Closed avuton closed 4 years ago
Here's a better bt after I found MPD Crashes
[New Thread 0x7fffdaffd640 (LWP 8769)] avahi: Service group changed to state 1 avahi: Service group is REGISTERING Freed frame ../../source3/libsmb/namequery.c:1918, expected ../../source3/libsmb/namequery.c:2656. Freed frame ../../source3/libsmb/libsmb_file.c:54, expected ../../source3/libsmb/namequery.c:2656. Bad talloc magic value - unknown value
Thread 6 "decoder" received signal SIGABRT, Aborted.
from /usr/local/samba/lib/private/libtalloc.so.2
from /usr/local/samba/lib/private/libtalloc.so.2
from /usr/local/samba/lib/private/libtalloc.so.2
from /usr/local/samba/lib/private/libtalloc.so.2
from /usr/local/samba/lib/private/libtalloc.so.2
from /usr/local/samba/lib/private/libtalloc.so.2
from /usr/local/samba/lib/private/libtalloc.so.2
from /usr/local/samba/lib/private/libtalloc.so.2
from /usr/local/samba/lib/private/libgse-samba4.so
from /usr/local/samba/lib/private/libgse-samba4.so
mode=0) at ../MPD/src/lib/smbclient/Context.hxx:71
at ../MPD/src/lib/smbclient/Context.hxx:75
at ../MPD/src/input/plugins/SmbclientInputPlugin.cxx:88
at ../MPD/src/decoder/Bridge.cxx:395
at ../MPD/src/decoder/Thread.cxx:306
at ../MPD/src/decoder/Thread.cxx:441
at ../MPD/src/decoder/Thread.cxx:502
_instance=0x7fffe9d81730) at ../MPD/src/util/BindMethod.hxx:189
This crashes inside libsmbclient. This could be a libsmbclient bug, but it could also be a threading/locking bug. Please paste the backtrace of all threads.
I could reproduce it, and was able to debug it. It turns out that this is a known libsmbclient bug. https://bugzilla.samba.org/show_bug.cgi?id=11413
Turns out that it is not possible to use more than one SMBCCTX
, because creating a new one frees memory referenced by the previous one, leading to use-after-free crashes.
This bug has been known for many years, and the bug report above was made in 2015, five years ago. I have no hope that it will ever be solved.
Since libsmbclient isn't even documented (and has a very badly designed API), I'm currently leaning towards removing support for it from MPD completely.
Just for completeness, I wanted to mention that this plugin never crashes for me, although I almost exclusively listen to music through a local MPD that gets the file through samba from a central MPD. :shrug:
It seems to crash while playing music when updating the database.
I'm currently leaning towards removing support for it from MPD completely.
It would be really cool if you don’t, having the files on samba is really useful.
If it’s confirmed that the crash only occurs when doing two things concurrently (@avuton, could you try to update the database without music, then while music playing, to confirm the behavior?), you could pause the music while updating, and putting a message in the logs indicating that this is due to a smbclient bug (yeah, I know, not really a good solution).
Bug report
Describe the bug
MPD crashes after a few seconds during Samba playback. Sometimes makes it through a minute long track.
This occurred with the Samba package from Arch, so I built Samba/talloc locally to get the debug symbols (there's probably an easier way I wasn't aware of).
Expected Behavior
No crash during Samba playback
Actual Behavior
MPD crashes during Samba playback
Version
Samba version 4.13.0
Music Player Daemon 0.23~git (v0.22.1-67-gad585e179) Copyright 2003-2007 Warren Dukes warren.dukes@gmail.com Copyright 2008-2018 Max Kellermann max.kellermann@gmail.com This is free software; see the source for copying conditions. There is NO warranty; not even MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Database plugins: simple proxy
Storage plugins: local smbclient udisks nfs curl
Neighbor plugins: smbclient udisks
Decoders plugins: [mad] mp3 mp2 [mpg123] mp3 [vorbis] ogg oga [oggflac] ogg oga [flac] flac [opus] opus ogg oga [sndfile] wav aiff aif au snd paf iff svx sf voc w64 pvf xi htk caf sd2 [dsdiff] dff [dsf] dsf [hybrid_dsd] m4a [faad] aac [mpcdec] mpc [wavpack] wv [modplug] 669 amf ams dbm dfm dsm far it med mdl mod mtm mt2 okt s3m stm ult umx xm [sidplay] sid mus str prg P00 [wildmidi] mid [ffmpeg] 16sv 3g2 3gp 4xm 8svx aa3 aac ac3 adx afc aif aifc aiff al alaw amr anim apc ape asf atrac au aud avi avm2 avs bap bfi c93 cak cin cmv cpk daud dct divx dts dv dvd dxa eac3 film flac flc fli fll flx flv g726 gsm gxf iss m1v m2v m2t m2ts m4a m4b m4v mad mj2 mjpeg mjpg mka mkv mlp mm mmf mov mp+ mp1 mp2 mp3 mp4 mpc mpeg mpg mpga mpp mpu mve mvi mxf nc nsv nut nuv oga ogm ogv ogx oma ogg omg opus psp pva qcp qt r3d ra ram rl2 rm rmvb roq rpl rvc shn smk snd sol son spx str swf tak tgi tgq tgv thp ts tsp tta xa xvid uv uv2 vb vid vob voc vp6 vmd wav webm wma wmv wsaud wsvga wv wve rtp:// rtsp:// rtsps:// [gme] ay gbs gym hes kss nsf nsfe sap spc vgm vgz [pcm]
