all: fix and enable "-Wsign-compare" warningupstream-main

35 files changed, 103 insertions, 74 deletions

diff --git a/Makefile.am b/Makefile.am
index 2e564404..227fa566 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -41,7 +41,6 @@ warn_cppflags = \
 	-Wpointer-arith \
 	-Wvla \
 	\
-	-Wno-sign-compare \
 	-Wno-unused-parameter \
 	$(NULL)
 
diff --git a/lib/addr.c b/lib/addr.c
index 89a3b38d..a3e9f995 100644
--- a/lib/addr.c
+++ b/lib/addr.c
@@ -1042,8 +1042,8 @@ char *nl_addr2str(const struct nl_addr *addr, char *buf, size_t size)
 
 prefix:
 	if (addr->a_family != AF_MPLS &&
-	    addr->a_prefixlen != (8 * addr->a_len)) {
-		snprintf(tmp, sizeof(tmp), "/%u", addr->a_prefixlen);
+	    (unsigned)addr->a_prefixlen != (8u * ((size_t)addr->a_len))) {
+		snprintf(tmp, sizeof(tmp), "/%d", addr->a_prefixlen);
 		strncat(buf, tmp, size - strlen(buf) - 1);
 	}
 
diff --git a/lib/attr.c b/lib/attr.c
index 11805d93..a365cf2a 100644
--- a/lib/attr.c
+++ b/lib/attr.c
@@ -206,7 +206,7 @@ static int validate_nla(const struct nlattr *nla, int maxtype,
 	else if (pt->type != NLA_UNSPEC)
 		minlen = nla_attr_minlen[pt->type];
 
-	if (nla_len(nla) < minlen)
+	if (_nla_len(nla) < minlen)
 		return -NLE_RANGE;
 
 	if (pt->maxlen && nla_len(nla) > pt->maxlen)
@@ -459,14 +459,14 @@ int nla_strcmp(const struct nlattr *nla, const char *str)
 struct nlattr *nla_reserve(struct nl_msg *msg, int attrtype, int attrlen)
 {
 	struct nlattr *nla;
-	int tlen;
+	size_t tlen;
 
 	if (attrlen < 0)
 		return NULL;
 
 	tlen = NLMSG_ALIGN(msg->nm_nlh->nlmsg_len) + nla_total_size(attrlen);
 
-	if (tlen > msg->nm_size)
+	if (tlen > msg->nm_size || tlen > UINT32_MAX)
 		return NULL;
 
 	nla = (struct nlattr *) nlmsg_tail(msg->nm_nlh);
@@ -738,7 +738,7 @@ int64_t nla_get_s64(const struct nlattr *nla)
 {
 	int64_t tmp = 0;
 
-	if (nla && nla_len(nla) >= sizeof(tmp))
+	if (nla && _nla_len(nla) >= sizeof(tmp))
 		memcpy(&tmp, nla_data(nla), sizeof(tmp));
 
 	return tmp;
@@ -768,7 +768,7 @@ uint64_t nla_get_u64(const struct nlattr *nla)
 {
 	uint64_t tmp = 0;
 
-	if (nla && nla_len(nla) >= sizeof(tmp))
+	if (nla && _nla_len(nla) >= sizeof(tmp))
 		memcpy(&tmp, nla_data(nla), sizeof(tmp));
 
 	return tmp;
diff --git a/lib/fib_lookup/lookup.c b/lib/fib_lookup/lookup.c
index 7ff26840..260f1d9f 100644
--- a/lib/fib_lookup/lookup.c
+++ b/lib/fib_lookup/lookup.c
@@ -236,7 +236,7 @@ int flnl_lookup_build_request(struct flnl_request *req, int flags,
 	fr.fl_fwmark = fwmark != UINT_LEAST64_MAX ? fwmark : 0;
 	fr.fl_tos = tos >= 0 ? tos : 0;
 	fr.fl_scope = scope >= 0 ? scope : RT_SCOPE_UNIVERSE;
-	fr.tb_id_in = table >= 0 ? table : RT_TABLE_UNSPEC;
+	fr.tb_id_in = table >= 0 ? (unsigned)table : (unsigned)RT_TABLE_UNSPEC;
 
 	addr = flnl_request_get_addr(req);
 	if (!addr)
diff --git a/lib/genl/genl.c b/lib/genl/genl.c
index 2e52aae1..41add3a7 100644
--- a/lib/genl/genl.c
+++ b/lib/genl/genl.c
@@ -116,12 +116,14 @@ int genl_send_simple(struct nl_sock *sk, int family, int cmd,
 int genlmsg_valid_hdr(struct nlmsghdr *nlh, int hdrlen)
 {
 	struct genlmsghdr *ghdr;
+	int l;
 
 	if (!nlmsg_valid_hdr(nlh, GENL_HDRLEN))
 		return 0;
 
 	ghdr = nlmsg_data(nlh);
-	if (genlmsg_len(ghdr) < NLMSG_ALIGN(hdrlen))
+	l = genlmsg_len(ghdr);
+	if (l < 0 || ((unsigned)l) < NLMSG_ALIGN(hdrlen))
 		return 0;
 
 	return 1;
diff --git a/lib/genl/mngt.c b/lib/genl/mngt.c
index e55256c5..06a0253a 100644
--- a/lib/genl/mngt.c
+++ b/lib/genl/mngt.c
@@ -248,7 +248,7 @@ int genl_register(struct nl_cache_ops *ops)
 		goto errout;
 	}
 
