MPD crashes during smbclient playback on Samba 4.13.0

[avuton]

Bug report

Describe the bug

MPD crashes after a few seconds during Samba playback. Sometimes makes it through a minute long track.

This occurred with the Samba package from Arch, so I built Samba/talloc locally to get the debug symbols (there's probably an easier way I wasn't aware of).

Expected Behavior

No crash during Samba playback

Actual Behavior

MPD crashes during Samba playback

Version

Samba version 4.13.0

Music Player Daemon 0.23~git (v0.22.1-67-gad585e179)
Copyright 2003-2007 Warren Dukes [email protected]
Copyright 2008-2018 Max Kellermann [email protected]
This is free software; see the source for copying conditions. There is NO
warranty; not even MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Database plugins:
simple proxy

Storage plugins:
local smbclient udisks nfs curl

Neighbor plugins:
smbclient udisks

Decoders plugins:
[mad] mp3 mp2
[mpg123] mp3
[vorbis] ogg oga
[oggflac] ogg oga
[flac] flac
[opus] opus ogg oga
[sndfile] wav aiff aif au snd paf iff svx sf voc w64 pvf xi htk caf sd2
[dsdiff] dff
[dsf] dsf
[hybrid_dsd] m4a
[faad] aac
[mpcdec] mpc
[wavpack] wv
[modplug] 669 amf ams dbm dfm dsm far it med mdl mod mtm mt2 okt s3m stm ult umx xm
[sidplay] sid mus str prg P00
[wildmidi] mid
[ffmpeg] 16sv 3g2 3gp 4xm 8svx aa3 aac ac3 adx afc aif aifc aiff al alaw amr anim apc ape asf atrac au aud avi avm2 avs bap bfi c93 cak cin cmv cpk daud dct divx dts dv dvd dxa eac3 film flac flc fli fll flx flv g726 gsm gxf iss m1v m2v m2t m2ts m4a m4b m4v mad mj2 mjpeg mjpg mka mkv mlp mm mmf mov mp+ mp1 mp2 mp3 mp4 mpc mpeg mpg mpga mpp mpu mve mvi mxf nc nsv nut nuv oga ogm ogv ogx oma ogg omg opus psp pva qcp qt r3d ra ram rl2 rm rmvb roq rpl rvc shn smk snd sol son spx str swf tak tgi tgq tgv thp ts tsp tta xa xvid uv uv2 vb vid vob voc vp6 vmd wav webm wma wmv wsaud wsvga wv wve rtp:// rtsp:// rtsps://
[gme] ay gbs gym hes kss nsf nsfe sap spc vgm vgz
[pcm]

Filters:
libsamplerate soxr

Tag plugins:
id3tag

Output plugins:
shout null fifo pipe alsa openal pulse jack httpd recorder

Encoder plugins:
null vorbis opus lame wave flac

Archive plugins:
[bz2] bz2
[zzip] zip
[iso] iso

Input plugins:
file archive alsa tidal qobuz curl ffmpeg smbclient nfs mms cdio_paranoia

Playlist plugins:
extm3u m3u pls xspf asx rss soundcloud flac cue embcue

Protocols:
file:// alsa:// cdda:// ftp:// ftps:// gopher:// hls+http:// hls+https:// http:// https:// mms:// mmsh:// mmst:// mmsu:// nfs:// qobuz:// rtmp:// rtmpe:// rtmps:// rtmpt:// rtmpte:// rtmpts:// rtp:// rtsp:// rtsps:// scp:// sftp:// smb:// srtp:// tidal://

Other features:
avahi dbus udisks epoll icu inotify ipv6 systemd tcp un

git bisect

2fc4802 is the first bad commit
commit 2fc4802
Author: Max Kellermann [email protected]
Date: Mon Jul 20 22:32:27 2020 +0200

neighbor/smbclient: remove mutex locking

This is no longer necessary with the new API.

src/neighbor/plugins/SmbclientNeighborPlugin.cxx | 2 --
1 file changed, 2 deletions(-)

