Subject: Re: [PATCH net-next 2/3] tcp: move tcp_v6_send_check() to tcp_output.c

From: kernel test robot <[email-masked]>
Date: Mon, 9 Feb 2026 13:10:00 +0800

Hello,

kernel test robot noticed "RIP:skb_checksum_help" on:

commit: e0b782187c458dac827263181b85fed32e3e0faa ("[PATCH net-next 2/3] tcp: move tcp_v6_send_check() to tcp_output.c")
url: https://github.com/intel-lab-lkp/linux/commits/Eric-Dumazet/tcp-inline-__tcp_v4_send_check/20260203-224938
base: https://git.kernel.org/cgit/linux/kernel/git/davem/net-next.git 667539f6dce27aa7db0a711375f94e14e714a698
patch link: https://lore.kernel.org/all/[email-masked]/
patch subject: [PATCH net-next 2/3] tcp: move tcp_v6_send_check() to tcp_output.c

in testcase: kernel-selftests
version: kernel-selftests-x86_64-9f2693489ef8-1_20260201
with following parameters:

	group: sgx

config: x86_64-rhel-9.4-kselftests
compiler: gcc-14
test machine: 16 threads 1 sockets Intel(R) Xeon(R) E-2278G CPU @ 3.40GHz (Coffee Lake-E) with 32G memory

(please refer to attached dmesg/kmsg for entire log/backtrace)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email-masked]>
| Closes: https://lore.kernel.org/oe-lkp/[email-masked]

[   58.597580][ T2071] ------------[ cut here ]------------
[   58.597581][ T2071] offset (-246) >= skb_headlen() (74)
[   58.597583][ T2071] WARNING: net/core/dev.c:3591 at skb_checksum_help+0x3fc/0x6b0, CPU#9: wget/2071
[   58.597589][ T2071] Modules linked in: btrfs blake2b libblake2b xor zstd_compress raid6_pq intel_rapl_msr intel_rapl_common intel_uncore_frequency intel_uncore_frequency_common x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel sd_mod kvm sg snd_pcm irqbypass ghash_clmulni_intel ast snd_timer i2c_designware_platform rapl drm_client_lib i2c_designware_core snd intel_cstate drm_shmem_helper ppdev ahci soundcore wmi_bmof intel_wmi_thunderbolt libahci intel_uncore i2c_i801 drm_kms_helper intel_lpss_pci mei_me intel_pmc_core intel_lpss intel_ish_ipc pcspkr i2c_smbus libata idma64 mei intel_ishtp intel_pch_thermal ie31200_edac parport_pc pmt_telemetry video acpi_power_meter parport pmt_discovery pmt_class acpi_ipmi wmi ipmi_devintf pinctrl_cannonlake intel_pmc_ssram_telemetry intel_vsec ipmi_msghandler acpi_pad acpi_tad binfmt_misc fuse drm nfnetlink sch_fq_codel
[   58.597670][ T2071] CPU: 9 UID: 0 PID: 2071 Comm: wget Tainted: G S                  6.19.0-rc7-01160-ge0b782187c45 #1 PREEMPT(voluntary)
[   58.597674][ T2071] Tainted: [S]=CPU_OUT_OF_SPEC
[   58.597676][ T2071] Hardware name: Intel Corporation Mehlow UP Server Platform/Moss Beach Server, BIOS CNLSE2R1.R00.X188.B13.1903250419 03/25/2019
[   58.597678][ T2071] RIP: 0010:skb_checksum_help (net/core/dev.c:3591 (discriminator 1))
[   58.597681][ T2071] Code: ff ff 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 80 3d 38 9f e0 02 00 0f 84 13 01 00 00 48 8d 3d b4 86 ea 02 89 c2 44 89 c6 <67> 48 0f b9 3a eb c8 80 3d 17 9f e0 02 00 0f 84 69 01 00 00 48 8d
All code
========
   0:	ff                   	(bad)
   1:	ff 5b 5d             	lcall  *0x5d(%rbx)
   4:	41 5c                	pop    %r12
   6:	41 5d                	pop    %r13
   8:	41 5e                	pop    %r14
   a:	41 5f                	pop    %r15
   c:	c3                   	ret
   d:	cc                   	int3
   e:	cc                   	int3
   f:	cc                   	int3
  10:	cc                   	int3
  11:	80 3d 38 9f e0 02 00 	cmpb   $0x0,0x2e09f38(%rip)        # 0x2e09f50
  18:	0f 84 13 01 00 00    	je     0x131
  1e:	48 8d 3d b4 86 ea 02 	lea    0x2ea86b4(%rip),%rdi        # 0x2ea86d9
  25:	89 c2                	mov    %eax,%edx
  27:	44 89 c6             	mov    %r8d,%esi
  2a:*	67 48 0f b9 3a       	ud1    (%edx),%rdi		<-- trapping instruction
  2f:	eb c8                	jmp    0xfffffffffffffff9
  31:	80 3d 17 9f e0 02 00 	cmpb   $0x0,0x2e09f17(%rip)        # 0x2e09f4f
  38:	0f 84 69 01 00 00    	je     0x1a7
  3e:	48                   	rex.W
  3f:	8d                   	.byte 0x8d

