[PATCH net v4 1/1] net/sched: fix pedit partial COW leading to page cache corruption

[PATCH net v4 1/1] net/sched: fix pedit partial COW leading to page cache corruption

[Jamal Hadi Salim]

From: Rajat Gupta <rajat.gupta@oss.qualcomm.com>

tcf_pedit_act() computes the COW range for skb_ensure_writable()
once before the key loop using tcfp_off_max_hint, but the hint does
not account for the runtime header offset added by typed keys. This
can leave part of the write region un-COW'd.

Fix by moving skb_ensure_writable() inside the per-key loop where
the actual write offset is known, and add overflow checking on the
offset arithmetic. For negative offsets (e.g. Ethernet header edits
at ingress), use skb_cow() to COW the headroom instead. Guard
offset_valid() against INT_MIN, where negation is undefined.

Fixes: 8b796475fd78 ("net/sched: act_pedit: really ensure the skb is writable")
Reported-by: Yiming Qian <yimingqian591@gmail.com>
Reported-by: Keenan Dong <keenanat2000@gmail.com>
Reported-by: Han Guidong <2045gemini@gmail.com>
Reported-by: Zhang Cen <rollkingzzc@gmail.com>
Reviewed-by: Han Guidong <2045gemini@gmail.com>
Tested-by: Han Guidong <2045gemini@gmail.com>
Reviewed-by: Davide Caratti <dcaratti@redhat.com>
Tested-by: Davide Caratti <dcaratti@redhat.com>
Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
Tested-by: Toke Høiland-Jørgensen <toke@redhat.com>
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Tested-by: Victor Nogueira <victor@mojatatu.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Rajat Gupta <rajat.gupta@oss.qualcomm.com>
---
v3->v4
1) Restore the Fixes tag which was accidentally deleted in v3
2) Remove tcfp_off_max_hint as pointed by sashiko [1]
3) Fix a boundary condition identified by sashiko [1]
4) Add unaligned access support to safely access ptr support to compensate for
   removal of skb_header_pointer() / skb_store_bits() which handled it fine

[1]https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260527181731.1166373-1-jhs%40mojatatu.com
---
 include/net/tc_act/tc_pedit.h |  1 -
 net/sched/act_pedit.c         | 72 ++++++++++++++++++++---------------
 2 files changed, 41 insertions(+), 32 deletions(-)

diff --git a/include/net/tc_act/tc_pedit.h b/include/net/tc_act/tc_pedit.h
index f58ee15cd858..cb7b82f2cbc7 100644
--- a/include/net/tc_act/tc_pedit.h
+++ b/include/net/tc_act/tc_pedit.h
@@ -15,7 +15,6 @@ struct tcf_pedit_parms {
 	struct tc_pedit_key	*tcfp_keys;
 	struct tcf_pedit_key_ex	*tcfp_keys_ex;
 	int action;
-	u32 tcfp_off_max_hint;
 	unsigned char tcfp_nkeys;
 	unsigned char tcfp_flags;
 	struct rcu_head rcu;
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index bc20f08a2789..4e60793d184a 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -16,6 +16,8 @@
 #include <linux/ip.h>
 #include <linux/ipv6.h>
 #include <linux/slab.h>
+#include <linux/overflow.h>
+#include <linux/unaligned.h>
 #include <net/ipv6.h>
 #include <net/netlink.h>
 #include <net/pkt_sched.h>
@@ -242,7 +244,6 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
 		goto out_free_ex;
 	}
 
-	nparms->tcfp_off_max_hint = 0;
 	nparms->tcfp_flags = parm->flags;
 	nparms->tcfp_nkeys = parm->nkeys;
 
@@ -273,9 +274,6 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
 		 */
 		cur += (0xff & offmask) >> nparms->tcfp_keys[i].shift;
 
-		/* Each key touches 4 bytes starting from the computed offset */
-		nparms->tcfp_off_max_hint =
-			max(nparms->tcfp_off_max_hint, cur + 4);
 	}
 
 	p = to_pedit(*a);
@@ -318,15 +316,12 @@ static void tcf_pedit_cleanup(struct tc_action *a)
 		call_rcu(&parms->rcu, tcf_pedit_cleanup_rcu);
 }
 
