* [PATCH bpf 1/2] bpf: test_run: Fix false -EBADMSG after skb leaves CHECKSUM_COMPLETE
2026-10-07 18:12 [PATCH bpf 0/2] bpf: test_run: Fix false -EBADMSG with BPF_F_TEST_SKB_CHECKSUM_COMPLETE Maxim Skokov
@ 2026-10-07 18:12 ` Maxim Skokov
2026-10-07 18:45 ` bot+bpf-ci
2026-10-07 18:12 ` [PATCH bpf 2/2] selftests/bpf: Cover test_run csum validation after bpf_skb_change_tail() Maxim Skokov
1 sibling, 1 reply; 5+ messages in thread
From: Maxim Skokov @ 2026-10-07 18:12 UTC (permalink / raw)
To: bpf
Cc: ast, daniel, andrii, martin.lau, eddyz87, song, yonghong.song,
jolsa, memxor, emil, ihor.solodrai, davem, edumazet, kuba, pabeni,
horms, shuah, vadim.fedorenko, netdev, linux-kselftest,
linux-kernel, Maxim Skokov
With BPF_F_TEST_SKB_CHECKSUM_COMPLETE, bpf_prog_test_run_skb() computes
skb->csum over the packet from the network header to the end and marks
the skb CHECKSUM_COMPLETE. After the program has run, it recomputes the
checksum and returns -EBADMSG if it does not match skb->csum.
bpf_skb_change_tail() resizes the skb with __skb_trim_rcsum() and
__skb_grow_rcsum(), which move a CHECKSUM_COMPLETE skb to CHECKSUM_NONE
and leave skb->csum as it is. The post-run check still compares against
that stale value, so a correct program fails with -EBADMSG. After a
trim, skb->csum still covers the removed bytes. After a grow, later
writes cannot update skb->csum, even with BPF_F_RECOMPUTE_CSUM, because
skb->csum is only adjusted for CHECKSUM_COMPLETE skbs.
skb->csum only holds the packet checksum while ip_summed is
CHECKSUM_COMPLETE. With CHECKSUM_NONE the stack does not rely on it and
validates the packet in software, so there is nothing to compare. Only
do the check if the skb is still CHECKSUM_COMPLETE after the run. A
program that keeps the skb CHECKSUM_COMPLETE but leaves skb->csum stale
still gets -EBADMSG.
Dropping the checksum offload is documented behaviour of
bpf_skb_change_tail() ("implicitly linearizes, unclones and drops
offloads"), and the stack does the same in other places, for example
skb_forward_csum(). The test harness has to accept CHECKSUM_NONE either
way, whether or not the helper is later taught to keep
CHECKSUM_COMPLETE.
Fixes: a3cfe84cca28 ("bpf: Add CHECKSUM_COMPLETE to bpf test progs")
Assisted-by: LLM
Signed-off-by: Maxim Skokov <skokovmaksimevg@gmail.com>
---
net/bpf/test_run.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
index 513354e928cb5..45718fa9adfd2 100644
--- a/net/bpf/test_run.c
+++ b/net/bpf/test_run.c
@@ -1237,7 +1237,12 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
memset(__skb_push(skb, hh_len), 0, hh_len);
}
- if (kattr->test.flags & BPF_F_TEST_SKB_CHECKSUM_COMPLETE) {
+ /* A helper such as bpf_skb_change_tail() may have downgraded the skb
+ * from CHECKSUM_COMPLETE. skb->csum is then unused by the stack and
+ * there is nothing to validate.
+ */
+ if ((kattr->test.flags & BPF_F_TEST_SKB_CHECKSUM_COMPLETE) &&
+ skb->ip_summed == CHECKSUM_COMPLETE) {
const int off = skb_network_offset(skb);
int len = skb->len - off;
__wsum csum;
--
2.47.3
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH bpf 2/2] selftests/bpf: Cover test_run csum validation after bpf_skb_change_tail()
2026-10-07 18:12 [PATCH bpf 0/2] bpf: test_run: Fix false -EBADMSG with BPF_F_TEST_SKB_CHECKSUM_COMPLETE Maxim Skokov
2026-10-07 18:12 ` [PATCH bpf 1/2] bpf: test_run: Fix false -EBADMSG after skb leaves CHECKSUM_COMPLETE Maxim Skokov
@ 2026-10-07 18:12 ` Maxim Skokov
1 sibling, 0 replies; 5+ messages in thread
From: Maxim Skokov @ 2026-10-07 18:12 UTC (permalink / raw)
To: bpf
Cc: ast, daniel, andrii, martin.lau, eddyz87, song, yonghong.song,
jolsa, memxor, emil, ihor.solodrai, davem, edumazet, kuba, pabeni,
horms, shuah, vadim.fedorenko, netdev, linux-kselftest,
linux-kernel, Maxim Skokov
Add BPF_F_TEST_SKB_CHECKSUM_COMPLETE tests for tc programs that move the
skb out of CHECKSUM_COMPLETE with bpf_skb_change_tail():
- change_tail_trim trims the last 4 bytes of pkt_v4. They hold the
non-zero tcp.urg_ptr, so the stale skb->csum no longer matches the
packet.
