| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <202602091222.231689fb-lkp@intel.com>
Date: Mon, 9 Feb 2026 13:10:00 +0800
From: kernel test robot <oliver.sang@...el.com>
To: Eric Dumazet <edumazet@...gle.com>
CC: <oe-lkp@...ts.linux.dev>, <lkp@...el.com>, <netdev@...r.kernel.org>,
"David S . Miller" <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>,
Paolo Abeni <pabeni@...hat.com>, Simon Horman <horms@...nel.org>, "Neal
Cardwell" <ncardwell@...gle.com>, Kuniyuki Iwashima <kuniyu@...gle.com>,
<eric.dumazet@...il.com>, Eric Dumazet <edumazet@...gle.com>,
<oliver.sang@...el.com>
Subject: Re: [PATCH net-next 2/3] tcp: move tcp_v6_send_check() to
tcp_output.c
Hello,
kernel test robot noticed "RIP:skb_checksum_help" on:
commit: e0b782187c458dac827263181b85fed32e3e0faa ("[PATCH net-next 2/3] tcp: move tcp_v6_send_check() to tcp_output.c")
url: https://github.com/intel-lab-lkp/linux/commits/Eric-Dumazet/tcp-inline-__tcp_v4_send_check/20260203-224938
base: https://git.kernel.org/cgit/linux/kernel/git/davem/net-next.git 667539f6dce27aa7db0a711375f94e14e714a698
patch link: https://lore.kernel.org/all/20260203144053.83193-3-edumazet@google.com/
patch subject: [PATCH net-next 2/3] tcp: move tcp_v6_send_check() to tcp_output.c
in testcase: kernel-selftests
version: kernel-selftests-x86_64-9f2693489ef8-1_20260201
with following parameters:
group: sgx
config: x86_64-rhel-9.4-kselftests
compiler: gcc-14
test machine: 16 threads 1 sockets Intel(R) Xeon(R) E-2278G CPU @ 3.40GHz (Coffee Lake-E) with 32G memory
(please refer to attached dmesg/kmsg for entire log/backtrace)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@...el.com>
| Closes: https://lore.kernel.org/oe-lkp/202602091222.231689fb-lkp@intel.com
[ 58.597580][ T2071] ------------[ cut here ]------------
[ 58.597581][ T2071] offset (-246) >= skb_headlen() (74)
[ 58.597583][ T2071] WARNING: net/core/dev.c:3591 at skb_checksum_help+0x3fc/0x6b0, CPU#9: wget/2071
[ 58.597589][ T2071] Modules linked in: btrfs blake2b libblake2b xor zstd_compress raid6_pq intel_rapl_msr intel_rapl_common intel_uncore_frequency intel_uncore_frequency_common x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel sd_mod kvm sg snd_pcm irqbypass ghash_clmulni_intel ast snd_timer i2c_designware_platform rapl drm_client_lib i2c_designware_core snd intel_cstate drm_shmem_helper ppdev ahci soundcore wmi_bmof intel_wmi_thunderbolt libahci intel_uncore i2c_i801 drm_kms_helper intel_lpss_pci mei_me intel_pmc_core intel_lpss intel_ish_ipc pcspkr i2c_smbus libata idma64 mei intel_ishtp intel_pch_thermal ie31200_edac parport_pc pmt_telemetry video acpi_power_meter parport pmt_discovery pmt_class acpi_ipmi wmi ipmi_devintf pinctrl_cannonlake intel_pmc_ssram_telemetry intel_vsec ipmi_msghandler acpi_pad acpi_tad binfmt_misc fuse drm nfnetlink sch_fq_codel
[ 58.597670][ T2071] CPU: 9 UID: 0 PID: 2071 Comm: wget Tainted: G S 6.19.0-rc7-01160-ge0b782187c45 #1 PREEMPT(voluntary)
[ 58.597674][ T2071] Tainted: [S]=CPU_OUT_OF_SPEC
[ 58.597676][ T2071] Hardware name: Intel Corporation Mehlow UP Server Platform/Moss Beach Server, BIOS CNLSE2R1.R00.X188.B13.1903250419 03/25/2019
[ 58.597678][ T2071] RIP: 0010:skb_checksum_help (net/core/dev.c:3591 (discriminator 1))
[ 58.597681][ T2071] Code: ff ff 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 80 3d 38 9f e0 02 00 0f 84 13 01 00 00 48 8d 3d b4 86 ea 02 89 c2 44 89 c6 <67> 48 0f b9 3a eb c8 80 3d 17 9f e0 02 00 0f 84 69 01 00 00 48 8d
