Re: [PATCH net 1/6] seg6: fix skb checksum update helpers

[Hangbin Liu]

On Sat, Oct 31, 2026 at 11:50:28PM +0100, Andrea Mayer wrote:
> With CHECKSUM_COMPLETE, ipv6_srh_rcv() updates skb->csum for the new
> Segments Left and destination address through seg6_update_csum().
> Replacing "from" with "to" in the packet must change skb->csum (C) to
> C - from + to, but update_csum_diff4() and update_csum_diff16() compute:
> 
>   ~csum_partial({ ~from, to }, ~C) = ~(~C + ~from + to) = C + from - to
> 
> This does not affect packets forwarded by ip6_forward(), which sets
> ip_summed to CHECKSUM_NONE. But when the packet is delivered on the same
> node and skb->csum was computed in software, for instance by conntrack, UDP
> can drop the packet as a checksum error. With skb->csum computed by the
> device, TCP can instead log a "hw csum failure", as if the device had
> computed a wrong skb->csum.
> 
> Fix update_csum_diff4() and update_csum_diff16() to compute C - from + to.
> 
> Found by manual code inspection, while checking that the skb->csum updates
> in the SRv6 receive path are consistent. A following commit adds a selftest
> that reproduces the problem with a tc ct action. The issue was confirmed in
> a VM without kernel changes or error injection: with the rest of this
> series and without this patch, that selftest fails, as UDP drops datagrams
> as checksum errors. Also tested against the srv6 selftests, and with a
> ConnectX-6 Lx NIC (mlx5) that provides CHECKSUM_COMPLETE.
> 
> Fixes: 1ababeba4a21 ("ipv6: implement dataplane support for rthdr type 4 (Segment Routing Header)")
> Signed-off-by: Andrea Mayer <andrea.mayer@xxxxxxxxxxx>
> ---
>  include/net/seg6.h | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/include/net/seg6.h b/include/net/seg6.h
> index 82b3fbbcbb93..01d8034e48fc 100644
> --- a/include/net/seg6.h
> +++ b/include/net/seg6.h
> @@ -19,7 +19,7 @@ static inline void update_csum_diff4(struct sk_buff *skb, __be32 from,
>  {
>  	__be32 diff[] = { ~from, to };
>  
> -	skb->csum = ~csum_partial((char *)diff, sizeof(diff), ~skb->csum);
> +	skb->csum = csum_partial(diff, sizeof(diff), skb->csum);
>  }
>  
>  static inline void update_csum_diff16(struct sk_buff *skb, __be32 *from,
> @@ -30,7 +30,7 @@ static inline void update_csum_diff16(struct sk_buff *skb, __be32 *from,
>  		to[0], to[1], to[2], to[3],
>  	};
>  
> -	skb->csum = ~csum_partial((char *)diff, sizeof(diff), ~skb->csum);
> +	skb->csum = csum_partial(diff, sizeof(diff), skb->csum);
>  }
>  
>  struct seg6_pernet_data {
> -- 
> 2.43.0
> 

Reviewed-by: Hangbin Liu <liuhangbin@xxxxxxxxxx>