tree: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y head: 38c92ba3580f0d00e57a55caf8f880aa1a0f2a50 commit: 2555bb2a5163e3741d5dd5916f3a9f0228750aca [1224/1774] net: drop bogus skb with CHECKSUM_PARTIAL and offset beyond end of trimmed packet config: mips-randconfig-r013-20210705 (attached as .config) compiler: mips64el-linux-gcc (GCC) 9.3.0 reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gi... git remote add linux-stable-rc https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git git fetch --no-tags linux-stable-rc linux-4.4.y git checkout 2555bb2a5163e3741d5dd5916f3a9f0228750aca # save the attached .config to linux build tree COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-9.3.0 make.cross ARCH=mips If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <lkp(a)intel.com&gt; All warnings (new ones prefixed by >>): In file included from include/net/sock.h:51, from include/linux/tcp.h:22, from net/core/skbuff.c:50: include/linux/netdevice.h: In function 'netif_msg_init': include/linux/netdevice.h:3304:37: warning: comparison of integer expressions of different signedness: 'int' and 'long unsigned int' [-Wsign-compare] 3304 | if (debug_value < 0 || debug_value >= (sizeof(u32) * 8)) | ^~ In file included from include/net/rtnetlink.h:5, from include/net/sch_generic.h:12, from include/linux/filter.h:16, from include/net/sock.h:62, from include/linux/tcp.h:22, from net/core/skbuff.c:50: include/net/netlink.h: In function 'nlmsg_ok': include/net/netlink.h:337:18: warning: comparison of integer expressions of different signedness: '__u32' {aka 'const unsigned int'} and 'int' [-Wsign-compare] 337 | nlh->nlmsg_len <= remaining); | ^~ include/net/netlink.h: In function 'nlmsg_parse': include/net/netlink.h:372:21: warning: comparison of integer expressions of different signedness: '__u32' {aka 'const unsigned int'} and 'int' [-Wsign-compare] 372 | if (nlh->nlmsg_len < nlmsg_msg_size(hdrlen)) | ^ include/net/netlink.h: In function 'nlmsg_validate': include/net/netlink.h:405:21: warning: comparison of integer expressions of different signedness: '__u32' {aka 'const unsigned int'} and 'int' [-Wsign-compare] 405 | if (nlh->nlmsg_len < nlmsg_msg_size(hdrlen)) | ^ In file included from include/net/sch_generic.h:12, from include/linux/filter.h:16, from include/net/sock.h:62, from include/linux/tcp.h:22, from net/core/skbuff.c:50: include/net/rtnetlink.h: In function 'rtnl_msg_family': include/net/rtnetlink.h:20:21: warning: comparison of integer expressions of different signedness: 'int' and 'long unsigned int' [-Wsign-compare] 20 | if (nlmsg_len(nlh) >= sizeof(struct rtgenmsg)) | ^~ In file included from include/uapi/linux/stddef.h:1, from include/linux/stddef.h:4, from include/uapi/linux/posix_types.h:4, from include/uapi/linux/types.h:13, from include/linux/types.h:5, from include/linux/list.h:4, from include/linux/module.h:9, from net/core/skbuff.c:41: include/net/sch_generic.h: In function 'qdisc_cb_private_validate': include/net/sch_generic.h:267:33: warning: comparison of integer expressions of different signedness: 'long unsigned int' and 'int' [-Wsign-compare] 267 | BUILD_BUG_ON(sizeof(qcb->data) < sz); | ^ include/linux/compiler.h:491:19: note: in definition of macro '__compiletime_assert' 491 | bool __cond = !(condition); \ | ^~~~~~~~~ include/linux/compiler.h:511:2: note: in expansion of macro '_compiletime_assert' 511 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) | ^~~~~~~~~~~~~~~~~~~ include/linux/bug.h:50:37: note: in expansion of macro 'compiletime_assert' 50 | #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg) | ^~~~~~~~~~~~~~~~~~ include/linux/bug.h:74:2: note: in expansion of macro 'BUILD_BUG_ON_MSG' 74 | BUILD_BUG_ON_MSG(condition, "BUILD_BUG_ON failed: " #condition) | ^~~~~~~~~~~~~~~~ include/net/sch_generic.h:267:2: note: in expansion of macro 'BUILD_BUG_ON' 267 | BUILD_BUG_ON(sizeof(qcb->data) < sz); | ^~~~~~~~~~~~ In file included from include/net/sock.h:62, from include/linux/tcp.h:22, from net/core/skbuff.c:50: include/linux/filter.h: In function 'bpf_needs_clear_a': include/linux/filter.h:517:16: warning: