From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f181.google.com (mail-pg1-f181.google.com [209.85.215.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7FFFD33F8A1 for ; Tue, 18 Aug 2026 22:16:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.181 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787091369; cv=none; b=sQvfc8OxeouEKwwSWqTgCfmwK3YhORtmFiKt8vkVCKpB6s5U0gboNMdfyqu9YxFZOS5MFE6SR90VkWa5uUvFrEA1VjYm2RrDMqM7rUVODt3aQ03xwD4soPRb+lMqvf16j+ajqoDsTreE4ezV/A5+rKdP7/71goSQWyah66uR8dE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787091369; c=relaxed/simple; bh=5pCMJvmTRWodZPjIeaJ9tOdNMSzMsh3PNy0m9xaH0Nw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=UB3noJEflk2PC7SjVdJ3OO7TZQnmuuSDOP5r5yvWCg4yb4UYpOzRy0i+M3efIXcaVtqQkLrmFPcgIl2Mj719rSIyolXvtWYt9XWaiCMjbeZ+iZlBHssGAoVMFtHisewfLewqUe/T63HYnUvmjdq+k5d3L+lcodFVfd85ImLZDhE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=BEpbvnPV; arc=none smtp.client-ip=209.85.215.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="BEpbvnPV" Received: by mail-pg1-f181.google.com with SMTP id 41be03b00d2f7-c9e7391839cso289845a12.0 for ; Tue, 18 Aug 2026 15:16:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787091367; x=1787696167; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=aYpN2ZOSXMQHmxIbzvwC74/jrfpE9711u+W0ljMUVKI=; b=BEpbvnPVZNTuCSV3/15FcaoMHFwh/1kUTEjRAZ1Bx4TN4CvZAYVGuKf1l88Igke+Ky Jbiq0wh4ctHi+NA2vAbgM0j911+uUxSxJYGUxI20ye3oJB/gtY+6mXtkHWI+zrdooayl hqA3pZW3ODQruGnqGT8Zs/1wFly5hoFCu3W2DYpNidcg8FVOwqB6MEIY3KaVoxuGwFlx cU5fW/23KAWs7/WYxtCXbGNG7uZ8EGJWiRXyZWu/KVaQeRfSkBQ5xKvJmMNOu9grIlW0 CzlHa9GK8OYa21p6DJ2siU41puyiyt9Dd7SsxepFVj23axJPIu6kJYVRhocouREPQTGq bW2A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787091367; x=1787696167; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=aYpN2ZOSXMQHmxIbzvwC74/jrfpE9711u+W0ljMUVKI=; b=YjeKCQFsw/5/5hIMHGcaqDqM4eVphXN9sqgFszTMRdbplq3zs0FTKlBsl36O0dDbSF 48+2uOsZOWwlGCFJL/cuMPdHpXEn58+4QiPQ7jeMXmQBbtUyZ0NxJeFCr9IIi/y059Xi 0mb246dmjUqoCdGwvjK9cOr7B3ClJYvtm3zkcDjpvY2D9d9cEIEyAOYkNKWa/7tEq0zt BuzeQK0mHuZ9jT88gGQSdW60MHYgak3Am1Vs49EyyUBtiC3IqdI6WbtBeIT+MzIdU7BJ mU94J1f7YzTFRVPmvcim1/iVT3YLQ56yWy0sEgDBNxrPoRtlDB3xLu8nBACCY5Jmz5Ye aSiQ== X-Forwarded-Encrypted: i=1; AHgh+RqMyRZMegoRmYzTX9fZ6KaMYok6yD/wcz99xryGjz/RnDrL+CwhjPlBmcrjgZTRUAkAs5z/9keEyuY6ZGc=@vger.kernel.org X-Gm-Message-State: AOJu0Yx4v9nHFIgejRyKKa8CIWhWS6uP1VJHCz23mAsR11jdmrOZA4WF ppzWRH0ONiM7Qx7hZFpXgqmsBWAWdIedo/nKCWWb3nKvzSbWVkSqjiAvFz/gYrBrf1w2IA== X-Gm-Gg: AR+sD10GZpKLaoV6Tx+9pYdb628jVcP+OFnBmx+6uoTJZxfZKtei3o5+y3JuTR49c93 2hllncT3bR3Y9ljuu10YjsPwEE2FMwNJN0qogV7zrs2weiPP+wibDOTKTnOrH1TMiZpqXMl9bEo yMgoZT5I9RUfUJKC6KhCmwmkmya+CtTvvsRWI0HhhW5xz+SFa21d0rpDpndt3VTT7ohaVQBXrdR wYUAifM2xGVz5tTRtFEK3f4HxWwN1kPA8n/bxuvwx7Dpf6MC4xaaNeH1T5i2A/nwr5klbSSA/eC MTl9u1UzMz8x+LnAW+XkHbP/mQCuuCVgCUaD1wHLN0wjZinXYv/GDKRduPlMAZbGRkqDlSskboX DWBM38kKRGIUisG7DwthIOmdltzJwccuPrSQj0Ngc3oN3UJB6xZcCLRR1JD7j059ilJI+nDFQyf wjnX+elxWR2xGqehyc0JYc6yqxDMKtnhlNUL7PLkbYnM9AGsZ6tRSAub2I3wH4uIh9KIWjE7eYr E9LvfsBSIAo9w8WPNsmDOA3PoHwXpgpn+oZPW3IrQ== X-Received: by 2002:a05:6a20:e607:b0:3c3:89ce:b5bc with SMTP id adf61e73a8af0-3cd01213941mr682869637.15.1787091366743; Tue, 18 Aug 2026 15:16:06 -0700 (PDT) Received: from fedora ([202.47.63.86]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-327bf10d497sm223707eec.14.2026.08.18.15.15.