-	if (ops->co_hdrsize < GENL_HDRSIZE(0)) {
+	if (ops->co_hdrsize < (int)GENL_HDRSIZE(0)) {
 		err = -NLE_INVAL;
 		goto errout;
 	}
diff --git a/lib/mpls.c b/lib/mpls.c
index d0189bfc..f5b4f274 100644
--- a/lib/mpls.c
+++ b/lib/mpls.c
@@ -26,7 +26,7 @@ static const char *mpls_ntop1(const struct mpls_label *addr,
 		uint32_t label = (entry & MPLS_LS_LABEL_MASK) >> MPLS_LS_LABEL_SHIFT;
 		int len = snprintf(dest, destlen, "%u", label);
 
-		if (len >= destlen)
+		if (len < 0 || (unsigned)len >= destlen)
 			break;
 
 		/* Is this the end? */
diff --git a/lib/msg.c b/lib/msg.c
index 0e1592a7..64e6b2f7 100644
--- a/lib/msg.c
+++ b/lib/msg.c
@@ -36,7 +36,7 @@
 #include "nl-priv-dynamic-core/cache-api.h"
 #include "nl-aux-core/nl-core.h"
 
-static size_t default_msg_size;
+static size_t default_msg_size; /* GLOBAL! */
 
 static void _nl_init init_msg_size(void)
 {
@@ -168,7 +168,10 @@ int nlmsg_attrlen(const struct nlmsghdr *nlh, int hdrlen)
 
 int nlmsg_valid_hdr(const struct nlmsghdr *nlh, int hdrlen)
 {
-	if (nlh->nlmsg_len < nlmsg_msg_size(hdrlen))
+	int s;
+
+	s = nlmsg_msg_size(hdrlen);
+	if (s < 0 || nlh->nlmsg_len < ((unsigned)s))
 		return 0;
 
 	return 1;
@@ -183,7 +186,7 @@ int nlmsg_ok(const struct nlmsghdr *nlh, int remaining)
 {
 	return (remaining >= (int)sizeof(struct nlmsghdr) &&
 		nlh->nlmsg_len >= sizeof(struct nlmsghdr) &&
-		nlh->nlmsg_len <= remaining);
+		nlh->nlmsg_len <= ((unsigned)remaining));
 }
 
 /**
@@ -369,8 +372,11 @@ struct nl_msg *nlmsg_alloc_simple(int nlmsgtype, int flags)
  */
 void nlmsg_set_default_size(size_t max)
 {
-	if (max < nlmsg_total_size(0))
-		max = nlmsg_total_size(0);
+	size_t s;
+
+	s = nlmsg_total_size(0);
+	if (max < s)
+		max = s;
 
 	default_msg_size = max;
 }
@@ -841,7 +847,7 @@ static void *print_genl_msg(struct nl_msg *msg, FILE *ofd, struct nlmsghdr *hdr,
 {
 	char *data = nlmsg_data(hdr);
 
-	if (*payloadlen < GENL_HDRLEN)
+	if (*payloadlen < (int)GENL_HDRLEN)
 		return data;
 
 	print_genl_hdr(ofd, data);
@@ -917,10 +923,12 @@ static void dump_error_msg(struct nl_msg *msg, FILE *ofd)
 {
 	struct nlmsghdr *hdr = nlmsg_hdr(msg);
 	struct nlmsgerr *err = nlmsg_data(hdr);
+	int l;
 
 	fprintf(ofd, "  [ERRORMSG] %zu octets\n", sizeof(*err));
 
-	if (nlmsg_len(hdr) >= sizeof(*err)) {
+	l = nlmsg_len(hdr);
+	if (l >= 0 && ((unsigned)l) >= sizeof(*err)) {
 		struct nl_msg *errmsg;
 
 		fprintf(ofd, "    .error = %d \"%s\"\n", err->error,
diff --git a/lib/netfilter/log_msg_obj.c b/lib/netfilter/log_msg_obj.c
index 6b6ff07d..6e8b5541 100644
--- a/lib/netfilter/log_msg_obj.c
+++ b/lib/netfilter/log_msg_obj.c
@@ -377,7 +377,9 @@ uint32_t nfnl_log_msg_get_physoutdev(const struct nfnl_log_msg *msg)
 
