github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-14 16:10:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
369cecd238
linux/include/net/tc_act
History
Rajat Gupta 899ee91156 net/sched: fix pedit partial COW leading to page cache corruption 
tcf_pedit_act() computes the COW range for skb_ensure_writable()
once before the key loop using tcfp_off_max_hint, but the hint does
not account for the runtime header offset added by typed keys. This
can leave part of the write region un-COW'd.

Fix by moving skb_ensure_writable() inside the per-key loop where
the actual write offset is known, and add overflow checking on the
offset arithmetic. For negative offsets (e.g. Ethernet header edits
at ingress), use skb_cow() to COW the headroom instead. Guard
offset_valid() against INT_MIN, where negation is undefined.

Fixes: 8b796475fd ("net/sched: act_pedit: really ensure the skb is writable")
Reported-by: Yiming Qian <yimingqian591@gmail.com>
Reported-by: Keenan Dong <keenanat2000@gmail.com>
Reported-by: Han Guidong <2045gemini@gmail.com>
Reported-by: Zhang Cen <rollkingzzc@gmail.com>
Reviewed-by: Han Guidong <2045gemini@gmail.com>
Tested-by: Han Guidong <2045gemini@gmail.com>
Reviewed-by: Davide Caratti <dcaratti@redhat.com>
Tested-by: Davide Caratti <dcaratti@redhat.com>
Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
Tested-by: Toke Høiland-Jørgensen <toke@redhat.com>
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Tested-by: Victor Nogueira <victor@mojatatu.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Rajat Gupta <rajat.gupta@oss.qualcomm.com>
Link: https://patch.msgid.link/20260531123221.48732-1-jhs@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-04 08:29:02 -07:00
..
tc_bpf.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
tc_connmark.h net_sched: act_connmark: use RCU in tcf_connmark_dump() 2025-07-11 16:01:15 -07:00
tc_csum.h net_sched: act_csum: use RCU in tcf_csum_dump() 2025-07-11 16:01:16 -07:00
tc_ct.h net_sched: act_ct: use RCU in tcf_ct_dump() 2025-07-11 16:01:16 -07:00
tc_ctinfo.h net_sched: act_ctinfo: use RCU in tcf_ctinfo_dump() 2025-07-11 16:01:16 -07:00
tc_defact.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
tc_gact.h net/sched: act_gact: Add extack messages for offload failure 2022-04-08 13:45:43 +01:00
tc_gate.h net/sched: act_gate: snapshot parameters with RCU on replace 2026-02-27 16:10:36 -08:00
tc_ife.h net/sched: act_ife: Fix metalist update behavior 2026-03-05 07:54:08 -08:00
tc_mirred.h net/sched: act_mirred: Allow mirred to block 2023-12-26 21:20:09 +00:00
tc_mpls.h net_sched: act_mpls: use RCU in tcf_mpls_dump() 2025-07-11 16:01:16 -07:00
tc_nat.h net_sched: act_nat: use RCU in tcf_nat_dump() 2025-07-11 16:01:16 -07:00
tc_pedit.h net/sched: fix pedit partial COW leading to page cache corruption 2026-06-04 08:29:02 -07:00
tc_police.h net_sched: act_police: use RCU in tcf_police_dump() 2025-07-11 16:01:17 -07:00
tc_sample.h net/sched: Remove unused functions 2025-06-25 15:28:08 -07:00
tc_skbedit.h net_sched: act_skbedit: use RCU in tcf_skbedit_dump() 2025-07-11 16:01:17 -07:00
tc_skbmod.h net_sched: act_skbmod: use RCU in tcf_skbmod_dump() 2025-08-28 16:46:23 -07:00
tc_tunnel_key.h net_sched: act_tunnel_key: use RCU in tunnel_key_dump() 2025-08-28 16:46:23 -07:00
tc_vlan.h net_sched: act_vlan: use RCU in tcf_vlan_dump() 2025-08-28 16:46:23 -07:00