[Samba] samba 4.9.5 smbd panic

[Andrea Cucciarre']

Hello,

Some of my system running Samba 4.9.5 are suffering the following smbd 
panic:

Jan 14 21:15:56 fact-hf01 smbd[444]: [ID 702911 daemon.error] 
[2020/01/14 21:15:56.552277,  0] ../lib/util/fault.c:79(fault_report)
Jan 14 21:15:56 fact-hf01 smbd[444]: [ID 702911 daemon.error] 
===============================================================
Jan 14 21:15:56 fact-hf01 smbd[444]: [ID 702911 daemon.error] 
[2020/01/14 21:15:56.554475,  0] ../lib/util/fault.c:80(fault_report)
Jan 14 21:15:56 fact-hf01 smbd[444]: [ID 702911 daemon.error] INTERNAL 
ERROR: Signal 11 in pid 444 (4.9.5)
Jan 14 21:15:56 fact-hf01 smbd[444]: [ID 702911 daemon.error] Please 
read the Trouble-Shooting section of the Samba HOWTO
Jan 14 21:15:56 fact-hf01 smbd[444]: [ID 702911 daemon.error] 
[2020/01/14 21:15:56.554638,  0] ../lib/util/fault.c:82(fault_report)
Jan 14 21:15:56 fact-hf01 smbd[444]: [ID 702911 daemon.error] 
===============================================================
Jan 14 21:15:56 fact-hf01 smbd[444]: [ID 702911 daemon.error] 
[2020/01/14 21:15:56.554713,  0] ../source3/lib/util.c:816(smb_panic_s3)
Jan 14 21:15:56 fact-hf01 smbd[444]: [ID 702911 daemon.error] PANIC (pid 
444): internal error
Jan 14 21:15:56 fact-hf01 smbd[444]: [ID 702911 daemon.error] 
[2020/01/14 21:15:56.658060,  0] ../lib/util/fault.c:261(log_stack_trace)
Jan 14 21:15:56 fact-hf01 smbd[444]: [ID 702911 daemon.error] BACKTRACE: 
60 stack frames:
Jan 14 21:15:56 fact-hf01 smbd[444]: [ID 702911 daemon.error]    #0 
/opt/samba/lib/libsamba-util.so.0.0.1'log_stack_trace+0x26 [0xfedabc3e]
Jan 14 21:15:56 fact-hf01 smbd[444]: [ID 702911 daemon.error]    #1 
/opt/samba/lib/libsmbconf.so.0'smb_panic_s3+0x68 [0xfe8b184f]
Jan 14 21:15:56 fact-hf01 smbd[444]: [ID 702911 daemon.error]    #2 
/opt/samba/lib/libsamba-util.so.0.0.1'smb_panic+0x2a [0xfedabc00]
Jan 14 21:15:56 fact-hf01 smbd[444]: [ID 702911 daemon.error]    #3 
/opt/samba/lib/libsamba-util.so.0.0.1'sig_fault+0x0 [0xfedab910]
Jan 14 21:15:56 fact-hf01 smbd[444]: [ID 702911 daemon.error]    #4 
/opt/samba/lib/libsamba-util.so.0.0.1'sig_fault+0x1b [0xfedab92b]
Jan 14 21:15:56 fact-hf01 smbd[444]: [ID 702911 daemon.error]    #5 
/lib/libc.so.1'__sighndlr+0x15 [0xfc57c465]
Jan 14 21:15:56 fact-hf01 smbd[444]: [ID 702911 daemon.error]    #6 
/lib/libc.so.1'call_user_handler+0x298 [0xfc570ceb]
Jan 14 21:15:56 fact-hf01 smbd[444]: [ID 702911 daemon.error]    #7 
/opt/samba/lib/private/libsmbd-base-samba4.so'change_to_user+0x2a 
[0xfe59ed5a]
Jan 14 21:15:56 fact-hf01 smbd[444]: [ID 702911 daemon.error]    #8 
/opt/samba/lib/private/libsmbd-base-samba4.so'change_to_user_by_fsp+0x2e 
[0xfe59eeab]
Jan 14 21:15:56 fact-hf01 smbd[444]: [ID 702911 daemon.error]    #9 
/opt/samba/lib/private/libsmbd-base-samba4.so'vfswrap_offload_write_cleanup+0x5c 
[0xfe4f3c39]
Jan 14 21:15:56 fact-hf01 smbd[444]: [ID 702911 daemon.error]    #10 
/opt/samba/lib/private/libtevent.so.0.9.37'tevent_req_cleanup+0x4b 
[0xfec48771]
Jan 14 21:15:56 fact-hf01 smbd[444]: [ID 702911 daemon.error]    #11 
/opt/samba/lib/private/libtevent.so.0.9.37'tevent_req_received+0xad 
[0xfec48ade]
Jan 14 21:15:56 fact-hf01 smbd[444]: [ID 702911 daemon.error]    #12 
/opt/samba/lib/private/libtevent.so.0.9.37'tevent_req_destructor+0x1e 
[0xfec486b4]
Jan 14 21:15:56 fact-hf01 smbd[444]: [ID 702911 daemon.error]    #13 
/opt/samba/lib/private/libtalloc.so.2.1.14'_tc_free_internal+0xf6 
[0xfecc373b]
Jan 14 21:15:56 fact-hf01 smbd[444]: [ID 702911 daemon.error]    #14 
/opt/samba/lib/private/libtalloc.so.2.1.14'_tc_free_children_internal+0x7a 
[0xfecc45de]
.......

