github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-21 04:10:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
899ee91156
linux/net
History
Rajat Gupta 899ee91156 net/sched: fix pedit partial COW leading to page cache corruption 
tcf_pedit_act() computes the COW range for skb_ensure_writable()
once before the key loop using tcfp_off_max_hint, but the hint does
not account for the runtime header offset added by typed keys. This
can leave part of the write region un-COW'd.

Fix by moving skb_ensure_writable() inside the per-key loop where
the actual write offset is known, and add overflow checking on the
offset arithmetic. For negative offsets (e.g. Ethernet header edits
at ingress), use skb_cow() to COW the headroom instead. Guard
offset_valid() against INT_MIN, where negation is undefined.

Fixes: 8b796475fd ("net/sched: act_pedit: really ensure the skb is writable")
Reported-by: Yiming Qian <yimingqian591@gmail.com>
Reported-by: Keenan Dong <keenanat2000@gmail.com>
Reported-by: Han Guidong <2045gemini@gmail.com>
Reported-by: Zhang Cen <rollkingzzc@gmail.com>
Reviewed-by: Han Guidong <2045gemini@gmail.com>
Tested-by: Han Guidong <2045gemini@gmail.com>
Reviewed-by: Davide Caratti <dcaratti@redhat.com>
Tested-by: Davide Caratti <dcaratti@redhat.com>
Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
Tested-by: Toke Høiland-Jørgensen <toke@redhat.com>
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Tested-by: Victor Nogueira <victor@mojatatu.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Rajat Gupta <rajat.gupta@oss.qualcomm.com>
Link: https://patch.msgid.link/20260531123221.48732-1-jhs@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-04 08:29:02 -07:00
..
6lowpan 6lowpan: fix off-by-one in multicast context address compression 2026-06-01 19:10:16 -07:00
9p 9p/trans_xen: replace simple_strto* with kstrtouint 2026-04-16 02:57:01 +00:00
802 net: garp: fix unsigned integer underflow in garp_pdu_parse_attr 2026-06-02 12:16:53 -07:00
8021q 8021q: delete cleared egress QoS mappings 2026-04-23 12:13:57 +02:00
appletalk appletalk: aarp: zero-initialize aarp_entry to prevent heap info leak 2026-06-03 18:08:58 -07:00
atm net: atm: fix skb leak in sigd_send() default branch 2026-05-12 18:07:02 -07:00
batman-adv batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface 2026-05-19 10:43:54 +02:00
bluetooth Bluetooth: MGMT: Fix backward compatibility with userspace 2026-06-03 11:24:12 -04:00
bpf bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb 2026-04-12 15:42:57 -07:00
bridge netfilter: bridge: make ebt_snat ARP rewrite writable 2026-06-01 13:43:53 +02:00
can Networking changes for 7.1. 2026-04-14 18:36:10 -07:00
ceph libceph: Fix potential null-ptr-deref in decode_choose_args() 2026-05-12 21:00:59 +02:00
core net: Annotate sk->sk_write_space() for UDP SOCKMAP. 2026-06-02 11:44:43 -07:00
dcb Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
devlink devlink: Release nested relation on devlink free 2026-06-01 19:54:52 -07:00
dns_resolver net: Add SPDX ids to some source files 2026-03-09 18:32:45 -07:00
dsa net: dsa: remove redundant netdev_lock_ops() from conduit ethtool ops 2026-04-16 19:10:48 -07:00
ethernet bonding: prevent potential infinite loop in bond_header_parse() 2026-03-16 19:29:45 -07:00
ethtool ethtool: eeprom: add more safeties to EEPROM Netlink fallback 2026-05-27 17:42:09 -07:00
handshake net/handshake: Drain pending requests at net namespace exit 2026-05-28 13:35:32 +02:00
hsr hsr: Remove WARN_ONCE() in hsr_addr_is_self(). 2026-06-02 12:04:52 -07:00
ieee802154 net: remove addr_len argument of recvmsg() handlers 2026-03-02 18:17:17 -08:00
ife
ipv4 ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options 2026-06-03 18:53:14 -07:00