-static bool offset_valid(struct sk_buff *skb, int offset)
+static bool offset_valid(struct sk_buff *skb, int offset, int len)
 {
-	if (offset > 0 && offset > skb->len)
+	if (offset < -(int)skb_headroom(skb))
 		return false;
 
-	if  (offset < 0 && -offset > skb_headroom(skb))
-		return false;
-
-	return true;
+	return offset <= (int)skb->len - len;
 }
 
 static int pedit_l4_skb_offset(struct sk_buff *skb, int *hoffset, const int header_type)
@@ -393,18 +388,10 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb,
 	struct tcf_pedit_key_ex *tkey_ex;
 	struct tcf_pedit_parms *parms;
 	struct tc_pedit_key *tkey;
-	u32 max_offset;
 	int i;
 
 	parms = rcu_dereference_bh(p->parms);
 
-	max_offset = (skb_transport_header_was_set(skb) ?
-		      skb_transport_offset(skb) :
-		      skb_network_offset(skb)) +
-		     parms->tcfp_off_max_hint;
-	if (skb_ensure_writable(skb, min(skb->len, max_offset)))
-		goto done;
-
 	tcf_lastuse_update(&p->tcf_tm);
 	tcf_action_update_bstats(&p->common, skb);
 
@@ -412,10 +399,11 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb,
 	tkey_ex = parms->tcfp_keys_ex;
 
 	for (i = parms->tcfp_nkeys; i > 0; i--, tkey++) {
+		int write_offset, write_len;
 		int offset = tkey->off;
 		int hoffset = 0;
-		u32 *ptr, hdata;
-		u32 val;
+		u32 cur_val, val;
+		u32 *ptr;
 		int rc;
 
 		if (tkey_ex) {
@@ -433,13 +421,15 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb,
 
 		if (tkey->offmask) {
 			u8 *d, _d;
+			int at_offset;
 
-			if (!offset_valid(skb, hoffset + tkey->at)) {
+			if (check_add_overflow(hoffset, tkey->at, &at_offset) ||
+			    !offset_valid(skb, at_offset, sizeof(_d))) {
 				pr_info_ratelimited("tc action pedit 'at' offset %d out of bounds\n",
 						    hoffset + tkey->at);
 				goto bad;
 			}
-			d = skb_header_pointer(skb, hoffset + tkey->at,
+			d = skb_header_pointer(skb, at_offset,
 					       sizeof(_d), &_d);
 			if (!d)
 				goto bad;
@@ -451,31 +441,51 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb,
 			}
 		}
 
-		if (!offset_valid(skb, hoffset + offset)) {
-			pr_info_ratelimited("tc action pedit offset %d out of bounds\n", hoffset + offset);
+		if (check_add_overflow(hoffset, offset, &write_offset)) {
+			pr_info_ratelimited("tc action pedit offset overflow\n");
 			goto bad;
 		}
 
-		ptr = skb_header_pointer(skb, hoffset + offset,
-					 sizeof(hdata), &hdata);
-		if (!ptr)
+		if (!offset_valid(skb, write_offset, sizeof(*ptr))) {
+			pr_info_ratelimited("tc action pedit offset %d out of bounds\n",
+					    write_offset);
 			goto bad;
+		}
+
+		if (write_offset < 0) {
+			if (skb_cow(skb, -write_offset))
+				goto bad;
+			if (write_offset + (int)sizeof(*ptr) > 0) {
+				if (skb_ensure_writable(skb,
+							min(skb->len,
+							    write_offset + (int)sizeof(*ptr))))
+					goto bad;
+			}
+		} else {
+			if (check_add_overflow(write_offset, (int)sizeof(*ptr),
+					       &write_len))
+				goto bad;
+			if (skb_ensure_writable(skb, min_t(int, skb->len,
+							   write_len)))
+				goto bad;
+		}
+
+		ptr = (u32 *)(skb->data + write_offset);
+		cur_val = get_unaligned(ptr);
 		/* just do it, baby */
 		switch (cmd) {
 		case TCA_PEDIT_KEY_EX_CMD_SET:
 			val = tkey->val;
 			break;
 		case TCA_PEDIT_KEY_EX_CMD_ADD:
-			val = (*ptr + tkey->val) & ~tkey->mask;
+			val = (cur_val + tkey->val) & ~tkey->mask;
 			break;
 		default:
 			pr_info_ratelimited("tc action pedit bad command (%d)\n", cmd);
 			goto bad;
 		}
 
