smbd panics when Windows-7 client attempts to open a lot of files.
Log file contains a lot of fragments like the following.

[2012/09/13 10:12:39.845973,  0] lib/util.c:1221(log_stack_trace)
  BACKTRACE: 22 stack frames:
   #0 /usr/sbin/smbd(log_stack_trace+0x1a) [0x7f86f64fe26a]
   #1 /usr/sbin/smbd(smb_panic+0x22) [0x7f86f64fe342]
   #2 /usr/sbin/smbd(+0x3c1559) [0x7f86f648e559]
   #3 /usr/lib/x86_64-linux-gnu/libtalloc.so.2(_talloc_free+0x3f1)
   #[0x7f86f380db91]
   #4 /usr/sbin/smbd(+0x16e43f) [0x7f86f623b43f]
   #5 /usr/sbin/smbd(+0x1719ce) [0x7f86f623e9ce]
   #6 /usr/sbin/smbd(create_file_default+0x120) [0x7f86f623f3a0]
   #7 /usr/sbin/smbd(+0x1af25b) [0x7f86f627c25b]
   #8 /usr/sbin/smbd(smb_vfs_call_create_file+0xa5) [0x7f86f6245685]
   #9 /usr/sbin/smbd(reply_ntcreate_and_X+0x3bc) [0x7f86f6203b5c]
   #10 /usr/sbin/smbd(+0x18a08c) [0x7f86f625708c]
   #11 /usr/sbin/smbd(+0x18a492) [0x7f86f6257492]
   #12 /usr/sbin/smbd(+0x18a8d1) [0x7f86f62578d1]
   #13 /usr/sbin/smbd(run_events_poll+0x353) [0x7f86f650dd43]
   #14 /usr/sbin/smbd(smbd_process+0x84a) [0x7f86f625903a]
   #15 /usr/sbin/smbd(+0x69f513) [0x7f86f676c513]
   #16 /usr/sbin/smbd(run_events_poll+0x353) [0x7f86f650dd43]
   #17 /usr/sbin/smbd(+0x440eda) [0x7f86f650deda]
   #18 /usr/sbin/smbd(_tevent_loop_once+0x90) [0x7f86f650ea40]
   #19 /usr/sbin/smbd(main+0xf30) [0x7f86f61d7850]
   #20 /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xfd)
   #[0x7f86f2e6bead]
   #21 /usr/sbin/smbd(+0x10ac8d) [0x7f86f61d7c8d]

smb.conf:
[global]
        dos charset = CP866
        unix charset = cp1251
        workgroup = IMB
        realm = IMB.INVENTION.COM
        server string = Debian GNU/Linux (samba %v)
        security = ADS
        map to guest = Bad User
        password server = srv-dc
        announce as = NT Workstation
        client ldap sasl wrapping = sign
        keepalive = 60
        max open files = 10000
        load printers = No
        os level = 2
        local master = No
        wins server = 172.17.1.1
        message command = /bin/mail -s '%m -> %t' cheusov < %s; rm %s
        panic action = /usr/share/samba/panic-action %d
        idmap config * : backend = tdb
        hide dot files = No
[syntagma7]
        path = /var/local/syntagma7
        read only = No
        guest ok = Yes
        fake oplocks = Yes
        strict locking = No
        dos filetime resolution = Yes