 void nfnl_log_msg_set_hwaddr(struct nfnl_log_msg *msg, uint8_t *hwaddr, int len)
 {
-	if (len > sizeof(msg->log_msg_hwaddr))
+	if (len < 0)
+		len = 0;
+	else if (((unsigned)len) > sizeof(msg->log_msg_hwaddr))
 		len = sizeof(msg->log_msg_hwaddr);
 	msg->log_msg_hwaddr_len = len;
 	memcpy(msg->log_msg_hwaddr, hwaddr, len);
diff --git a/lib/netfilter/queue_msg_obj.c b/lib/netfilter/queue_msg_obj.c
index 000669bc..210351b8 100644
--- a/lib/netfilter/queue_msg_obj.c
+++ b/lib/netfilter/queue_msg_obj.c
@@ -378,9 +378,10 @@ uint32_t nfnl_queue_msg_get_physoutdev(const struct nfnl_queue_msg *msg)
 void nfnl_queue_msg_set_hwaddr(struct nfnl_queue_msg *msg, uint8_t *hwaddr,
 			       int len)
 {
-	if (len > sizeof(msg->queue_msg_hwaddr))
+	if (len < 0)
+		len = 0;
+	else if (((unsigned)len) > sizeof(msg->queue_msg_hwaddr))
 		len = sizeof(msg->queue_msg_hwaddr);
-
 	msg->queue_msg_hwaddr_len = len;
 	memcpy(msg->queue_msg_hwaddr, hwaddr, len);
 	msg->ce_mask |= QUEUE_MSG_ATTR_HWADDR;
diff --git a/lib/nl.c b/lib/nl.c
index 7d729a79..a24c0260 100644
--- a/lib/nl.c
+++ b/lib/nl.c
@@ -659,7 +659,7 @@ int nl_recv(struct nl_sock *sk, struct sockaddr_nl *nla,
 {
 	ssize_t n;
 	int flags = 0;
-	static int page_size = 0;
+	static int page_size = 0; /* GLOBAL! */
 	struct iovec iov;
 	struct msghdr msg = {
 		.msg_name = (void *) nla,
@@ -680,7 +680,7 @@ int nl_recv(struct nl_sock *sk, struct sockaddr_nl *nla,
 	if (page_size == 0)
 		page_size = getpagesize() * 4;
 
-	iov.iov_len = sk->s_bufsize ? sk->s_bufsize : page_size;
+	iov.iov_len = sk->s_bufsize ? sk->s_bufsize : ((size_t)page_size);
 	iov.iov_base = malloc(iov.iov_len);
 
 	if (!iov.iov_base) {
@@ -734,7 +734,7 @@ retry:
 		goto retry;
 	}
 
-	if (iov.iov_len < n || (msg.msg_flags & MSG_TRUNC)) {
+	if (iov.iov_len < ((size_t)n) || (msg.msg_flags & MSG_TRUNC)) {
 		void *tmp;
 
 		/* respond with error to an incomplete message */
@@ -964,7 +964,8 @@ continue_reading:
 		else if (hdr->nlmsg_type == NLMSG_ERROR) {
 			struct nlmsgerr *e = nlmsg_data(hdr);
 
-			if (hdr->nlmsg_len < nlmsg_size(sizeof(*e))) {
+			if (hdr->nlmsg_len <
+			    ((unsigned)nlmsg_size(sizeof(*e)))) {
 				/* Truncated error message, the default action
 				 * is to stop parsing. The user may overrule
 				 * this action by returning NL_SKIP or
diff --git a/lib/route/addr.c b/lib/route/addr.c
index 1f72c535..34b834ed 100644
--- a/lib/route/addr.c
+++ b/lib/route/addr.c
@@ -642,7 +642,7 @@ struct rtnl_addr *rtnl_addr_get(struct nl_cache *cache, int ifindex,
 		return NULL;
 
 	nl_list_for_each_entry(a, &cache->c_items, ce_list) {
-		if (ifindex && a->a_ifindex != ifindex)
+		if (ifindex != 0 && a->a_ifindex != ((unsigned)ifindex))
 			continue;
 
 		if (a->ce_mask & ADDR_ATTR_LOCAL &&
diff --git a/lib/route/class.c b/lib/route/class.c
index 29ba8094..c04b1124 100644
--- a/lib/route/class.c
+++ b/lib/route/class.c
@@ -359,7 +359,8 @@ struct rtnl_class *rtnl_class_get(struct nl_cache *cache, int ifindex,
 		return NULL;
 
 	nl_list_for_each_entry(class, &cache->c_items, ce_list) {
-		if (class->c_handle == handle && class->c_ifindex == ifindex) {
+		if (class->c_handle == handle &&
+		    class->c_ifindex == ((unsigned)ifindex)) {
 			nl_object_get((struct nl_object *) class);
 			return class;
 		}
@@ -390,7 +391,8 @@ struct rtnl_class *rtnl_class_get_by_parent(struct nl_cache *cache, int ifindex,
 		return NULL;
 
 	nl_list_for_each_entry(class, &cache->c_items, ce_list) {
-		if (class->c_parent == parent && class->c_ifindex == ifindex) {
+		if (class->c_parent == parent &&
+		    class->c_ifindex == ((unsigned)ifindex)) {
 			nl_object_get((struct nl_object *) class);
 			return class;
 		}
diff --git a/lib/route/cls.c b/lib/route/cls.c
index 8f970b12..b207a093 100644
--- a/lib/route/cls.c
+++ b/lib/route/cls.c
@@ -393,7 +393,7 @@ struct rtnl_cls *rtnl_cls_find_by_handle(struct nl_cache *cache, int ifindex, ui
 