Log

client: [0] process command "idle player message"
client: [0] command returned 1
Freed frame ../../source3/libsmb/clireadwrite.c:667, expected ../../source3/libsmb/namequery.c:1918.
Freed frame ../../source3/libsmb/libsmb_dir.c:482, expected ../../source3/libsmb/namequery.c:1918.
client: [1] process command "status"
client: [1] command returned 0
client: [1] process command "idle"
client: [1] command returned 1
../../source3/libsmb/namequery.c:1900: Type mismatch: name[NULL] expected[struct name_resolve_bcast_state]

Thread 4 "smbclient" received signal SIGABRT, Aborted.
[Switching to Thread 0x7fffea5e5640 (LWP 76414)]
0x00007ffff3487615 in raise () from /usr/lib/libc.so.6
(gdb) bt
#0 0x00007ffff3487615 in raise () from /usr/lib/libc.so.6
#1 0x00007ffff3470862 in abort () from /usr/lib/libc.so.6
#2 0x00007fffee8b478e in talloc_abort () from /usr/local/samba/lib/private/libtalloc.so.2
#3 0x00007fffee8b6654 in talloc_abort_type_mismatch () from /usr/local/samba/lib/private/libtalloc.so.2
#4 0x00007fffee8b6690 in _talloc_get_type_abort () from /usr/local/samba/lib/private/libtalloc.so.2
#5 0x00007fffee5bd01c in name_resolve_bcast_recv () from /usr/local/samba/lib/private/libgse-samba4.so
#6 0x00007fffee5bd12e in name_resolve_bcast () from /usr/local/samba/lib/private/libgse-samba4.so
#7 0x00007ffff5b69cc0 in SMBC_opendir_ctx () from /usr/local/samba/lib/libsmbclient.so.0
#8 0x000055555560e1d2 in SmbclientContext::OpenDirectory (this=0x5555558c2a70, fname=0x555555750730 "smb://") at ../MPD/src/lib/smbclient/Context.hxx:99
#9 0x000055555560df5e in ReadServers (ctx=..., uri=0x555555750730 "smb://", list=empty std::forward_list) at ../MPD/src/neighbor/plugins/SmbclientNeighborPlugin.cxx:163
#10 0x000055555560dfed in DetectServers (ctx=...) at ../MPD/src/neighbor/plugins/SmbclientNeighborPlugin.cxx:177
#11 0x000055555560e474 in SmbclientNeighborExplorer::Run (this=0x5555558c2a60) at ../MPD/src/neighbor/plugins/SmbclientNeighborPlugin.cxx:201
#12 0x000055555560e8a0 in SmbclientNeighborExplorer::ThreadFunc (this=0x5555558c2a60) at ../MPD/src/neighbor/plugins/SmbclientNeighborPlugin.cxx:244
#13 0x000055555560f8ee in BindMethodDetail::BindMethodWrapperGenerator2<SmbclientNeighborExplorer, true, void (SmbclientNeighborExplorer::)() noexcept, &SmbclientNeighborExplorer::ThreadFunc, void>::Invoke(void) (_instance=0x5555558c2a60) at ../MPD/src/util/BindMethod.hxx:189
#14 0x00005555555feab2 in BoundMethod<void () noexcept>::operator()() const (this=0x5555558c2a78) at ../MPD/src/util/BindMethod.hxx:91
#15 0x00005555556092d0 in Thread::Run (this=0x5555558c2a78) at ../MPD/src/thread/Thread.cxx:63
#16 0x00005555556092b1 in Thread::ThreadProc (ctx=0x5555558c2a78) at ../MPD/src/thread/Thread.cxx:92
#17 0x00007ffff566e3e9 in start_thread () from /usr/lib/libpthread.so.0
#18 0x00007ffff354a293 in clone () from /usr/lib/libc.so.6

[avuton]