Filters: libsamplerate soxr
Tag plugins: id3tag
Output plugins: shout null fifo pipe alsa openal pulse jack httpd recorder
Encoder plugins: null vorbis opus lame wave flac
Archive plugins: [bz2] bz2 [zzip] zip [iso] iso
Input plugins: file archive alsa tidal qobuz curl ffmpeg smbclient nfs mms cdio_paranoia
Playlist plugins: extm3u m3u pls xspf asx rss soundcloud flac cue embcue
Protocols: file:// alsa:// cdda:// ftp:// ftps:// gopher:// hls+http:// hls+https:// http:// https:// mms:// mmsh:// mmst:// mmsu:// nfs:// qobuz:// rtmp:// rtmpe:// rtmps:// rtmpt:// rtmpte:// rtmpts:// rtp:// rtsp:// rtsps:// scp:// sftp:// smb:// srtp:// tidal://
Other features: avahi dbus udisks epoll icu inotify ipv6 systemd tcp un
git bisect
2fc4802886e81a8cecdb6697d79b54852c7ec6b3 is the first bad commit commit 2fc4802886e81a8cecdb6697d79b54852c7ec6b3 Author: Max Kellermann max@musicpd.org Date: Mon Jul 20 22:32:27 2020 +0200
src/neighbor/plugins/SmbclientNeighborPlugin.cxx | 2 -- 1 file changed, 2 deletions(-)
Log
client: [0] process command "idle player message" client: [0] command returned 1 Freed frame ../../source3/libsmb/clireadwrite.c:667, expected ../../source3/libsmb/namequery.c:1918. Freed frame ../../source3/libsmb/libsmb_dir.c:482, expected ../../source3/libsmb/namequery.c:1918. client: [1] process command "status" client: [1] command returned 0 client: [1] process command "idle" client: [1] command returned 1 ../../source3/libsmb/namequery.c:1900: Type mismatch: name[NULL] expected[struct name_resolve_bcast_state]
Thread 4 "smbclient" received signal SIGABRT, Aborted. [Switching to Thread 0x7fffea5e5640 (LWP 76414)] 0x00007ffff3487615 in raise () from /usr/lib/libc.so.6 (gdb) bt
0 0x00007ffff3487615 in raise () from /usr/lib/libc.so.6
1 0x00007ffff3470862 in abort () from /usr/lib/libc.so.6
2 0x00007fffee8b478e in talloc_abort () from /usr/local/samba/lib/private/libtalloc.so.2
3 0x00007fffee8b6654 in talloc_abort_type_mismatch () from /usr/local/samba/lib/private/libtalloc.so.2
4 0x00007fffee8b6690 in _talloc_get_type_abort () from /usr/local/samba/lib/private/libtalloc.so.2
5 0x00007fffee5bd01c in name_resolve_bcast_recv () from /usr/local/samba/lib/private/libgse-samba4.so
6 0x00007fffee5bd12e in name_resolve_bcast () from /usr/local/samba/lib/private/libgse-samba4.so
7 0x00007ffff5b69cc0 in SMBC_opendir_ctx () from /usr/local/samba/lib/libsmbclient.so.0
8 0x000055555560e1d2 in SmbclientContext::OpenDirectory (this=0x5555558c2a70, fname=0x555555750730 "smb://") at ../MPD/src/lib/smbclient/Context.hxx:99
9 0x000055555560df5e in ReadServers (ctx=..., uri=0x555555750730 "smb://", list=empty std::forward_list) at ../MPD/src/neighbor/plugins/SmbclientNeighborPlugin.cxx:163
10 0x000055555560dfed in DetectServers (ctx=...) at ../MPD/src/neighbor/plugins/SmbclientNeighborPlugin.cxx:177
11 0x000055555560e474 in SmbclientNeighborExplorer::Run (this=0x5555558c2a60) at ../MPD/src/neighbor/plugins/SmbclientNeighborPlugin.cxx:201
12 0x000055555560e8a0 in SmbclientNeighborExplorer::ThreadFunc (this=0x5555558c2a60) at ../MPD/src/neighbor/plugins/SmbclientNeighborPlugin.cxx:244
13 0x000055555560f8ee in BindMethodDetail::BindMethodWrapperGenerator2<SmbclientNeighborExplorer, true, void (SmbclientNeighborExplorer::)() noexcept, &SmbclientNeighborExplorer::ThreadFunc, void>::Invoke(void) (_instance=0x5555558c2a60) at ../MPD/src/util/BindMethod.hxx:189
14 0x00005555555feab2 in BoundMethod<void () noexcept>::operator()() const (this=0x5555558c2a78) at ../MPD/src/util/BindMethod.hxx:91
15 0x00005555556092d0 in Thread::Run (this=0x5555558c2a78) at ../MPD/src/thread/Thread.cxx:63
16 0x00005555556092b1 in Thread::ThreadProc (ctx=0x5555558c2a78) at ../MPD/src/thread/Thread.cxx:92
17 0x00007ffff566e3e9 in start_thread () from /usr/lib/libpthread.so.0
18 0x00007ffff354a293 in clone () from /usr/lib/libc.so.6