 	nl_list_for_each_entry(cls, &cache->c_items, ce_list) {
 		if ((cls->c_parent == parent) &&
-		    (cls->c_ifindex == ifindex)&&
+		    cls->c_ifindex == ((unsigned)ifindex) &&
 		    (cls->c_handle == handle)) {
 			nl_object_get((struct nl_object *) cls);
 			return cls;
@@ -429,9 +429,9 @@ struct rtnl_cls *rtnl_cls_find_by_prio(struct nl_cache *cache, int ifindex,
 
 	nl_list_for_each_entry(cls, &cache->c_items, ce_list) {
 		if ((cls->c_parent == parent) &&
-		    (cls->c_ifindex == ifindex) &&
+		    cls->c_ifindex == ((unsigned)ifindex) &&
 		    (cls->c_prio == prio)) {
-			nl_object_get((struct nl_object *) cls);
+			nl_object_get((struct nl_object *)cls);
 			return cls;
 		}
 	}
diff --git a/lib/route/cls/ematch.c b/lib/route/cls/ematch.c
index 5a5a2104..6b4dfdec 100644
--- a/lib/route/cls/ematch.c
+++ b/lib/route/cls/ematch.c
@@ -451,7 +451,7 @@ int rtnl_ematch_parse_attr(struct nlattr *attr, struct rtnl_ematch_tree **result
 		NL_DBG(3, "parsing ematch attribute %d, len=%u\n",
 			  nmatches+1, nla_len(a));
 
-		if (nla_len(a) < sizeof(*hdr)) {
+		if (_nla_len(a) < sizeof(*hdr)) {
 			err = -NLE_INVAL;
 			goto errout;
 		}
diff --git a/lib/route/cls/u32.c b/lib/route/cls/u32.c
index 52f6e31c..9821c770 100644
--- a/lib/route/cls/u32.c
+++ b/lib/route/cls/u32.c
@@ -154,7 +154,7 @@ static int u32_msg_parser(struct rtnl_tc *tc, void *data)
 		sel = u->cu_selector->d_data;
 		pcnt_size = sizeof(struct tc_u32_pcnt) +
 				(sel->nkeys * sizeof(uint64_t));
-		if (nla_len(tb[TCA_U32_PCNT]) < pcnt_size) {
+		if (_nla_len(tb[TCA_U32_PCNT]) < pcnt_size) {
 			err = -NLE_INVAL;
 			goto errout;
 		}
diff --git a/lib/route/link.c b/lib/route/link.c
index ce1355b9..e634a8bf 100644
--- a/lib/route/link.c
+++ b/lib/route/link.c
@@ -440,7 +440,7 @@ int rtnl_link_info_parse(struct rtnl_link *link, struct nlattr **tb)
 		/* beware: @st might not be the full struct, only fields up to
 		 * tx_compressed are present. See _nl_offsetofend() above. */
 
-		if (nla_len(tb[IFLA_STATS]) >= _nl_offsetofend (struct rtnl_link_stats, rx_nohandler))
+		if (_nla_len(tb[IFLA_STATS]) >= _nl_offsetofend (struct rtnl_link_stats, rx_nohandler))
 			link->l_stats[RTNL_LINK_RX_NOHANDLER] = st->rx_nohandler;
 		else
 			link->l_stats[RTNL_LINK_RX_NOHANDLER] = 0;
@@ -1320,7 +1320,7 @@ struct rtnl_link *rtnl_link_get(struct nl_cache *cache, int ifindex)
 		return NULL;
 
 	nl_list_for_each_entry(link, &cache->c_items, ce_list) {
-		if (link->l_index == ifindex) {
+		if (link->l_index == ((unsigned)ifindex)) {
 			nl_object_get((struct nl_object *) link);
 			return link;
 		}
diff --git a/lib/route/link/can.c b/lib/route/link/can.c
index da00144f..86e6684e 100644
--- a/lib/route/link/can.c
+++ b/lib/route/link/can.c
@@ -168,7 +168,7 @@ static int can_parse(struct rtnl_link *link, struct nlattr *data,
 		ci->ci_mask |= CAN_HAS_DATA_BITTIMING_CONST;
 	}
 
-	if (xstats && nla_len(xstats) >= sizeof(ci->ci_device_stats)) {
+	if (xstats && _nla_len(xstats) >= sizeof(ci->ci_device_stats)) {
 		nla_memcpy(&ci->ci_device_stats, xstats, sizeof(ci->ci_device_stats));
 		ci->ci_mask |= CAN_HAS_DEVICE_STATS;
 	}
diff --git a/lib/route/link/macsec.c b/lib/route/link/macsec.c
index a989eed8..7f4f5682 100644
--- a/lib/route/link/macsec.c
+++ b/lib/route/link/macsec.c
@@ -369,7 +369,8 @@ static int macsec_compare(struct rtnl_link *link_a, struct rtnl_link *link_b,
 	struct macsec_info *a = link_a->l_info;
 	struct macsec_info *b = link_b->l_info;
 	int diff = 0;
-	uint32_t attrs = flags & LOOSE_COMPARISON ? b->ce_mask : ~0;
+	uint32_t attrs = flags & LOOSE_COMPARISON ? b->ce_mask :
+						    ~((uint32_t)0u);
 
