net/sched: fix pedit partial COW leading to page cache corruption

[ Upstream commit 899ee91156e57784090c5565e4f31bd7dbffbc5a ]

tcf_pedit_act() computes the COW range for skb_ensure_writable()
once before the key loop using tcfp_off_max_hint, but the hint does
not account for the runtime header offset added by typed keys. This
can leave part of the write region un-COW'd.

Fix by moving skb_ensure_writable() inside the per-key loop where
the actual write offset is known, and add overflow checking on the
offset arithmetic. For negative offsets (e.g. Ethernet header edits
at ingress), use skb_cow() to COW the headroom instead. Guard
offset_valid() against INT_MIN, where negation is undefined.

Fixes: 8b796475fd78 ("net/sched: act_pedit: really ensure the skb is writable")
Reported-by: Yiming Qian <yimingqian591@gmail.com>
Reported-by: Keenan Dong <keenanat2000@gmail.com>
Reported-by: Han Guidong <2045gemini@gmail.com>
Reported-by: Zhang Cen <rollkingzzc@gmail.com>
Reviewed-by: Han Guidong <2045gemini@gmail.com>
Tested-by: Han Guidong <2045gemini@gmail.com>
Reviewed-by: Davide Caratti <dcaratti@redhat.com>
Tested-by: Davide Caratti <dcaratti@redhat.com>
Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
Tested-by: Toke Høiland-Jørgensen <toke@redhat.com>
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Tested-by: Victor Nogueira <victor@mojatatu.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Rajat Gupta <rajat.gupta@oss.qualcomm.com>
Link: https://patch.msgid.link/20260531123221.48732-1-jhs@mojatatu.com
[rename include file from linux/unaligned.h to asm/unaligned.h]
Conflicts:
	include/net/tc_act/tc_pedit.h
	net/sched/act_pedit.c
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[uli: backport to 4.19]
Signed-off-by: Ulrich Hecht <uli@kernel.org>
Reviewed-by: Pavel Machek <pavel@nabladev.com>

include/net/tc_act/tc_pedit.h

@@ -14,7 +14,6 @@ struct tcf_pedit {
 	struct tc_action	common;
 	unsigned char		tcfp_nkeys;
 	unsigned char		tcfp_flags;
-	u32			tcfp_off_max_hint;
 	struct tc_pedit_key	*tcfp_keys;
 	struct tcf_pedit_key_ex	*tcfp_keys_ex;
 };

net/sched/act_pedit.c

@@ -18,6 +18,8 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/slab.h>
+#include <linux/overflow.h>
+#include <asm/unaligned.h>
 #include <net/netlink.h>
 #include <net/pkt_sched.h>
 #include <linux/tc_act/tc_pedit.h>
@@ -222,21 +224,11 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
 		p->tcfp_nkeys = parm->nkeys;
 	}
 	memcpy(p->tcfp_keys, parm->keys, ksize);
-	p->tcfp_off_max_hint = 0;
 	for (i = 0; i < p->tcfp_nkeys; ++i) {
-		u32 cur = p->tcfp_keys[i].off;
-
 		/* sanitize the shift value for any later use */
 		p->tcfp_keys[i].shift = min_t(size_t, BITS_PER_TYPE(int) - 1,
 					      p->tcfp_keys[i].shift);
 
-		/* The AT option can read a single byte, we can bound the actual
-		 * value with uchar max.
-		 */
-		cur += (0xff & p->tcfp_keys[i].offmask) >> p->tcfp_keys[i].shift;
-
-		/* Each key touches 4 bytes starting from the computed offset */
-		p->tcfp_off_max_hint = max(p->tcfp_off_max_hint, cur + 4);
 	}
 
 	p->tcfp_flags = parm->flags;
@@ -267,15 +259,12 @@ static void tcf_pedit_cleanup(struct tc_action *a)
 	kfree(p->tcfp_keys_ex);
 }
 
-static bool offset_valid(struct sk_buff *skb, int offset)
+static bool offset_valid(struct sk_buff *skb, int offset, int len)
 {
-	if (offset > 0 && offset > skb->len)
+	if (offset < -(int)skb_headroom(skb))
 		return false;
 
-	if  (offset < 0 && -offset > skb_headroom(skb))
-		return false;
-
-	return true;
+	return offset <= (int)skb->len - len;
 }
 
 static int pedit_skb_hdr_offset(struct sk_buff *skb,
@@ -315,18 +304,10 @@ static int tcf_pedit_act(struct sk_buff *skb, const struct tc_action *a,
 			 struct tcf_result *res)
 {
 	struct tcf_pedit *p = to_pedit(a);
-	u32 max_offset;
 	int i;
 
 	spin_lock(&p->tcf_lock);
 
