[PATCH v4 0/2] cifs: two size-management bug fixes

These two patches fix independent bugs in cifs file size management.
v3 patch 1 (clear tcon after cifsFileInfo_put()) was already picked up;
this series contains the two remaining fixes.

Patch 1 fixes a premature i_size update in cifs_do_truncate(): when no
writable cached handle is available the truncation happens implicitly
via O_TRUNC in the following cifs_open() request, but the previous code
set i_size to 0 locally beforehand.  If the subsequent open fails, other
processes sharing the inode observe a spuriously zero-sized file.

Patch 2 fixes a loff_t underflow in cifs_remap_file_range() when len
== 0 and off >= i_size.  The computed length is negative, which corrupts
the downstream filemap_write_and_wait_range() range and sends a huge
ByteCount in the FSCTL_DUPLICATE_EXTENTS_TO_FILE request.

Changes from v3:
  Patch 1: Call cifs_invalidate_cache() in the if (cfile) success arm
    as well as the no-handle else branch.  The original unified if (!rc)
    block called it for both paths; the v3 refactoring accidentally
    dropped it from the cached-handle path, leaving the fscache backing
    store unstamped after a successful set_file_size().
  Patch 2: Unchanged from v3.

Frank Sorenson (2):
  cifs: don't update i_size in cifs_do_truncate() without a cached
    handle
  cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0

 fs/smb/client/cifsfs.c | 11 +++++++++--
 fs/smb/client/file.c   | 18 ++++++++++++++----
 2 files changed, 23 insertions(+), 6 deletions(-)

-- 
2.55.0