Follow-up to commit f8ffad69c9f8 ("bpf: add skb_postpush_rcsum and fix dev_forward_skb occasions") to fix an issue for dev_queue_xmit() redirect locations which need CHECKSUM_COMPLETE fixups on ingress. For the same reasons as described in f8ffad69c9f8 already, we of course also need this here, since dev_queue_xmit() on a veth device will let us end up in the dev_forward_skb() helper again to cross namespaces. Latter then calls into skb_postpull_rcsum() to pull out L2 header, so that netif_rx_internal() sees CHECKSUM_COMPLETE as it is expected. That is, CHECKSUM_COMPLETE on ingress covering L2 _payload_, not L2 headers. Also here we have to address bpf_redirect() and bpf_clone_redirect().
Unified · Split
| @@ -1365,6 +1365,12 @@ static inline int bpf_try_make_writable(struct sk_buff *skb, · 1364 unmodified lines | |||
| 1365 | return err; | 1365 | return err; |
| 1366 | } | 1366 | } |
| 1367 | 1367 | ||
| 1368 | static inline void bpf_push_mac_rcsum(struct sk_buff *skb) | ||
| 1369 | { | ||
| 1370 | if (skb_at_tc_ingress(skb)) | ||
| 1371 | skb_postpush_rcsum(skb, skb_mac_header(skb), skb->mac_len); | ||
| 1372 | } | ||
| 1373 | |||
| 1368 | static u64 bpf_skb_store_bytes(u64 r1, u64 r2, u64 r3, u64 r4, u64 flags) | 1374 | static u64 bpf_skb_store_bytes(u64 r1, u64 r2, u64 r3, u64 r4, u64 flags) |
| 1369 | { | 1375 | { |
| 1370 | struct bpf_scratchpad *sp = this_cpu_ptr(&bpf_sp); | 1376 | struct bpf_scratchpad *sp = this_cpu_ptr(&bpf_sp); |
| @@ -1607,9 +1613,6 @@ static const struct bpf_func_proto bpf_csum_diff_proto = { · 236 unmodified lines | |||
| 1607 | 1613 | ||
| 1608 | static inline int __bpf_rx_skb(struct net_device *dev, struct sk_buff *skb) | 1614 | static inline int __bpf_rx_skb(struct net_device *dev, struct sk_buff *skb) |
| 1609 | { | 1615 | { |
| 1610 | if (skb_at_tc_ingress(skb)) | ||
| 1611 | skb_postpush_rcsum(skb, skb_mac_header(skb), skb->mac_len); | ||
| 1612 | |||
| 1613 | return dev_forward_skb(dev, skb); | 1616 | return dev_forward_skb(dev, skb); |
| 1614 | } | 1617 | } |
| 1615 | 1618 | ||
| @@ -1648,6 +1651,8 @@ static u64 bpf_clone_redirect(u64 r1, u64 ifindex, u64 flags, u64 r4, u64 r5) · 32 unmodified lines | |||
| 1648 | if (unlikely(!skb)) | 1651 | if (unlikely(!skb)) |
| 1649 | return -ENOMEM; | 1652 | return -ENOMEM; |
| 1650 | 1653 | ||
| 1654 | bpf_push_mac_rcsum(skb); | ||
| 1655 | |||
| 1651 | return flags & BPF_F_INGRESS ? | 1656 | return flags & BPF_F_INGRESS ? |
| 1652 | __bpf_rx_skb(dev, skb) : __bpf_tx_skb(dev, skb); | 1657 | __bpf_rx_skb(dev, skb) : __bpf_tx_skb(dev, skb); |
| 1653 | } | 1658 | } |
| @@ -1693,6 +1698,8 @@ int skb_do_redirect(struct sk_buff *skb) · 39 unmodified lines | |||
| 1693 | return -EINVAL; | 1698 | return -EINVAL; |
| 1694 | } | 1699 | } |
| 1695 | 1700 | ||
| 1701 | bpf_push_mac_rcsum(skb); | ||
| 1702 | |||
| 1696 | return ri->flags & BPF_F_INGRESS ? | 1703 | return ri->flags & BPF_F_INGRESS ? |
| 1697 | __bpf_rx_skb(dev, skb) : __bpf_tx_skb(dev, skb); | 1704 | __bpf_rx_skb(dev, skb) : __bpf_tx_skb(dev, skb); |
| 1698 | } | 1705 | } |