* [PATCH net v6 1/1] net: gso: limit recursive IP-in-IP segmentation
2026-09-24 5:15 [PATCH net v6 0/1] net: gso: limit recursive IP-in-IP segmentation Zihan Xi
@ 2026-09-24 5:15 ` Zihan Xi
2026-09-25 21:13 ` Willem de Bruijn
0 siblings, 1 reply; 3+ messages in thread
From: Zihan Xi @ 2026-09-24 5:15 UTC (permalink / raw)
To: netdev
Cc: linux-kernel, davem, edumazet, kuba, pabeni, horms, dsahern,
idosch, kuniyu, willemb, kees, richardbgobert, zihanx, stable,
Vega, Luxing Yin
IP-in-IP GSO can re-enter inet_gso_segment() or ipv6_gso_segment()
for each nested IP header. encap_level tracks header bytes, not callback
depth, so a deep chain can exhaust the kernel stack. Making
inet_gso_segment() stackable introduced unbounded IPv4 nesting; IPIP
GSO/TSO later made the path reachable. The IPv6 stackable path was
introduced separately and uses the same guard.
Count IPv4 and IPv6 GSO handler entries in skb_gso_cb, initialized once
per top-level GSO operation and preserved across GRE/UDP context changes.
Use the existing IP_TUNNEL_RECURSION_LIMIT for both handlers. The first
five entries pass, and the sixth returns -EINVAL before dispatching
another GSO callback.
Fixes: 3347c9602955 ("ipv4: gso: make inet_gso_segment() stackable")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Closes: https://lore.kernel.org/all/cover.1790157745.git.zihanx@nebusec.ai/
Assisted-by: LLM
Co-developed-by: Luxing Yin <root@tr0jan.top>
Signed-off-by: Luxing Yin <root@tr0jan.top>
Signed-off-by: Zihan Xi <zihanx@nebusec.ai>
---
changes in v6:
- Use IP_TUNNEL_RECURSION_LIMIT directly for both IP GSO handler
checks instead of defining a duplicate GSO_RECURSION_LIMIT.
- Add Closes for the v5 cover letter.
- v5 Link: https://lore.kernel.org/all/cover.1790157745.git.zihanx@nebusec.ai/
changes in v5:
- Replace the cumulative header-offset check with a shared IP GSO
recursion counter. Allow five handler entries and reject the sixth.
- Initialize the counter for each top-level GSO operation and keep it
across GRE/UDP context changes.
- v4 Link: https://lore.kernel.org/all/cover.1790041241.git.zihanx@nebusec.ai/
changes in v4:
- Keep the budget check only at the two IP GSO handler entries; remove
the common callback wrapper and other GSO call-site checks.
- Reuse skb_gso_cb->mac_offset and current skb headroom as the
cumulative header-offset budget.
- v3 Link: https://lore.kernel.org/all/cover.1789802623.git.zihanx@nebusec.ai/
changes in v3:
- Treat an exhausted 256-byte budget as a callback-entry failure,
including the zero-length check used by the common callback wrapper.
- v2 Link: https://lore.kernel.org/all/cover.1789618203.git.zihanx@nebusec.ai/
changes in v2:
- Replace the callback counter with a cumulative 256-byte header budget
carried in skb_gso_cb.
- Apply the budget at common callback entry and across IP, GRE, UDP,
MPLS, NSH, ESP, and IPv6 extension dispatch, including context resets.
- Rebase the UDP hunk and rerun both IPv4 PoCs; use decoded crash
evidence from unpatched 88c17de85ddb.
- v1 Link: https://lore.kernel.org/all/cover.1789302084.git.zihanx@nebusec.ai/
include/net/gso.h | 8 ++++++++
net/core/gso.c | 1 +
net/ipv4/af_inet.c | 3 +++
net/ipv6/ip6_offload.c | 4 ++++
4 files changed, 16 insertions(+)
diff --git a/include/net/gso.h b/include/net/gso.h
index 29975440cad51..0749230d414ec 100644
--- a/include/net/gso.h
+++ b/include/net/gso.h
@@ -19,10 +19,18 @@ struct skb_gso_cb {
int encap_level;
__wsum csum;
__u16 csum_start;
+ /* Number of IPv4/IPv6 GSO handler entries for this packet. */
+ u8 recursion_counter;
};
#define SKB_GSO_CB_OFFSET 32
#define SKB_GSO_CB(skb) ((struct skb_gso_cb *)((skb)->cb + SKB_GSO_CB_OFFSET))
+static inline bool gso_recursion_inc_test(struct sk_buff *skb,
+ unsigned int limit)
+{
+ return ++SKB_GSO_CB(skb)->recursion_counter > limit;
+}
+
static inline int skb_tnl_header_len(const struct sk_buff *inner_skb)
{
return (skb_mac_header(inner_skb) - inner_skb->head) -
diff --git a/net/core/gso.c b/net/core/gso.c
index bcd156372f4df..e96ef63500648 100644
--- a/net/core/gso.c
+++ b/net/core/gso.c
@@ -117,6 +117,7 @@ struct sk_buff *__skb_gso_segment(struct sk_buff *skb,
SKB_GSO_CB(skb)->mac_offset = skb_headroom(skb);
SKB_GSO_CB(skb)->encap_level = 0;
+ SKB_GSO_CB(skb)->recursion_counter = 0;
skb_reset_mac_header(skb);
skb_reset_mac_len(skb);
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 32d006c1a8eed..4ce38c99fef9e 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1375,6 +1375,9 @@ struct sk_buff *inet_gso_segment(struct sk_buff *skb,
int id;
skb_reset_network_header(skb);
+ if (unlikely(gso_recursion_inc_test(skb,
+ IP_TUNNEL_RECURSION_LIMIT)))
+ goto out;
nhoff = skb_network_header(skb) - skb_mac_header(skb);
if (unlikely(!pskb_may_pull(skb, sizeof(*iph))))
goto out;
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 78f50c93c536c..700f1861d8eb7 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -17,6 +17,7 @@
#include <net/udp.h>
#include <net/gro.h>
#include <net/gso.h>
+#include <net/ip_tunnels.h>
#include "ip6_offload.h"
#include "tcpv6_offload.c"
@@ -104,6 +105,9 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
bool gso_partial;
skb_reset_network_header(skb);
+ if (unlikely(gso_recursion_inc_test(skb,
+ IP_TUNNEL_RECURSION_LIMIT)))
+ goto out;
nhoff = skb_network_header(skb) - skb_mac_header(skb);
if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h))))
goto out;
--
2.43.0
^ permalink raw reply [flat|nested] 3+ messages in thread