Re: [v4] net/cksum: compute raw cksum for several segments

[Stephen Hemminger <stephen@networkplumber.org>]

On Thu, 18 Jun 2026 14:32:42 +0800
Su Sai <spiderdetective.ss@gmail.com> wrote:

> The rte_raw_cksum_mbuf function is used to compute
> the raw checksum of a packet.
> If the packet payload stored in multi mbuf, the function
> will goto the hard case. In hard case,
> the variable 'tmp' is a type of uint32_t,
> so rte_bswap16 will drop high 16 bit.
> Meanwhile, the variable 'sum' is a type of uint32_t,
> so 'sum += tmp' will drop the carry when overflow.
> Both drop will make cksum incorrect.
> This commit fixes the above bug.
> 
> Signed-off-by: Su Sai <spiderdetective.ss@gmail.com>
> Acked-by: Marat Khalili <marat.khalili@huawei.com>
> ---

Still one error in the test.

Error — double-free in test_l4_cksum_multi_mbufs() (app/test/test_cksum.c)
The segments are chained into one packet (rte_pktmbuf_chain sets
m[0]->next = m[1], m[1]->next = m[2]), but cleanup then calls
rte_pktmbuf_free_bulk(m, segs_len) over the array.
rte_pktmbuf_free_bulk walks the ->next chain of each array element, so
index 0 frees the entire chain (m[0], m[1], m[2]), and indices 1 and 2
then free m[1]/m[2] a second time. This fires on the normal success
path every run, and on the fail path whenever ≥2 segments were chained
— a debug/ASAN build will abort on the sanity check, and a normal build
corrupts pool accounting. The array-of-independent-mbufs contract that
free_bulk expects doesn't hold here because the elements alias one
chain. Free the chain once through its head: