Re: [PATCH net v2 1/1] net/sched: fix pedit partial COW leading to page cache corruption

[Jamal Hadi Salim]

On Wed, May 27, 2026 at 12:48 PM Jamal Hadi Salim <jhs@xxxxxxxxxxxx> wrote:
>
> On Wed, May 27, 2026 at 12:13 PM David Laight
> <david.laight.linux@xxxxxxxxx> wrote:
> >
> > On Wed, 27 May 2026 10:56:57 -0400
> > Jamal Hadi Salim <jhs@xxxxxxxxxxxx> wrote:
> >
> > >  &&
> > >
> > > On Tue, May 26, 2026 at 3:22 PM Toke Høiland-Jørgensen <toke@xxxxxxxxxx> wrote:
> > > >
> > > > Jamal Hadi Salim <jhs@xxxxxxxxxxxx> writes:
> > > >
> > > > > From: Rajat Gupta <rajat.gupta@xxxxxxxxxxxxxxxx>
> > > > >
> > > > > tcf_pedit_act() computes the COW range for skb_ensure_writable()
> > > > > once before the key loop using tcfp_off_max_hint, but the hint does
> > > > > not account for the runtime header offset added by typed keys. This
> > > > > can leave part of the write region un-COW'd.
> > > > >
> > > > > Fix by moving skb_ensure_writable() inside the per-key loop where
> > > > > the actual write offset is known, and add overflow checking on the
> > > > > offset arithmetic. For negative offsets (e.g. Ethernet header edits
> > > > > at ingress), use skb_cow() to COW the headroom instead. Guard
> > > > > offset_valid() against INT_MIN, where negation is undefined.
> > > > >
> > > > > Additionally, linearize skbs with shared frags upfront to prevent
> > > > > silent data corruption when pedit operates on zero-copy pages
> > > > > (e.g. from sendfile).
> > > > >
> > > > > Fixes: 8b796475fd78 ("net/sched: act_pedit: really ensure the skb is writable")
> > > > > Reported-by: Yiming Qian <yimingqian591@xxxxxxxxx>
> > > > > Reported-by: Keenan Dong <keenanat2000@xxxxxxxxx>
> > > > > Reported-by: Han Guidong <2045gemini@xxxxxxxxx>
> > > > > Reported-by: Zhang Cen <rollkingzzc@xxxxxxxxx>
> > > > > Tested-by: Victor Nogueira <victor@xxxxxxxxxxxx>
> > > > > Acked-by: Jamal Hadi Salim <jhs@xxxxxxxxxxxx>
> > > > > Signed-off-by: Rajat Gupta <rajat.gupta@xxxxxxxxxxxxxxxx>
> > > >
> > > > Re-ran the tests, and everything looks good, so:
> > > >
> > > > Tested-by: Toke Høiland-Jørgensen <toke@xxxxxxxxxx>
> > > >
> > > > Also looked at the code, and I have a few nits below, but I'm really
> > > > nitpicking here, so whether you end up fixing those or not:
> > > >
> > > > Reviewed-by: Toke Høiland-Jørgensen <toke@xxxxxxxxxx>
> > > >
> > > >
> > > > [...]
> > > >
> > > > > @@ -323,7 +324,7 @@ static bool offset_valid(struct sk_buff *skb, int offset)
> > > > >       if (offset > 0 && offset > skb->len)
> > > > >               return false;
> > > > >
> > > > > -     if  (offset < 0 && -offset > skb_headroom(skb))
> > > > > +     if (offset < 0 && offset < -(int)skb_headroom(skb))
> > > > >               return false;
> > > >
> > > > This change makes it really obvious that this is really just:
> > > >
> > > >         if (offset < -(int)skb_headroom(skb))
> > > >                 return false;
> > > >
> > > > so, well, that would be clearer, IMO.
> > > >
> > > > But then I guess the same could be said of the positive case, so:
> > > >
> > > > static bool offset_valid(struct sk_buff *skb, int offset)
> > > > {
> > > >         if (offset > skb->len || offset < -(int)skb_headroom(skb))
> > > >                 return false;
> > > >
> > > >         return true;
> > > > }
> > > >
> > >
> > > Yes, that improves readability. If i understood the discussion between
> > > you and David L. something like this one liner would be reasonable?
> > >
> > > if (offset > (int)skb->len || offset < -(int)skb_headroom(skb))
> >
> > I doubt it will be measurable whatever you pick.
> >
> > Thinks, can 'we' get away with the much more readable:
> >         offset + (int)skb_headroom(skb) < 0
> > No need to worry about the '+' wrapping,
>
> By that you mean if offset was _very large_ then things will overflow
> and wrap around to a negative number?
>
> > the first test will fail.
> > Large -ve offset are going to stay negative.
> > So it does look all right.
> >
>
> To use Toke's code golfing analogy, maybe let's just stay with the
> last optimization I posted i.e " (offset > (int)skb->len || offset <
> -(int)skb_headroom(skb))"  ?
>

I sent v3. I added names for Tested-by/Reviewed-by but because i made
change, even though they are simple, please test if you can. I dont
expect anything to break and Victor reviewed and tested already.

Please no more changes. Hold your tongue if you see some missing comma
or period.

cheers,
jamal