Daemon samba-bgqd unexpectedly terminates with SIGABRT.

This document (000020879) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise High Performance Computing 12 SP5

Situation

After Samba version update, severe errors from SAMBA printing subsystem are seen.

Working version:

samba-4.15.8+git.462.e73f4310487-3.68.1.x86_64.rpm

Non Working Version:

samba-4.15.8+git.473.1a1018e0a0b-3.71.2.x86_64.rpm

Versions of libgnutls installed:

libgnutls28 SUSE Linux Enterprise 12 3.3.27-3.6.1
libgnutls30 SUSE Linux Enterprise 12 3.4.17-8.11.1

When trying to view printer list in explorer, it shows up as an empy list instead of the printer list. In this log, you'll see this error:

# /var/log/samba/log.samba-bgqd:

[2022/10/21 15:56:03, 0] ../../lib/util/fault.c:176(smb_panic_log) INTERNAL ERROR: ../../lib/util/genrand.c:53:generate_random_buffer: GnuTLS could not generate a random buffer: GNUTLS_E_RANDOM_DEVICE_ERROR [-342]

Output of coredumpctl:

# /usr/bin/coredumpctl list
TIME                            PID   UID   GID SIG PRESENT EXE
Wed 2022-10-19 15:19:16 CEST  74329     0     0   6   /usr/lib64/samba/samba-bgqd
Wed 2022-10-19 15:31:46 CEST  74821     0     0   6   /usr/lib64/samba/samba-bgqd

See "Cause Section" for more details.

Resolution

This is resolved by the updated libgnutls package (version 3.4.17-8.14.1), released on Nov 28, 2022.
https://lists.suse.com/pipermail/sle-updates/2022-November/026570.html
This update for gnutls fixes the following issues:
- sysrng-linux: re-open /dev/urandom every time [bsc#1204763]
This avoids crashes of samba-bgqd, which closes all filedescriptors on startup.

If patching libgnutls is not and option or will take more time a workaround is available.
Disable the printing feature in smb.conf if printing is not in use.
These settings in the global section of smb.conf will disable printing:

[global]
# Disable Printing
        load printers = no
        printing = bsd
        printcap name = /dev/null
        disable spoolss = yes

Cause

This became an issue because Samba was updated to (4.15.8+git.473.1a1018e0a0b-3.71.2) and includes patches for CVE-2022-1615 which were added in that version on Sept 14, 2022.
https://lists.suse.com/pipermail/sle-updates/2022-September/025146.html
https://bugzilla.samba.org/show_bug.cgi?id=15103

Status

Reported to Engineering

Additional Information

The important message is "GnuTLS could not generate a random buffer". It means *predictable random* data is being generated.

From process view, the error appears in the way, that a child process from daemon samba-bgqd is terminated by SIGABRT, creating a process core.

From user view the error appears as an empty list in Windows Explorer instead of the printer list. If an update in Windows Explorer is done, this leads to the process fork of samba-bgqd.

See /var/log/samba :

[2022/10/21 15:55:13, 0] ../../lib/util/become_daemon.c:150(daemon_status)
daemon_status: daemon 'samba-bgqd' : Starting process ...
[2022/10/21 15:56:03, 0] ../../lib/util/fault.c:172(smb_panic_log)
===============================================================
[2022/10/21 15:56:03, 0] ../../lib/util/fault.c:176(smb_panic_log)
INTERNAL ERROR: ../../lib/util/genrand.c:53:generate_random_buffer: GnuTLS could not generate a random buffer: GNUTLS_E_RANDOM_DEVICE_ERROR [-342]
in pid 86143 (4.15.8-git.473.1a1018e0a0b3.71.2-SUSE-SLE_12-x86_64)
[2022/10/21 15:56:03, 0] ../../lib/util/fault.c:181(smb_panic_log)
If you are running a recent Samba version, and if you think this problem is not yet fixed in the latest versions, please consider reporting this bug,
see https://wiki.samba.org/index.php/Bug_Reporting
[2022/10/21 15:56:03, 0] ../../lib/util/fault.c:182(smb_panic_log)
===============================================================
[2022/10/21 15:56:03, 0] ../../lib/util/fault.c:184(smb_panic_log)
PANIC (pid 86143): ../../lib/util/genrand.c:53:generate_random_buffer: GnuTLS could not generate a random buffer: GNUTLS_E_RANDOM_DEVICE_ERROR [-342]
in 4.15.8-git.473.1a1018e0a0b3.71.2-SUSE-SLE_12-x86_64
[2022/10/21 15:56:03, 0] ../../lib/util/fault.c:288(log_stack_trace)




BACKTRACE: 20 stack frames:

#0 /usr/lib64/samba/libgenrand-samba4.so(log_stack_trace+0x18) [0x7f4826fae708]
#1 /usr/lib64/samba/libgenrand-samba4.so(smb_panic+0x9) [0x7f4826fae919]
#2 /usr/lib64/samba/libgenrand-samba4.so(+0x12ea) [0x7f4826fae2ea]
#3 /usr/lib64/samba/libgenrand-samba4.so(+0x1412) [0x7f4826fae412]
#4 /usr/lib64/samba/libmessages-dgm-samba4.so(messaging_dgm_init+0x32a) [0x7f4823adac4a]
#5 /usr/lib64/samba/libmessages-dgm-samba4.so(messaging_dgm_ref+0x8a) [0x7f4823adc10a]
#6 /usr/lib64/libsmbconf.so.0(messaging_reinit+0xc0) [0x7f4828350120]
#7 /usr/lib64/libsmbconf.so.0(reinit_after_fork+0xb9) [0x7f48283616f9]
#8 /usr/lib64/samba/libsmbd-base-samba4.so(cups_cache_reload+0xcd) [0x7f482768b3fd]
#9 /usr/lib64/samba/libsmbd-base-samba4.so(pcap_cache_reload+0xf0) [0x7f48276885c0]
#10 /usr/lib64/samba/libsmbd-base-samba4.so(+0x84699) [0x7f482767b699]
#11 /usr/lib64/libsmbconf.so.0(+0x52ca8) [0x7f4828359ca8]
#12 /usr/lib64/samba/libtevent.so.0(tevent_common_invoke_timer_handler+0x120) [0x7f4828ddb1b0]
#13 /usr/lib64/samba/libtevent.so.0(tevent_common_loop_timer_delay+0x49) [0x7f4828ddb339]
#14 /usr/lib64/samba/libtevent.so.0(+0xd639) [0x7f4828ddc639]
#15 /usr/lib64/samba/libtevent.so.0(+0xb737) [0x7f4828dda737]
#16 /usr/lib64/samba/libtevent.so.0(_tevent_loop_once+0x9d) [0x7f4828dd56dd]
#17 /usr/lib64/samba/samba-bgqd(main+0x7d1) [0x5596a283b011]
#18 /lib64/libc.so.6(__libc_start_main+0xf5) [0x7f48263cfad5]
#19 /usr/lib64/samba/samba-bgqd(_start+0x29) [0x5596a283b669]
[2022/10/21 15:56:03, 0] ../../source3/lib/dumpcore.c:318(dump_core)
coredump is handled by helper binary specified at /proc/sys/kernel/core_pattern

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.