-	max_offset = (skb_transport_header_was_set(skb) ?
-		      skb_transport_offset(skb) :
-		      skb_network_offset(skb)) +
-		     p->tcfp_off_max_hint;
-	if (skb_ensure_writable(skb, min(skb->len, max_offset)))
-		goto unlock;
-
 	tcf_lastuse_update(&p->tcf_tm);
 
 	if (p->tcfp_nkeys > 0) {
@@ -337,10 +318,11 @@ static int tcf_pedit_act(struct sk_buff *skb, const struct tc_action *a,
 		enum pedit_cmd cmd = TCA_PEDIT_KEY_EX_CMD_SET;
 
 		for (i = p->tcfp_nkeys; i > 0; i--, tkey++) {
-			u32 *ptr, hdata;
+			int write_offset, write_len;
+			u32 *ptr;
 			int offset = tkey->off;
 			int hoffset;
-			u32 val;
+			u32 cur_val, val;
 			int rc;
 
 			if (tkey_ex) {
@@ -359,13 +341,15 @@ static int tcf_pedit_act(struct sk_buff *skb, const struct tc_action *a,
 
 			if (tkey->offmask) {
 				u8 *d, _d;
+				int at_offset;
 
-				if (!offset_valid(skb, hoffset + tkey->at)) {
+				if (check_add_overflow(hoffset, (int)tkey->at, &at_offset) ||
+				    !offset_valid(skb, at_offset, sizeof(_d))) {
 					pr_info("tc action pedit 'at' offset %d out of bounds\n",
 						hoffset + tkey->at);
 					goto bad;
 				}
-				d = skb_header_pointer(skb, hoffset + tkey->at,
+				d = skb_header_pointer(skb, at_offset,
 						       sizeof(_d), &_d);
 				if (!d)
 					goto bad;
@@ -377,23 +361,44 @@ static int tcf_pedit_act(struct sk_buff *skb, const struct tc_action *a,
 				goto bad;
 			}
 
-			if (!offset_valid(skb, hoffset + offset)) {
-				pr_info("tc action pedit offset %d out of bounds\n",
-					hoffset + offset);
+			if (check_add_overflow(hoffset, offset, &write_offset)) {
+				pr_info_ratelimited("tc action pedit offset overflow\n");
 				goto bad;
 			}
 
-			ptr = skb_header_pointer(skb, hoffset + offset,
-						 sizeof(hdata), &hdata);
-			if (!ptr)
+			if (!offset_valid(skb, write_offset, sizeof(*ptr))) {
+				pr_info_ratelimited("tc action pedit offset %d out of bounds\n",
+						    write_offset);
 				goto bad;
+			}
+
+			if (write_offset < 0) {
+				if (skb_cow(skb, -write_offset))
+					goto bad;
+				if (write_offset + (int)sizeof(*ptr) > 0) {
+					if (skb_ensure_writable(skb,
+								min_t(int, skb->len,
+								      write_offset + (int)sizeof(*ptr))))
+						goto bad;
+				}
+			} else {
+				if (check_add_overflow(write_offset, (int)sizeof(*ptr),
+						       &write_len))
+					goto bad;
+				if (skb_ensure_writable(skb, min_t(int, skb->len,
+								   write_len)))
+					goto bad;
+			}
+
+			ptr = (u32 *)(skb->data + write_offset);
+			cur_val = get_unaligned(ptr);
 			/* just do it, baby */
 			switch (cmd) {
 			case TCA_PEDIT_KEY_EX_CMD_SET:
 				val = tkey->val;
 				break;
 			case TCA_PEDIT_KEY_EX_CMD_ADD:
-				val = (*ptr + tkey->val) & ~tkey->mask;
+				val = (cur_val + tkey->val) & ~tkey->mask;
 				break;
 			default:
 				pr_info("tc action pedit bad command (%d)\n",
@@ -401,9 +406,7 @@ static int tcf_pedit_act(struct sk_buff *skb, const struct tc_action *a,
 				goto bad;
 			}
 
-			*ptr = ((*ptr & tkey->mask) ^ val);
-			if (ptr == &hdata)
-				skb_store_bits(skb, hoffset + offset, ptr, 4);
+			put_unaligned((cur_val & tkey->mask) ^ val, ptr);
 		}
 
 		goto done;
@@ -415,7 +418,6 @@ bad:
 	p->tcf_qstats.overlimits++;
 done:
 	bstats_update(&p->tcf_bstats, skb);
-unlock:
 	spin_unlock(&p->tcf_lock);
 	return p->tcf_action;
 }