On Thu, 18 Jun 2026 14:32:42 +0800 Su Sai <[email protected]> wrote:
> The rte_raw_cksum_mbuf function is used to compute > the raw checksum of a packet. > If the packet payload stored in multi mbuf, the function > will goto the hard case. In hard case, > the variable 'tmp' is a type of uint32_t, > so rte_bswap16 will drop high 16 bit. > Meanwhile, the variable 'sum' is a type of uint32_t, > so 'sum += tmp' will drop the carry when overflow. > Both drop will make cksum incorrect. > This commit fixes the above bug. > > Signed-off-by: Su Sai <[email protected]> > Acked-by: Marat Khalili <[email protected]> > --- Still one error in the test. Error — double-free in test_l4_cksum_multi_mbufs() (app/test/test_cksum.c) The segments are chained into one packet (rte_pktmbuf_chain sets m[0]->next = m[1], m[1]->next = m[2]), but cleanup then calls rte_pktmbuf_free_bulk(m, segs_len) over the array. rte_pktmbuf_free_bulk walks the ->next chain of each array element, so index 0 frees the entire chain (m[0], m[1], m[2]), and indices 1 and 2 then free m[1]/m[2] a second time. This fires on the normal success path every run, and on the fail path whenever ≥2 segments were chained — a debug/ASAN build will abort on the sanity check, and a normal build corrupts pool accounting. The array-of-independent-mbufs contract that free_bulk expects doesn't hold here because the elements alias one chain. Free the chain once through its head:
