[PATCH] net/vhost: fix SW checksum when zero

[PATCH] net/vhost: fix SW checksum when zero

[Morten Brørup]

Identifying UDP packets by masking the packet type with the L4 UDP packet
type value (0x00000200) also matched other L4 packet types with that bit
set; specifically IP fragments, IGMP packets, and certain non-fragments.
This meant that non-UDP packets followed the special UDP rule about
transmitting a checksum of zero as 0xffff instead.

Updated to mask the packet type with the L4 packet type mask and then
compare to the L4 UDP packet type, so only UDP packets follow the special
UDP checksum rule.

Fixes: 8ba1723783b2 ("net/vhost: perform SW checksum in Tx path")
Fixes: 8f1750f42e2d ("net/vhost: perform SW checksum in Rx path")
Cc: stable@dpdk.org

Signed-off-by: Morten Brørup <mb@smartsharesystems.com>
---
 drivers/net/vhost/rte_eth_vhost.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/vhost/rte_eth_vhost.c b/drivers/net/vhost/rte_eth_vhost.c
index f6ef997455..1f55ee9670 100644
--- a/drivers/net/vhost/rte_eth_vhost.c
+++ b/drivers/net/vhost/rte_eth_vhost.c
@@ -346,7 +346,7 @@ vhost_dev_tx_sw_csum(struct rte_mbuf *mbuf)
 
 	csum = ~csum;
 	/* See RFC768 */
-	if (unlikely((mbuf->packet_type & RTE_PTYPE_L4_UDP) && csum == 0))
+	if (unlikely(csum == 0) && (mbuf->packet_type & RTE_PTYPE_L4_MASK) == RTE_PTYPE_L4_UDP)
 		csum = 0xffff;
 
 	if (rte_pktmbuf_data_len(mbuf) >= csum_offset + 1)
@@ -389,7 +389,7 @@ vhost_dev_rx_sw_csum(struct rte_mbuf *mbuf)
 
 	csum = ~csum;
 	/* See RFC768 */
-	if (unlikely((ptype & RTE_PTYPE_L4_UDP) && csum == 0))
+	if (unlikely(csum == 0) && (ptype & RTE_PTYPE_L4_MASK) == RTE_PTYPE_L4_UDP)
 		csum = 0xffff;
 
 	if (rte_pktmbuf_data_len(mbuf) >= csum_offset + 1)
-- 
2.43.0

[PATCH v2] net/vhost: fix SW checksum when zero

[Morten Brørup]

There is a special rule for UDP, where a checksum of zero is as 0xffff
instead of zero.

Identifying packet types requires masking with the mask, not the value,
before comparing to the value.
Identifying by masking with the L4 UDP packet type value (0x00000200)
instead of the L4 packet type mask caused other L4 packet types to match;
specifically IP fragments, IGMP packets, and certain non-fragments.
This meant that some non-UDP packets followed the special UDP checksum
rule, which they should not.

Updated to mask the packet type with the L4 packet type mask and then
compare to the L4 UDP packet type value, so only UDP packets follow the
special UDP checksum rule.

Furthermore, according to the mbuf documentation, Tx checksum offload
requires that "ol_flags" is set, and only mentions "packet_type" for Rx,
so use "ol_flags" instead of "packet_type" for checking the packet type
at Tx.

Note:
Using "if (unlikely(cksum == 0) && PTYPE_MATCH)" to advise the optimizer
about the need to evaluate PTYPE_MATCH being unlikely.
The probability of cksum being zero is only 1/65536, so it's better to
branch early.

Fixes: 8ba1723783b2 ("net/vhost: perform SW checksum in Tx path")
Fixes: 8f1750f42e2d ("net/vhost: perform SW checksum in Rx path")
Cc: stable@dpdk.org

Signed-off-by: Morten Brørup <mb@smartsharesystems.com>
---
v2:
* Use ol_flags instead of packet_type for Tx.
* Added note about the use of unlikely().
---
 drivers/net/vhost/rte_eth_vhost.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/vhost/rte_eth_vhost.c b/drivers/net/vhost/rte_eth_vhost.c
index f6ef997455..e9b2606d22 100644
--- a/drivers/net/vhost/rte_eth_vhost.c
+++ b/drivers/net/vhost/rte_eth_vhost.c
@@ -346,7 +346,8 @@ vhost_dev_tx_sw_csum(struct rte_mbuf *mbuf)
 
 	csum = ~csum;
 	/* See RFC768 */
-	if (unlikely((mbuf->packet_type & RTE_PTYPE_L4_UDP) && csum == 0))
+	if (unlikely(csum == 0) &&
+			(mbuf->ol_flags & RTE_MBUF_F_TX_L4_MASK) == RTE_MBUF_F_TX_UDP_CKSUM)
 		csum = 0xffff;
 
