Re: [PATCH net] net/sched: fix pedit partial COW leading to page cache corruption

["Toke Høiland-Jørgensen" <toke@toke.dk>]

Jamal Hadi Salim <jhs@mojatatu.com> writes:

> On Thu, May 21, 2026 at 11:51 AM Davide Caratti <dcaratti@redhat.com> wrote:
>>
>> On Thu, May 21, 2026 at 4:59 PM Jakub Kicinski <kuba@kernel.org> wrote:
>> >
>> > On Thu, 21 May 2026 06:15:17 -0400 Jamal Hadi Salim wrote:
>> > > > This is the same claim as sashiko1 but sashiko2 gave a much more
>> > > > convincing description ;->
>> > > > skb_has_shared_frag() is only true if the frags are flagged as
>> > > > SKBFL_SHARED_FRAG (which is what the repro did); however, if we get
>> > > > frags from eg a driver on ingress and that skb gets cloned with frags
>> > > > we won't catch it.
>> > > > One approach is to do an if (skb_has_any_shared_frags(skb)) and then
>> > > > do a skb_linearize_cow() but that sounds like overkill.
>> > >
>> > > Yeah, this would be overkill - imagine running tcpdump 100% will be cloned
>> > >
>> > > > Another which will make the patch even uglier (but less expensive) is
>> > > > to add an extra check insde the patch's "if (write_offset < 0)"
>> > > > to do:  if (write_offset + (int)sizeof(hdata) > 0) { skb_ensure_writable()}
>> > > >
>> > >
>> > > To be precise, something like attached (untested, uncompiled)
>>
>> hi Jamal,
>>
>> I tested Rajat's patch with your latest addition; it compiles and passes with the same subset of tests ran earlier by Toke.
>> Agree some follow-ups can be done (e.g. removing the hint, and maybe another smaller thing not yet detected by Sashiko) but AFAICT you can add my Reviewed-by: when sending v2.
>>
>
> Thanks Davide. And a Tested-by as well? I guess the same goes for
> Toke.

Applied your hunk on top Rajat's patch and re-ran the tests. So feel
free to apply my reviewed-by and tested-by to the combination on
resubmit :)

-Toke