Re: [PATCH v2 0/3] cifs: three size-management bug fixes

On 8/6/26 9:41 PM, Frank Sorenson wrote:
> These patches fix three independent bugs in cifs file size and handle
> management.

Sashiko brought up some serious concerns which I'll have to address.

Sorry for the noise.


Frank


> Patch 1 fixes a use-after-free in cifs_file_set_size(): when the
> handle-based set_file_size() call fails and falls through to the
> path-based fallback, tcon is reused from the cifsFileInfo that was
> already released by cifsFileInfo_put().  If that put drops the last
> reference on a tlink that has been removed from the tlink tree, the
> subsequent set_path_size() call is a use-after-free.
>
> Patch 2 fixes a premature i_size update in cifs_do_truncate(): when
> no cached writable handle is available, the server truncation happens
> implicitly via the O_TRUNC flag in the following cifs_open() request,
> but the current code sets i_size to 0 locally beforehand.  If the
> subsequent open fails, other processes sharing the inode observe a
> spuriously zero-sized file.
>
> Patch 3 fixes a loff_t underflow in cifs_remap_file_range() when
> len == 0 and off >= i_size.  The computed length is negative, which
> corrupts downstream arithmetic and sends a huge ByteCount in the
> FSCTL_DUPLICATE_EXTENTS_TO_FILE request.
>
> Patches 1 and 2 fix regressions introduced by commit 110fee6b9bb5
> ("smb: client: fix missing timestamp updates with O_TRUNC").
>
> v2: rebased
>
> Frank Sorenson (3):
>    cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()
>    cifs: don't update i_size in cifs_do_truncate() without a cached
>      handle
>    cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
>
>   fs/smb/client/cifsfs.c |  7 ++++++-
>   fs/smb/client/file.c   | 17 +++++++++++++----
>   fs/smb/client/inode.c  |  1 +
>   3 files changed, 20 insertions(+), 5 deletions(-)
>