 	if (rte_pktmbuf_data_len(mbuf) >= csum_offset + 1)
@@ -389,7 +390,7 @@ vhost_dev_rx_sw_csum(struct rte_mbuf *mbuf)
 
 	csum = ~csum;
 	/* See RFC768 */
-	if (unlikely((ptype & RTE_PTYPE_L4_UDP) && csum == 0))
+	if (unlikely(csum == 0) && (ptype & RTE_PTYPE_L4_MASK) == RTE_PTYPE_L4_UDP)
 		csum = 0xffff;
 
 	if (rte_pktmbuf_data_len(mbuf) >= csum_offset + 1)
-- 
2.43.0

[PATCH v3] net/vhost: fix SW checksum when zero

[Morten Brørup]

There is a special rule for UDP, where a checksum of zero is as 0xffff
instead of zero.

Identifying packet types requires masking with the mask, not the value,
before comparing to the value.
Identifying by masking with the L4 UDP packet type value (0x00000200)
instead of the L4 packet type mask caused other L4 packet types to match;
specifically IP fragments, IGMP packets, and certain non-fragments.
This meant that some non-UDP packets followed the special UDP checksum
rule, which they should not.

Updated to mask the packet type with the L4 packet type mask and then
compare to the L4 UDP packet type value, so only UDP packets follow the
special UDP checksum rule.

Furthermore, according to the mbuf documentation, Tx checksum offload
requires that "ol_flags" is set, and only mentions "packet_type" for Rx,
so use "ol_flags" instead of "packet_type" for checking the packet type
at Tx.

Furthermore, writing the checksum needs room for 2 bytes, not 1 byte.

Note:
Using "if (unlikely(cksum == 0) && PTYPE_MATCH)" to advise the optimizer
about the need to evaluate PTYPE_MATCH being unlikely.
The probability of cksum being zero is only 1/65536, so it's better to
branch early.

Fixes: 8ba1723783b2 ("net/vhost: perform SW checksum in Tx path")
Fixes: 8f1750f42e2d ("net/vhost: perform SW checksum in Rx path")
Cc: stable@dpdk.org

Signed-off-by: Morten Brørup <mb@smartsharesystems.com>
---
v3:
* Writing the checksum needs room for 2 bytes, not 1 byte.
v2:
* Use ol_flags instead of packet_type for Tx.
* Added note about the use of unlikely().
---
 drivers/net/vhost/rte_eth_vhost.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/net/vhost/rte_eth_vhost.c b/drivers/net/vhost/rte_eth_vhost.c
index f6ef997455..9ffc844356 100644
--- a/drivers/net/vhost/rte_eth_vhost.c
+++ b/drivers/net/vhost/rte_eth_vhost.c
@@ -346,10 +346,11 @@ vhost_dev_tx_sw_csum(struct rte_mbuf *mbuf)
 
 	csum = ~csum;
 	/* See RFC768 */
-	if (unlikely((mbuf->packet_type & RTE_PTYPE_L4_UDP) && csum == 0))
+	if (unlikely(csum == 0) &&
+			(mbuf->ol_flags & RTE_MBUF_F_TX_L4_MASK) == RTE_MBUF_F_TX_UDP_CKSUM)
 		csum = 0xffff;
 
-	if (rte_pktmbuf_data_len(mbuf) >= csum_offset + 1)
+	if (rte_pktmbuf_data_len(mbuf) >= csum_offset + sizeof(uint16_t))
 		*rte_pktmbuf_mtod_offset(mbuf, uint16_t *, csum_offset) = csum;
 
 	mbuf->ol_flags &= ~RTE_MBUF_F_TX_L4_MASK;
@@ -389,10 +390,10 @@ vhost_dev_rx_sw_csum(struct rte_mbuf *mbuf)
 
 	csum = ~csum;
 	/* See RFC768 */
-	if (unlikely((ptype & RTE_PTYPE_L4_UDP) && csum == 0))
+	if (unlikely(csum == 0) && (ptype & RTE_PTYPE_L4_MASK) == RTE_PTYPE_L4_UDP)
 		csum = 0xffff;
 
-	if (rte_pktmbuf_data_len(mbuf) >= csum_offset + 1)
+	if (rte_pktmbuf_data_len(mbuf) >= csum_offset + sizeof(uint16_t))
 		*rte_pktmbuf_mtod_offset(mbuf, uint16_t *, csum_offset) = csum;
 
 	mbuf->ol_flags &= ~RTE_MBUF_F_RX_L4_CKSUM_MASK;
-- 
2.43.0

Re: [PATCH v3] net/vhost: fix SW checksum when zero

[Maxime Coquelin]