 #define _DIFF(ATTR, EXPR) ATTR_DIFF(attrs, ATTR, a, b, EXPR)
 	if (a->ce_mask & MACSEC_ATTR_SCI && b->ce_mask & MACSEC_ATTR_SCI)
diff --git a/lib/route/link/macvlan.c b/lib/route/link/macvlan.c
index 5452d9eb..fa7d0bbd 100644
--- a/lib/route/link/macvlan.c
+++ b/lib/route/link/macvlan.c
@@ -225,7 +225,7 @@ static int macvlan_put_attrs(struct nl_msg *msg, struct rtnl_link *link)
 {
 	struct macvlan_info *mvi = link->l_info;
 	struct nlattr *data, *datamac = NULL;
-	int i, ret;
+	int ret;
 
 	if (!(data = nla_nest_start(msg, IFLA_INFO_DATA)))
 		return -NLE_MSGSIZE;
@@ -239,6 +239,8 @@ static int macvlan_put_attrs(struct nl_msg *msg, struct rtnl_link *link)
 		NLA_PUT_U16(msg, IFLA_MACVLAN_FLAGS, mvi->mvi_flags);
 
 	if (mvi->mvi_mask & MACVLAN_HAS_MACADDR) {
+		uint32_t i;
+
 		NLA_PUT_U32(msg, IFLA_MACVLAN_MACADDR_MODE, mvi->mvi_macmode);
 		datamac = nla_nest_start(msg, IFLA_MACVLAN_MACADDR_DATA);
 		if (!datamac)
@@ -345,7 +347,6 @@ int rtnl_link_is_macvlan(struct rtnl_link *link)
 int rtnl_link_macvlan_set_mode(struct rtnl_link *link, uint32_t mode)
 {
 	struct macvlan_info *mvi = link->l_info;
-	int i;
 
 	IS_MACVLAN_LINK_ASSERT(link);
 
@@ -353,6 +354,8 @@ int rtnl_link_macvlan_set_mode(struct rtnl_link *link, uint32_t mode)
 	mvi->mvi_mask |= MACVLAN_HAS_MODE;
 
 	if (mode != MACVLAN_MODE_SOURCE) {
+		uint32_t i;
+
 		for (i = 0; i < mvi->mvi_maccount; i++)
 			nl_addr_put(mvi->mvi_macaddr[i]);
 		free(mvi->mvi_macaddr);
diff --git a/lib/route/link/sriov.c b/lib/route/link/sriov.c
index d47d1ddf..98087e2f 100644
--- a/lib/route/link/sriov.c
+++ b/lib/route/link/sriov.c
@@ -633,7 +633,7 @@ int rtnl_link_sriov_parse_vflist(struct rtnl_link *link, struct nlattr **tb) {
 		if (t[IFLA_VF_SPOOFCHK]) {
 			vf_spoofchk = nla_data(t[IFLA_VF_SPOOFCHK]);
 
-			if (vf_spoofchk->setting != -1) {
+			if (vf_spoofchk->setting != ((uint32_t)-1)) {
 				vf_data->vf_spoofchk = vf_spoofchk->setting ? 1 : 0;
 				vf_data->ce_mask |= SRIOV_ATTR_SPOOFCHK;
 			}
@@ -662,7 +662,7 @@ int rtnl_link_sriov_parse_vflist(struct rtnl_link *link, struct nlattr **tb) {
 		if (t[IFLA_VF_RSS_QUERY_EN]) {
 			vf_rss_query = nla_data(t[IFLA_VF_RSS_QUERY_EN]);
 
-			if (vf_rss_query->setting != -1) {
+			if (vf_rss_query->setting != ((uint32_t)-1)) {
 				vf_data->vf_rss_query_en = vf_rss_query->setting ? 1 : 0;
 				vf_data->ce_mask |= SRIOV_ATTR_RSS_QUERY_EN;
 			}
@@ -702,7 +702,7 @@ int rtnl_link_sriov_parse_vflist(struct rtnl_link *link, struct nlattr **tb) {
 		if (t[IFLA_VF_TRUST]) {
 			vf_trust = nla_data(t[IFLA_VF_TRUST]);
 