Code starting with the faulting instruction
===========================================
   0:	67 48 0f b9 3a       	ud1    (%edx),%rdi
   5:	eb c8                	jmp    0xffffffffffffffcf
   7:	80 3d 17 9f e0 02 00 	cmpb   $0x0,0x2e09f17(%rip)        # 0x2e09f25
   e:	0f 84 69 01 00 00    	je     0x17d
  14:	48                   	rex.W
  15:	8d                   	.byte 0x8d
[   58.597684][ T2071] RSP: 0018:ffffc900078feeb8 EFLAGS: 00010202
[   58.597687][ T2071] RAX: 000000000000004a RBX: ffff88885161cd68 RCX: 0000000000000000
[   58.597689][ T2071] RDX: 000000000000004a RSI: 00000000ffffff0a RDI: ffffffff8669e580
[   58.597690][ T2071] RBP: ffff88885161ce38 R08: 00000000ffffff0a R09: 0000000000000000
[   58.597692][ T2071] R10: ffff8887d84ac7cb R11: ffffffff85611318 R12: ffff88885161cddc
[   58.597694][ T2071] R13: 00000000000000f6 R14: ffff88885161cdd8 R15: 0000000000000000
[   58.597696][ T2071] FS:  00007f92ce5929c0(0000) GS:ffff888850da1000(0000) knlGS:0000000000000000
[   58.597698][ T2071] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   58.597699][ T2071] CR2: 00007f820b871060 CR3: 0000000320a0a006 CR4: 00000000003726f0
[   58.597701][ T2071] Call Trace:
[   58.597703][ T2071]  <TASK>
[   58.597708][ T2071]  skb_csum_hwoffload_help (net/core/dev.c:3910)
[   58.597714][ T2071]  ? __pfx_skb_csum_hwoffload_help (net/core/dev.c:3910)
[   58.597722][ T2071]  validate_xmit_skb (net/core/dev.c:4040 (discriminator 1))
[   58.597728][ T2071]  validate_xmit_skb_list (net/core/dev.c:4068)
[   58.597733][ T2071]  sch_direct_xmit (net/sched/sch_generic.c:335 (discriminator 1))
[   58.597740][ T2071]  ? __pfx_sch_direct_xmit (net/sched/sch_generic.c:322)
[   58.597742][ T2071]  ? do_raw_spin_lock (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 kernel/locking/spinlock_debug.c:116)
[   58.597746][ T2071]  ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114)
[   58.597750][ T2071]  ? lock_acquire (include/trace/events/lock.h:24 (discriminator 2) kernel/locking/lockdep.c:5831 (discriminator 2))
[   58.597755][ T2071]  __dev_xmit_skb (net/core/dev.c:4248 (discriminator 1))
[   58.597761][ T2071]  ? __pfx___dev_xmit_skb (net/core/dev.c:4155)
[   58.597765][ T2071]  ? netdev_pick_tx (net/core/dev.c:4673)
[   58.597772][ T2071]  __dev_queue_xmit (net/core/dev.c:4797 (discriminator 1))
[   58.597776][ T2071]  ? check_prev_add (kernel/locking/lockdep.c:3245)
[   58.597779][ T2071]  ? look_up_lock_class (kernel/locking/lockdep.c:933 (discriminator 28))
[   58.597784][ T2071]  ? validate_chain (kernel/locking/lockdep.c:192 kernel/locking/lockdep.c:3912)
[   58.597787][ T2071]  ? lock_release (kernel/locking/lockdep.c:470 (discriminator 4) kernel/locking/lockdep.c:5891 (discriminator 4) kernel/locking/lockdep.c:5875 (discriminator 4))
[   58.604179][  T427]
[   58.609631][ T2071]  ? __pfx___dev_queue_xmit (net/core/dev.c:4739)
[   58.614759][  T427] Setting up libperl5.40:amd64 (5.40.1-6) ...
[   58.622521][ T2071]  ? __lock_acquire (kernel/locking/lockdep.c:5598 (discriminator 1) kernel/locking/lockdep.c:5227 (discriminator 1))
[   58.622528][ T2071]  ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1))
