[PATCH net 1/6] seg6: fix skb checksum update helpers

[Andrea Mayer]

With CHECKSUM_COMPLETE, ipv6_srh_rcv() updates skb->csum for the new
Segments Left and destination address through seg6_update_csum().
Replacing "from" with "to" in the packet must change skb->csum (C) to
C - from + to, but update_csum_diff4() and update_csum_diff16() compute:

  ~csum_partial({ ~from, to }, ~C) = ~(~C + ~from + to) = C + from - to

This does not affect packets forwarded by ip6_forward(), which sets
ip_summed to CHECKSUM_NONE. But when the packet is delivered on the same
node and skb->csum was computed in software, for instance by conntrack, UDP
can drop the packet as a checksum error. With skb->csum computed by the
device, TCP can instead log a "hw csum failure", as if the device had
computed a wrong skb->csum.

Fix update_csum_diff4() and update_csum_diff16() to compute C - from + to.

Found by manual code inspection, while checking that the skb->csum updates
in the SRv6 receive path are consistent. A following commit adds a selftest
that reproduces the problem with a tc ct action. The issue was confirmed in
a VM without kernel changes or error injection: with the rest of this
series and without this patch, that selftest fails, as UDP drops datagrams
as checksum errors. Also tested against the srv6 selftests, and with a
ConnectX-6 Lx NIC (mlx5) that provides CHECKSUM_COMPLETE.

Fixes: 1ababeba4a21 ("ipv6: implement dataplane support for rthdr type 4 (Segment Routing Header)")
Signed-off-by: Andrea Mayer <andrea.mayer@xxxxxxxxxxx>
---
 include/net/seg6.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/net/seg6.h b/include/net/seg6.h
index 82b3fbbcbb93..01d8034e48fc 100644
--- a/include/net/seg6.h
+++ b/include/net/seg6.h
@@ -19,7 +19,7 @@ static inline void update_csum_diff4(struct sk_buff *skb, __be32 from,
 {
 	__be32 diff[] = { ~from, to };
 
-	skb->csum = ~csum_partial((char *)diff, sizeof(diff), ~skb->csum);
+	skb->csum = csum_partial(diff, sizeof(diff), skb->csum);
 }
 
 static inline void update_csum_diff16(struct sk_buff *skb, __be32 *from,
@@ -30,7 +30,7 @@ static inline void update_csum_diff16(struct sk_buff *skb, __be32 *from,
 		to[0], to[1], to[2], to[3],
 	};
 
-	skb->csum = ~csum_partial((char *)diff, sizeof(diff), ~skb->csum);
+	skb->csum = csum_partial(diff, sizeof(diff), skb->csum);
 }
 
 struct seg6_pernet_data {
-- 
2.43.0