* [PATCH net] net/sched: act_nat: Fix missing headroom COW and integer underflow in header rewriting
2026-08-18 22:15 [PATCH net] net/sched: act_skbmod: Fix headroom COW leading to page cache corruption Muhammad Bilal
@ 2026-08-18 22:15 ` Muhammad Bilal
2026-08-18 22:15 ` [PATCH net] net/sched: act_csum: " Muhammad Bilal
2026-08-19 9:43 ` [PATCH net] net/sched: act_skbmod: Fix headroom COW leading to page cache corruption Jamal Hadi Salim
2 siblings, 0 replies; 4+ messages in thread
From: Muhammad Bilal @ 2026-08-18 22:15 UTC (permalink / raw)
To: netdev
Cc: jhs, davem, edumazet, kuba, pabeni, stable, linux-kernel,
Muhammad Bilal
tcf_nat_act() accesses and rewrites IPv4, TCP, UDP, and ICMP headers
based on noff = skb_network_offset(skb).
When the network header resides in the headroom (noff < 0), two issues
occur:
1. sizeof(*iph) + noff can evaluate to a negative value or underflow
when passed to functions expecting unsigned lengths, such as
pskb_may_pull() and skb_try_make_writable().
2. skb_try_make_writable() only evaluates writability from skb->data
forwards and does not invoke skb_cow() on the headroom. When modifying
cloned SKBs (e.g. from packet sockets, tc mirred, or BPF redirects),
in-place header modification via iph->saddr / iph->daddr mutates
shared headroom data directly, leading to packet corruption and page
cache corruption.
Fix this by introducing a helper nat_ensure_writable() that validates
headroom using skb_cow(skb, -offset) when offset is negative before
ensuring writability across the modified header length.
Fixes: b4219952356b ("[PKT_SCHED]: Add stateless NAT")
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
---
net/sched/act_nat.c | 29 ++++++++++++++++++-----------
1 file changed, 18 insertions(+), 11 deletions(-)
diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index 28cb48419616..1bf5d55b3dc4 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -112,6 +112,18 @@ static struct tc_action_ops act_nat_ops;
static const struct rhashtable_params tcf_nat_ht_params;
+static int nat_ensure_writable(struct sk_buff *skb, int offset, size_t len)
+{
+ if (offset < 0) {
+ if (skb_cow(skb, -offset))
+ return -ENOMEM;
+ if (offset + (int)len > 0)
+ return skb_ensure_writable(skb, offset + len);
+ return 0;
+ }
+ return skb_ensure_writable(skb, offset + len);
+}
+
TC_INDIRECT_SCOPE int tcf_nat_act(struct sk_buff *skb,
const struct tc_action *a,
struct tcf_result *res)
@@ -142,7 +154,7 @@ TC_INDIRECT_SCOPE int tcf_nat_act(struct sk_buff *skb,
egress = parms->flags & TCA_NAT_FLAG_EGRESS;
noff = skb_network_offset(skb);
- if (!pskb_may_pull(skb, sizeof(*iph) + noff))
+ if (nat_ensure_writable(skb, noff, sizeof(*iph)))
goto drop;
iph = ip_hdr(skb);
@@ -153,9 +165,6 @@ TC_INDIRECT_SCOPE int tcf_nat_act(struct sk_buff *skb,
addr = iph->daddr;
if (!((old_addr ^ addr) & mask)) {
- if (skb_try_make_writable(skb, sizeof(*iph) + noff))
- goto drop;
-
new_addr &= mask;
new_addr |= addr & ~mask;
@@ -180,8 +189,7 @@ TC_INDIRECT_SCOPE int tcf_nat_act(struct sk_buff *skb,
{
struct tcphdr *tcph;
- if (!pskb_may_pull(skb, ihl + sizeof(*tcph) + noff) ||
- skb_try_make_writable(skb, ihl + sizeof(*tcph) + noff))
+ if (nat_ensure_writable(skb, noff, ihl + sizeof(*tcph)))
goto drop;
tcph = (void *)(skb_network_header(skb) + ihl);
@@ -193,8 +201,7 @@ TC_INDIRECT_SCOPE int tcf_nat_act(struct sk_buff *skb,
{
struct udphdr *udph;
- if (!pskb_may_pull(skb, ihl + sizeof(*udph) + noff) ||
- skb_try_make_writable(skb, ihl + sizeof(*udph) + noff))
+ if (nat_ensure_writable(skb, noff, ihl + sizeof(*udph)))
goto drop;
udph = (void *)(skb_network_header(skb) + ihl);
@@ -209,19 +216,19 @@ TC_INDIRECT_SCOPE int tcf_nat_act(struct sk_buff *skb,
{
struct icmphdr *icmph;
- if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + noff))
+ if (nat_ensure_writable(skb, noff, ihl + sizeof(*icmph)))
goto drop;
icmph = (void *)(skb_network_header(skb) + ihl);
if (!icmp_is_err(icmph->type))
break;
- if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + sizeof(*iph) +
- noff))
+ if (nat_ensure_writable(skb, noff,
+ ihl + sizeof(*icmph) + sizeof(*iph)))
goto drop;
icmph = (void *)(skb_network_header(skb) + ihl);
iph = (void *)(icmph + 1);
if (egress)
addr = iph->daddr;
else
addr = iph->saddr;
if ((old_addr ^ addr) & mask)
break;
-
- if (skb_try_make_writable(skb, ihl + sizeof(*icmph) +
- sizeof(*iph) + noff))
- goto drop;
icmph = (void *)(skb_network_header(skb) + ihl);
iph = (void *)(icmph + 1);
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH net] net/sched: act_csum: Fix missing headroom COW and integer underflow in header rewriting
2026-08-18 22:15 [PATCH net] net/sched: act_skbmod: Fix headroom COW leading to page cache corruption Muhammad Bilal
2026-08-18 22:15 ` [PATCH net] net/sched: act_nat: Fix missing headroom COW and integer underflow in header rewriting Muhammad Bilal
@ 2026-08-18 22:15 ` Muhammad Bilal
2026-08-19 9:43 ` [PATCH net] net/sched: act_skbmod: Fix headroom COW leading to page cache corruption Jamal Hadi Salim
2 siblings, 0 replies; 4+ messages in thread
From: Muhammad Bilal @ 2026-08-18 22:15 UTC (permalink / raw)
To: netdev
Cc: jhs, davem, edumazet, kuba, pabeni, stable, linux-kernel,
Muhammad Bilal
tcf_csum_skb_nextlayer() and tcf_csum_ipv4() access and rewrite IP and L4
headers based on ntkoff = skb_network_offset(skb).
When the network header resides in the headroom (ntkoff < 0):
1. hl + ntkoff or sizeof(*iph) + ntkoff can evaluate to a negative value
or underflow when passed to functions expecting unsigned lengths, such
as pskb_may_pull() and skb_try_make_writable().
2. skb_try_make_writable() only evaluates writability from skb->data
forwards and does not invoke skb_cow() on the headroom. When modifying
cloned SKBs (e.g. from packet sockets, tc mirred, or BPF redirects),
updating headers via ip_send_check() or L4 checksum replacements mutates
shared headroom data directly, leading to packet corruption and page
cache corruption.
Fix this by introducing a helper csum_ensure_writable() that validates
headroom using skb_cow(skb, -offset) when offset is negative before
ensuring writability across the modified header length.
Fixes: eb4d40654505 ("net/sched: add ACT_CSUM action to update packets checksums")
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
---
net/sched/act_csum.c | 21 ++++++++++++++++-----
1 file changed, 16 insertions(+), 5 deletions(-)
diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
index a8e2b83ebae5..cd2a6e974e6f 100644
--- a/net/sched/act_csum.c
+++ b/net/sched/act_csum.c
@@ -124,6 +124,18 @@ static int tcf_csum_init(struct net *net, struct nlattr *nla,
return err;
}
+static int csum_ensure_writable(struct sk_buff *skb, int offset, size_t len)
+{
+ if (offset < 0) {
+ if (skb_cow(skb, -offset))
+ return -ENOMEM;
+ if (offset + (int)len > 0)
+ return skb_ensure_writable(skb, offset + len);
+ return 0;
+ }
+ return skb_ensure_writable(skb, offset + len);
+}
+
/**
* tcf_csum_skb_nextlayer - Get next layer pointer
* @skb: sk_buff to use
@@ -139,8 +151,7 @@ static void *tcf_csum_skb_nextlayer(struct sk_buff *skb,
int ntkoff = skb_network_offset(skb);
int hl = ihl + jhl;
- if (!pskb_may_pull(skb, ipl + ntkoff) || (ipl < hl) ||
- skb_try_make_writable(skb, hl + ntkoff))
+ if (ipl < hl || csum_ensure_writable(skb, ntkoff, max_t(unsigned int, ipl, hl)))
return NULL;
else
return (void *)(skb_network_header(skb) + ihl);
@@ -437,8 +448,8 @@ static int tcf_csum_ipv4(struct sk_buff *skb, u32 update_flags)
}
if (update_flags & TCA_CSUM_UPDATE_FLAG_IPV4HDR) {
- if (skb_try_make_writable(skb, sizeof(*iph) + ntkoff))
+ if (csum_ensure_writable(skb, ntkoff, sizeof(*iph)))
goto fail;
ip_send_check(ip_hdr(skb));
}
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH net] net/sched: act_skbmod: Fix headroom COW leading to page cache corruption
2026-08-18 22:15 [PATCH net] net/sched: act_skbmod: Fix headroom COW leading to page cache corruption Muhammad Bilal
2026-08-18 22:15 ` [PATCH net] net/sched: act_nat: Fix missing headroom COW and integer underflow in header rewriting Muhammad Bilal
2026-08-18 22:15 ` [PATCH net] net/sched: act_csum: " Muhammad Bilal
@ 2026-08-19 9:43 ` Jamal Hadi Salim
2 siblings, 0 replies; 4+ messages in thread
From: Jamal Hadi Salim @ 2026-08-19 9:43 UTC (permalink / raw)
To: Muhammad Bilal
Cc: netdev, davem, edumazet, kuba, pabeni, stable, linux-kernel
On Tue, Aug 18, 2026 at 6:15 PM Muhammad Bilal <meatuni001@gmail.com> wrote:
>
> tcf_skbmod_act() calls skb_ensure_writable(skb, max_edit_len) to ensure
> the modified packet header is writable before rewriting Ethernet addresses
> or setting ECN bits.
