smbd: NotifyChangeDirectory: NETWORK_ERROR (need help)

[Michael Tokarev]

I tried to debug an interesting issue today.

The thing is that some applications, for example FarManager (farmanager.com),
will enable change notifications on the directories they keep "current",
including the case when this directory is on a remote samba server.
And sometimes, it ends up in list of files on the samba panel to become
empty with the error message:

  Error: Cannot read folder contents
  0x00000003 - The system cannot find the path specified.

This happens only on samba so far, and it didn't occur with older samba
version (I can't say which, maybe 4.16, but 4.13 for sure).  I can click
on "Ok" and tell it to re-read the directory, which works, until after
some more time the whole thing happens again.  What's interesting here
is that the directory in question is *not* actually modified, not this
one neither any file/dir inside it, so if anything, this notification
is false.  Also, I don't see any inotify filedescriptors in lsof output
of this smbd process.

So I started from tracing far.exe, but this one gave nothing really interesting.
Here's what ProcMon.exe (from sysinternals) shows for it:

  13.04.2023 16:09:24,2428431 Far.exe 11600 NotifyChangeDirectory \\tsrv\mjt-adm\ NETWORK ERROR \
     Filter: FILE_NOTIFY_CHANGE_FILE_NAME, ...

So system call NotifyChangeDirectory returned NETWORK ERROR.  After this,
far.exe immediately displays the above error message without issuing other
system calls.

I tried to match this event on the samba side, but I can't find it so far.
There are a few interesting cases going on there, some definitely unrelated,
some might be related, but overall things look quite ok, and there's no
relevant errors returned by the kernel.

What's interesting is that a) samba does not use any inotify mechanism, at
least there's no inotify file descriptors in use according to lsof.  Yet,
actual changes happening in the directories being watched, are immediately
catched up.

b) the above error happens when *no* files are modified on the samba side,
this dir and anything below it is *not* modified at the moment this error
happens.

c) as far as I can see, the error is often related to some *other* user
activity on the same machine (these machines are win10 with more than
one user running).  I'm not sure it is always the case, but so far it's
like this. Here, one smbd serves multiple user sessions (for different
users).


I have straces for the issue, where, among other things, I see smbd
receives SMB commands from the client and sends replies, but so far
I never tried to decode the protocol/commands which are being exchanged
(and I don't really know much about the protocol and the set of commands
it uses).

I'd love to find out what's going on.  Can I have some help here, or
is the only option for me to learn SMB and at least find out where smbd
sends "failed" NotifyChange replies to the client?


Thanks,

/mjt