-			if (vf_trust->setting != -1) {
+			if (vf_trust->setting != ((uint32_t)-1)) {
 				vf_data->vf_trust = vf_trust->setting ? 1 : 0;
 				vf_data->ce_mask |= SRIOV_ATTR_TRUST;
 			}
diff --git a/lib/route/link/vlan.c b/lib/route/link/vlan.c
index 60e4358f..75842d8c 100644
--- a/lib/route/link/vlan.c
+++ b/lib/route/link/vlan.c
@@ -123,7 +123,7 @@ static int vlan_parse(struct rtnl_link *link, struct nlattr *data,
 		memset(vi->vi_ingress_qos, 0, sizeof(vi->vi_ingress_qos));
 
 		nla_for_each_nested(nla, tb[IFLA_VLAN_INGRESS_QOS], remaining) {
-			if (nla_len(nla) < sizeof(*map))
+			if (_nla_len(nla) < sizeof(*map))
 				return -NLE_INVAL;
 
 			map = nla_data(nla);
@@ -154,7 +154,7 @@ static int vlan_parse(struct rtnl_link *link, struct nlattr *data,
 		int remaining, i = 0;
 
 		nla_for_each_nested(nla, tb[IFLA_VLAN_EGRESS_QOS], remaining) {
-			if (nla_len(nla) < sizeof(*map))
+			if (_nla_len(nla) < sizeof(*map))
 				return -NLE_INVAL;
 			i++;
 		}
diff --git a/lib/route/link/vxlan.c b/lib/route/link/vxlan.c
index 4606dd5f..0603bf59 100644
--- a/lib/route/link/vxlan.c
+++ b/lib/route/link/vxlan.c
@@ -617,7 +617,8 @@ static int vxlan_compare(struct rtnl_link *link_a, struct rtnl_link *link_b,
 	struct vxlan_info *a = link_a->l_info;
 	struct vxlan_info *b = link_b->l_info;
 	int diff = 0;
-	uint32_t attrs = flags & LOOSE_COMPARISON ? b->ce_mask : ~0;
+	uint32_t attrs = flags & LOOSE_COMPARISON ? b->ce_mask :
+						    ~((uint32_t)0u);
 
 #define _DIFF(ATTR, EXPR) ATTR_DIFF(attrs, ATTR, a, b, EXPR)
 	diff |= _DIFF(VXLAN_ATTR_ID, a->vxi_id != b->vxi_id);
diff --git a/lib/route/neigh.c b/lib/route/neigh.c
index 7e698b49..56c1e095 100644
--- a/lib/route/neigh.c
+++ b/lib/route/neigh.c
@@ -676,8 +676,8 @@ struct rtnl_neigh * rtnl_neigh_get(struct nl_cache *cache, int ifindex,
 	struct rtnl_neigh *neigh;
 
 	nl_list_for_each_entry(neigh, &cache->c_items, ce_list) {
-		if (neigh->n_ifindex == ifindex &&
-		    neigh->n_family == dst->a_family &&
+		if (neigh->n_ifindex == ((unsigned)ifindex) &&
+		    neigh->n_family == ((unsigned)dst->a_family) &&
 		    !nl_addr_cmp(neigh->n_dst, dst)) {
 			nl_object_get((struct nl_object *) neigh);
 			return neigh;
@@ -702,9 +702,9 @@ struct rtnl_neigh * rtnl_neigh_get_by_vlan(struct nl_cache *cache, int ifindex,
 	struct rtnl_neigh *neigh;
 
 	nl_list_for_each_entry(neigh, &cache->c_items, ce_list) {
-		if (neigh->n_ifindex == ifindex &&
-		    neigh->n_vlan == vlan &&
-		    neigh->n_lladdr && !nl_addr_cmp(neigh->n_lladdr, lladdr)) {
+		if ((neigh->n_ifindex == (unsigned)ifindex) &&
+		    neigh->n_vlan == vlan && neigh->n_lladdr &&
+		    !nl_addr_cmp(neigh->n_lladdr, lladdr)) {
 			nl_object_get((struct nl_object *) neigh);
 			return neigh;
 		}
@@ -1012,7 +1012,7 @@ static inline int __assign_addr(struct rtnl_neigh *neigh, struct nl_addr **pos,
 {
 	if (!nocheck) {
 		if (neigh->ce_mask & NEIGH_ATTR_FAMILY) {
-			if (new->a_family != neigh->n_family)
+			if (neigh->n_family != ((unsigned)new->a_family))
 				return -NLE_AF_MISMATCH;
 		} else {
 			neigh->n_family = new->a_family;
diff --git a/lib/route/neightbl.c b/lib/route/neightbl.c
index a699867d..8d5db8a3 100644
--- a/lib/route/neightbl.c
+++ b/lib/route/neightbl.c
@@ -534,8 +534,7 @@ struct rtnl_neightbl *rtnl_neightbl_get(struct nl_cache *cache,
 
 	nl_list_for_each_entry(nt, &cache->c_items, ce_list) {
 		if (!strcasecmp(nt->nt_name, name) &&
-		    ((!ifindex && !nt->nt_parms.ntp_ifindex) ||
-		     (ifindex && ifindex == nt->nt_parms.ntp_ifindex))) {
+		    ((unsigned)ifindex) == nt->nt_parms.ntp_ifindex) {
 			nl_object_get((struct nl_object *)nt);
 			return nt;
 		}
diff --git a/lib/route/nh.c b/lib/route/nh.c
index c63a85f6..3dfe5586 100644
--- a/lib/route/nh.c
+++ b/lib/route/nh.c
@@ -454,7 +454,7 @@ struct rtnl_nh *rtnl_nh_get(struct nl_cache *cache, int nhid)
 		return NULL;
 