"gdb bt" output.
#0  0x00007f86f2e7f475 in raise () from /lib/x86_64-linux-gnu/libc.so.6
#1  0x00007f86f2e826f0 in abort () from /lib/x86_64-linux-gnu/libc.so.6
#2  0x00007f86f64efbeb in dump_core () at lib/fault.c:391
#3  0x00007f86f64fe37e in smb_panic (why=<optimized out>) at lib/util.c:1133
#4  0x00007f86f648e559 in share_mode_lock_destructor (lck=<optimized out>)
    at locking/locking.c:911
#5  share_mode_lock_destructor (lck=<optimized out>) at
locking/locking.c:867
#6  0x00007f86f380db91 in _talloc_free () from
#/usr/lib/x86_64-linux-gnu/libtalloc.so.2
#7  0x00007f86f623b43f in open_file_ntcreate
#(conn=conn@entry=0x7f86f703e4c0,
    req=req@entry=0x7f86f7243d40, access_mask=0, access_mask@entry=131209,
    share_access=<optimized out>,
create_disposition=create_disposition@entry=1,
    create_options=create_options@entry=2097220,
    new_dos_attributes=new_dos_attributes@entry=0,
    oplock_request=oplock_request@entry=3,
    private_flags=private_flags@entry=0,
    pinfo=pinfo@entry=0x7fff1f77a3d4, fsp=0x7f86f7245d80) at
    smbd/open.c:2404
#8  0x00007f86f623e9ce in create_file_unixpath
(conn=conn@entry=0x7f86f703e4c0,
    req=req@entry=0x7f86f7243d40, smb_fname=smb_fname@entry=0x7f86f7244020,
    access_mask=access_mask@entry=131209, share_access=share_access@entry=5,
    create_disposition=create_disposition@entry=1,
    create_options=create_options@entry=2097220,
    file_attributes=file_attributes@entry=0,
    oplock_request=oplock_request@entry=3,
    allocation_size=allocation_size@entry=0,
    private_flags=private_flags@entry=0,
    sd=sd@entry=0x0, ea_list=ea_list@entry=0x0,
    result=result@entry=0x7fff1f77a4a0,
    pinfo=pinfo@entry=0x7fff1f77a49c) at smbd/open.c:3294
#9  0x00007f86f623f3a0 in create_file_default (conn=0x7f86f703e4c0,
req=0x7f86f7243d40,
    root_dir_fid=<optimized out>, smb_fname=0x7f86f7244020,
access_mask=131209,
    share_access=5, create_disposition=create_disposition@entry=1,
    create_options=create_options@entry=2097220,
    file_attributes=file_attributes@entry=0,
    oplock_request=oplock_request@entry=3,
    allocation_size=allocation_size@entry=0,
    private_flags=private_flags@entry=0,
    sd=sd@entry=0x0, ea_list=ea_list@entry=0x0,
    result=result@entry=0x7fff1f77a688,
    pinfo=pinfo@entry=0x7fff1f77a670) at smbd/open.c:3683
#10 0x00007f86f627c25b in vfswrap_create_file (handle=<optimized out>,
    req=<optimized out>, root_dir_fid=<optimized out>, smb_fname=<optimized
out>,
    access_mask=<optimized out>, share_access=<optimized out>,
create_disposition=1,
    create_options=2097220, file_attributes=0, oplock_request=3,
allocation_size=0,
    private_flags=0, sd=0x0, ea_list=0x0, result=0x7fff1f77a688,
pinfo=0x7fff1f77a670)
    at modules/vfs_default.c:329
#11 0x00007f86f6245685 in smb_vfs_call_create_file (handle=<optimized out>,
    req=req@entry=0x7f86f7243d40, root_dir_fid=root_dir_fid@entry=0,
    smb_fname=<optimized out>, access_mask=access_mask@entry=131209,
    share_access=<optimized out>,
    create_disposition=create_disposition@entry=1,
    create_options=2097220, file_attributes=file_attributes@entry=0,
    oplock_request=oplock_request@entry=3,
    allocation_size=allocation_size@entry=0,
    private_flags=0, private_flags@entry=3, sd=sd@entry=0x0,
    ea_list=ea_list@entry=0x0,
    result=result@entry=0x7fff1f77a688, pinfo=pinfo@entry=0x7fff1f77a670)
    at smbd/vfs.c:1312
#12 0x00007f86f6203b5c in reply_ntcreate_and_X
(req=req@entry=0x7f86f7243d40)
    at smbd/nttrans.c:568
#13 0x00007f86f625708c in switch_message (type=162 '\242',
req=req@entry=0x7f86f7243d40,
    size=size@entry=226) at smbd/process.c:1574
#14 0x00007f86f6257492 in construct_reply (deferred_pcd=0x0,
encrypted=false,
    seqnum=<optimized out>, unread_bytes=0, size=226, inbuf=0x0,
sconn=0x7f86f70245e0)
    at smbd/process.c:1610
#15 process_smb (sconn=sconn@entry=0x7f86f70245e0, inbuf=<optimized out>,
nread=226,
    unread_bytes=0, seqnum=<optimized out>, encrypted=false,
    deferred_pcd=deferred_pcd@entry=0x0) at smbd/process.c:1688
#16 0x00007f86f62578d1 in smbd_server_connection_read_handler
(conn=0x7f86f70245e0,
    fd=25) at smbd/process.c:2317
#17 0x00007f86f650dd43 in run_events_poll (num_pfds=3, pfds=0x7f86f703b030,
    pollrtn=<optimized out>, ev=0x7f86f7024520) at lib/events.c:286
#18 run_events_poll (ev=0x7f86f7024520, pollrtn=pollrtn@entry=1,
pfds=0x7f86f703b030,
    num_pfds=3) at lib/events.c:184
#19 0x00007f86f625903a in smbd_server_connection_loop_once
(conn=0x7f86f70245e0)
---Type <return> to continue, or q <return> to quit---
    at smbd/process.c:1017
#20 smbd_process (sconn=0x7f86f70245e0) at smbd/process.c:3158
#21 0x00007f86f676c513 in smbd_accept_connection (ev=<optimized out>,
    fde=<optimized out>, flags=<optimized out>, private_data=<optimized
out>)
    at smbd/server.c:514
#22 0x00007f86f650dd43 in run_events_poll (num_pfds=5, pfds=0x7f86f703be30,
    pollrtn=<optimized out>, ev=0x7f86f7024520) at lib/events.c:286
#23 run_events_poll (ev=0x7f86f7024520, pollrtn=<optimized out>,
pfds=0x7f86f703be30,
    num_pfds=5) at lib/events.c:184
#24 0x00007f86f650deda in s3_event_loop_once (ev=0x7f86f7024520,
    location=<optimized out>) at lib/events.c:349
#25 0x00007f86f650ea40 in _tevent_loop_once (ev=0x7f86f7024520,
    location=location@entry=0x7f86f69742e9 "smbd/server.c:847")
    at ../lib/tevent/tevent.c:494
#26 0x00007f86f61d7850 in smbd_parent_loop (parent=<optimized out>) at
smbd/server.c:847
#27 main (argc=<optimized out>, argv=0x7f86f7026d90) at smbd/server.c:1327

Hello,

Are you able to reproduce this bug on latest jessie
(2:4.2.14+dfsg-0+deb8u11) or latest stretch (2:4.5.16+dfsg-1)? This
would be good if you tested it on latest buster (2:4.9.4+dfsg-3, -2 is ok).

Regards

Version: 4.0.0+dfsg-1

This is an old bugreport filed against samba3, lots of changes
has been made to samba since that time. Samba these days
definitely allows to open really many files without crashing.
Also the requested information has not been provided.

Closing this bugreport with version 4.0.0, hopefully this problem
has been fixed for good.  Please feel free to reopen it if you
think the problem is still relevant to current version of samba.

Thank you!

/mjt