smbd hits an assertion and disconnects the client when a snapshot (Previous
Version) is accessed on a share whose "path = /" (mounted at the CephFS file
system root).

ceph_snap_gmt_convert_dir() builds the absolute .snap directory path by joining
the share's connectpath, the request-relative name and the snapshot subdir with
'/' separators. When the connectpath is a bare "/" (root-mounted share), or the
request-relative name is itself absolute / contains '/' runs (e.g. when
accessing a file inside a snapshot), the join produces a path with a run of
consecutive '/', e.g. "//foo/.snap".

This path is handed to OpenDir() -> fd_openat() -> filename_convert_dirfsp_rel(),
which splits on '/', and openat_pathref_fsp_nosymlink() asserts that no
component is empty:

    SMB_ASSERT(rel_fname.base_name[0] != '\0')   source3/smbd/files.c:1212

The empty component from the '//' run trips the assert and panics smbd.

Whether the malformed path reaches the assert also depends on the Ceph client
accepting the non-canonical "//" path in the preceding stat(), so
reproducibility is libcephfs-version dependent (reproduced with Ceph v20.2.1 /
libcephfs).

Reproducer
----------

smb.conf:

    [share]
        path = /
        vfs objects = ceph_snapshots ceph_new
        ceph_new:config_file = /etc/ceph/ceph.conf
        ceph_new:user_id = admin
        read only = no

Create a snapshot from a kernel mount at the CephFS root:

    touch testfile
    mkdir .snap/testsnapshot

Then via smbclient, enumerating previous versions of the file (or
"allinfo testfile") disconnects with NT_STATUS_CONNECTION_DISCONNECTED, and the
smbd log shows the SMB_ASSERT panic. With "log level = 10" the malformed path is
visible, e.g.:

    ceph_snap_gmt_convert_dir: enumerating shadow copy dir at //foo/.snap

The same happens for files within a subdirectory of a snapshot.