Re: [PATCH net 2/6] seg6: update skb checksum when ipv6_srh_rcv() decrements the Hop Limit

[Hangbin Liu]

On Sat, Oct 31, 2026 at 11:50:29PM +0100, Andrea Mayer wrote:
> When the next segment is a local address, ipv6_srh_rcv() processes it
> directly and also decrements the Hop Limit. With CHECKSUM_COMPLETE,
> skb->csum is not updated for this change. If the packet is then delivered
> on the same node and skb->csum was computed in software, for instance by
> conntrack, UDP can drop the packet as a checksum error. With skb->csum
> computed by the device, TCP can instead log a "hw csum failure", as if the
> device had computed a wrong skb->csum.
> 
> Update skb->csum for the Hop Limit decrement with update_csum_diff4().
> 
> Depends on patch "seg6: fix skb checksum update helpers".
> 
> Found by manual code inspection, and reproduced in a VM without kernel
> changes or error injection. A following commit adds a selftest that
> reproduces the problem with a tc ct action. With this patch, the selftest
> passes for the path with local SRH segments. Also tested against the srv6
> selftests, and with a ConnectX-6 Lx NIC (mlx5) that provides
> CHECKSUM_COMPLETE.
> 
> Fixes: 1ababeba4a21 ("ipv6: implement dataplane support for rthdr type 4 (Segment Routing Header)")
> Signed-off-by: Andrea Mayer <andrea.mayer@xxxxxxxxxxx>
> ---
>  net/ipv6/exthdrs.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
> index 96c8402a27a5..9d3ba310065a 100644
> --- a/net/ipv6/exthdrs.c
> +++ b/net/ipv6/exthdrs.c
> @@ -460,6 +460,10 @@ static int ipv6_srh_rcv(struct sk_buff *skb, struct inet6_dev *idev)
>  	}
>  
>  	if (skb_dst_dev(skb)->flags & IFF_LOOPBACK) {
> +		/* payload_len, nexthdr and hop_limit */
> +		__be32 *hlim_word = (__be32 *)ipv6_hdr(skb) + 1;
> +		__be32 old;
> +
>  		if (ipv6_hdr(skb)->hop_limit <= 1) {
>  			__IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
>  			icmpv6_send(skb, ICMPV6_TIME_EXCEED,
> @@ -467,8 +471,12 @@ static int ipv6_srh_rcv(struct sk_buff *skb, struct inet6_dev *idev)
>  			kfree_skb_reason(skb, SKB_DROP_REASON_IP_TTL_EXCEEDED);
>  			return -1;
>  		}
> +		old = *hlim_word;
>  		ipv6_hdr(skb)->hop_limit--;
>  
> +		if (skb->ip_summed == CHECKSUM_COMPLETE)
> +			update_csum_diff4(skb, old, *hlim_word);
> +
>  		skb_pull(skb, skb_transport_offset(skb));
>  		goto looped_back;
>  	}
> -- 
> 2.43.0
> 

Reviewed-by: Hangbin Liu <liuhangbin@xxxxxxxxxx>