Data loss via unsynchronized truncation and buffered writes

A race in the Linux SMB client allows local users to lose file data through concurrent buffered writes and O_TRUNC opens. In cifs_do_truncate(), the flush and server truncation run without i_rwsem or invalidate_lock, allowing newly dirtied pages to be discarded by cifs_setsize() through truncate_pagecache(). Triggering requires an SMB-mounted file with concurrent write and truncate access; the documented consequence is silent loss of buffered writes, not code execution.