[   58.630933][  T427]
[   58.639329][ T2071]  ? ip_finish_output2 (include/net/neighbour.h:554 net/ipv4/ip_output.c:237)
[   58.639350][ T2071]  ? mark_held_locks (kernel/locking/lockdep.c:4325 (discriminator 1))
[   58.648209][  T427] Setting up perl (5.40.1-6) ...
[   58.654544][ T2071]  ? neigh_hh_output (arch/x86/include/asm/irqflags.h:42 arch/x86/include/asm/irqflags.h:119 arch/x86/include/asm/irqflags.h:159 include/linux/seqlock.h:74 include/linux/seqlock.h:836 include/net/neighbour.h:510)
[   58.654549][ T2071]  ? __asan_memcpy (mm/kasan/shadow.c:105 (discriminator 1))
[   58.659944][  T427]
[   58.665171][ T2071]  ? neigh_hh_output (include/net/neighbour.h:521 (discriminator 6))
[   58.665177][ T2071]  ip_finish_output2 (include/net/neighbour.h:554 net/ipv4/ip_output.c:237)
[   58.674975][  T427] Setting up libgcc-14-dev:amd64 (14.2.0-19) ...
[   58.750584][ T2071]  ? __pfx_ip_finish_output2 (net/ipv4/ip_output.c:201)
[   58.763043][  T427]
[   58.767700][ T2071]  ? __ip_finish_output (include/net/ip.h:518 net/ipv4/ip_output.c:308 net/ipv4/ip_output.c:297)
[   58.781614][  T427] Setting up gcc-14-x86-64-linux-gnu (14.2.0-19) ...
[   58.786471][ T2071]  ip_output (include/linux/netfilter.h:307 net/ipv4/ip_output.c:438)
[   58.805959][  T427]
[   58.811915][ T2071]  ? __pfx_ip_output (net/ipv4/ip_output.c:429)
[   58.811918][ T2071]  ? lock_acquire (include/linux/preempt.h:469 (discriminator 2) include/trace/events/lock.h:24 (discriminator 2) include/trace/events/lock.h:24 (discriminator 2) kernel/locking/lockdep.c:5831 (discriminator 2))
[   58.820369][  T427] Setting up gcc-14 (14.2.0-19) ...
[   58.827634][ T2071]  ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1))
[   58.835497][  T427]
[   58.843338][ T2071]  ? ip4_dst_hoplimit (include/linux/rcupdate.h:341 include/linux/rcupdate.h:897 include/net/route.h:395)
[   58.851846][  T427] Setting up gcc-x86-64-linux-gnu (4:14.2.0-1) ...
[   58.860005][ T2071]  ? ip4_dst_hoplimit (include/linux/rcupdate.h:341 include/linux/rcupdate.h:897 include/net/route.h:395)
[   58.866491][  T427]
[   58.874333][ T2071]  ? __lock_release+0x5d/0x1b0
[   58.878004][  T427] Setting up gcc (4:14.2.0-1) ...
[   58.880336][ T2071]  __ip_queue_xmit (include/net/dst.h:470 (discriminator 8) net/ipv4/ip_output.c:131 (discriminator 8) net/ipv4/ip_output.c:534 (discriminator 8))
[   58.885595][  T427]
[   58.891439][ T2071]  __tcp_transmit_skb (net/ipv4/tcp_output.c:1696 (discriminator 4))
[   58.896997][  T427] Setting up g++-14-x86-64-linux-gnu (14.2.0-19) ...
[   58.901427][ T2071]  ? __pfx___tcp_transmit_skb (net/ipv4/tcp_output.c:1513)
[   58.906158][  T427]
[   58.911321][ T2071]  ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4629 (discriminator 4))
[   58.916669][  T427] Setting up g++-14 (14.2.0-19) ...
[   58.921472][ T2071]  tcp_connect (net/ipv4/tcp_output.c:1714 net/ipv4/tcp_output.c:4380)
[   58.925973][  T427]
[   58.930620][ T2071]  ? __pfx_tcp_connect (net/ipv4/tcp_output.c:4300)
[   58.936411][  T427] Setting up g++-x86-64-linux-gnu (4:14.2.0-1) ...
[   58.940337][ T2071]  ? get_net_ns_by_id (include/linux/rcupdate.h:895 (discriminator 5) net/core/net_namespace.c:383 (discriminator 5))