-		*ptr = ((*ptr & tkey->mask) ^ val);
-		if (ptr == &hdata)
-			skb_store_bits(skb, hoffset + offset, ptr, 4);
+		put_unaligned((cur_val & tkey->mask) ^ val, ptr);
 	}
 
 	goto done;
-- 
2.34.1

Re: [PATCH net v4 1/1] net/sched: fix pedit partial COW leading to page cache corruption

[Toke Høiland-Jørgensen]

Jamal Hadi Salim <jhs@mojatatu.com> writes:

> From: Rajat Gupta <rajat.gupta@oss.qualcomm.com>
>
> tcf_pedit_act() computes the COW range for skb_ensure_writable()
> once before the key loop using tcfp_off_max_hint, but the hint does
> not account for the runtime header offset added by typed keys. This
> can leave part of the write region un-COW'd.
>
> Fix by moving skb_ensure_writable() inside the per-key loop where
> the actual write offset is known, and add overflow checking on the
> offset arithmetic. For negative offsets (e.g. Ethernet header edits
> at ingress), use skb_cow() to COW the headroom instead. Guard
> offset_valid() against INT_MIN, where negation is undefined.
>
> Fixes: 8b796475fd78 ("net/sched: act_pedit: really ensure the skb is writable")
> Reported-by: Yiming Qian <yimingqian591@gmail.com>
> Reported-by: Keenan Dong <keenanat2000@gmail.com>
> Reported-by: Han Guidong <2045gemini@gmail.com>
> Reported-by: Zhang Cen <rollkingzzc@gmail.com>
> Reviewed-by: Han Guidong <2045gemini@gmail.com>
> Tested-by: Han Guidong <2045gemini@gmail.com>
> Reviewed-by: Davide Caratti <dcaratti@redhat.com>
> Tested-by: Davide Caratti <dcaratti@redhat.com>
> Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
> Tested-by: Toke Høiland-Jørgensen <toke@redhat.com>
> Reviewed-by: Victor Nogueira <victor@mojatatu.com>
> Tested-by: Victor Nogueira <victor@mojatatu.com>
> Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
> Signed-off-by: Rajat Gupta <rajat.gupta@oss.qualcomm.com>
> ---
> v3->v4
> 1) Restore the Fixes tag which was accidentally deleted in v3
> 2) Remove tcfp_off_max_hint as pointed by sashiko [1]
> 3) Fix a boundary condition identified by sashiko [1]
> 4) Add unaligned access support to safely access ptr support to compensate for
>    removal of skb_header_pointer() / skb_store_bits() which handled it fine
>
> [1]https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260527181731.1166373-1-jhs%40mojatatu.com

Re-tested and LGTM. Let's hope this is the last one ;)

-Toke

Re: [PATCH net v4 1/1] net/sched: fix pedit partial COW leading to page cache corruption

[Jamal Hadi Salim]

