Ceph

Samba submits names like .//some-file.txt.

Libceph in path_walk fails to notice the empty component and calls _lookup with an empty string:

int r = _lookup(cur, dname.c_str(), &next);
    if (r < 0)
      return r;

This causes the mds to crash with the following traceback:

ceph version 0.24.2-2779-g0bf1dc3 (0bf1dc33a3b40629312582e9d362d9c8abc74ba1)
1: /usr/bin/cmds() [0x6ff474]
2: (()+0xf4c0) [0x7fade4fd54c0]
3: (Server::handle_client_stat(MDRequest*)+0x4b5) [0x4fb485]
4: (Server::dispatch_client_request(MDRequest*)+0x3ae) [0x51976e]
5: (Server::handle_client_request(MClientRequest*)+0x621) [0x51d0c1]
6: (Server::dispatch(Message*)+0x3ab) [0x51d7db]
7: (MDS::handle_deferrable_message(Message*)+0xadf) [0x49b70f]
8: (MDS::_dispatch(Message*)+0x1a19) [0x4aeb09]
9: (MDS::_dispatch(Message*)+0x4ee) [0x4ad5de]
10: (MDS::ms_dispatch(Message*)+0x73) [0x4af143]
11: (SimpleMessenger::dispatch_entry()+0x859) [0x6ba8c9]
12: (SimpleMessenger::DispatchThread::entry()+0x1c) [0x48d4ec]
13: (()+0x77e1) [0x7fade4fcd7e1]
14: (clone()+0x6d) [0x7fade3e5a53d]

While the mds should not crash, path_walk should really do something like this:

diff --git a/src/client/Client.cc b/src/client/Client.cc
index 3aa5f0b..20d0fa2 100644
--- a/src/client/Client.cc
+++ b/src/client/Client.cc
@ -3396,6 +3396,9 @ int Client::path_walk(const filepath& origpath, Inode **fi
const string &dname = path[i];

Attached is a log from the mds
ldout(cct, 10) << " " << i << " " << *cur << " " << dname << dendl;
Inode *next;
+ // Protect against // in the path
+ if (!dname.size())
+ continue;
int r = _lookup(cur, dname.c_str(), &next);
if (r < 0)
return r;