ipv6 ipv6: anycast: insert aca into global hash under idev->lock 2026-06-02 19:30:39 -07:00
iucv net/iucv: fix locking in .getsockopt 2026-05-22 17:40:32 -07:00
kcm kcm: fix zero-frag skb in frag_list on partial sendmsg error 2026-02-23 17:26:55 -08:00
key xfrm: route MIGRATE notifications to caller's netns 2026-05-07 09:31:10 +02:00
l2tp l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() 2026-06-01 19:40:46 -07:00
l3mdev
lapb treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
llc llc: Return -EINPROGRESS from llc_ui_connect() 2026-04-23 11:40:39 -07:00
mac80211 wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap 2026-06-02 13:26:33 +02:00
mac802154 bonding: prevent potential infinite loop in bond_header_parse() 2026-03-16 19:29:45 -07:00
mctp net: mctp: test: Use dev_direct_xmit for TX to our test device 2026-04-30 13:36:47 -07:00
mpls Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-04-02 11:03:13 -07:00
mptcp mptcp: add-addr: always drop other suboptions 2026-06-03 19:04:27 -07:00
ncsi net: ncsi: fix skb leak in error paths 2026-03-06 17:34:48 -08:00
netfilter netfilter: nft_byteorder: remove multi-register support 2026-06-01 13:43:53 +02:00
netlabel Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
netlink net: netlink: don't set nsid on local notifications 2026-05-22 17:11:09 -07:00
nfc nfc: hci: fix out-of-bounds read in HCP header parsing 2026-05-07 12:42:09 +02:00
nsh
openvswitch openvswitch: vport: fix race between linking and the device notifier 2026-05-18 16:38:45 -07:00
packet net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() 2026-04-22 20:16:34 -07:00
phonet phonet/pep: disable BH around forwarded sk_receive_skb() 2026-05-21 07:38:21 -07:00
psample treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
psp psp: strip variable-length PSP header in psp_dev_rcv() 2026-05-04 19:25:14 -07:00
qrtr Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-04-14 12:04:00 -07:00
rds net: rds: clear i_sends on setup unwind 2026-06-02 13:31:27 -07:00
rfkill net: rfkill: prevent unlimited numbers of rfkill events from being created 2026-04-07 12:35:04 +02:00
rxrpc rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer 2026-05-20 16:36:45 -07:00
sched net/sched: fix pedit partial COW leading to page cache corruption 2026-06-04 08:29:02 -07:00
sctp sctp: diag: reject stale associations in dump_one path 2026-06-02 14:25:17 -07:00
shaper net: shaper: rework the VALID marking (again) 2026-05-20 16:34:20 -07:00
smc net/smc: Do not re-initialize smc hashtables 2026-05-22 17:38:02 -07:00
strparser net: strparser: fix skb_head leak in strp_abort_strp() 2026-04-14 12:37:00 +02:00
sunrpc nfsd-7.1 fixes: 2026-05-26 13:49:13 -07:00
switchdev bridge: No DEV_PATH_BR_VLAN_UNTAG_HW for dsa foreign 2026-03-19 13:14:00 +01:00
tipc Including fixes from Netfilter. 2026-04-23 16:50:42 -07:00
tls tls: Preserve sk_err across recvmsg() when data has been copied 2026-05-14 18:19:44 -07:00
unix af_unix: Fix inq_len update problem in partial read 2026-06-03 18:52:25 -07:00
vmw_vsock vsock/vmci: fix sk_ack_backlog leak on failed handshake 2026-06-04 13:08:02 +02:00
wireless wifi: cfg80211: enforce HE/EHT cap/oper consistency 2026-06-03 13:25:19 +02:00
x25 vfs-7.1-rc1.kino 2026-04-13 12:19:01 -07:00
xdp xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() 2026-06-03 17:45:42 -07:00
xfrm xfrm: input: hold netns during deferred transport reinjection 2026-05-26 10:35:30 +02:00
compat.c socket: Unify getsockname and getpeername implementation 2025-11-26 13:45:23 -07:00
devres.c
Kconfig net: remove ax25 and amateur radio (hamradio) subsystem 2026-04-23 10:24:02 -07:00
Kconfig.debug
Makefile net: remove ax25 and amateur radio (hamradio) subsystem 2026-04-23 10:24:02 -07:00
socket.c Networking changes for 7.1. 2026-04-14 18:36:10 -07:00
sysctl_net.c