Hi,

We have occasionally reproduced the following scenario:
1. A regular client was viewing CIFS share.
2. Admin client (with full access permissions) was deleting all content of the same share via Visual Basic script.
3. Due a mistake in the script, empty path was also used as the last step of deletion.  SMBrmdir request with empty path was sent to the server and the result was *successful*.
4. The first (regular) client was not able to work with the share any more due DELETE_PENDING errors.
5. The flow returned to normal when all CIFS clients closed their connections to the share. Share itself was NOT deleted.

Step4 is problematic here: CIFS share is blocked by regular CIFS request and cannot be accessed any more.

Debugging samba code gave following flow:
- Empty path for SMBrmdir request was mapped to '.' path inside samba.
- In the step3 Delete operation is done via opening the '.' directory and setting DELETE_ON_CLOSE flag for it (see reply_rmdir function). Access was granted, directory was marked for deletion, no special sanity checks was performed for the path.
- On the directory close actual deletion was not done while there is other client holding the same directory.
-In the step4 NTCreate operations by regular client for share directory fail because the directory is marked for deletion (until it will be closed by the last client).
-In step5 when the last client closes the handle of directory '.' and sees DELETE_ON_CLOSE flag, it actually tries to delete it. He proceed VFS layers and finally enters default implementation for VFS_rmdir (vfswrap_rmdir). rmdir(".") syscall is executed, but it fails with EINVAL error:

$ man 2 rmdir |grep EINVAL
EINVAL pathname has .  as last component.
 
In such way SMBclose fails with NT_STATUS_INVALID_PARAMETER and share directory is NOT deleted; DELETE_ON_CLOSE flag is not set any more, clients can work with the share again.

This is some kind of Deny-Of-Service issue. I propose to fix it by denying deletion of the share directory ('.'). The good place for the fix is can_set_delete_on_close() function: the share directory cannot be deleted.

Thanks,
Volodymyr Khomenko.