Re: [PATCH net v2] net/iucv: take a private, writable frame before rewriting it in place

[Bryam Vargas <hexlabsecurity@proton.me>]

On Tue, 13 Oct 2026 15:05:54 +0200, Paolo Abeni wrote:
> > +	if (skb_cow_head(skb, ETH_HLEN)) {
>
> Sashiko (nipa) noted the above is the wrong helper:
>
> https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261008-b4-disp-bf46f1ba-v2-1-46ff1ea9c40b@proton.me
>
> you should use skb_ensure_writable() or skb_cow()

Agreed, and sorry for the slow answer. The rewrite is in the data, not
the headroom, and skb_cow_head() only tests skb_header_cloned(), which
leaves the data shared with a nohdr holder. No af_iucv frame has one
today (nohdr is set only on the TCP, SCTP and GRO frag_list paths), so
the two cases in the commit message still get their copy; it's still
the wrong contract for a data rewrite.

v3 uses skb_cow(skb, ETH_HLEN): skb_cloned() for the rewrite, the same
ETH_HLEN headroom for the push in afiucv_swap_src_dest(). Same s390x
QEMU A/B as v2, re-run on v3: eight boots, the tap and the
ETH_P_AF_IUCV socket read every frame as sent, and each of the two
calls is still needed.

Thanks,
Bryam

pw-bot: cr