[PATCH v2 0/3] cifs: three size-management bug fixes

[Frank Sorenson <sorenson@redhat.com>]

These patches fix three independent bugs in cifs file size and handle
management.

Patch 1 fixes a use-after-free in cifs_file_set_size(): when the
handle-based set_file_size() call fails and falls through to the
path-based fallback, tcon is reused from the cifsFileInfo that was
already released by cifsFileInfo_put().  If that put drops the last
reference on a tlink that has been removed from the tlink tree, the
subsequent set_path_size() call is a use-after-free.

Patch 2 fixes a premature i_size update in cifs_do_truncate(): when
no cached writable handle is available, the server truncation happens
implicitly via the O_TRUNC flag in the following cifs_open() request,
but the current code sets i_size to 0 locally beforehand.  If the
subsequent open fails, other processes sharing the inode observe a
spuriously zero-sized file.

Patch 3 fixes a loff_t underflow in cifs_remap_file_range() when
len == 0 and off >= i_size.  The computed length is negative, which
corrupts downstream arithmetic and sends a huge ByteCount in the
FSCTL_DUPLICATE_EXTENTS_TO_FILE request.

Patches 1 and 2 fix regressions introduced by commit 110fee6b9bb5
("smb: client: fix missing timestamp updates with O_TRUNC").

v2: rebased

Frank Sorenson (3):
  cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()
  cifs: don't update i_size in cifs_do_truncate() without a cached
    handle
  cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0

 fs/smb/client/cifsfs.c |  7 ++++++-
 fs/smb/client/file.c   | 17 +++++++++++++----
 fs/smb/client/inode.c  |  1 +
 3 files changed, 20 insertions(+), 5 deletions(-)

-- 
2.55.0