[Samba] Segfaults: PANIC: Bad talloc magic value - access after free

[Marc Muehlfeld]

Hello,

I switched the first member server in production from 3.6 to 4.1. But 
since that, several times per day, smbd processes are crashing on that 
machine. Has anybody encountered this, too?

[2013/11/05 04:14:43.532768,  0, pid=91892]
../source3/lib/popt_common.c:67(popt_s3_talloc_log_fn)
   talloc: access after free error - first free may be at
../source3/smbd/open.c:1529
[2013/11/05 04:14:43.532916,  0, pid=91892]
../source3/lib/popt_common.c:67(popt_s3_talloc_log_fn)
   Bad talloc magic value - access after free
[2013/11/05 04:14:43.532976,  0, pid=91892]
../source3/lib/util.c:785(smb_panic_s3)
   PANIC (pid 91892): Bad talloc magic value - access after free
[2013/11/05 04:14:43.533704,  0, pid=91892]
../source3/lib/util.c:896(log_stack_trace)
   BACKTRACE: 22 stack frames:
    #0 /usr/local/samba/lib/libsmbconf.so.0(log_stack_trace+0x1f)
[0x7f2db6366c06]
    #1 /usr/local/samba/lib/libsmbconf.so.0(smb_panic_s3+0x6d) 
[0x7f2db6366a75]
    #2 /usr/local/samba/lib/libsamba-util.so.0(smb_panic+0x28) 
[0x7f2db81d3cfb]
    #3 /usr/local/samba/lib/samba/libtalloc.so.2(+0x20a9) [0x7f2db760d0a9]
    #4 /usr/local/samba/lib/samba/libtalloc.so.2(+0x2125) [0x7f2db760d125]
    #5 /usr/local/samba/lib/samba/libtalloc.so.2(+0x21a3) [0x7f2db760d1a3]
    #6 /usr/local/samba/lib/samba/libtalloc.so.2(talloc_get_name+0x18)
[0x7f2db760ec83]
    #7 
/usr/local/samba/lib/samba/libtalloc.so.2(_talloc_get_type_abort+0x4c)
[0x7f2db760ee03]
    #8 /usr/local/samba/lib/libsmbconf.so.0(+0x31767) [0x7f2db6372767]
    #9
/usr/local/samba/lib/samba/libtevent.so.0(tevent_common_loop_immediate+0x1f9)
[0x7f2db73feee4]
    #10 /usr/local/samba/lib/libsmbconf.so.0(run_events_poll+0x57)
[0x7f2db638319b]
    #11 /usr/local/samba/lib/libsmbconf.so.0(+0x42848) [0x7f2db6383848]
    #12 /usr/local/samba/lib/samba/libtevent.so.0(_tevent_loop_once+0xfc)
[0x7f2db73fdfa9]
    #13 /usr/local/samba/lib/samba/libsmbd_base.so(smbd_process+0x1321)
[0x7f2db7977a1e]
    #14 /usr/sbin/smbd(+0x9c38) [0x7f2db883cc38]
    #15 /usr/local/samba/lib/libsmbconf.so.0(run_events_poll+0x544)
[0x7f2db6383688]
    #16 /usr/local/samba/lib/libsmbconf.so.0(+0x4295e) [0x7f2db638395e]
    #17 /usr/local/samba/lib/samba/libtevent.so.0(_tevent_loop_once+0xfc)
[0x7f2db73fdfa9]
    #18 /usr/sbin/smbd(+0xa8d7) [0x7f2db883d8d7]
    #19 /usr/sbin/smbd(main+0x15d1) [0x7f2db883eff9]
    #20 /lib64/libc.so.6(__libc_start_main+0xfd) [0x7f2db4bfbcdd]
    #21 /usr/sbin/smbd(+0x5809) [0x7f2db8838809]
[2013/11/05 04:14:43.534362,  0, pid=91892]
../source3/lib/util.c:797(smb_panic_s3)
   smb_panic(): calling panic action [/usr/local/bin/panic-action 91892]
[2013/11/05 04:14:44.128587,  0, pid=91892]
../source3/lib/util.c:805(smb_panic_s3)
   smb_panic(): action returned status 0
[2013/11/05 04:14:44.128711,  0, pid=91892]
../source3/lib/dumpcore.c:317(dump_core)
   dumping core in /var/log/samba//cores/smbd



I also had already opened a bug report:
https://bugzilla.samba.org/show_bug.cgi?id=10250


Regards,
Marc