On Sat, May 30, 2026 at 11:19 AM Toke Høiland-Jørgensen <toke@redhat.com> wrote:
>
> Jamal Hadi Salim <jhs@mojatatu.com> writes:
>
> > From: Rajat Gupta <rajat.gupta@oss.qualcomm.com>
> >
> > tcf_pedit_act() computes the COW range for skb_ensure_writable()
> > once before the key loop using tcfp_off_max_hint, but the hint does
> > not account for the runtime header offset added by typed keys. This
> > can leave part of the write region un-COW'd.
> >
> > Fix by moving skb_ensure_writable() inside the per-key loop where
> > the actual write offset is known, and add overflow checking on the
> > offset arithmetic. For negative offsets (e.g. Ethernet header edits
> > at ingress), use skb_cow() to COW the headroom instead. Guard
> > offset_valid() against INT_MIN, where negation is undefined.
> >
> > Fixes: 8b796475fd78 ("net/sched: act_pedit: really ensure the skb is writable")
> > Reported-by: Yiming Qian <yimingqian591@gmail.com>
> > Reported-by: Keenan Dong <keenanat2000@gmail.com>
> > Reported-by: Han Guidong <2045gemini@gmail.com>
> > Reported-by: Zhang Cen <rollkingzzc@gmail.com>
> > Reviewed-by: Han Guidong <2045gemini@gmail.com>
> > Tested-by: Han Guidong <2045gemini@gmail.com>
> > Reviewed-by: Davide Caratti <dcaratti@redhat.com>
> > Tested-by: Davide Caratti <dcaratti@redhat.com>
> > Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
> > Tested-by: Toke Høiland-Jørgensen <toke@redhat.com>
> > Reviewed-by: Victor Nogueira <victor@mojatatu.com>
> > Tested-by: Victor Nogueira <victor@mojatatu.com>
> > Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
> > Signed-off-by: Rajat Gupta <rajat.gupta@oss.qualcomm.com>
> > ---
> > v3->v4
> > 1) Restore the Fixes tag which was accidentally deleted in v3
> > 2) Remove tcfp_off_max_hint as pointed by sashiko [1]
> > 3) Fix a boundary condition identified by sashiko [1]
> > 4) Add unaligned access support to safely access ptr support to compensate for
> >    removal of skb_header_pointer() / skb_store_bits() which handled it fine
> >
> > [1]https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260527181731.1166373-1-jhs%40mojatatu.com
>
> Re-tested and LGTM. Let's hope this is the last one ;)
>

Fingers crossed ;-> Let's see what our new overlords say tomorrow morning.

cheers,
jamal

> -Toke
>

Re: [PATCH net v4 1/1] net/sched: fix pedit partial COW leading to page cache corruption

[Jamal Hadi Salim]

"

On Sat, May 30, 2026 at 12:15 PM Jamal Hadi Salim <jhs@mojatatu.com> wrote:
>
> On Sat, May 30, 2026 at 11:19 AM Toke Høiland-Jørgensen <toke@redhat.com> wrote:
> >
> > Jamal Hadi Salim <jhs@mojatatu.com> writes:
> >

[..]

> > Re-tested and LGTM. Let's hope this is the last one ;)
> >
>
> Fingers crossed ;-> Let's see what our new overlords say tomorrow morning.
>

Sigh. Now both sashikos are complaining about the min() macro.

Sashiko 1:
=========

 + if (write_offset < 0) {
 + if (skb_cow(skb, -write_offset))
 + goto bad;
 + if (write_offset + (int)sizeof(*ptr) > 0) {
 + if (skb_ensure_writable(skb,
 + min(skb->len,
 +     write_offset + (int)sizeof(*ptr))))

Could this min() macro trigger a build failure?
skb->len is an unsigned int, but write_offset + (int)sizeof(*ptr) evaluates
to a signed int.
The min() macro enforces strict type checking and usually triggers a static
assertion failure when mixing signed and unsigned variables.
--------

And Sashiko 2, on the same issue
===========================
Will this build?  In the negative-offset arm the call is
min(skb->len, write_offset + (int)sizeof(*ptr))
skb->len is unsigned int and write_offset is a runtime int local, so
the two arguments differ in signedness.  The min() macro in
include/linux/minmax.h enforces signedness compatibility:
#define __careful_cmp(op, x, y) \
__cmp_once_check(op, x, y, ...)
with
BUILD_BUG_ON_MSG(!__types_ok(ux, uy), #op "(" #x ", " #y ") signedness error")
__is_nonneg() relies on __builtin_constant_p(), which returns 0 for a
runtime int such as write_offset, so the int side ends up signed-only
while skb->len is unsigned-only and __types_ok() is 0.
The matching positive-offset arm in the same hunk already uses
skb_ensure_writable(skb, min_t(int, skb->len, write_len))
and existing call sites such as those in net/core/skbuff.c and
net/ipv4/tcp_output.c likewise use min_t(int, skb->len, ...).  Should
the negative-offset arm use min_t(int, ...) for consistency and to
avoid the signedness BUILD_BUG_ON?
------------

So i looked at why this thing compiles despite the statements above...
I could be wrong but I think the compiler optimizes away with -O2
because under that if statement  "if (write_offset + (int)sizeof(*ptr)
> 0)" IOW, the compiler already knows this is a positive outcome.

