[PATCH net v2 1/1] net: gso: limit recursive IP-in-IP segmentation
From: Zihan Xi <hidden>
Date: 2026-09-17 16:01:04
Also in:
lkml, stable
Subsystem:
networking [general], networking [ipsec], networking [ipv4/ipv6], the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Steffen Klassert, Herbert Xu, David Ahern, Ido Schimmel, Linus Torvalds
IPIP GSO/TSO support makes IP-in-IP GSO dispatch re-enter
inet_gso_segment() or ipv6_gso_segment() for every nested IP header. The
only state that tracks this nesting is encap_level, which records header
bytes and has no recursion bound. A sufficiently deep chain can consume the
kernel stack before a transport GSO callback is reached.
The unbounded callback nesting was introduced when inet_gso_segment() was
made stackable by "ipv4: gso: make inet_gso_segment() stackable". GRE GSO
support predated that change, and IP-in-IP GSO/TSO support later made the
affected path reachable.
The corresponding IPv6 stackable path was introduced separately by
"ipv6: gso: make ipv6_gso_segment() stackable". This patch uses the same
budget for IPv6, but the Fixes tag covers the IPv4 root cause only.
Limit the cumulative header budget for a GSO operation to GSO_MAX_HEADER
(256 bytes). Keep the consumed budget in skb_gso_cb and charge each header
before dispatching the next GSO callback. The callback wrapper checks the
same state, so direct IP handler re-entry and nested tunnel dispatch share
one monotonic budget. GRE and UDP context resets cannot restart it before
an inner GSO callback; other GSO tunnel and extension handlers charge their
stripped headers before inner dispatch as well.
GSO_MAX_HEADER is a practical header budget, not a measured stack-overflow
threshold or an architecture-independent stack-safety proof. With a zero
initial offset, 12 minimum-sized IPv4 headers consume 240 bytes; the next
header is rejected. IPv6 base headers, extension headers, and tunnel
headers use the budget faster. Validation of the preceding
implementation on x86_64 used a 16 KiB task stack and completed without a
stack-guard fault, but this does not establish a uniform margin for
architectures with smaller stacks.
Fixes: 3347c9602955 ("ipv4: gso: make inet_gso_segment() stackable")
Cc: stable@vger.kernel.org
Reported-by: Vega <redacted>
Assisted-by: LLM
Co-developed-by: Luxing Yin <redacted>
Signed-off-by: Luxing Yin <redacted>
Signed-off-by: Zihan Xi <redacted>
---
changes in v2:
- Replace the callback counter with a cumulative 256-byte header budget
carried in skb_gso_cb.
- Apply the budget at common callback entry and across IP, GRE, UDP, MPLS,
NSH, ESP, and IPv6 extension dispatch, including GRE/UDP context resets.
- Rebase the UDP hunk onto selected revision c9151088f167 and rerun both
IPv4 PoCs; use the decoded crash evidence from unpatched 88c17de85ddb.
- v1 Link: https://lore.kernel.org/all/cover.1789302084.git.zihanx@nebusec.ai/ (local)
include/net/gso.h | 29 +++++++++++++++++++++++++++++
net/core/gso.c | 7 +++++--
net/ipv4/af_inet.c | 7 ++++++-
net/ipv4/esp4_offload.c | 9 +++++++--
net/ipv4/gre_offload.c | 2 ++
net/ipv4/udp_offload.c | 4 +++-
net/ipv6/esp6_offload.c | 9 +++++++--
net/ipv6/ip6_offload.c | 11 ++++++++++-
net/mpls/mpls_gso.c | 2 ++
net/nsh/nsh.c | 2 ++
10 files changed, 73 insertions(+), 9 deletions(-)
diff --git a/include/net/gso.h b/include/net/gso.h
index 29975440c..c3d38f838 100644
--- a/include/net/gso.h
+++ b/include/net/gso.h@@ -19,10 +19,39 @@ struct skb_gso_cb { int encap_level; __wsum csum; __u16 csum_start; + /* Bytes charged to the current GSO callback chain. */ + u16 gso_header_len; }; #define SKB_GSO_CB_OFFSET 32 #define SKB_GSO_CB(skb) ((struct skb_gso_cb *)((skb)->cb + SKB_GSO_CB_OFFSET)) +#define GSO_MAX_HEADER 256 + +static inline bool gso_header_len_add(struct sk_buff *skb, + unsigned int len) +{ + struct skb_gso_cb *cb = SKB_GSO_CB(skb); + + if (unlikely(cb->gso_header_len > GSO_MAX_HEADER || + len > GSO_MAX_HEADER - cb->gso_header_len)) + return true; + + cb->gso_header_len += len; + return false; +} + +static inline struct sk_buff * +skb_gso_segment_cb(struct sk_buff *skb, + struct sk_buff *(*gso_segment)(struct sk_buff *, + netdev_features_t), + netdev_features_t features) +{ + if (unlikely(gso_header_len_add(skb, 0))) + return ERR_PTR(-EINVAL); + + return gso_segment(skb, features); +} + static inline int skb_tnl_header_len(const struct sk_buff *inner_skb) { return (skb_mac_header(inner_skb) - inner_skb->head) -