All code
========
0: ff (bad)
1: ff 5b 5d lcall *0x5d(%rbx)
4: 41 5c pop %r12
6: 41 5d pop %r13
8: 41 5e pop %r14
a: 41 5f pop %r15
c: c3 ret
d: cc int3
e: cc int3
f: cc int3
10: cc int3
11: 80 3d 38 9f e0 02 00 cmpb $0x0,0x2e09f38(%rip) # 0x2e09f50
18: 0f 84 13 01 00 00 je 0x131
1e: 48 8d 3d b4 86 ea 02 lea 0x2ea86b4(%rip),%rdi # 0x2ea86d9
25: 89 c2 mov %eax,%edx
27: 44 89 c6 mov %r8d,%esi
2a:* 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: eb c8 jmp 0xfffffffffffffff9
31: 80 3d 17 9f e0 02 00 cmpb $0x0,0x2e09f17(%rip) # 0x2e09f4f
38: 0f 84 69 01 00 00 je 0x1a7
3e: 48 rex.W
3f: 8d .byte 0x8d
Code starting with the faulting instruction
===========================================
0: 67 48 0f b9 3a ud1 (%edx),%rdi
5: eb c8 jmp 0xffffffffffffffcf
7: 80 3d 17 9f e0 02 00 cmpb $0x0,0x2e09f17(%rip) # 0x2e09f25
e: 0f 84 69 01 00 00 je 0x17d
14: 48 rex.W
15: 8d .byte 0x8d
[ 58.597684][ T2071] RSP: 0018:ffffc900078feeb8 EFLAGS: 00010202
[ 58.597687][ T2071] RAX: 000000000000004a RBX: ffff88885161cd68 RCX: 0000000000000000
[ 58.597689][ T2071] RDX: 000000000000004a RSI: 00000000ffffff0a RDI: ffffffff8669e580
[ 58.597690][ T2071] RBP: ffff88885161ce38 R08: 00000000ffffff0a R09: 0000000000000000
[ 58.597692][ T2071] R10: ffff8887d84ac7cb R11: ffffffff85611318 R12: ffff88885161cddc
[ 58.597694][ T2071] R13: 00000000000000f6 R14: ffff88885161cdd8 R15: 0000000000000000
[ 58.597696][ T2071] FS: 00007f92ce5929c0(0000) GS:ffff888850da1000(0000) knlGS:0000000000000000
[ 58.597698][ T2071] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 58.597699][ T2071] CR2: 00007f820b871060 CR3: 0000000320a0a006 CR4: 00000000003726f0
[ 58.597701][ T2071] Call Trace:
[ 58.597703][ T2071] <TASK>
[ 58.597708][ T2071] skb_csum_hwoffload_help (net/core/dev.c:3910)
[ 58.597714][ T2071] ? __pfx_skb_csum_hwoffload_help (net/core/dev.c:3910)
[ 58.597722][ T2071] validate_xmit_skb (net/core/dev.c:4040 (discriminator 1))
[ 58.597728][ T2071] validate_xmit_skb_list (net/core/dev.c:4068)
[ 58.597733][ T2071] sch_direct_xmit (net/sched/sch_generic.c:335 (discriminator 1))
[ 58.597740][ T2071] ? __pfx_sch_direct_xmit (net/sched/sch_generic.c:322)
[ 58.597742][ T2071] ? do_raw_spin_lock (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 kernel/locking/spinlock_debug.c:116)
[ 58.597746][ T2071] ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114)
[ 58.597750][ T2071] ? lock_acquire (include/trace/events/lock.h:24 (discriminator 2) kernel/locking/lockdep.c:5831 (discriminator 2))
[ 58.597755][ T2071] __dev_xmit_skb (net/core/dev.c:4248 (discriminator 1))
[ 58.597761][ T2071] ? __pfx___dev_xmit_skb (net/core/dev.c:4155)
[ 58.597765][ T2071] ? netdev_pick_tx (net/core/dev.c:4673)
[ 58.597772][ T2071] __dev_queue_xmit (net/core/dev.c:4797 (discriminator 1))
[ 58.597776][ T2071] ? check_prev_add (kernel/locking/lockdep.c:3245)
[ 58.597779][ T2071] ? look_up_lock_class (kernel/locking/lockdep.c:933 (discriminator 28))
[ 58.597784][ T2071] ? validate_chain (kernel/locking/lockdep.c:192 kernel/locking/lockdep.c:3912)
[ 58.597787][ T2071] ? lock_release (kernel/locking/lockdep.c:470 (discriminator 4) kernel/locking/lockdep.c:5891 (discriminator 4) kernel/locking/lockdep.c:5875 (discriminator 4))
[ 58.604179][ T427]
[ 58.609631][ T2071] ? __pfx___dev_queue_xmit (net/core/dev.c:4739)
[ 58.614759][ T427] Setting up libperl5.40:amd64 (5.40.1-6) ...