David, this is what i had asked in the earlier discussion. It dos feel
like it is safe as is,  I suppose given the compiler I am using but is
it possible that older compilers may not do this optimization? It will
also very likely fail at lower optimizations..
Shall i restore to min_t()?

cheers,
jamal





David, I am going back to min_t.

Re: [PATCH net v4 1/1] net/sched: fix pedit partial COW leading to page cache corruption

[Jamal Hadi Salim]

On Sun, May 31, 2026 at 5:58 AM Jamal Hadi Salim <jhs@mojatatu.com> wrote:
>
> "
>
> On Sat, May 30, 2026 at 12:15 PM Jamal Hadi Salim <jhs@mojatatu.com> wrote:
> >
> > On Sat, May 30, 2026 at 11:19 AM Toke Høiland-Jørgensen <toke@redhat.com> wrote:
> > >
> > > Jamal Hadi Salim <jhs@mojatatu.com> writes:
> > >
>
> [..]
>
> > > Re-tested and LGTM. Let's hope this is the last one ;)
> > >
> >
> > Fingers crossed ;-> Let's see what our new overlords say tomorrow morning.
> >
>
> Sigh. Now both sashikos are complaining about the min() macro.
>
> Sashiko 1:
> =========
>
>  + if (write_offset < 0) {
>  + if (skb_cow(skb, -write_offset))
>  + goto bad;
>  + if (write_offset + (int)sizeof(*ptr) > 0) {
>  + if (skb_ensure_writable(skb,
>  + min(skb->len,
>  +     write_offset + (int)sizeof(*ptr))))
>
> Could this min() macro trigger a build failure?
> skb->len is an unsigned int, but write_offset + (int)sizeof(*ptr) evaluates
> to a signed int.
> The min() macro enforces strict type checking and usually triggers a static
> assertion failure when mixing signed and unsigned variables.
> --------
>
> And Sashiko 2, on the same issue
> ===========================
> Will this build?  In the negative-offset arm the call is
> min(skb->len, write_offset + (int)sizeof(*ptr))
> skb->len is unsigned int and write_offset is a runtime int local, so
> the two arguments differ in signedness.  The min() macro in
> include/linux/minmax.h enforces signedness compatibility:
> #define __careful_cmp(op, x, y) \
> __cmp_once_check(op, x, y, ...)
> with
> BUILD_BUG_ON_MSG(!__types_ok(ux, uy), #op "(" #x ", " #y ") signedness error")
> __is_nonneg() relies on __builtin_constant_p(), which returns 0 for a
> runtime int such as write_offset, so the int side ends up signed-only
> while skb->len is unsigned-only and __types_ok() is 0.
> The matching positive-offset arm in the same hunk already uses
> skb_ensure_writable(skb, min_t(int, skb->len, write_len))
> and existing call sites such as those in net/core/skbuff.c and
> net/ipv4/tcp_output.c likewise use min_t(int, skb->len, ...).  Should
> the negative-offset arm use min_t(int, ...) for consistency and to
> avoid the signedness BUILD_BUG_ON?
> ------------
>
> So i looked at why this thing compiles despite the statements above...
> I could be wrong but I think the compiler optimizes away with -O2
> because under that if statement  "if (write_offset + (int)sizeof(*ptr)
> > 0)" IOW, the compiler already knows this is a positive outcome.
>
> David, this is what i had asked in the earlier discussion. It dos feel
> like it is safe as is,  I suppose given the compiler I am using but is
> it possible that older compilers may not do this optimization? It will
> also very likely fail at lower optimizations..
> Shall i restore to min_t()?

>
> David, I am going back to min_t.

That was definetely subliminal ;-> I am going to make another update.
David you can improve things after, I just want this thing to go in so
going back to min_t.

Although these changes should not affect functionality, to everyone
who tested and reviewed if you can go ahead and review/test.

cheers,
jamal