build_udp_packet_csum() passes udph->len, which is in network byte order, as the number of bytes to checksum. On little-endian hosts this reads up to 64KB past the UDP header and computes a wrong checksum. Existing callers did not crash only because they use packet buffers of MAX_VNET_TUNNEL_PACKET_SZ bytes. Use ntohs(udph->len), as tap.c does in its own build_udp_packet(). While at it, clear udph->check before summing instead of relying on the caller, and send 0xffff instead of a computed zero checksum, as the kernel does with CSUM_MANGLED_0. Fixes: a942fcd72e97 ("selftest: tun: Introduce tuntap_helpers.h header for TUN/TAP testing") Reviewed-by: Willem de Bruijn Signed-off-by: Eric Dumazet --- tools/testing/selftests/net/tuntap_helpers.h | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/tools/testing/selftests/net/tuntap_helpers.h b/tools/testing/selftests/net/tuntap_helpers.h index d6c0437136ec..ecad83fae158 100644 --- a/tools/testing/selftests/net/tuntap_helpers.h +++ b/tools/testing/selftests/net/tuntap_helpers.h @@ -330,14 +330,22 @@ static inline void build_udp_packet_csum(uint8_t *buf, int family, size_t ipalen = ip_addr_len(family); uint32_t sum; + udph->check = 0; + /* No extension IPv4 and IPv6 headers addresses are the last fields */ sum = add_csum(buf - 2 * ipalen, 2 * ipalen); sum += htons(IPPROTO_UDP) + udph->len; if (!csum_off) - sum += add_csum(buf, udph->len); + sum += add_csum(buf, ntohs(udph->len)); udph->check = finish_ip_csum(sum); + + /* A zero UDP checksum means no checksum: send 0xffff instead, + * as the kernel does with CSUM_MANGLED_0. + */ + if (!csum_off && !udph->check) + udph->check = 0xffff; } static inline int build_udp_packet(uint8_t *buf, uint16_t sport, uint16_t dport, -- 2.53.0