Here's a better bt after I found MPD Crashes

[New Thread 0x7fffdaffd640 (LWP 8769)]
avahi: Service group changed to state 1
avahi: Service group is REGISTERING
Freed frame ../../source3/libsmb/namequery.c:1918, expected ../../source3/libsmb/namequery.c:2656.
Freed frame ../../source3/libsmb/libsmb_file.c:54, expected ../../source3/libsmb/namequery.c:2656.
Bad talloc magic value - unknown value

Thread 6 "decoder" received signal SIGABRT, Aborted.
#0 0x00007ffff3487615 in raise () from /usr/lib/libc.so.6
#1 0x00007ffff3470862 in abort () from /usr/lib/libc.so.6
#2 0x00007fffee8b478e in talloc_abort ()
from /usr/local/samba/lib/private/libtalloc.so.2
#3 0x00007fffee8b47c4 in talloc_abort_unknown_value ()
from /usr/local/samba/lib/private/libtalloc.so.2
#4 0x00007fffee8b4842 in talloc_chunk_from_ptr ()
from /usr/local/samba/lib/private/libtalloc.so.2
#5 0x00007fffee8b4c05 in __talloc_with_prefix ()
from /usr/local/samba/lib/private/libtalloc.so.2
#6 0x00007fffee8b4e29 in __talloc ()
from /usr/local/samba/lib/private/libtalloc.so.2
#7 0x00007fffee8b51f7 in _talloc_named_const ()
from /usr/local/samba/lib/private/libtalloc.so.2
#8 0x00007fffee8b6df0 in _talloc_realloc ()
from /usr/local/samba/lib/private/libtalloc.so.2
#9 0x00007fffee8b8ae3 in _talloc_realloc_array ()
from /usr/local/samba/lib/private/libtalloc.so.2
#10 0x00007fffee5be29a in resolve_hosts ()
from /usr/local/samba/lib/private/libgse-samba4.so
#11 0x00007fffee5bf397 in internal_resolve_name ()
from /usr/local/samba/lib/private/libgse-samba4.so
#12 0x00007fffee5bfff8 in resolve_name_list ()
#13 0x00007fffee90b277 in cli_connect_sock_send () from /usr/local/samba/lib/private/liblibsmb-samba4.so
#14 0x00007fffee90b92e in cli_connect_nb_send () from /usr/local/samba/lib/private/liblibsmb-samba4.so
#15 0x00007fffee90bc17 in cli_connect_nb () from /usr/local/samba/lib/private/liblibsmb-samba4.so
#16 0x00007ffff5b749f3 in SMBC_server_internal () from /usr/local/samba/lib/libsmbclient.so.0
#17 0x00007ffff5b753dc in SMBC_server () from /usr/local/samba/lib/libsmbclient.so.0
#18 0x00007ffff5b6fa0e in SMBC_open_ctx () from /usr/local/samba/lib/libsmbclient.so.0
#19 0x00005555556320a6 in SmbclientContext::Open (this=0x7fffe95803a0, fname=0x7fffe0000eb0 "smb://anpmech.com/sound/Albums/2Pac/Me Against the World/10 It Ain't Easy.flac", flags=0,
mode=0) at ../MPD/src/lib/smbclient/Context.hxx:71
#20 0x00005555556320d2 in SmbclientContext::OpenReadOnly (this=0x7fffe95803a0, fname=0x7fffe0000eb0 "smb://anpmech.com/sound/Albums/2Pac/Me Against the World/10 It Ain't Easy.flac")
at ../MPD/src/lib/smbclient/Context.hxx:75
#21 0x0000555555631c90 in input_smbclient_open (uri=0x7fffe0000eb0 "smb://anpmech.com/sound/Albums/2Pac/Me Against the World/10 It Ain't Easy.flac", mutex=...)
at ../MPD/src/input/plugins/SmbclientInputPlugin.cxx:88
#22 0x00005555556179fb in InputStream::Open (url=0x7fffe0000eb0 "smb://anpmech.com/sound/Albums/2Pac/Me Against the World/10 It Ain't Easy.flac", mutex=...) at ../MPD/src/input/Open.cxx:43
#23 0x00005555555a07d2 in DecoderBridge::OpenUri (this=0x7fffe95806e0, uri=0x7fffe0000eb0 "smb://anpmech.com/sound/Albums/2Pac/Me Against the World/10 It Ain't Easy.flac")
at ../MPD/src/decoder/Bridge.cxx:395
#24 0x000055555559b712 in decoder_run_stream (bridge=..., uri=0x7fffe0000eb0 "smb://anpmech.com/sound/Albums/2Pac/Me Against the World/10 It Ain't Easy.flac")
at ../MPD/src/decoder/Thread.cxx:306
#25 0x000055555559bda2 in DecoderUnlockedRunUri (bridge=..., real_uri=0x7fffe0000eb0 "smb://anpmech.com/sound/Albums/2Pac/Me Against the World/10 It Ain't Easy.flac", path_fs=...)
at ../MPD/src/decoder/Thread.cxx:441
#26 0x000055555559c073 in decoder_run_song (dc=..., song=..., uri=0x7fffe0000eb0 "smb://anpmech.com/sound/Albums/2Pac/Me Against the World/10 It Ain't Easy.flac", path_fs=...)
at ../MPD/src/decoder/Thread.cxx:502
#27 0x000055555559c324 in decoder_run (dc=...) at ../MPD/src/decoder/Thread.cxx:543
#28 0x000055555559c4b6 in DecoderControl::RunThread (this=0x7fffe9d81730) at ../MPD/src/decoder/Thread.cxx:568
#29 0x000055555559f0c8 in BindMethodDetail::BindMethodWrapperGenerator2<DecoderControl, true, void (DecoderControl::)() noexcept, &DecoderControl::RunThread, void>::Invoke(void) (
_instance=0x7fffe9d81730) at ../MPD/src/util/BindMethod.hxx:189
#30 0x00005555555feab2 in BoundMethod<void () noexcept>::operator()() const (this=0x7fffe9d81738) at ../MPD/src/util/BindMethod.hxx:91
#31 0x00005555556092d0 in Thread::Run (this=0x7fffe9d81738) at ../MPD/src/thread/Thread.cxx:63
#32 0x00005555556092b1 in Thread::ThreadProc (ctx=0x7fffe9d81738) at ../MPD/src/thread/Thread.cxx:92
#33 0x00007ffff566e3e9 in start_thread () from /usr/lib/libpthread.so.0
#34 0x00007ffff354a293 in clone () from /usr/lib/libc.so.6