 	nl_list_for_each_entry(nh, &cache->c_items, ce_list) {
-		if (nh->nh_id == nhid) {
+		if (nh->nh_id == ((unsigned)nhid)) {
 			nl_object_get((struct nl_object *)nh);
 			return nh;
 		}
diff --git a/lib/route/qdisc.c b/lib/route/qdisc.c
index 67ea358d..9887e0db 100644
--- a/lib/route/qdisc.c
+++ b/lib/route/qdisc.c
@@ -388,7 +388,8 @@ struct rtnl_qdisc *rtnl_qdisc_get_by_parent(struct nl_cache *cache,
 		return NULL;
 
 	nl_list_for_each_entry(q, &cache->c_items, ce_list) {
-		if (q->q_parent == parent && q->q_ifindex == ifindex) {
+		if (q->q_parent == parent &&
+		    q->q_ifindex == ((unsigned)ifindex)) {
 			nl_object_get((struct nl_object *) q);
 			return q;
 		}
@@ -420,7 +421,8 @@ struct rtnl_qdisc *rtnl_qdisc_get_by_kind(struct nl_cache *cache,
 		return NULL;
 
 	nl_list_for_each_entry(q, &cache->c_items, ce_list) {
-		if ((q->q_ifindex == ifindex) && (!strcmp(q->q_kind, kind))) {
+		if ((q->q_ifindex == ((unsigned)ifindex)) &&
+		    (!strcmp(q->q_kind, kind))) {
 			nl_object_get((struct nl_object *) q);
 			return q;
 		}
@@ -452,7 +454,8 @@ struct rtnl_qdisc *rtnl_qdisc_get(struct nl_cache *cache, int ifindex,
 		return NULL;
 
 	nl_list_for_each_entry(q, &cache->c_items, ce_list) {
-		if (q->q_handle == handle && q->q_ifindex == ifindex) {
+		if (q->q_handle == handle &&
+		    q->q_ifindex == ((unsigned)ifindex)) {
 			nl_object_get((struct nl_object *) q);
 			return q;
 		}
diff --git a/lib/route/qdisc/tbf.c b/lib/route/qdisc/tbf.c
index 67996eb5..a054a146 100644
--- a/lib/route/qdisc/tbf.c
+++ b/lib/route/qdisc/tbf.c
@@ -139,9 +139,9 @@ static int tbf_msg_fill(struct rtnl_tc *tc, void *data, struct nl_msg *msg)
 	uint32_t rtab[RTNL_TC_RTABLE_SIZE], ptab[RTNL_TC_RTABLE_SIZE];
 	struct tc_tbf_qopt opts;
 	struct rtnl_tbf *tbf = data;
-	int required = TBF_ATTR_RATE | TBF_ATTR_LIMIT;
+	const uint32_t REQUIRED = TBF_ATTR_RATE | TBF_ATTR_LIMIT;
 
-	if ((tbf->qt_mask & required) != required)
+	if ((tbf->qt_mask & REQUIRED) != REQUIRED)
 		return -NLE_MISSING_ATTR;
 
 	memset(&opts, 0, sizeof(opts));
diff --git a/lib/route/route_obj.c b/lib/route/route_obj.c
index 812d7ad5..094ae536 100644
--- a/lib/route/route_obj.c
+++ b/lib/route/route_obj.c
@@ -948,9 +948,11 @@ void rtnl_route_foreach_nexthop(struct rtnl_route *r,
 struct rtnl_nexthop *rtnl_route_nexthop_n(struct rtnl_route *r, int n)
 {
 	struct rtnl_nexthop *nh;
-	uint32_t i;
 
-	if (r->ce_mask & ROUTE_ATTR_MULTIPATH && r->rt_nr_nh > n) {
+	if (r->ce_mask & ROUTE_ATTR_MULTIPATH && n >= 0 &&
+	    ((unsigned)n) < r->rt_nr_nh) {
+		int i;
+
 		i = 0;
 		nl_list_for_each_entry(nh, &r->rt_nexthops, rtnh_list) {
 			if (i == n) return nh;
@@ -1270,7 +1272,7 @@ int rtnl_route_parse(struct nlmsghdr *nlh, struct rtnl_route **result)
 			return err;
 
 		for (i = 1; i <= RTAX_MAX; i++) {
-			if (mtb[i] && nla_len(mtb[i]) >= sizeof(uint32_t)) {
+			if (mtb[i] && _nla_len(mtb[i]) >= sizeof(uint32_t)) {
 				uint32_t m = nla_get_u32(mtb[i]);
 
 				err = rtnl_route_set_metric(route, i, m);
diff --git a/lib/route/tc.c b/lib/route/tc.c
index a2fd5674..bbb2f8ca 100644
--- a/lib/route/tc.c
+++ b/lib/route/tc.c
@@ -678,7 +678,7 @@ int rtnl_tc_calc_cell_log(int cell_size)
 	int i;
 