diff --git a/net/core/gso.c b/net/core/gso.c
index bcd156372..68e4acc11 100644
--- a/net/core/gso.c
+++ b/net/core/gso.c@@ -19,7 +19,8 @@ struct sk_buff *skb_eth_gso_segment(struct sk_buff *skb, rcu_read_lock(); list_for_each_entry_rcu(ptype, &net_hotdata.offload_base, list) { if (ptype->type == type && ptype->callbacks.gso_segment) { - segs = ptype->callbacks.gso_segment(skb, features); + segs = skb_gso_segment_cb(skb, ptype->callbacks.gso_segment, + features); break; } }
@@ -50,7 +51,8 @@ struct sk_buff *skb_mac_gso_segment(struct sk_buff *skb, rcu_read_lock(); list_for_each_entry_rcu(ptype, &net_hotdata.offload_base, list) { if (ptype->type == type && ptype->callbacks.gso_segment) { - segs = ptype->callbacks.gso_segment(skb, features); + segs = skb_gso_segment_cb(skb, ptype->callbacks.gso_segment, + features); break; } }
@@ -117,6 +119,7 @@ struct sk_buff *__skb_gso_segment(struct sk_buff *skb, SKB_GSO_CB(skb)->mac_offset = skb_headroom(skb); SKB_GSO_CB(skb)->encap_level = 0; + SKB_GSO_CB(skb)->gso_header_len = 0; skb_reset_mac_header(skb); skb_reset_mac_len(skb);
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 32d006c1a..415274d49 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c@@ -1375,6 +1375,8 @@ struct sk_buff *inet_gso_segment(struct sk_buff *skb, int id; skb_reset_network_header(skb); + if (unlikely(gso_header_len_add(skb, 0))) + goto out; nhoff = skb_network_header(skb) - skb_mac_header(skb); if (unlikely(!pskb_may_pull(skb, sizeof(*iph)))) goto out;
@@ -1390,6 +1392,8 @@ struct sk_buff *inet_gso_segment(struct sk_buff *skb, /* Warning: after this point, iph might be no longer valid */ if (unlikely(!pskb_may_pull(skb, ihl))) goto out; + if (unlikely(gso_header_len_add(skb, ihl))) + goto out; __skb_pull(skb, ihl); encap = SKB_GSO_CB(skb)->encap_level > 0;
@@ -1408,7 +1412,8 @@ struct sk_buff *inet_gso_segment(struct sk_buff *skb, ops = rcu_dereference(inet_offloads[proto]); if (likely(ops && ops->callbacks.gso_segment)) { - segs = ops->callbacks.gso_segment(skb, features); + segs = skb_gso_segment_cb(skb, ops->callbacks.gso_segment, + features); if (!segs) skb->network_header = skb_mac_header(skb) + nhoff - skb->head; }
diff --git a/net/ipv4/esp4_offload.c b/net/ipv4/esp4_offload.c
index abd77162f..cb2c4bbe6 100644
--- a/net/ipv4/esp4_offload.c
+++ b/net/ipv4/esp4_offload.c@@ -141,7 +141,8 @@ static struct sk_buff *xfrm4_transport_gso_segment(struct xfrm_state *x, skb->transport_header += x->props.header_len; ops = rcu_dereference(inet_offloads[xo->proto]); if (likely(ops && ops->callbacks.gso_segment)) - segs = ops->callbacks.gso_segment(skb, features); + segs = skb_gso_segment_cb(skb, ops->callbacks.gso_segment, + features); return segs; }
@@ -182,7 +183,8 @@ static struct sk_buff *xfrm4_beet_gso_segment(struct xfrm_state *x, __skb_pull(skb, skb_transport_offset(skb)); ops = rcu_dereference(inet_offloads[proto]); if (likely(ops && ops->callbacks.gso_segment)) - segs = ops->callbacks.gso_segment(skb, features); + segs = skb_gso_segment_cb(skb, ops->callbacks.gso_segment, + features); return segs; }
@@ -229,6 +231,9 @@ static struct sk_buff *esp4_gso_segment(struct sk_buff *skb, if (!pskb_may_pull(skb, sizeof(*esph) + crypto_aead_ivsize(aead))) return ERR_PTR(-EINVAL); + if (unlikely(gso_header_len_add(skb, + sizeof(*esph) + crypto_aead_ivsize(aead)))) + return ERR_PTR(-EINVAL); __skb_pull(skb, sizeof(*esph) + crypto_aead_ivsize(aead));
diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c
index 5028c72d4..a973b552b 100644
--- a/net/ipv4/gre_offload.c
+++ b/net/ipv4/gre_offload.c@@ -32,6 +32,8 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb, if (unlikely(!pskb_may_pull(skb, tnl_hlen))) goto out; + if (unlikely(gso_header_len_add(skb, tnl_hlen))) + goto out; /* setup inner skb. */ skb->encapsulation = 0;
diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index cf07c3c66..bcba85c6c 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c@@ -188,6 +188,8 @@ static struct sk_buff *__skb_udp_tunnel_segment(struct sk_buff *skb, if (unlikely(!pskb_may_pull(skb, tnl_hlen))) goto out; + if (unlikely(gso_header_len_add(skb, tnl_hlen))) + goto out; uh = udp_hdr(skb);
@@ -242,7 +244,7 @@ static struct sk_buff *__skb_udp_tunnel_segment(struct sk_buff *skb, } /* segment inner packet. */ - segs = gso_inner_segment(skb, features); + segs = skb_gso_segment_cb(skb, gso_inner_segment, features); if (IS_ERR_OR_NULL(segs)) { skb_gso_error_unwind(skb, protocol, tnl_hlen, mac_offset, mac_len);
diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c
index 22895521a..9f4fc9dae 100644
--- a/net/ipv6/esp6_offload.c
+++ b/net/ipv6/esp6_offload.c@@ -177,7 +177,8 @@ static struct sk_buff *xfrm6_transport_gso_segment(struct xfrm_state *x, skb->transport_header += x->props.header_len; ops = rcu_dereference(inet6_offloads[xo->proto]); if (likely(ops && ops->callbacks.gso_segment)) - segs = ops->callbacks.gso_segment(skb, features); + segs = skb_gso_segment_cb(skb, ops->callbacks.gso_segment, + features); return segs; }
@@ -222,7 +223,8 @@ static struct sk_buff *xfrm6_beet_gso_segment(struct xfrm_state *x, __skb_pull(skb, skb_transport_offset(skb)); ops = rcu_dereference(inet6_offloads[proto]); if (likely(ops && ops->callbacks.gso_segment)) - segs = ops->callbacks.gso_segment(skb, features); + segs = skb_gso_segment_cb(skb, ops->callbacks.gso_segment, + features); return segs; }
@@ -269,6 +271,9 @@ static struct sk_buff *esp6_gso_segment(struct sk_buff *skb, if (!pskb_may_pull(skb, sizeof(*esph) + crypto_aead_ivsize(aead))) return ERR_PTR(-EINVAL); + if (unlikely(gso_header_len_add(skb, + sizeof(*esph) + crypto_aead_ivsize(aead)))) + return ERR_PTR(-EINVAL); __skb_pull(skb, sizeof(*esph) + crypto_aead_ivsize(aead));
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 78f50c93c..2182e77ae 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c@@ -79,6 +79,8 @@ static int ipv6_gso_pull_exthdrs(struct sk_buff *skb, int proto) if (unlikely(!pskb_may_pull(skb, len))) break; + if (unlikely(gso_header_len_add(skb, len))) + return -EINVAL; opth = (void *)skb->data; proto = opth->nexthdr;
@@ -104,9 +106,13 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, bool gso_partial; skb_reset_network_header(skb); + if (unlikely(gso_header_len_add(skb, 0))) + goto out; nhoff = skb_network_header(skb) - skb_mac_header(skb); if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h)))) goto out; + if (unlikely(gso_header_len_add(skb, sizeof(*ipv6h)))) + goto out; encap = SKB_GSO_CB(skb)->encap_level > 0; if (encap)
@@ -118,6 +124,8 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, segs = ERR_PTR(-EPROTONOSUPPORT); proto = ipv6_gso_pull_exthdrs(skb, ipv6h->nexthdr); + if (unlikely(proto < 0)) + goto out; if (skb->encapsulation && skb_shinfo(skb)->gso_type & (SKB_GSO_IPXIP4 | SKB_GSO_IPXIP6))
@@ -132,7 +140,8 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, if (!skb_reset_transport_header_careful(skb)) goto out; - segs = ops->callbacks.gso_segment(skb, features); + segs = skb_gso_segment_cb(skb, ops->callbacks.gso_segment, + features); if (!segs) skb->network_header = skb_mac_header(skb) + nhoff - skb->head; }
diff --git a/net/mpls/mpls_gso.c b/net/mpls/mpls_gso.c
index 34ab659f5..a535f4988 100644
--- a/net/mpls/mpls_gso.c
+++ b/net/mpls/mpls_gso.c@@ -36,6 +36,8 @@ static struct sk_buff *mpls_gso_segment(struct sk_buff *skb, goto out; if (unlikely(!pskb_may_pull(skb, mpls_hlen))) goto out; + if (unlikely(gso_header_len_add(skb, mpls_hlen))) + goto out; /* Setup inner SKB. */ mpls_protocol = skb->protocol;
diff --git a/net/nsh/nsh.c b/net/nsh/nsh.c
index bfb775806..49d16283b 100644
--- a/net/nsh/nsh.c
+++ b/net/nsh/nsh.c@@ -95,6 +95,8 @@ static struct sk_buff *nsh_gso_segment(struct sk_buff *skb, goto out; if (unlikely(!pskb_may_pull(skb, nsh_len))) goto out; + if (unlikely(gso_header_len_add(skb, nsh_len))) + goto out; proto = tun_p_to_eth_p(nsh_hdr(skb)->np); if (!proto)
--
2.43.0