Bug 1224003

Summary: after snapshot 20240424 core dump for named with samba-ad-dc
Product: [openSUSE] openSUSE Tumbleweed Reporter: Philippe Condé <conde.philippe>
Component: NetworkAssignee: Jorik Cronenberg <jorik.cronenberg>
Status: NEW --- QA Contact: E-mail List <qa-bugs>
Severity: Major    
Priority: P5 - None CC: conde.philippe, samba-maintainers
Version: Current   
Target Milestone: ---   
Hardware: aarch64   
OS: openSUSE Tumbleweed   
Whiteboard:
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Attachments: Coredump of named with samba-ad-dc
corerdump with samba 4.20.1
output of command coredumpctl dump pid -o output.core

Description Philippe Condé 2024-05-07 11:32:49 UTC
Created attachment 874735 [details]
Coredump of named  with samba-ad-dc

I have a raspberry with samba-ad-dc and named. After snapshot 20240424 named doesn't start and I have a core dump for named; If I comment the instructions  for samba-ad-dc in /etc/named.conf I can start named.

the two instructions commented in named.confare 
include "/var/lib/samba/bind-dns/named.conf";
tkey-gssapi-keytab "/var/lib/samba/bind-dns/dns.keytab";

Samba-ad-dc is running 

rasp:/etc # systemctl status samba-ad-dc
● samba-ad-dc.service - Samba AD Daemon
     Loaded: loaded (/usr/lib/systemd/system/samba-ad-dc.service; enabled; preset: disabled)
     Active: active (running) since Wed 2024-04-03 09:04:17 CEST; 1 month 3 days ago
       Docs: man:samba(8)
             man:samba(7)
             man:smb.conf(5)
    Process: 1256 ExecStartPre=/usr/share/samba/update-apparmor-samba-profile (code=exited, status=0/SUCCESS)
   Main PID: 1318 (samba)
     Status: "samba: ready to serve connections..."
      Tasks: 51 (limit: 4471)
        CPU: 9min 54.827s
     CGroup: /system.slice/samba-ad-dc.service
etc....
I attach the coredump

Many thanks in advance
Comment 1 Philippe Condé 2024-05-07 14:31:11 UTC
I did some tests, it is the line  
include "/var/lib/samba/bind-dns/named.conf"; which trigger the coredump. this file contains only a call to 
database "dlopen /usr/lib64/samba/bind9/dlz_bind9_18.so -d 9";

This file exists
rasp:/var/lib/samba/bind-dns # ls -l /usr/lib64/samba/bind9/dlz_bind9_18.so
-rwxr-xr-x 1 root root 67632 Feb 23 20:13 /usr/lib64/samba/bind9/dlz_bind9_18.so

Regards
Comment 2 Philippe Condé 2024-06-03 18:37:21 UTC
Created attachment 875282 [details]
corerdump with samba 4.20.1

Snapshot 20240530 was released today with an update of samba -> 4.20.1
I retested named but the core dump still occurs; See here attached
Comment 3 Philippe Condé 2024-06-16 15:37:44 UTC
Created attachment 875505 [details]
output of command coredumpctl dump pid -o output.core

This core dump is still present. I have set the debug level to 9 in  the command "dlopen /usr/lib64/samba/bind9/dlz_bind9_18.so -d 9" and restarted named. Here the output of command coredumpctl dump.
Comment 4 Philippe Condé 2024-06-28 05:27:17 UTC
hello,

tjere is a message on the samba mailing list refering to the same problem in debian and a answer about this

see https://lists.samba.org/archive/samba/2024-June/249319.html
"
We had bind segfaulting before already.  It was a bug in samba, - samba used a symbol name
dns_domain_equal(), which is an obvious name of a function but it's obvious for both named
and samba internal dns, and so both named and samba had it, the prob was when the two tried
to load into the same address space (where symbol names are unique), so a wrong symbol were
used by one of the components.  We renamed this function in samba to fix the issue. "

Can you have a look?
Comment 5 Philippe Condé 2024-07-01 17:37:41 UTC
in the samba mailing list there is a proposed solution:

"Seemingly you need to set an environmental variable
LDB_MODULES_DISABLE_DEEPBIND 

The easiest way I found to do this was to create a systemd override file

systemctl edit named.service

Add (where it tells you to):

[Service]
Environment="LDB_MODULES_DISABLE_DEEPBIND=1"

Save and close the file.

Now start Bind9"

I tested this on tmy pi 400 system and it wotks.
Maybe this line can be added in the existing 
/usr/lib/systemd/system/named.service.d/26-samba-dlz.conf

Regards
Philippe Condé
Comment 6 Jorik Cronenberg 2024-07-02 08:22:50 UTC
I've added the samba maintainers since it seems more like a samba issue. Could you maybe take a look?
Comment 7 Philippe Condé 2024-07-02 08:53:15 UTC
As far as I understand he report in samba bugzilla it seems that bind-9.18.27-1.1 use per default jemalloc,  but the library /usr/lib64/samba/bind9/dlz_bind9_18.so
from package samba-ad-dc-libs use malloc from (glibc?).

Theses functions can't work together.the current work around but not a real solution . I think that the package samba-ad-dc-libs must be enhanced with a new function for bind >= 9.18.27 

regards
Philippe
Comment 9 Jorik Cronenberg 2024-07-17 12:12:34 UTC
I see that there was a fix released for Factory/samba, thanks Samuel. @Philippe can you confirm and possibly close the issue?
Comment 10 Philippe Condé 2024-07-17 12:34:38 UTC
Hello,

My Samba server is on a pi 400 ,  and I don't see currently any update of samba available for tumbleweed aarch64.
rasp:/home/philippe/.vnc # zypper info samba-ad-dc
Loading repository data...
Reading installed packages...


Information for package samba-ad-dc:
------------------------------------
Repository     : openSUSE-Tumbleweed-Oss
Name           : samba-ad-dc
Version        : 4.20.1+git.339.cf6e153bb2-1.1
Arch           : aarch64
Vendor         : openSUSE
Installed Size : 17.6 MiB
Installed      : Yes
Status         : up-to-date
Source package : samba-4.20.1+git.339.cf6e153bb2-1.1.src
Upstream URL   : https://www.samba.org/
Summary        : Samba Active Directory-compatible Domain Controller
Description    : 
    This package contains the Active Directory-compatible Domain Controller

but for tumbleweed x86-64 I see a more recent version

hpprol2: # zypper info samba-ad-dc
Retrieving repository 'openSUSE Tools' metadata ..................................................[done]
Building repository 'openSUSE Tools' cache ..................................................[done]
Loading repository data...
Reading installed packages...


Information for package samba-ad-dc:
------------------------------------
Repository     : Main Repository (OSS)
Name           : samba-ad-dc
Version        : 4.20.2+git.348.4fb6af61307-1.1
Arch           : x86_64
Vendor         : openSUSE
Installed Size : 17.5 MiB
Installed      : No
Status         : not installed
Source package : samba-4.20.2+git.348.4fb6af61307-1.1.src
Upstream URL   : https://www.samba.org/
Summary        : Samba Active Directory-compatible Domain Controller
Description    : 
    This package contains the Active Directory-compatible Domain Controller

So I'm waiting a new snapshot from aarch64

Regards
Philippe