With CHECKSUM_COMPLETE, ipv6_srh_rcv() updates skb->csum for the new Segments Left and destination address through seg6_update_csum(). Replacing "from" with "to" in the packet must change skb->csum (C) to C - from + to, but update_csum_diff4() and update_csum_diff16() compute: ~csum_partial({ ~from, to }, ~C) = ~(~C + ~from + to) = C + from - to This does not affect packets forwarded by ip6_forward(), which sets ip_summed to CHECKSUM_NONE. But when the packet is delivered on the same node and skb->csum was computed in software, for instance by conntrack, UDP can drop the packet as a checksum error. With skb->csum computed by the device, TCP can instead log a "hw csum failure", as if the device had computed a wrong skb->csum. Fix update_csum_diff4() and update_csum_diff16() to compute C - from + to. Found by manual code inspection, while checking that the skb->csum updates in the SRv6 receive path are consistent. A following commit adds a selftest that reproduces the problem with a tc ct action. The issue was confirmed in a VM without kernel changes or error injection: with the rest of this series and without this patch, that selftest fails, as UDP drops datagrams as checksum errors. Also tested against the srv6 selftests, and with a ConnectX-6 Lx NIC (mlx5) that provides CHECKSUM_COMPLETE. Fixes: 1ababeba4a21 ("ipv6: implement dataplane support for rthdr type 4 (Segment Routing Header)") Signed-off-by: Andrea Mayer --- include/net/seg6.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/include/net/seg6.h b/include/net/seg6.h index 82b3fbbcbb93..01d8034e48fc 100644 --- a/include/net/seg6.h +++ b/include/net/seg6.h @@ -19,7 +19,7 @@ static inline void update_csum_diff4(struct sk_buff *skb, __be32 from, { __be32 diff[] = { ~from, to }; - skb->csum = ~csum_partial((char *)diff, sizeof(diff), ~skb->csum); + skb->csum = csum_partial(diff, sizeof(diff), skb->csum); } static inline void update_csum_diff16(struct sk_buff *skb, __be32 *from, @@ -30,7 +30,7 @@ static inline void update_csum_diff16(struct sk_buff *skb, __be32 *from, to[0], to[1], to[2], to[3], }; - skb->csum = ~csum_partial((char *)diff, sizeof(diff), ~skb->csum); + skb->csum = csum_partial(diff, sizeof(diff), skb->csum); } struct seg6_pernet_data { -- 2.43.0