[MaxKellermann]

This crashes inside libsmbclient. This could be a libsmbclient bug, but it could also be a threading/locking bug. Please paste the backtrace of all threads.

[MaxKellermann]

I could reproduce it, and was able to debug it. It turns out that this is a known libsmbclient bug. https://bugzilla.samba.org/show_bug.cgi?id=11413
Turns out that it is not possible to use more than one SMBCCTX, because creating a new one frees memory referenced by the previous one, leading to use-after-free crashes.
This bug has been known for many years, and the bug report above was made in 2015, five years ago. I have no hope that it will ever be solved.
Since libsmbclient isn't even documented (and has a very badly designed API), I'm currently leaning towards removing support for it from MPD completely.

[grandchild]

Just for completeness, I wanted to mention that this plugin never crashes for me, although I almost exclusively listen to music through a local MPD that gets the file through samba from a central MPD. 🤷

[ldidry]

It seems to crash while playing music when updating the database.

I'm currently leaning towards removing support for it from MPD completely.

It would be really cool if you don’t, having the files on samba is really useful.

If it’s confirmed that the crash only occurs when doing two things concurrently (@avuton, could you try to update the database without music, then while music playing, to confirm the behavior?), you could pause the music while updating, and putting a message in the logs indicating that this is due to a smbclient bug (yeah, I know, not really a good solution).