[   58.945154][  T427]
[   58.949884][ T2071]  ? lock_release (kernel/locking/lockdep.c:470 (discriminator 4) kernel/locking/lockdep.c:5891 (discriminator 4) kernel/locking/lockdep.c:5875 (discriminator 4))
[   58.949914][ T2071]  tcp_v4_connect (net/ipv4/tcp_ipv4.c:347 (discriminator 1))
[   58.955368][  T427] Setting up g++ (4:14.2.0-1) ...
[   58.959662][ T2071]  ? __pfx_tcp_v4_connect (net/ipv4/tcp_ipv4.c:225)
[   58.964136][  T427]
[   58.966346][ T2071]  ? do_raw_spin_lock (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 kernel/locking/spinlock_debug.c:116)
[   58.972814][  T427] update-alternatives: using /usr/bin/g++ to provide /usr/bin/c++ (c++) in auto mode
[   58.977548][ T2071]  ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1))
[   58.982282][  T427]
[   58.986831][ T2071]  ? inet_stream_connect (net/ipv4/af_inet.c:750)
[   58.989558][  T427] Setting up libdpkg-perl (1.22.21) ...
[   58.994118][ T2071]  __inet_stream_connect (net/ipv4/af_inet.c:679)
[   58.998769][  T427]
[   59.003583][ T2071]  inet_stream_connect (net/ipv4/af_inet.c:751)
[   59.008877][  T427] Setting up dropwatch (1.5.4-4) ...
[   59.012874][ T2071]  __sys_connect (include/linux/file.h:62 (discriminator 1) include/linux/file.h:83 (discriminator 1) net/socket.c:2098 (discriminator 1))
[   59.015120][  T427]
[   59.019936][ T2071]  ? __pfx___sys_connect (net/socket.c:2096)
[   59.025375][  T427] Setting up ebtables (2.0.11-6) ...
[   59.031064][ T2071]  ? _copy_to_user (arch/x86/include/asm/uaccess_64.h:126 arch/x86/include/asm/uaccess_64.h:147 include/linux/uaccess.h:206 lib/usercopy.c:26)
[   59.036408][  T427]
[   59.038621][ T2071]  ? __x64_sys_rt_sigaction (kernel/signal.c:4646 (discriminator 1) kernel/signal.c:4627 (discriminator 1) kernel/signal.c:4627 (discriminator 1))
[   59.045289][  T427] update-alternatives: using /usr/sbin/ebtables-legacy to provide /usr/sbin/ebtables (ebtables) in auto mode
[   59.050243][ T2071]  ? __pfx___x64_sys_rt_sigaction (kernel/signal.c:4627)
[   59.054368][  T427]
[   59.056585][ T2071]  __x64_sys_connect (net/socket.c:2111)
[   59.061751][  T427] Setting up lib32gcc-s1 (14.2.0-19) ...
[   59.066293][ T2071]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))
[   59.066299][ T2071]  ? lock_acquire (include/linux/preempt.h:469 (discriminator 2) include/trace/events/lock.h:24 (discriminator 2) include/trace/events/lock.h:24 (discriminator 2) kernel/locking/lockdep.c:5831 (discriminator 2))
[   59.071388][  T427]
[   59.075940][ T2071]  ? __might_fault (mm/memory.c:7177 (discriminator 1))
[   59.078713][  T427] Setting up libx32gcc-s1 (14.2.0-19) ...
[   59.083070][ T2071]  ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1))
[   59.089460][  T427]
[   59.094354][ T2071]  ? __might_fault (mm/memory.c:7177 (discriminator 1))
[   59.097161][  T427] Setting up lib32atomic1 (14.2.0-19) ...
[   59.101827][ T2071]  ? __might_fault (mm/memory.c:7177 (discriminator 1))

The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20260209/[email-masked]

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki