Re: [PATCH bpf-next v4 2/6] net: veth: Add xmo_rx_checksum callback to veth driver

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] The XDP CHECKSUM_COMPLETE value returned by veth_xdp_rx_checksum lacks the MAC header contribution, causing XDP programs to compute incorrect checksums.
- [High] veth_xdp_rx_checksum incorrectly maps CHECKSUM_PARTIAL to XDP_CHECKSUM_NONE, causing XDP programs to drop valid locally generated traffic.
--

--- Patch [2]: [PATCH bpf-next v4 2/6] net: veth: Add xmo_rx_checksum callback to veth driver ---
commit 5a562d33c7a2a6e1ab983df15c58e768727ee475
Author: Lorenzo Bianconi <lorenzo@kernel.org>
Date:   Wed Jul 8 20:34:06 2026 +0000

    net: veth: Add xmo_rx_checksum callback to veth driver
    
    Implement xmo_rx_checksum callback in veth driver to report RX checksum
    result to the eBPF program bounded to the veth device.

> diff --git a/drivers/net/veth.c b/drivers/net/veth.c
> index 1c51421491753..498d894d043da 100644
> --- a/drivers/net/veth.c
> +++ b/drivers/net/veth.c

[ ... ]

> +static int veth_xdp_rx_checksum(const struct xdp_md *ctx,
> +				enum xdp_checksum *ip_summed,
> +				u32 *cksum, u8 *cksum_level)
> +{
> +	const struct veth_xdp_buff *_ctx = (void *)ctx;
> +	const struct sk_buff *skb = _ctx->skb;
> +
> +	if (!skb)
> +		return -ENODATA;
> +
> +	switch (skb->ip_summed) {
> +	case CHECKSUM_COMPLETE:
> +		*ip_summed = XDP_CHECKSUM_COMPLETE;
> +		*cksum = skb->csum;

[Severity: High]
Does this return a checksum that is out of sync with the packet data exposed
to the XDP program?

When the packet enters veth_xdp_rcv_skb(), the MAC header is pushed back
into the packet data so it is visible to the XDP program:

drivers/net/veth.c:veth_xdp_rcv_skb() {
    ...
    __skb_push(skb, skb->data - skb_mac_header(skb));
    ...
}

However, it doesn't look like skb_postpush_rcsum() is called to update the
checksum. Since the earlier eth_type_trans() subtracted the MAC header from
skb->csum, returning skb->csum here means the XDP program will receive a
checksum that lacks the MAC header contribution, which might lead to a
checksum mismatch when the program validates the packet.

> +		*cksum_level = 0;
> +		break;
> +	case CHECKSUM_UNNECESSARY:
> +		*ip_summed = XDP_CHECKSUM_UNNECESSARY;
> +		*cksum_level = skb->csum_level;
> +		*cksum = 0;
> +		break;
> +	default:

[Severity: High]
Will CHECKSUM_PARTIAL fall through to this default case and be reported as
XDP_CHECKSUM_NONE?

Locally generated traffic transmitted through a veth device defaults to
skb->ip_summed == CHECKSUM_PARTIAL because veth advertises NETIF_F_HW_CSUM.

If this falls through to XDP_CHECKSUM_NONE, strict XDP firewalls might try
to manually validate the checksum. Since the payload checksum hasn't been
populated by hardware yet, the validation will fail and valid local
traffic will be incorrectly dropped. Should this explicitly handle
CHECKSUM_PARTIAL?

> +		*ip_summed = XDP_CHECKSUM_NONE;
> +		*cksum_level = 0;
> +		*cksum = 0;
> +		break;
> +	}
> +
> +	return 0;
> +}

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708203410.45121-1-deliran@verdict.gg?part=2