[ 58.622521][ T2071] ? __lock_acquire (kernel/locking/lockdep.c:5598 (discriminator 1) kernel/locking/lockdep.c:5227 (discriminator 1))
[ 58.622528][ T2071] ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1))
[ 58.630933][ T427]
[ 58.639329][ T2071] ? ip_finish_output2 (include/net/neighbour.h:554 net/ipv4/ip_output.c:237)
[ 58.639350][ T2071] ? mark_held_locks (kernel/locking/lockdep.c:4325 (discriminator 1))
[ 58.648209][ T427] Setting up perl (5.40.1-6) ...
[ 58.654544][ T2071] ? neigh_hh_output (arch/x86/include/asm/irqflags.h:42 arch/x86/include/asm/irqflags.h:119 arch/x86/include/asm/irqflags.h:159 include/linux/seqlock.h:74 include/linux/seqlock.h:836 include/net/neighbour.h:510)
[ 58.654549][ T2071] ? __asan_memcpy (mm/kasan/shadow.c:105 (discriminator 1))
[ 58.659944][ T427]
[ 58.665171][ T2071] ? neigh_hh_output (include/net/neighbour.h:521 (discriminator 6))
[ 58.665177][ T2071] ip_finish_output2 (include/net/neighbour.h:554 net/ipv4/ip_output.c:237)
[ 58.674975][ T427] Setting up libgcc-14-dev:amd64 (14.2.0-19) ...
[ 58.750584][ T2071] ? __pfx_ip_finish_output2 (net/ipv4/ip_output.c:201)
[ 58.763043][ T427]
[ 58.767700][ T2071] ? __ip_finish_output (include/net/ip.h:518 net/ipv4/ip_output.c:308 net/ipv4/ip_output.c:297)
[ 58.781614][ T427] Setting up gcc-14-x86-64-linux-gnu (14.2.0-19) ...
[ 58.786471][ T2071] ip_output (include/linux/netfilter.h:307 net/ipv4/ip_output.c:438)
[ 58.805959][ T427]
[ 58.811915][ T2071] ? __pfx_ip_output (net/ipv4/ip_output.c:429)
[ 58.811918][ T2071] ? lock_acquire (include/linux/preempt.h:469 (discriminator 2) include/trace/events/lock.h:24 (discriminator 2) include/trace/events/lock.h:24 (discriminator 2) kernel/locking/lockdep.c:5831 (discriminator 2))
[ 58.820369][ T427] Setting up gcc-14 (14.2.0-19) ...
[ 58.827634][ T2071] ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1))
[ 58.835497][ T427]
[ 58.843338][ T2071] ? ip4_dst_hoplimit (include/linux/rcupdate.h:341 include/linux/rcupdate.h:897 include/net/route.h:395)
[ 58.851846][ T427] Setting up gcc-x86-64-linux-gnu (4:14.2.0-1) ...
[ 58.860005][ T2071] ? ip4_dst_hoplimit (include/linux/rcupdate.h:341 include/linux/rcupdate.h:897 include/net/route.h:395)
[ 58.866491][ T427]
[ 58.874333][ T2071] ? __lock_release+0x5d/0x1b0
[ 58.878004][ T427] Setting up gcc (4:14.2.0-1) ...
[ 58.880336][ T2071] __ip_queue_xmit (include/net/dst.h:470 (discriminator 8) net/ipv4/ip_output.c:131 (discriminator 8) net/ipv4/ip_output.c:534 (discriminator 8))
[ 58.885595][ T427]
[ 58.891439][ T2071] __tcp_transmit_skb (net/ipv4/tcp_output.c:1696 (discriminator 4))
[ 58.896997][ T427] Setting up g++-14-x86-64-linux-gnu (14.2.0-19) ...
[ 58.901427][ T2071] ? __pfx___tcp_transmit_skb (net/ipv4/tcp_output.c:1513)
[ 58.906158][ T427]
[ 58.911321][ T2071] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4629 (discriminator 4))
[ 58.916669][ T427] Setting up g++-14 (14.2.0-19) ...
