On Wed, May 29, 2013 at 01:19:17PM -0700, Jeremy Allison wrote: > > Let me look into the mainline Samba code here. As I recall > it should set the fsp->fh->fd to -1 after doing the vfs_closedir() > when the file handle on the directory is closed. Thus the > vfs_close should see the fsp->fh->fd as already zero and > just ignore it. Here is the code flow. Closing a directory handle ends up inside source3/smbd/close.c:close_directory() which ends up calling fd_close(). Inside source3/smbd/open.c:fd_close() we have: if (fsp->dptr) { dptr_CloseDir(fsp); } if (fsp->fh->fd == -1) { return NT_STATUS_OK; /* What we used to call a stat open. */ } dptr_CloseDir (indirectly via dptr_close_internal()) calls: TALLOC_FREE(dptr->dir_hnd); This triggers the talloc descructor on dptr->dir_hnd, smb_Dir_destructor(), which is found in source3/smbd/dir.c. Inside here we have: if (dirp->dir != NULL) { SMB_VFS_CLOSEDIR(dirp->conn,dirp->dir); if (dirp->fsp != NULL) { /* * The SMB_VFS_CLOSEDIR above * closes the underlying fd inside * dirp->fsp. */ dirp->fsp->fh->fd = -1; if (dirp->fsp->dptr != NULL) { SMB_ASSERT(dirp->fsp->dptr->dir_hnd == dirp); dirp->fsp->dptr->dir_hnd = NULL; } dirp->fsp = NULL; } } which sets dirp->fsp->fh->fd = -1. So going back to the code inside source3/smbd/open.c:fd_close() if (fsp->dptr) { dptr_CloseDir(fsp); } if (fsp->fh->fd == -1) { return NT_STATUS_OK; /* What we used to call a stat open. */ } if dptr_CloseDir() was called we should always find fsp->fh->fd == -1 and VFS_CLOSE should not be being called. If it is there's a logic bug somewhere I'd like to track down first. Can you set a breakpoint on your VFS_CLOSE and see if it's ever being called with fsp->fh->fd == -1 ? Jeremy.