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 18 Aug 2026 15:16:05 -0700 (PDT) From: Muhammad Bilal To: netdev@vger.kernel.org Cc: jhs@mojatatu.com, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, stable@vger.kernel.org, linux-kernel@vger.kernel.org, Muhammad Bilal Subject: [PATCH net] net/sched: act_csum: Fix missing headroom COW and integer underflow in header rewriting Date: Wed, 19 Aug 2026 03:15:19 +0500 Message-ID: <20260818221519.75088-3-meatuni001@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260818221519.75088-1-meatuni001@gmail.com> References: <20260818221519.75088-1-meatuni001@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit tcf_csum_skb_nextlayer() and tcf_csum_ipv4() access and rewrite IP and L4 headers based on ntkoff = skb_network_offset(skb). When the network header resides in the headroom (ntkoff < 0): 1. hl + ntkoff or sizeof(*iph) + ntkoff can evaluate to a negative value or underflow when passed to functions expecting unsigned lengths, such as pskb_may_pull() and skb_try_make_writable(). 2. skb_try_make_writable() only evaluates writability from skb->data forwards and does not invoke skb_cow() on the headroom. When modifying cloned SKBs (e.g. from packet sockets, tc mirred, or BPF redirects), updating headers via ip_send_check() or L4 checksum replacements mutates shared headroom data directly, leading to packet corruption and page cache corruption. Fix this by introducing a helper csum_ensure_writable() that validates headroom using skb_cow(skb, -offset) when offset is negative before ensuring writability across the modified header length. Fixes: eb4d40654505 ("net/sched: add ACT_CSUM action to update packets checksums") Signed-off-by: Muhammad Bilal --- net/sched/act_csum.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c index a8e2b83ebae5..cd2a6e974e6f 100644 --- a/net/sched/act_csum.c +++ b/net/sched/act_csum.c @@ -124,6 +124,18 @@ static int tcf_csum_init(struct net *net, struct nlattr *nla, return err; } +static int csum_ensure_writable(struct sk_buff *skb, int offset, size_t len) +{ + if (offset < 0) { + if (skb_cow(skb, -offset)) + return -ENOMEM; + if (offset + (int)len > 0) + return skb_ensure_writable(skb, offset + len); + return 0; + } + return skb_ensure_writable(skb, offset + len); +} + /** * tcf_csum_skb_nextlayer - Get next layer pointer * @skb: sk_buff to use @@ -139,8 +151,7 @@ static void *tcf_csum_skb_nextlayer(struct sk_buff *skb, int ntkoff = skb_network_offset(skb); int hl = ihl + jhl; - if (!pskb_may_pull(skb, ipl + ntkoff) || (ipl < hl) || - skb_try_make_writable(skb, hl + ntkoff)) + if (ipl < hl || csum_ensure_writable(skb, ntkoff, max_t(unsigned int, ipl, hl))) return NULL; else return (void *)(skb_network_header(skb) + ihl); @@ -437,8 +448,8 @@ static int tcf_csum_ipv4(struct sk_buff *skb, u32 update_flags) } if (update_flags & TCA_CSUM_UPDATE_FLAG_IPV4HDR) { - if (skb_try_make_writable(skb, sizeof(*iph) + ntkoff)) + if (csum_ensure_writable(skb, ntkoff, sizeof(*iph))) goto fail; ip_send_check(ip_hdr(skb)); } -- 2.43.0