[ 58.921472][ T2071] tcp_connect (net/ipv4/tcp_output.c:1714 net/ipv4/tcp_output.c:4380)
[ 58.925973][ T427]
[ 58.930620][ T2071] ? __pfx_tcp_connect (net/ipv4/tcp_output.c:4300)
[ 58.936411][ T427] Setting up g++-x86-64-linux-gnu (4:14.2.0-1) ...
[ 58.940337][ T2071] ? get_net_ns_by_id (include/linux/rcupdate.h:895 (discriminator 5) net/core/net_namespace.c:383 (discriminator 5))
[ 58.945154][ T427]
[ 58.949884][ T2071] ? lock_release (kernel/locking/lockdep.c:470 (discriminator 4) kernel/locking/lockdep.c:5891 (discriminator 4) kernel/locking/lockdep.c:5875 (discriminator 4))
[ 58.949914][ T2071] tcp_v4_connect (net/ipv4/tcp_ipv4.c:347 (discriminator 1))
[ 58.955368][ T427] Setting up g++ (4:14.2.0-1) ...
[ 58.959662][ T2071] ? __pfx_tcp_v4_connect (net/ipv4/tcp_ipv4.c:225)
[ 58.964136][ T427]
[ 58.966346][ T2071] ? do_raw_spin_lock (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 kernel/locking/spinlock_debug.c:116)
[ 58.972814][ T427] update-alternatives: using /usr/bin/g++ to provide /usr/bin/c++ (c++) in auto mode
[ 58.977548][ T2071] ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1))
[ 58.982282][ T427]
[ 58.986831][ T2071] ? inet_stream_connect (net/ipv4/af_inet.c:750)
[ 58.989558][ T427] Setting up libdpkg-perl (1.22.21) ...
[ 58.994118][ T2071] __inet_stream_connect (net/ipv4/af_inet.c:679)
[ 58.998769][ T427]
[ 59.003583][ T2071] inet_stream_connect (net/ipv4/af_inet.c:751)
[ 59.008877][ T427] Setting up dropwatch (1.5.4-4) ...
[ 59.012874][ T2071] __sys_connect (include/linux/file.h:62 (discriminator 1) include/linux/file.h:83 (discriminator 1) net/socket.c:2098 (discriminator 1))
[ 59.015120][ T427]
[ 59.019936][ T2071] ? __pfx___sys_connect (net/socket.c:2096)
[ 59.025375][ T427] Setting up ebtables (2.0.11-6) ...
[ 59.031064][ T2071] ? _copy_to_user (arch/x86/include/asm/uaccess_64.h:126 arch/x86/include/asm/uaccess_64.h:147 include/linux/uaccess.h:206 lib/usercopy.c:26)
[ 59.036408][ T427]
[ 59.038621][ T2071] ? __x64_sys_rt_sigaction (kernel/signal.c:4646 (discriminator 1) kernel/signal.c:4627 (discriminator 1) kernel/signal.c:4627 (discriminator 1))
[ 59.045289][ T427] update-alternatives: using /usr/sbin/ebtables-legacy to provide /usr/sbin/ebtables (ebtables) in auto mode
[ 59.050243][ T2071] ? __pfx___x64_sys_rt_sigaction (kernel/signal.c:4627)
[ 59.054368][ T427]
[ 59.056585][ T2071] __x64_sys_connect (net/socket.c:2111)
[ 59.061751][ T427] Setting up lib32gcc-s1 (14.2.0-19) ...
[ 59.066293][ T2071] do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))
[ 59.066299][ T2071] ? lock_acquire (include/linux/preempt.h:469 (discriminator 2) include/trace/events/lock.h:24 (discriminator 2) include/trace/events/lock.h:24 (discriminator 2) kernel/locking/lockdep.c:5831 (discriminator 2))
[ 59.071388][ T427]
[ 59.075940][ T2071] ? __might_fault (mm/memory.c:7177 (discriminator 1))
[ 59.078713][ T427] Setting up libx32gcc-s1 (14.2.0-19) ...
[ 59.083070][ T2071] ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1))
[ 59.089460][ T427]
[ 59.094354][ T2071] ? __might_fault (mm/memory.c:7177 (discriminator 1))
[ 59.097161][ T427] Setting up lib32atomic1 (14.2.0-19) ...
[ 59.101827][ T2071] ? __might_fault (mm/memory.c:7177 (discriminator 1))
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20260209/202602091222.231689fb-lkp@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Powered by blists - more mailing lists