# pstack core\ \(1\).smbd
core 'core (1).smbd' of 444:    /opt/samba/sbin/smbd --daemon
-----------------  lwp# 1 / thread# 1  --------------------
  fc581035 _lwp_kill (1, 6, 8046b60, fc5ef000, fc5ef000, 0) + 15
  fc515eeb raise    (6, 0, 8046b80, 0, 0, 0) + 2b
  fc4f0aae abort    (fe8ffff0, fc1b2a40, 8046be8, fe8b19a5, fc5ef000, 
fee05a6c) + 10e
  fe8c31ed ???????? (fc5ef000, fee05a6c, 8046c08, 810a118, fedf4e80, 
fee05a6c)
  fe8b19a5 readdirname (fedf4f75, 808d590, 8046c14, fedabbe2)
  fedabc00 smb_panic (fedf4f75, 0, fedf4f5e, fedf50c4, fc518c46, 
fc5ef000) + 2a
  fedab910 sig_fault (b, fc5ef000, 8046c9c, fedab91b)
  fedab92b sig_fault (b, 0, 8046d10, fc5ef000, fc5ef000, fc1b2a40) + 1b
  fc57c465 __sighndlr (b, 0, 8046d10, fedab910, 80a44e0, 8046ca8) + 15
  fc570ceb call_user_handler (b, 0, 8046d10, fc1b2a40, fc5ef804, 
8046d28) + 298
  fc570d89 sigacthandler (b, 0, 8046d10) + 80
  --- called from signal handler with signal 11 (SIGSEGV) ---
  fe59ed5a change_to_user (fdea6642, 0, 0, fe59ee89) + 2a
  fe59eeab change_to_user_by_fsp (812bdd8, fe6d7418, fe6d73f0, fe4f3be9) 
+ 2e
  fe4f3c39 vfswrap_offload_write_cleanup (8160b98, 6, 8160be8, fec48731) 
+ 5c
  fec48771 tevent_req_cleanup (8160b98, fec52af0, 26011999, fec48a3d) + 4b
  fec48ade tevent_req_received (8160b98, 0, 8160b68, fec486a2) + ad
  fec486b4 tevent_req_destructor (8160b98, 0, 8047048, fecc3651) + 1e
  fecc373b _tc_free_internal (8160b68, fec52b30, 0, fecc4570) + f6
  fecc45de _tc_free_children_internal (8161220, 8161250, fec52b30, 
fecc3651) + 7a
  fecc389a _tc_free_internal (8161220, fec52b30, 0, fecc39c4) + 255
  fecc3a50 _talloc_free_internal (8161250, fec52b30, 8047108, fecc48a0) + 98
  fecc497e _talloc_free (8161250, fec52b30, 8047138, fec48a3d) + ea
  fec48b01 tevent_req_received (8161170, 816c250, 8161140, fec486a2) + d0
  fec486b4 tevent_req_destructor (8161170, fec52b30, fec52b30, fecc3651) 
+ 1e
  fecc373b _tc_free_internal (8161140, fec52b30, 80471d8, fecc4570) + f6
  fecc45de _tc_free_children_internal (816c1a0, 816c1d0, fec52b30, 
fecc3651) + 7a
  fecc389a _tc_free_internal (816c1a0, fec52b30, 4, fecc39c4) + 255
  fecc3a50 _talloc_free_internal (816c1d0, fec52b30, 809fac8, fecc48a0) + 98
  fecc497e _talloc_free (816c1d0, fec52b30, 0, fec48a3d) + ea

Any idea what could be the root-cause?

-- 

Regards
Andrea Cucciarre'