>
> However, skb_ensure_writable() only pulls and COWs memory starting from
> skb->data onwards. At ingress or on forwarded packets, the Ethernet
> header (or network header) may reside in the headroom at a negative
> offset (skb_mac_offset(skb) < 0).
>
> Because skb_cow() is omitted for negative offsets, writes via
> ether_addr_copy() or INET_ECN_set_ce() modify shared headroom in-place
> on cloned SKBs (e.g., cloned by tc mirred, bpf_clone_redirect, or
> packet capture sockets). This can result in silent packet corruption
> and page cache corruption.
>
> Fix this by ensuring that if the target header starts at a negative
> offset in the headroom, skb_cow(skb, -offset) is called to unshare the
> headroom before ensuring writability across the header span.
>
1. You must provide a reproducer. We test everything. Make sure you
have the correct logs for what you reproduced.
If the reproducer is security-sensitive, send it off-list. A standard
tdc test (if possible) is the prefered option.
2. These bugs follow the same exact pattern; no need for 3 patches.
Fold them into 1. Create a helper they all use.
In case wasnt clear: You need a v2.
cheers,
jamal
> Fixes: 86da71b57383 ("net_sched: Introduce skbmod action")
> Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
> ---
> net/sched/act_skbmod.c | 37 ++++++++++++++++++++++++-------------
> 1 file changed, 24 insertions(+), 13 deletions(-)
>
> diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c
> index a8e2b83ebae5..cd2a6e974e6f 100644
> --- a/net/sched/act_skbmod.c
> +++ b/net/sched/act_skbmod.c
> @@ -22,13 +22,24 @@
>
> static struct tc_action_ops act_skbmod_ops;
>
> +static int skbmod_ensure_writable(struct sk_buff *skb, int offset, int len)
> +{
> + if (offset < 0) {
> + if (skb_cow(skb, -offset))
> + return -ENOMEM;
> + if (offset + len > 0)
> + return skb_ensure_writable(skb, offset + len);
> + return 0;
> + }
> + return skb_ensure_writable(skb, offset + len);
> +}
> +
> TC_INDIRECT_SCOPE int tcf_skbmod_act(struct sk_buff *skb,
> const struct tc_action *a,
> struct tcf_result *res)
> {
> struct tcf_skbmod *d = to_skbmod(a);
> struct tcf_skbmod_params *p;
> - int max_edit_len, err;
> u64 flags;
>
> tcf_lastuse_update(&d->tcf_tm);
> @@ -38,7 +49,6 @@ TC_INDIRECT_SCOPE int tcf_skbmod_act(struct sk_buff *skb,
> if (unlikely(p->action == TC_ACT_SHOT))
> goto drop;
>
> - max_edit_len = skb_mac_header_len(skb);
> flags = p->flags;
>
> /* tcf_skbmod_init() guarantees "flags" to be one of the following:
> @@ -52,19 +62,20 @@ TC_INDIRECT_SCOPE int tcf_skbmod_act(struct sk_buff *skb,
> switch (skb_protocol(skb, true)) {
> case cpu_to_be16(ETH_P_IP):
> case cpu_to_be16(ETH_P_IPV6):
> - max_edit_len += skb_network_header_len(skb);
> + if (skbmod_ensure_writable(skb, skb_network_offset(skb),
> + skb_network_header_len(skb)))
> + goto drop;
> break;
> default:
> goto out;
> }
> - } else if (!skb->dev || skb->dev->type != ARPHRD_ETHER) {
> - goto out;
> - }
> -
> - err = skb_ensure_writable(skb, max_edit_len);
> - if (unlikely(err)) /* best policy is to drop on the floor */
> - goto drop;
> + } else {
> + if (!skb->dev || skb->dev->type != ARPHRD_ETHER)
> + goto out;
>
> + if (skbmod_ensure_writable(skb, skb_mac_offset(skb), ETH_HLEN))
> + goto drop;
> + }
> if (flags & SKBMOD_F_DMAC)
> ether_addr_copy(eth_hdr(skb)->h_dest, p->eth_dst);
> if (flags & SKBMOD_F_SMAC)
> --
> 2.43.0
^ permalink raw reply [flat|nested] 4+ messages in thread