[PATCH net 2/6] seg6: update skb checksum when ipv6_srh_rcv() decrements the Hop Limit

[Andrea Mayer]

When the next segment is a local address, ipv6_srh_rcv() processes it
directly and also decrements the Hop Limit. With CHECKSUM_COMPLETE,
skb->csum is not updated for this change. If the packet is then delivered
on the same node and skb->csum was computed in software, for instance by
conntrack, UDP can drop the packet as a checksum error. With skb->csum
computed by the device, TCP can instead log a "hw csum failure", as if the
device had computed a wrong skb->csum.

Update skb->csum for the Hop Limit decrement with update_csum_diff4().

Depends on patch "seg6: fix skb checksum update helpers".

Found by manual code inspection, and reproduced in a VM without kernel
changes or error injection. A following commit adds a selftest that
reproduces the problem with a tc ct action. With this patch, the selftest
passes for the path with local SRH segments. Also tested against the srv6
selftests, and with a ConnectX-6 Lx NIC (mlx5) that provides
CHECKSUM_COMPLETE.

Fixes: 1ababeba4a21 ("ipv6: implement dataplane support for rthdr type 4 (Segment Routing Header)")
Signed-off-by: Andrea Mayer <andrea.mayer@xxxxxxxxxxx>
---
 net/ipv6/exthdrs.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 96c8402a27a5..9d3ba310065a 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -460,6 +460,10 @@ static int ipv6_srh_rcv(struct sk_buff *skb, struct inet6_dev *idev)
 	}
 
 	if (skb_dst_dev(skb)->flags & IFF_LOOPBACK) {
+		/* payload_len, nexthdr and hop_limit */
+		__be32 *hlim_word = (__be32 *)ipv6_hdr(skb) + 1;
+		__be32 old;
+
 		if (ipv6_hdr(skb)->hop_limit <= 1) {
 			__IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 			icmpv6_send(skb, ICMPV6_TIME_EXCEED,
@@ -467,8 +471,12 @@ static int ipv6_srh_rcv(struct sk_buff *skb, struct inet6_dev *idev)
 			kfree_skb_reason(skb, SKB_DROP_REASON_IP_TTL_EXCEEDED);
 			return -1;
 		}
+		old = *hlim_word;
 		ipv6_hdr(skb)->hop_limit--;
 
+		if (skb->ip_summed == CHECKSUM_COMPLETE)
+			update_csum_diff4(skb, old, *hlim_word);
+
 		skb_pull(skb, skb_transport_offset(skb));
 		goto looped_back;
 	}
-- 
2.43.0