IP-in-IP GSO can re-enter inet_gso_segment() or ipv6_gso_segment() for each nested IP header. encap_level tracks header bytes, not callback depth, so a deep chain can exhaust the kernel stack. Making inet_gso_segment() stackable introduced unbounded IPv4 nesting; IPIP GSO/TSO later made the path reachable. The IPv6 stackable path was introduced separately and shares the guard; Fixes identifies the IPv4 root cause. Count IPv4 and IPv6 GSO handler entries in skb_gso_cb, initialized once per top-level GSO operation and preserved across GRE/UDP context changes. Set the cap to five, matching IP_TUNNEL_RECURSION_LIMIT. Allow five entries and reject the sixth with -EINVAL before it can dispatch another GSO callback. On the patched x86_64 kernel, tracefs observed six inet_gso_segment() entries for the 199-header reproducer; the sixth returned -EINVAL without a stack-guard fault. This validates the tested configuration, not an architecture-independent stack-safety margin. Fixes: 3347c9602955 ("ipv4: gso: make inet_gso_segment() stackable") Cc: stable@vger.kernel.org Reported-by: Vega Assisted-by: LLM Co-developed-by: Luxing Yin Signed-off-by: Luxing Yin Signed-off-by: Zihan Xi --- changes in v5: - Replace the header-offset budget with a shared IP GSO handler-entry counter. Entries one through five pass; entry six is rejected. - Initialize the count for each top-level GSO operation and preserve it across IPv4/IPv6 dispatch and GRE/UDP context changes. - Use the existing IP_TUNNEL_RECURSION_LIMIT value of five as a practical bound. Tracefs observed the sixth entry return -EINVAL on the final x86_64 revision; rerun both IPv4 PoCs on that revision. - Avoid rejecting a single-level tunnel based only on header length. - v4 Link: https://lore.kernel.org/all/cover.1790041241.git.zihanx@nebusec.ai/ include/net/gso.h | 9 +++++++++ net/core/gso.c | 1 + net/ipv4/af_inet.c | 2 ++ net/ipv6/ip6_offload.c | 2 ++ 4 files changed, 14 insertions(+) diff --git a/include/net/gso.h b/include/net/gso.h index 29975440c..18944ff06 100644 --- a/include/net/gso.h +++ b/include/net/gso.h @@ -19,10 +19,19 @@ struct skb_gso_cb { int encap_level; __wsum csum; __u16 csum_start; + /* Number of IPv4/IPv6 GSO handler entries for this packet. */ + u8 recursion_counter; }; #define SKB_GSO_CB_OFFSET 32 #define SKB_GSO_CB(skb) ((struct skb_gso_cb *)((skb)->cb + SKB_GSO_CB_OFFSET)) +#define GSO_RECURSION_LIMIT 5 + +static inline bool gso_recursion_inc_test(struct sk_buff *skb) +{ + return ++SKB_GSO_CB(skb)->recursion_counter > GSO_RECURSION_LIMIT; +} + static inline int skb_tnl_header_len(const struct sk_buff *inner_skb) { return (skb_mac_header(inner_skb) - inner_skb->head) - diff --git a/net/core/gso.c b/net/core/gso.c index bcd156372..e96ef6350 100644 --- a/net/core/gso.c +++ b/net/core/gso.c @@ -117,6 +117,7 @@ struct sk_buff *__skb_gso_segment(struct sk_buff *skb, SKB_GSO_CB(skb)->mac_offset = skb_headroom(skb); SKB_GSO_CB(skb)->encap_level = 0; + SKB_GSO_CB(skb)->recursion_counter = 0; skb_reset_mac_header(skb); skb_reset_mac_len(skb); diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c index 32d006c1a..18037d8d4 100644 --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c @@ -1375,6 +1375,8 @@ struct sk_buff *inet_gso_segment(struct sk_buff *skb, int id; skb_reset_network_header(skb); + if (unlikely(gso_recursion_inc_test(skb))) + goto out; nhoff = skb_network_header(skb) - skb_mac_header(skb); if (unlikely(!pskb_may_pull(skb, sizeof(*iph)))) goto out; diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c index 78f50c93c..099f14e09 100644 --- a/net/ipv6/ip6_offload.c +++ b/net/ipv6/ip6_offload.c @@ -104,6 +104,8 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, bool gso_partial; skb_reset_network_header(skb); + if (unlikely(gso_recursion_inc_test(skb))) + goto out; nhoff = skb_network_header(skb) - skb_mac_header(skb); if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h)))) goto out; -- 2.55.0.windows.3