 	for (i = 0; i < 32; i++)
-		if ((((uint32_t)1u) << i) == cell_size)
+		if ((((uint32_t)1u) << i) == ((uint32_t)cell_size))
 			return i;
 
 	return -NLE_INVAL;
diff --git a/lib/utils.c b/lib/utils.c
index 1d56f1df..679078e7 100644
--- a/lib/utils.c
+++ b/lib/utils.c
@@ -1069,14 +1069,15 @@ char *__type2str(int type, char *buf, size_t len,
 		 const struct trans_tbl *tbl, size_t tbl_len)
 {
 	size_t i;
+
 	for (i = 0; i < tbl_len; i++) {
-		if (tbl[i].i == type) {
+		if (tbl[i].i == ((uint64_t)type)) {
 			snprintf(buf, len, "%s", tbl[i].a);
 			return buf;
 		}
 	}
 
-	snprintf(buf, len, "0x%x", type);
+	snprintf(buf, len, "0x%x", (unsigned)type);
 	return buf;
 }
 
@@ -1169,7 +1170,7 @@ int __str2flags(const char *buf, const struct trans_tbl *tbl, size_t tbl_len)
 			p++;
 
 		t = strchr(p, ',');
-		len = t ? t - p : strlen(p);
+		len = t ? ((size_t)(t - p)) : strlen(p);
 		for (i = 0; i < tbl_len; i++)
 			if (len == strlen(tbl[i].a) &&
 			    !strncasecmp(tbl[i].a, p, len))
diff --git a/lib/xfrm/sp.c b/lib/xfrm/sp.c
index 642fbcbe..814ac484 100644
--- a/lib/xfrm/sp.c
+++ b/lib/xfrm/sp.c
@@ -1368,12 +1368,15 @@ void xfrmnl_sp_foreach_usertemplate(struct xfrmnl_sp *r,
 struct xfrmnl_user_tmpl *xfrmnl_sp_usertemplate_n(struct xfrmnl_sp *r, int n)
 {
 	struct xfrmnl_user_tmpl *utmpl;
-	uint32_t i;
 
-	if (r->ce_mask & XFRM_SP_ATTR_TMPL && r->nr_user_tmpl > n) {
+	if (r->ce_mask & XFRM_SP_ATTR_TMPL && n >= 0 &&
+	    ((unsigned)n) < r->nr_user_tmpl) {
+		uint32_t i;
+
 		i = 0;
 		nl_list_for_each_entry(utmpl, &r->usertmpl_list, utmpl_list) {
-			if (i == n) return utmpl;
+			if (i == ((unsigned)n))
+				return utmpl;
 			i++;
 		}
 	}
diff --git a/tests/cksuite-all-attr.c b/tests/cksuite-all-attr.c
index 943eda4b..86e3c6fd 100644
--- a/tests/cksuite-all-attr.c
+++ b/tests/cksuite-all-attr.c
@@ -70,7 +70,7 @@ START_TEST(msg_construct)
 	nlmsg_for_each_attr(a, nlh, 0, rem) {
 		ck_assert_msg(nla_type(a) == i, "Expected attribute %d", i);
 		i++;
-		ck_assert_msg(nla_get_u32(a) == i,
+		ck_assert_msg(nla_get_u32(a) == (unsigned)i,
 			      "Expected attribute value %d", i);
 	}
 
diff --git a/tests/cksuite-all-netns.c b/tests/cksuite-all-netns.c
index 9b32ab8d..5b9d3a5a 100644
--- a/tests/cksuite-all-netns.c
+++ b/tests/cksuite-all-netns.c
@@ -70,7 +70,7 @@ START_TEST(cache_and_clone)
 			.add = false,
 		},
 	};
-	int i;
+	size_t i;
 	int r;
 
 	for (i = 0; i < _NL_N_ELEMENTS(links); i++) {
diff --git a/tests/nl-test-util.c b/tests/nl-test-util.c
index 99a51a4c..6bbe2ae9 100644
--- a/tests/nl-test-util.c
+++ b/tests/nl-test-util.c
@@ -33,7 +33,7 @@ void _nltst_get_urandom(void *ptr, size_t len)
 	_nltst_assert_errno(fd >= 0);
 
 	nread = read(fd, ptr, len);
-	_nltst_assert_errno(nread == len);
+	_nltst_assert_errno(nread >= 0 && ((size_t)nread) == len);
 
 	_nltst_close(fd);
 }
@@ -961,7 +961,8 @@ bool _nltst_select_route_match(struct nl_object *route,
 
 	if (select_route->plen != -1) {
 		_check(addr, "missing address");
-		_check(nl_addr_get_prefixlen(addr) == select_route->plen,
+		_check(nl_addr_get_prefixlen(addr) ==
+			       (unsigned)select_route->plen,
 		       "unexpected prefix length");
 	}
 	if (select_route->addr || select_route->addr_pattern) {