netdev - [PATCH] net/mlx5e: don't assume psp tx skbs are ipv6 csum handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20260123-dzahka-fix-tx-csum-partial-v1-1-7b0107693883@gmail.com>
Date: Fri, 23 Jan 2026 10:11:05 -0800
From: Daniel Zahka <daniel.zahka@...il.com>
To: Boris Pismenny <borisp@...dia.com>, Saeed Mahameed <saeedm@...dia.com>, 
 Leon Romanovsky <leon@...nel.org>, Tariq Toukan <tariqt@...dia.com>, 
 Mark Bloch <mbloch@...dia.com>, Andrew Lunn <andrew+netdev@...n.ch>, 
 "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, 
 Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, 
 Rahul Rameshbabu <rrameshbabu@...dia.com>, Raed Salem <raeds@...dia.com>, 
 Cosmin Ratiu <cratiu@...dia.com>
Cc: netdev@...r.kernel.org, linux-rdma@...r.kernel.org, 
 linux-kernel@...r.kernel.org, Daniel Zahka <daniel.zahka@...il.com>
Subject: [PATCH] net/mlx5e: don't assume psp tx skbs are ipv6 csum handling

mlx5e_psp_handle_tx_skb() assumes skbs are ipv6 when doing a partial
TCP checksum with tso. Make correctly mlx5e_psp_handle_tx_skb() handle
ipv4 packets.

Fixes: e5a1861a298e ("net/mlx5e: Implement PSP Tx data path")
Signed-off-by: Daniel Zahka <daniel.zahka@...il.com>
---
This is a bug when an ipv4 tx skb passes through
mlx5e_psp_handle_tx_skb() and tso is requested. It was previously
undetected in my testing because my setup involves cx7's on both ends,
and mlx5e_handle_csum() marks PSP rx skb's with csum_unnecessary.

To reproduce the problem just turn off NETIF_F_RXCSUM and observe:
nstat -a | grep TcpInCsumErrors
---
 .../net/ethernet/mellanox/mlx5/core/en_accel/psp_rxtx.c   | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp_rxtx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp_rxtx.c
index c17ea0fcd8ef..15a344ad471d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp_rxtx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp_rxtx.c
@@ -178,7 +178,9 @@ bool mlx5e_psp_handle_tx_skb(struct net_device *netdev,
 	struct mlx5e_priv *priv = netdev_priv(netdev);
 	struct net *net = sock_net(skb->sk);
 	const struct ipv6hdr *ip6;
+	const struct iphdr *ip;
 	struct tcphdr *th;
+	int len;

 	if (!mlx5e_psp_set_state(priv, skb, psp_st))
 		return true;
@@ -190,11 +192,16 @@ bool mlx5e_psp_handle_tx_skb(struct net_device *netdev,
 		return false;
 	}
 	if (skb_is_gso(skb)) {
-		ip6 = ipv6_hdr(skb);
 		th = inner_tcp_hdr(skb);
-
-		th->check = ~tcp_v6_check(skb_shinfo(skb)->gso_size + inner_tcp_hdrlen(skb), &ip6->saddr,
-					  &ip6->daddr, 0);
+		len = skb_shinfo(skb)->gso_size + inner_tcp_hdrlen(skb);
+
+		if (skb->protocol == htons(ETH_P_IP)) {
+			ip = ip_hdr(skb);
+			th->check = ~tcp_v4_check(len, ip->saddr, ip->daddr, 0);
+		} else {
+			ip6 = ipv6_hdr(skb);
+			th->check = ~tcp_v6_check(len, &ip6->saddr, &ip6->daddr, 0);
+		}
 	}

 	return true;

---
base-commit: 4a3dba48188208e4f66822800e042686784d29d1
change-id: 20260122-dzahka-fix-tx-csum-partial-952e8dc28375

Best regards,
-- 
Daniel Zahka <daniel.zahka@...il.com>