smbd crashes with "assert failed: dirp->fsp->dptr->dir_hnd == dirp"

Issue

• smbd crashes with "assert failed: dirp->fsp->dptr->dir_hnd == dirp"

(gdb) bt
#0  0x00007fc6bc6671f7 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007fc6bc6688e8 in __GI_abort () at abort.c:90
#2  0x00007fc6bdfed5ee in dump_core () at ../source3/lib/dumpcore.c:338
#3  0x00007fc6bdfde7f7 in smb_panic_s3 (why=<optimized out>) at ../source3/lib/util.c:814
#4  0x00007fc6c00b995f in smb_panic (why=why@entry=0x7fc6bfd8dcf0 "assert failed: dirp->fsp->dptr->dir_hnd == dirp") at ../lib/util/fault.c:166
#5  0x00007fc6bfbeb7e7 in smb_Dir_destructor (dirp=dirp@entry=0x7fc6c0ed7c60) at ../source3/smbd/dir.c:1617
#6  0x00007fc6bce120b3 in _tc_free_internal (tc=0x7fc6c0ed7c00, location=0x7fc6bfd8dbf1 "../source3/smbd/dir.c:2160") at ../talloc.c:1078
#7  0x00007fc6bfbee9b7 in can_delete_directory_fsp (fsp=fsp@entry=0x7fc6c0ed6fd0) at ../source3/smbd/dir.c:2160
#8  0x00007fc6bfc72448 in can_set_delete_on_close (fsp=fsp@entry=0x7fc6c0ed6fd0, dosmode=dosmode@entry=16) at ../source3/smbd/file_access.c:244
#9  0x00007fc6bfc255c3 in smb_set_file_disposition_info (conn=conn@entry=0x7fc6c0ebc630, pdata=<optimized out>, total_data=total_data@entry=1, fsp=fsp@entry=0x7fc6c0ed6fd0, 
    smb_fname=smb_fname@entry=0x7fc6c0ee2820) at ../source3/smbd/trans2.c:6491
#10 0x00007fc6bfc35ca2 in smbd_do_setfilepathinfo (conn=conn@entry=0x7fc6c0ebc630, req=req@entry=0x7fc6c0ee1df0, mem_ctx=<optimized out>, info_level=<optimized out>, 
    fsp=fsp@entry=0x7fc6c0ed6fd0, smb_fname=0x7fc6c0ee2820, ppdata=ppdata@entry=0x7ffc4b8ccfe8, total_data=total_data@entry=1, ret_data_size=ret_data_size@entry=0x7ffc4b8ccfdc)
    at ../source3/smbd/trans2.c:8464
#11 0x00007fc6bfc8ea80 in smbd_smb2_setinfo_send (in_additional_information=0, in_input_buffer=..., in_file_info_class=13 '\r', in_info_type=1 '\001', fsp=0x7fc6c0ed6fd0, 
    smb2req=0x7fc6c0ee2a80, ev=0x7fc6c0e960f0, mem_ctx=0x7fc6c0ee2a80) at ../source3/smbd/smb2_setinfo.c:514
#12 smbd_smb2_request_process_setinfo (req=req@entry=0x7fc6c0ee2a80) at ../source3/smbd/smb2_setinfo.c:107
#13 0x00007fc6bfc76a45 in smbd_smb2_request_dispatch (req=req@entry=0x7fc6c0ee2a80) at ../source3/smbd/smb2_server.c:2662
#14 0x00007fc6bfc78e62 in smbd_smb2_io_handler (fde_flags=<optimized out>, xconn=0x7fc6c0e9fa00) at ../source3/smbd/smb2_server.c:3872
#15 smbd_smb2_connection_handler (ev=<optimized out>, fde=<optimized out>, flags=<optimized out>, private_data=<optimized out>) at ../source3/smbd/smb2_server.c:3910
#16 0x00007fc6bc9ffedb in epoll_event_loop (tvalp=0x7ffc4b8cd180, epoll_ev=0x7fc6c0e99e60) at ../tevent_epoll.c:728
#17 epoll_event_loop_once (ev=<optimized out>, location=<optimized out>) at ../tevent_epoll.c:930
#18 0x00007fc6bc9fe2a7 in std_event_loop_once (ev=0x7fc6c0e960f0, location=0x7fc6bfdb4a28 "../source3/smbd/process.c:4125") at ../tevent_standard.c:114
#19 0x00007fc6bc9fa0cd in _tevent_loop_once (ev=ev@entry=0x7fc6c0e960f0, location=location@entry=0x7fc6bfdb4a28 "../source3/smbd/process.c:4125") at ../tevent.c:721
#20 0x00007fc6bc9fa2fb in tevent_common_loop_wait (ev=0x7fc6c0e960f0, location=0x7fc6bfdb4a28 "../source3/smbd/process.c:4125") at ../tevent.c:844
#21 0x00007fc6bc9fe247 in std_event_loop_wait (ev=0x7fc6c0e960f0, location=0x7fc6bfdb4a28 "../source3/smbd/process.c:4125") at ../tevent_standard.c:145
#22 0x00007fc6bfc66f74 in smbd_process (ev_ctx=ev_ctx@entry=0x7fc6c0e960f0, msg_ctx=msg_ctx@entry=0x7fc6c0e96520, sock_fd=sock_fd@entry=40, interactive=interactive@entry=false)
    at ../source3/smbd/process.c:4125
#23 0x00007fc6c095da74 in smbd_accept_connection (ev=0x7fc6c0e960f0, fde=<optimized out>, flags=<optimized out>, private_data=<optimized out>) at ../source3/smbd/server.c:1017
#24 0x00007fc6bc9ffedb in epoll_event_loop (tvalp=0x7ffc4b8cd410, epoll_ev=0x7fc6c0e96370) at ../tevent_epoll.c:728
#25 epoll_event_loop_once (ev=<optimized out>, location=<optimized out>) at ../tevent_epoll.c:930
#26 0x00007fc6bc9fe2a7 in std_event_loop_once (ev=0x7fc6c0e960f0, location=0x7fc6c09615d9 "../source3/smbd/server.c:1384") at ../tevent_standard.c:114
#27 0x00007fc6bc9fa0cd in _tevent_loop_once (ev=ev@entry=0x7fc6c0e960f0, location=location@entry=0x7fc6c09615d9 "../source3/smbd/server.c:1384") at ../tevent.c:721
#28 0x00007fc6bc9fa2fb in tevent_common_loop_wait (ev=0x7fc6c0e960f0, location=0x7fc6c09615d9 "../source3/smbd/server.c:1384") at ../tevent.c:844
#29 0x00007fc6bc9fe247 in std_event_loop_wait (ev=0x7fc6c0e960f0, location=0x7fc6c09615d9 "../source3/smbd/server.c:1384") at ../tevent_standard.c:145
#30 0x00007fc6c0958a95 in smbd_parent_loop (parent=<optimized out>, ev_ctx=0x7fc6c0e960f0) at ../source3/smbd/server.c:1384
#31 main (argc=<optimized out>, argv=<optimized out>) at ../source3/smbd/server.c:2038
(gdb)