comparison of integer expressions of different signedness: '__u32' {aka 'const unsigned int'} and 'int' [-Wsign-compare] 517 | if (first->k == SKF_AD_OFF + SKF_AD_ALU_XOR_X) | ^~ In file included from include/linux/tcp.h:22, from net/core/skbuff.c:50: include/net/sock.h: In function 'skb_do_copy_data_nocache': include/net/sock.h:1838:54: warning: comparison of integer expressions of different signedness: 'size_t' {aka 'long unsigned int'} and 'int' [-Wsign-compare] 1838 | if (csum_and_copy_from_iter(to, copy, &csum, from) != copy) | ^~ include/net/sock.h:1842:46: warning: comparison of integer expressions of different signedness: 'size_t' {aka 'long unsigned int'} and 'int' [-Wsign-compare] 1842 | if (copy_from_iter_nocache(to, copy, from) != copy) | ^~ include/net/sock.h:1844:44: warning: comparison of integer expressions of different signedness: 'size_t' {aka 'long unsigned int'} and 'int' [-Wsign-compare] 1844 | } else if (copy_from_iter(to, copy, from) != copy) | ^~ In file included from include/linux/tcp.h:23, from net/core/skbuff.c:50: include/net/inet_connection_sock.h: In function 'inet_csk_reqsk_queue_is_full': include/net/inet_connection_sock.h:294:38: warning: comparison of integer expressions of different signedness: 'int' and 'u32' {aka 'const unsigned int'} [-Wsign-compare] 294 | return inet_csk_reqsk_queue_len(sk) >= sk->sk_max_ack_backlog; | ^~ net/core/skbuff.c: In function '___pskb_trim': net/core/skbuff.c:1440:13: warning: comparison of integer expressions of different signedness: 'int' and 'unsigned int' [-Wsign-compare] 1440 | if (offset >= len) | ^~ net/core/skbuff.c:1446:11: warning: comparison of integer expressions of different signedness: 'int' and 'unsigned int' [-Wsign-compare] 1446 | if (end < len) { | ^ net/core/skbuff.c:1481:11: warning: comparison of integer expressions of different signedness: 'int' and 'unsigned int' [-Wsign-compare] 1481 | if (end < len) { | ^ net/core/skbuff.c:1486:11: warning: comparison of integer expressions of different signedness: 'int' and 'unsigned int' [-Wsign-compare] 1486 | if (end > len && | ^ net/core/skbuff.c: In function 'pskb_trim_rcsum_slow': 1523 | if (offset + sizeof(__sum16) > hdlen) | ^ net/core/skbuff.c: In function '__pskb_pull_tail': net/core/skbuff.c:1603:18: warning: comparison of integer expressions of different signedness: 'unsigned int' and 'int' [-Wsign-compare] 1603 | if (list->len <= eat) { | ^~ net/core/skbuff.c: In function 'skb_split_no_header': net/core/skbuff.c:2571:18: warning: comparison of integer expressions of different signedness: 'int' and 'u32' {aka 'const unsigned int'} [-Wsign-compare] 2571 | if (pos + size > len) { | ^ net/core/skbuff.c:2574:12: warning: comparison of integer expressions of different signedness: 'int' and 'u32' {aka 'const unsigned int'} [-Wsign-compare] 2574 | if (pos < len) { | ^ net/core/skbuff.c: In function 'skb_split': net/core/skbuff.c:2609:10: warning: comparison of integer expressions of different signedness: 'u32' {aka 'const unsigned int'} and 'int' [-Wsign-compare] 2609 | if (len < pos) /* Split line is inside header. */ | ^ In file included from include/linux/bug.h:4, from include/linux/thread_info.h:11, from include/asm-generic/preempt.h:4, from arch/mips/include/generated/asm/preempt.h:1, from include/linux/preempt.h:59, from include/linux/spinlock.h:50, from include/linux/seqlock.h:35, from include/linux/time.h:5, from include/linux/stat.h:18, from include/linux/module.h:10, from net/core/skbuff.c:41: net/core/skbuff.c: In function 'skb_shift': net/core/skbuff.c:2648:18: warning: comparison of integer expressions of different signedness: 'int' and 'unsigned int' [-Wsign-compare] 2648 | BUG_ON(shiftlen > skb->len); | ^ arch/mips/include/asm/bug.h:33:44: note: in definition of macro 'BUG_ON' 33 | #define BUG_ON(C) __BUG_ON((unsigned long)(C)) | ^ net/core/skbuff.c:2687:16: warning: comparison of integer expressions of different signedness: 'int' and 'unsigned int' [-Wsign-compare] 2687 | if ((shiftlen == skb->len) && | ^~ net/core/skbuff.c:2688:41: warning: comparison of integer expressions of different signedness: 'int' and 