Samba crashes with INTERNAL ERROR: Signal 11: Segmentation fault in pid
Problem:
On a UCS 5 Domain Controller with Samba installed, the Samba service crashes sporadically and unexpectedly with a segmentation fault error message similar to the following:
INTERNAL ERROR: Signal 11: Segmentation fault in pid 29340 (4.18.3-Univention)
The failure occurs without any prior warning and can temporarily interrupt domain-related services such as AD authentication, file or printer access, or Kerberos communication, depending on which Samba process (e.g., smbd, kdc, or winbindd) was affected at the time.
Error Information:
Below is the full excerpt from the affected system’s Samba log files:
log.smbd:
[2024/10/30 06:25:04.018338, 0, pid=29340] ../../lib/util/fault.c:177(smb_panic_log)
INTERNAL ERROR: Signal 11: Segmentation fault in pid 29340 (4.18.3-Univention)
[2024/10/30 06:25:04.018345, 0, pid=29340] ../../lib/util/fault.c:182(smb_panic_log)
If you are running a recent Samba version, and if you think this problem is not yet fixed in the latest versions, please consider reporting this bug, see https://wiki.samba.org/index.php/Bug_Reporting
[2024/10/30 06:25:04.018350, 0, pid=29340] ../../lib/util/fault.c:183(smb_panic_log)
Core dump Backtrace:
[2024/12/17 08:11:03.862946, 1, pid=31187] ../../librpc/rpc/dcerpc_util.c:380(dcerpc_pull_auth_trailer)
dcerpc_pull_auth_trailer: ../../librpc/rpc/dcerpc_util.c:380: ERROR: auth_data_only pad length mismatch. Client sent a longer BIND packet than expected by 44 bytes (pkt_trailer->length=110 - auth_length=66) =
44 auth_pad_length=0
corrupted size vs. prev_size
[2024/12/17 08:11:14.979155, 0, pid=31197] ../../lib/util/fault.c:173(smb_panic_log)
===============================================================
[2024/12/17 08:11:14.979169, 0, pid=31197] ../../lib/util/fault.c:177(smb_panic_log)
INTERNAL ERROR: Signal 6: Aborted in pid 31197 (4.18.3-Univention)
[2024/12/17 08:11:14.979173, 0, pid=31197] ../../lib/util/fault.c:182(smb_panic_log)
If you are running a recent Samba version, and if you think this problem is not yet fixed in the latest versions, please consider reporting this bug, see https://wiki.samba.org/index.php/Bug_Reporting
[2024/12/17 08:11:14.979177, 0, pid=31197] ../../lib/util/fault.c:183(smb_panic_log)
===============================================================
[2024/12/17 08:11:14.979180, 0, pid=31197] ../../lib/util/fault.c:185(smb_panic_log)
PANIC (pid 31197): Signal 6: Aborted in 4.18.3-Univention
[2024/12/17 08:11:14.985846, 0, pid=31197] ../../lib/util/fault.c:293(log_stack_trace)
BACKTRACE: 49 stack frames:
#10 /lib/x86_64-linux-gnu/libc.so.6(realloc+0x15f) [0x7f6912d94f0f]
#11 /usr/lib/x86_64-linux-gnu/libtdb.so.1(+0xc9a7) [0x7f6912b039a7]
#12 /usr/lib/x86_64-linux-gnu/libtdb.so.1(+0x631a) [0x7f6912afd31a]
#13 /usr/lib/x86_64-linux-gnu/libtdb.so.1(tdb_store+0x94) [0x7f6912afd824]
...
[2024/12/17 08:18:11.407888, 0, pid=17119] ../../source4/samba/server.c:623(binary_smbd_main)
samba version 4.18.3-Univention started.
The backtrace clearly indicates a memory allocation error (realloc) within the libtdb library, suggesting that the crash was triggered by a corrupted or oversized TDB (Trivial Database) file used internally by Samba.
Example ucr output from the affected system:
ucr search --brief samba/database/
samba/database/backend/store/size: 8Gb
samba/database/backend/store: tdb
Analysis:
The error occurs due to memory corruption during Samba operations when using the TDB backend for its internal databases. TDB is known to be less efficient and less stable under heavy load or large database sizes (e.g., greater than several gigabytes).
In this case, the Segmentation Fault (Signal 11) occurs during an internal memory reallocation (realloc) when TDB attempts to resize or rewrite parts of its data files.
The automatic restart mechanism (panicRestartSamba.sh) temporarily restores availability by restarting the samba service; however, this only serves as a workaround, not a permanent solution. The underlying data corruption in the TDB database will persist and can lead to repeated crashes.
Reference: Problem: Samba Service Crashes Frequently
Root Cause
The segmentation fault and memory corruption trace point to instability in the TDB backend of Samba when handling large internal databases.
This issue is well-documented in Samba-related bug reports and Univention’s knowledge base. With UCS 5, the preferred and stable database backend for Samba was changed from TDB to MDB (Memory-Mapped Database).
Solution
The permanent resolution is to migrate Samba from TDB to MDB database backend.
This migration resolves stability and performance issues caused by large TDB databases and prevents recurring segmentation faults in Samba processes.
The migration steps are described in the following official Univention Knowledge Base article:
Pre-update checks for UCS 5.0.0 aborts: Warning about a very large Samba TDB database
After migrating to MDB, the Samba service operates stably, and the segmentation faults no longer occur.
Summary
| Aspect | Details |
|---|---|
| Component | Samba (4.18.3-Univention) |
| Symptom | Repeated service crashes with “INTERNAL ERROR: Signal 11: Segmentation fault” |
| Cause | Memory corruption in the TDB backend |
| Temporary Fix | Automatic restart of Samba via panicRestart script |
| Permanent Fix | Migration from TDB to MDB backend |
| Related KB Article | https://help.univention.com/t/problem-samba-service-crashes-frequently/13570 |
| Long-term Resolution | https://help.univention.com/t/pre-update-checks-for-ucs-5-0-0-aborts-warning-about-a-very-large-samba-tdb-database/18014 |