mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git
synced 2026-10-30 22:03:17 +01:00
Rajat Gupta
899ee91156
tcf_pedit_act() computes the COW range for skb_ensure_writable()
once before the key loop using tcfp_off_max_hint, but the hint does
not account for the runtime header offset added by typed keys. This
can leave part of the write region un-COW'd.
Fix by moving skb_ensure_writable() inside the per-key loop where
the actual write offset is known, and add overflow checking on the
offset arithmetic. For negative offsets (e.g. Ethernet header edits
at ingress), use skb_cow() to COW the headroom instead. Guard
offset_valid() against INT_MIN, where negation is undefined.
Fixes: 8b796475fd ("net/sched: act_pedit: really ensure the skb is writable")
Reported-by: Yiming Qian <[email protected]>
Reported-by: Keenan Dong <[email protected]>
Reported-by: Han Guidong <[email protected]>
Reported-by: Zhang Cen <[email protected]>
Reviewed-by: Han Guidong <[email protected]>
Tested-by: Han Guidong <[email protected]>
Reviewed-by: Davide Caratti <[email protected]>
Tested-by: Davide Caratti <[email protected]>
Reviewed-by: Toke Høiland-Jørgensen <[email protected]>
Tested-by: Toke Høiland-Jørgensen <[email protected]>
Reviewed-by: Victor Nogueira <[email protected]>
Tested-by: Victor Nogueira <[email protected]>
Acked-by: Jamal Hadi Salim <[email protected]>
Signed-off-by: Rajat Gupta <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>