'long unsigned int' [-Wsign-compare] 2688 | (skb_shinfo(skb)->nr_frags - from) > (MAX_SKB_FRAGS - to)) | ^ net/core/skbuff.c:2701:12: warning: comparison of integer expressions of different signedness: 'int' and 'unsigned int' [-Wsign-compare] 2701 | if (todo >= skb_frag_size(fragfrom)) { | ^~ net/core/skbuff.c: In function 'skb_append_datato_frags': net/core/skbuff.c:2952:15: warning: comparison of integer expressions of different signedness: 'int' and 'long unsigned int' [-Wsign-compare] 2952 | if (frg_cnt >= MAX_SKB_FRAGS) | ^~ net/core/skbuff.c: In function 'skb_append_pagefrags': net/core/skbuff.c:2993:15: warning: comparison of integer expressions of different signedness: 'int' and 'long unsigned int' [-Wsign-compare] 2993 | } else if (i < MAX_SKB_FRAGS) { | ^ net/core/skbuff.c: In function 'skb_segment': net/core/skbuff.c:3082:13: warning: comparison of integer expressions of different signedness: 'int' and 'unsigned int' [-Wsign-compare] 3082 | if (hsize > len || !sg) | ^ net/core/skbuff.c:3095:15: warning: comparison of integer expressions of different signedness: 'int' and 'unsigned int' [-Wsign-compare] 3095 | while (pos < offset + len) { | ^ net/core/skbuff.c:3099:20: warning: comparison of integer expressions of different signedness: 'int' and 'unsigned int' [-Wsign-compare] 3099 | if (pos + size > offset + len) | ^ net/core/skbuff.c:3175:14: warning: comparison of integer expressions of different signedness: 'int' and 'unsigned int' [-Wsign-compare] 3175 | while (pos < offset + len) { | ^ net/core/skbuff.c:3204:12: warning: comparison of integer expressions of different signedness: 'int' and 'unsigned int' [-Wsign-compare] 3204 | if (pos < offset) { | ^ net/core/skbuff.c:3211:19: warning: comparison of integer expressions of different signedness: 'int' and 'unsigned int' [-Wsign-compare] 3211 | if (pos + size <= offset + len) { | ^~ net/core/skbuff.c: In function 'skb_gro_receive': net/core/skbuff.c:3282:16: warning: comparison of integer expressions of different signedness: 'int' and 'long unsigned int' [-Wsign-compare] 3282 | if (nr_frags > MAX_SKB_FRAGS) | ^ net/core/skbuff.c:3315:40: warning: comparison of integer expressions of different signedness: 'int' and 'long unsigned int' [-Wsign-compare] 3315 | if (nr_frags + 1 + skbinfo->nr_frags > MAX_SKB_FRAGS) | ^ net/core/skbuff.c: In function 'alloc_skb_with_frags': net/core/skbuff.c:4540:13: warning: comparison of integer expressions of different signedness: 'int' and 'long unsigned int' [-Wsign-compare] 4540 | if (npages > MAX_SKB_FRAGS) | ^ In file included from arch/mips/include/asm/atomic.h:22, from include/linux/atomic.h:4, from include/linux/debug_locks.h:5, from include/linux/lockdep.h:23, from include/linux/spinlock_types.h:18, from include/linux/spinlock.h:81, from include/linux/seqlock.h:35, from include/linux/time.h:5, from include/linux/stat.h:18, from include/linux/module.h:10, from net/core/skbuff.c:41: arch/mips/include/asm/atomic.h: In function '__atomic_add_unless': arch/mips/include/asm/cmpxchg.h:212:6: warning: this statement may fall through [-Wimplicit-fallthrough=] 212 | if (sizeof(long) == 8) { \ | ^ arch/mips/include/asm/cmpxchg.h:227:33: note: in expansion of macro '__cmpxchg' 227 | #define cmpxchg(ptr, old, new) __cmpxchg(ptr, old, new, smp_mb__before_llsc(), smp_llsc_mb()) | ^~~~~~~~~ vim +1523 net/core/skbuff.c 1508 1509 /* Note : use pskb_trim_rcsum() instead of calling this directly 1510 */ 1511 int pskb_trim_rcsum_slow(struct sk_buff *skb, unsigned int len) 1512 { 1513 if (skb->ip_summed == CHECKSUM_COMPLETE) { 1514 int delta = skb->len - len; 1515 1516 skb->csum = csum_block_sub(skb->csum, 1517 skb_checksum(skb, len, delta, 0), 1518 len); 1519 } else if (skb->ip_summed == CHECKSUM_PARTIAL) { 1520 int hdlen = (len > skb_headlen(skb)) ? skb_headlen(skb) : len; 1521 int offset = skb_checksum_start_offset(skb) + skb->csum_offset; 1522 1524 return -EINVAL; 1525 } 1526 return __pskb_trim(skb, len); 1527 } 1528 EXPORT_SYMBOL(pskb_trim_rcsum_slow); 1529 --- 0-DAY CI Kernel Test Service, Intel Corporation https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org