007f65d49f508b in gensec_ spnego_ update_ post ( ) from /usr/l ib64/s amba/ libgensec -samba4. so
#35 0x0007f65d49f4bf6 in gensec_ spnego_ update_ done() from /usr/lib64/samba/libgensec -S amba4.so
#36 0x00007 f65dc4cf4d2 in_ tevent_ req_ notify_ callback ( ) from /usr/ lib64/samba/ l ibtevent.so.0
#37 0x00007f65dc4cf631 in tevent_ req_finish () from /usr/lib64/ samba/libtevent. so.0
#38 0x0007f65dc4cf65d in_ tevent_ req_ done ( ) from /usr/lib64/samba/libtevent.so.0
#39 0x0007f65d49f714e in gensec_ _update_ done ( ) from /usr/lib64/samba/l ibgensec -samba4.so
#40 0x00007f65dc4cf4d2 in_ tevent_ req_ notify_ callback ( ) from /usr/lib64/s amba/libtevent.so.0
#41 0x00007f65dc4cf631 in tevent_ req_ finish ( ) from /usr/lib64/samba/libtevent.so.0
#42 0x00007f65dc4cf65d in_ tevent_ req_ done ( ) from /usr/lib64/s amba/l ibtevent.so.0
#43 0x0007f65d49e2b0c in gensec_ ntlmssp_ _update_ done ( ) from /usr/lib64/samba/l ibgensec -samba4. so
#44 0x00007f65dc4cf4d2 in_ tevent_ req_ notify_ callback () from /usr/lib64/s amba/l ibtevent.so.0
#45 0x00007f65dc4cf631 in tevent_ req_ finish ( ) from /usr/lib64/samba/libtevent.so.0
#46 0x0007f65dc4cf65d in_ tevent_ req_ done ( ) from /usr/lib64/samba/libtevent.so.0
#470x00007f65d49e9205 in ntlmssp_ server_ auth_ done ( ) from /usr/lib64/s amba/l ibgensec - samba4.so
#48 0x00007f65dc4cf4d2 in_ tevent_ req_ notify_ callback () from /usr/lib64/s amba/l ibtevent.so.0
#49 0x00007 f65dc4cf631 in tevent_ req_ finish ( ) from /usr/lib64/samba/libtevent. so.0
#50 0x00007f65dc4cf75b in tevent_ req_ trigger () from /usr/lib64/samba/ libtevent.so.0
#51 0x00007 f65dc4ce385 in tevent_ common_ invoke_ immediate_ handler ( ) from /usr/lib64/samba/libtevent .so.0
#520x00007f65dc4ce4d4 in tevent_ common _loop_ immediate ( ) from /usr/lib64/samba/libtevent.so.0
#53 0x00007f65dc4d88e9 in epoll_ event_ loop_ once ( ) from /usr/lib64/samba/libtevent.so.0
#54 0x00007f65dc4d5304 in std_ event_ loop_ once ( ) from /usr/lib64/samba/libtevent.so.0

Is this tdb_unlock's bug? Or  idmap_ cache_ find_ sid2unixid's ?Or the pthread_mutex_unlock's provided by glibc ?and what's causality between smbd's error and winbind's?