- change_tail_grow_write appends 4 zero bytes, which on their own do
not change the sum, and then writes a byte with BPF_F_RECOMPUTE_CSUM.
That write can no longer update skb->csum.
Both return -EBADMSG without the preceding test_run fix and pass with
it.
Also add store_no_recompute as a negative test. It writes a byte
without BPF_F_RECOMPUTE_CSUM, so the skb stays CHECKSUM_COMPLETE with a
stale skb->csum, and test_run must keep returning -EBADMSG. This checks
that the validation still runs for CHECKSUM_COMPLETE skbs. The passing
case, a CHECKSUM_COMPLETE skb whose checksum is updated correctly, is
already covered by test_skb_pkt_end.
Assisted-by: LLM
Signed-off-by: Maxim Skokov <skokovmaksimevg@gmail.com>
---
.../bpf/prog_tests/skb_csum_complete.c | 39 ++++++++++++++++
.../selftests/bpf/progs/skb_csum_complete.c | 44 +++++++++++++++++++
2 files changed, 83 insertions(+)
create mode 100644 tools/testing/selftests/bpf/prog_tests/skb_csum_complete.c
create mode 100644 tools/testing/selftests/bpf/progs/skb_csum_complete.c
diff --git a/tools/testing/selftests/bpf/prog_tests/skb_csum_complete.c b/tools/testing/selftests/bpf/prog_tests/skb_csum_complete.c
new file mode 100644
index 0000000000000..919f24dbacd3d
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/skb_csum_complete.c
@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <test_progs.h>
+#include <network_helpers.h>
+#include "skb_csum_complete.skel.h"
+
+static void run(struct bpf_program *prog, int expected_err)
+{
+ LIBBPF_OPTS(bpf_test_run_opts, topts,
+ .data_in = &pkt_v4,
+ .data_size_in = sizeof(pkt_v4),
+ .repeat = 1,
+ .flags = BPF_F_TEST_SKB_CHECKSUM_COMPLETE,
+ );
+ int err;
+
+ err = bpf_prog_test_run_opts(bpf_program__fd(prog), &topts);
+ if (!ASSERT_EQ(err, expected_err, "test_run"))
+ return;
+ if (!expected_err)
+ ASSERT_EQ(topts.retval, 0, "retval");
+}
+
+void test_skb_csum_complete(void)
+{
+ struct skb_csum_complete *skel;
+
+ skel = skb_csum_complete__open_and_load();
+ if (!ASSERT_OK_PTR(skel, "skel_open_and_load"))
+ return;
+
+ if (test__start_subtest("change_tail_trim"))
+ run(skel->progs.change_tail_trim, 0);
+ if (test__start_subtest("change_tail_grow_write"))
+ run(skel->progs.change_tail_grow_write, 0);
+ if (test__start_subtest("store_no_recompute"))
+ run(skel->progs.store_no_recompute, -EBADMSG);
+
+ skb_csum_complete__destroy(skel);
+}
diff --git a/tools/testing/selftests/bpf/progs/skb_csum_complete.c b/tools/testing/selftests/bpf/progs/skb_csum_complete.c
new file mode 100644
index 0000000000000..8e8d53530899a
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/skb_csum_complete.c
@@ -0,0 +1,44 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <vmlinux.h>
+#include <bpf/bpf_helpers.h>
+
+SEC("tc")
+int change_tail_trim(struct __sk_buff *skb)
+{
+ /* Drops CHECKSUM_COMPLETE. skb->csum still covers the trimmed bytes,
+ * which hold the non-zero tcp.urg_ptr of pkt_v4, so it no longer
+ * matches the packet.
+ */
+ if (bpf_skb_change_tail(skb, skb->len - 4, 0))
+ return 1;
+ return 0;
+}
+
+SEC("tc")
+int change_tail_grow_write(struct __sk_buff *skb)
+{
+ __u8 val = 0xab;
+
+ /* Drops CHECKSUM_COMPLETE. The new bytes are zero and do not change
+ * the sum, but the write below can no longer update skb->csum.
+ */
+ if (bpf_skb_change_tail(skb, skb->len + 4, 0))
+ return 1;
+ if (bpf_skb_store_bytes(skb, skb->len - 1, &val, sizeof(val),
+ BPF_F_RECOMPUTE_CSUM))
+ return 2;
+ return 0;
+}
+
+SEC("tc")
+int store_no_recompute(struct __sk_buff *skb)
+{
+ __u8 val = 0xab;
+
+ /* skb stays CHECKSUM_COMPLETE, but skb->csum is not updated. */
+ if (bpf_skb_store_bytes(skb, skb->len - 1, &val, sizeof(val), 0))
+ return 1;
+ return 0;
+}
+
+char _license[] SEC("license") = "GPL";
--
2.47.3
^ permalink raw reply related [flat|nested] 5+ messages in thread