[Pkg-samba-maint] Bug#556536: winbind segfaults many time per second

[Dale Schroeder]

I see this in Karolin Seeger's 3.4.4 announcement today:

    o Fix Winbind crashes when queried from nss (bug #6889).
    o Fix Winbind crash when retrieving empty group members (bug #7014).


https://bugzilla.samba.org/show_bug.cgi?id=6889
https://bugzilla.samba.org/show_bug.cgi?id=7014

As there are similarities between these bug reports and what I am 
experiencing,
I can't help but wonder if they are somehow related.

Latest panic from a "getent group" on my fully patched test machine.

[Thread debugging using libthread_db enabled]
0xb7f9b424 in __kernel_vsyscall ()
#0  0xb7f9b424 in __kernel_vsyscall ()
#1  0xb7d30193 in waitpid () from /lib/i686/cmov/libc.so.6
#2  0xb7cd08eb in ?? () from /lib/i686/cmov/libc.so.6
#3  0x0817ffed in smb_panic (why=0x850a162 "internal error") at lib/util.c:1486
#4  0x0816d93e in fault_report (sig=11) at lib/fault.c:52
#5  sig_fault (sig=11) at lib/fault.c:75
#6<signal handler called>
#7  0x0827351f in rpc_pipe_np_smb_conn (p=0x0)
     at rpc_client/rpc_transport_np.c:402
#8  0x0826b74d in rpccli_set_timeout (rpc_cli=0x0, timeout=35000)
     at rpc_client/cli_pipe.c:2955
#9  0x080df427 in winbindd_lookup_sids (mem_ctx=0xa09bca0, domain=0xa0b3700,
     num_sids=1, sids=0xa0d4178, domains=0xbf937dcc, names=0xbf937dd4,
     types=0xbf937dd0) at winbindd/winbindd_rpc.c:1221
#10 0x080e28ef in lookup_groupmem (domain=0xa0b3700, mem_ctx=0xa0d4a40,
     group_sid=0xa0d84c8, num_names=0xbf93830c, sid_mem=0xbf938300,
     names=0xbf938304, name_types=0xbf938308) at winbindd/winbindd_ads.c:1124
#11 0x080c6167 in lookup_groupmem (domain=0xa0b3700, mem_ctx=0xa0d4a40,
     group_sid=0xa0d84c8, num_names=0xbf93830c, sid_mem=0xbf938300,
     names=0xbf938304, name_types=0xbf938308) at winbindd/winbindd_cache.c:2211
#12 0x080b8a6e in expand_groups (domain=0xa0b3700,
     state=<value optimized out>, group_sid=0xbf9384b0,
     group_name_type=SID_NAME_DOM_GRP, num_gr_mem=0xbf938538,
     gr_mem=0xbf938544, gr_mem_len=0xbf938548) at winbindd/winbindd_group.c:468
#13 fill_grent_mem (domain=0xa0b3700, state=<value optimized out>,
     group_sid=0xbf9384b0, group_name_type=SID_NAME_DOM_GRP,
     num_gr_mem=0xbf938538, gr_mem=0xbf938544, gr_mem_len=0xbf938548)
     at winbindd/winbindd_group.c:604
#14 0x080ba41c in winbindd_getgrent (state=0xa0da770)
     at winbindd/winbindd_group.c:1412
#15 0x080afdd2 in process_request (private_data=0xa0da770, success=true)
     at winbindd/winbindd.c:538
#16 request_recv (private_data=0xa0da770, success=true)
     at winbindd/winbindd.c:811
#17 0x080b0d18 in rw_callback (event=0xa0da77c, flags=1)
     at winbindd/winbindd.c:621
#18 0x080b226b in process_loop (argc=1, argv=0xbf938914, envp=0xbf93891c)
     at winbindd/winbindd.c:1109
#19 main (argc=1, argv=0xbf938914, envp=0xbf93891c) at winbindd/winbindd.c:1434
A debugging session is active.

	Inferior 1 [process 7824] will be detached.

Quit anyway? (y or n) [answered Y; input not from terminal]