Bug 199450 – net-fs/samba-3.0.27 causes PANIC (push_ascii - dest_len == -1) in logfiles and prevents clients from accessing samba shares

• Product: Gentoo Linux
• Status: RESOLVED FIXED

[Description Thomas Keller 2007-11-17 15:56:38 UTC]

After upgrading to net-fs/samba-3.0.27, I encountered various problems in mounting my samba shares (residing on a Gentoo server, accessed via a gentoo client); on the client, mounts are defined in /etc/fstab, a mount -a gave error "ERRnosuchshare".
After changing the filesystem in /etc/fstab from smbfs to cifs, no errors occur after "mount -a"; however, various usual directory operations such as "ls" result in an input/output error.

Checking the logs on the server, I found this in /var/log/samba/log.client.ip.address:

[2007/11/17 16:38:26, 0] lib/util.c:smb_panic(1632)
  PANIC (pid 12987): push_ascii - dest_len == -1
[2007/11/17 16:38:26, 0] lib/util.c:log_stack_trace(1736)
  BACKTRACE: 1 stack frames:
   #0 /usr/sbin/smbd(log_stack_trace+0x29) [0x8020d51a]
[2007/11/17 16:38:26, 0] lib/fault.c:dump_core(181)
  dumping core in /var/log/samba/cores/smbd

After googling, I found a similar bug related to Ubuntu: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/163042

I assume this is an upstream problem.

Reproducible: Always

Steps to Reproduce:
See description - NOT tested from my Windows client yet.



Server runs gentoo-sources-2.6.20-r8 (x86)
Client runs gentoo-sources-2.6.22-r9 (x86)

Both have Samba-3.0.27 installed.

[Comment 1 Jim Tupper 2007-11-17 22:10:43 UTC]

Can I add a +1 to this bug.
Using the CIFS filesystem instead of the SMBFS filesystem module works on version 3.0.27, however, since the mount options aren't exactly the same, my preference is to use the previous version.

Tested as broken on AMD64 client, AMD K7 server, both at gentoo-sources 2.6.22-r9.

[Comment 2 René T 2007-11-18 16:54:00 UTC]

Hi,

I'm having the same problem with my Linux clients. Windows clients work without problems.

Mounting the share with mount -t smbfs -o username=nobody //server/share /mnt/myserver works fine. The first "ls /mnt/myserver" however crashes the server and produces a core dump.

[Comment 3 Tiziano Müller (RETIRED) 2007-11-18 21:31:30 UTC]

Ok, samba-3.0.27 has been masked now, please downgrade to samba-3.0.26-r2 which fixes the remote vulnerability until upstream fixes the issue.
Sorry.

[Comment 4 Tiziano Müller (RETIRED) 2007-11-18 22:34:39 UTC]

Upstream-Bug: https://bugzilla.samba.org/show_bug.cgi?id=5087
For those interested in helping upstream: there's a fix. We'll wait with releasing a revision bump until the fix gets confirmed.

[Comment 5 Tiziano Müller (RETIRED) 2007-11-21 17:08:20 UTC]

Finally fixed with version 3.0.27a.
Users who use an unstable profile can directly update.
Users with stable profiles have to either downgrade to 3.0.26a-r2 or wait for 3.0.27a to become stable (won't take long).
Cheers.