Subject: Re: [PATCH net] net/sched: fix pedit partial COW leading to page cache corruption

From: Toke Høiland-Jørgensen <[email-masked]>
Date: Tue, 19 May 2026 13:18:58 +0200

Rajat Gupta <[email-masked]> writes:

> tcf_pedit_act() computes the COW range for skb_ensure_writable()
> once before the key loop using tcfp_off_max_hint, but the hint does
> not account for the runtime header offset added by typed keys. This
> can leave part of the write region un-COW'd.
>
> Fix by moving skb_ensure_writable() inside the per-key loop where
> the actual write offset is known, and add overflow checking on the
> offset arithmetic. For negative offsets (e.g. Ethernet header edits
> at ingress), use skb_cow() to COW the headroom instead. Guard
> offset_valid() against INT_MIN, where negation is undefined.
>
> Additionally, linearize skbs with shared frags upfront to prevent
> silent data corruption when pedit operates on zero-copy pages
> (e.g. from sendfile).
>
> Fixes: 8b796475fd78 ("net/sched: act_pedit: really ensure the skb is writable")
> Reported-by: Rajat Gupta <[email-masked]>
> Reported-by: Yiming Qian <[email-masked]>
> Reported-by: Keenan Dong <[email-masked]>
> Reported-by: Han Guidong <[email-masked]>
> Reported-by: Zhang Cen <[email-masked]>
> Tested-by: Han Guidong <[email-masked]>
> Acked-by: Jamal Hadi Salim <[email-masked]>
> Signed-off-by: Rajat Gupta <[email-masked]>

Reviewed-by: Toke Høiland-Jørgensen <[email-masked]>

Also applied this to -net and ran the TC pedit selftests and the
pedit_* scripts in net/forwarding, none of which turned up any
regressions, so:

Tested-by: Toke Høiland-Jørgensen <[email-masked]>