diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index bd3b1da3cd63..e7da01804891 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -394,7 +394,7 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb,
 	tkey_ex = parms->tcfp_keys_ex;
 
 	for (i = parms->tcfp_nkeys; i > 0; i--, tkey++) {
-		int write_offset, write_len;
+		int write_offset;
 		int offset = tkey->off;
 		int hoffset = 0;
 		u32 cur_val, val;
@@ -447,23 +447,12 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb,
 			goto bad;
 		}
 
-		if (write_offset < 0) {
-			if (skb_cow(skb, -write_offset))
-				goto bad;
-			if (write_offset + (int)sizeof(*ptr) > 0) {
-				if (skb_ensure_writable(skb,
-							min_t(int, skb->len,
-							      write_offset + (int)sizeof(*ptr))))
-					goto bad;
-			}
-		} else {
-			if (check_add_overflow(write_offset, (int)sizeof(*ptr),
-					       &write_len))
-				goto bad;
-			if (skb_ensure_writable(skb, min_t(int, skb->len,
-							   write_len)))
-				goto bad;
-		}
+		if (write_offset < 0 && skb_cow(skb, -write_offset))
+			goto bad;
+
+		if ((write_offset >= 0 || write_offset + (int)sizeof(*ptr) > 0) &&
+		    skb_ensure_writable(skb, write_offset + (int)sizeof(*ptr)))
+			goto bad;
 
 		ptr = (u32 *)(skb->data + write_offset);
 		cur_val = get_unaligned(ptr);