Follow-up to commit f8ffad69c9f8 ("bpf: add skb_postpush_rcsum and fix dev_forward_skb occasions") to fix an issue for dev_queue_xmit() redirect locations which need CHECKSUM_COMPLETE fixups on ingress. For the same reasons as described in f8ffad69c9f8 already, we of course also need this here, since dev_queue_xmit() on a veth device will let us end up in the dev_forward_skb() helper again to cross namespaces. Latter then calls into skb_postpull_rcsum() to pull out L2 header, so that netif_rx_internal() sees CHECKSUM_COMPLETE as it is expected. That is, CHECKSUM_COMPLETE on ingress covering L2 _payload_, not L2 headers. Also here we have to address bpf_redirect() and bpf_clone_redirect().
Unified · Split
| @@ -1365,6 +1365,12 @@ static inline int bpf_try_make_writable(struct sk_buff *skb, · 1364 unmodified lines | ||
| 1365 | 1365 | return err; |
| 1366 | 1366 | } |
| 1367 | 1367 | |
| 1368 | +static inline void bpf_push_mac_rcsum(struct sk_buff *skb) | |
| 1369 | +{ | |
| 1370 | + if (skb_at_tc_ingress(skb)) | |
| 1371 | + skb_postpush_rcsum(skb, skb_mac_header(skb), skb->mac_len); | |
| 1372 | +} | |
| 1373 | + | |
| 1368 | 1374 | static u64 bpf_skb_store_bytes(u64 r1, u64 r2, u64 r3, u64 r4, u64 flags) |
| 1369 | 1375 | { |
| 1370 | 1376 | struct bpf_scratchpad *sp = this_cpu_ptr(&bpf_sp); |
| @@ -1607,9 +1613,6 @@ static const struct bpf_func_proto bpf_csum_diff_proto = { · 236 unmodified lines | ||
| 1607 | 1613 | |
| 1608 | 1614 | static inline int __bpf_rx_skb(struct net_device *dev, struct sk_buff *skb) |
| 1609 | 1615 | { |
| 1610 | − if (skb_at_tc_ingress(skb)) | |
| 1611 | − skb_postpush_rcsum(skb, skb_mac_header(skb), skb->mac_len); | |
| 1612 | − | |
| 1613 | 1616 | return dev_forward_skb(dev, skb); |
| 1614 | 1617 | } |
| 1615 | 1618 | |
| @@ -1648,6 +1651,8 @@ static u64 bpf_clone_redirect(u64 r1, u64 ifindex, u64 flags, u64 r4, u64 r5) · 32 unmodified lines | ||
| 1648 | 1651 | if (unlikely(!skb)) |
| 1649 | 1652 | return -ENOMEM; |
| 1650 | 1653 | |
| 1654 | + bpf_push_mac_rcsum(skb); | |
| 1655 | + | |
| 1651 | 1656 | return flags & BPF_F_INGRESS ? |
| 1652 | 1657 | __bpf_rx_skb(dev, skb) : __bpf_tx_skb(dev, skb); |
| 1653 | 1658 | } |
| @@ -1693,6 +1698,8 @@ int skb_do_redirect(struct sk_buff *skb) · 39 unmodified lines | ||
| 1693 | 1698 | return -EINVAL; |
| 1694 | 1699 | } |
| 1695 | 1700 | |
| 1701 | + bpf_push_mac_rcsum(skb); | |
| 1702 | + | |
| 1696 | 1703 | return ri->flags & BPF_F_INGRESS ? |
| 1697 | 1704 | __bpf_rx_skb(dev, skb) : __bpf_tx_skb(dev, skb); |
| 1698 | 1705 | } |