On Sun, Oct 18, 2026 at 11:21 AM Morten Brørup <mb@smartsharesystems.com> wrote:
>
> There is a special rule for UDP, where a checksum of zero is as 0xffff
> instead of zero.
>
> Identifying packet types requires masking with the mask, not the value,
> before comparing to the value.
> Identifying by masking with the L4 UDP packet type value (0x00000200)
> instead of the L4 packet type mask caused other L4 packet types to match;
> specifically IP fragments, IGMP packets, and certain non-fragments.
> This meant that some non-UDP packets followed the special UDP checksum
> rule, which they should not.
>
> Updated to mask the packet type with the L4 packet type mask and then
> compare to the L4 UDP packet type value, so only UDP packets follow the
> special UDP checksum rule.
>
> Furthermore, according to the mbuf documentation, Tx checksum offload
> requires that "ol_flags" is set, and only mentions "packet_type" for Rx,
> so use "ol_flags" instead of "packet_type" for checking the packet type
> at Tx.
>
> Furthermore, writing the checksum needs room for 2 bytes, not 1 byte.
>
> Note:
> Using "if (unlikely(cksum == 0) && PTYPE_MATCH)" to advise the optimizer
> about the need to evaluate PTYPE_MATCH being unlikely.
> The probability of cksum being zero is only 1/65536, so it's better to
> branch early.
>
> Fixes: 8ba1723783b2 ("net/vhost: perform SW checksum in Tx path")
> Fixes: 8f1750f42e2d ("net/vhost: perform SW checksum in Rx path")
> Cc: stable@dpdk.org
>
> Signed-off-by: Morten Brørup <mb@smartsharesystems.com>
> ---
> v3:
> * Writing the checksum needs room for 2 bytes, not 1 byte.
> v2:
> * Use ol_flags instead of packet_type for Tx.
> * Added note about the use of unlikely().
> ---
>  drivers/net/vhost/rte_eth_vhost.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
>

Thanks for the fix, it looks good to me:
Reviewed-by; Maxime Coquelin <maxime.coquelin@redhat.com>

Maxime

RE: [PATCH v3] net/vhost: fix SW checksum when zero

[Morten Brørup]

> Reviewed-by; Maxime Coquelin <maxime.coquelin@redhat.com>

For Patchwork, replacing semicolon with colon...
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>

Re: [PATCH v3] net/vhost: fix SW checksum when zero

[Maxime Coquelin]

On 10/18/26 11:20 AM, Morten Brørup wrote:
> There is a special rule for UDP, where a checksum of zero is as 0xffff
> instead of zero.
>
> Identifying packet types requires masking with the mask, not the value,
> before comparing to the value.
> Identifying by masking with the L4 UDP packet type value (0x00000200)
> instead of the L4 packet type mask caused other L4 packet types to match;
> specifically IP fragments, IGMP packets, and certain non-fragments.
> This meant that some non-UDP packets followed the special UDP checksum
> rule, which they should not.
>
> Updated to mask the packet type with the L4 packet type mask and then
> compare to the L4 UDP packet type value, so only UDP packets follow the
> special UDP checksum rule.
>
> Furthermore, according to the mbuf documentation, Tx checksum offload
> requires that "ol_flags" is set, and only mentions "packet_type" for Rx,
> so use "ol_flags" instead of "packet_type" for checking the packet type
> at Tx.
>
> Furthermore, writing the checksum needs room for 2 bytes, not 1 byte.
>
> Note:
> Using "if (unlikely(cksum == 0) && PTYPE_MATCH)" to advise the optimizer
> about the need to evaluate PTYPE_MATCH being unlikely.
> The probability of cksum being zero is only 1/65536, so it's better to
> branch early.
>
> Fixes: 8ba1723783b2 ("net/vhost: perform SW checksum in Tx path")
> Fixes: 8f1750f42e2d ("net/vhost: perform SW checksum in Rx path")
> Cc: stable@dpdk.org
>
> Signed-off-by: Morten Brørup <mb@smartsharesystems.com>
> ---
> v3:
> * Writing the checksum needs room for 2 bytes, not 1 byte.
> v2:
> * Use ol_flags instead of packet_type for Tx.
> * Added note about the use of unlikely().
> ---
>   drivers/net/vhost/rte_eth_vhost.c | 9 +++++----
>   1 file changed, 5 insertions(+), 4 deletions(-)
>
Applied to next-virtio/for-next-net.

Thanks,

Maxime