#1005721 samba: Intermittent segfault+coredump when volume_label calls strlen

Package:
samba
Source:
samba
Description:
SMB/CIFS file, print, and login server for Unix
Submitter:
Richard Allen
Date:
2022-02-14 04:03:03 UTC
Severity:
normal
#1005721#5
Date:
2022-02-13 21:12:12 UTC
From:
To:
Dear Maintainer,

Copying around 50GB consisting of 3-4MB JPG and 400MB to 4.9GB MP4 files
from an SD card mounted by a Windows 10 Version 10.0.19044.1526 client
over a home mesh WiFi to an AMD64 NAS running Debian 11 and smbd
Version 4.13.13-Debian stored in a usershare on a ZFS filesystem.

I first tried copying a large directory from the SD card(D:\DCIM\).
The Windows GUI client reported an error and asked if I wanted to try again.
Trying again fixed the current file, but usually later another file failed
and had to be repeated.

When I tried Beyond Compare 4's directory comparison function and selected
the failed files to by re-copied, and more copied, but this time I saved the error text:
"An unexpected network error occurred"

When windows GUI client failed to copy a file, it left a zero-byte file
on the NAS. When I repeated the copy with beyond-compare, most of the failed
files were correctly copied and only one remained.

It seems each time the "network error occurred" smbd actually crashed and left a coredump.
I tried installing libc6-dbg, but after reproducing was unable to get the backtrace to
resolve calls inside libc6.so.6. I reviewed the source code of volume_label()
in loadparm.c - it seems the only libc function call there is a call to strcpy(),
so perhaps the label pointer was NULL or otherwise invalid?

I've saved a copy of the coredump, but would prefer not to post it publicly.

It seems 4.13 is out of maintenance with upstream, but when I have time I'll try
to pull down the latest from upstream and see if I can reproduce and create a bug
there if needed or otherwise report back.

#1005721#10
Date:
2022-02-13 21:27:51 UTC
From:
To:
Either way this is exactly the kind of bug to report upstream, as an
initial position all patches applied in Debian first have to be
accepted upstream.

I've sent you an invite to bugzilla.

Ideally do check with current master, as if it works you can then find
the patch that fixes in and just propose that to Debian.

Andrew Bartlett

#1005721#15
Date:
2022-02-14 03:58:46 UTC
From:
To:
Thanks Andrew,

I've done so, resulting in https://bugzilla.samba.org/show_bug.cgi?id=14978 .

https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1914420 seems to
have the same backtrace as well.