[PATCH net v2 1/1] net: gso: limit recursive IP-in-IP segmentation

[PATCH net v2 1/1] net: gso: limit recursive IP-in-IP segmentation

[Zihan Xi]

IPIP GSO/TSO support makes IP-in-IP GSO dispatch re-enter
inet_gso_segment() or ipv6_gso_segment() for every nested IP header. The
only state that tracks this nesting is encap_level, which records header
bytes and has no recursion bound. A sufficiently deep chain can consume the
kernel stack before a transport GSO callback is reached.

The unbounded callback nesting was introduced when inet_gso_segment() was
made stackable by "ipv4: gso: make inet_gso_segment() stackable". GRE GSO
support predated that change, and IP-in-IP GSO/TSO support later made the
affected path reachable.

The corresponding IPv6 stackable path was introduced separately by
"ipv6: gso: make ipv6_gso_segment() stackable". This patch uses the same
budget for IPv6, but the Fixes tag covers the IPv4 root cause only.

Limit the cumulative header budget for a GSO operation to GSO_MAX_HEADER
(256 bytes). Keep the consumed budget in skb_gso_cb and charge each header
before dispatching the next GSO callback. The callback wrapper checks the
same state, so direct IP handler re-entry and nested tunnel dispatch share
one monotonic budget. GRE and UDP context resets cannot restart it before
an inner GSO callback; other GSO tunnel and extension handlers charge their
stripped headers before inner dispatch as well.

GSO_MAX_HEADER is a practical header budget, not a measured stack-overflow
threshold or an architecture-independent stack-safety proof. With a zero
initial offset, 12 minimum-sized IPv4 headers consume 240 bytes; the next
header is rejected. IPv6 base headers, extension headers, and tunnel
headers use the budget faster. Validation of the preceding
implementation on x86_64 used a 16 KiB task stack and completed without a
stack-guard fault, but this does not establish a uniform margin for
architectures with smaller stacks.

Fixes: 3347c9602955 ("ipv4: gso: make inet_gso_segment() stackable")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Assisted-by: LLM
Co-developed-by: Luxing Yin <root@tr0jan.top>
Signed-off-by: Luxing Yin <root@tr0jan.top>
Signed-off-by: Zihan Xi <zihanx@nebusec.ai>
---
changes in v2:
  - Replace the callback counter with a cumulative 256-byte header budget
    carried in skb_gso_cb.
  - Apply the budget at common callback entry and across IP, GRE, UDP, MPLS,
    NSH, ESP, and IPv6 extension dispatch, including GRE/UDP context resets.
  - Rebase the UDP hunk onto selected revision c9151088f167 and rerun both
    IPv4 PoCs; use the decoded crash evidence from unpatched 88c17de85ddb.
  - v1 Link: https://lore.kernel.org/all/cover.1789302084.git.zihanx@nebusec.ai/

 include/net/gso.h       | 29 +++++++++++++++++++++++++++++
 net/core/gso.c          |  7 +++++--
 net/ipv4/af_inet.c      |  7 ++++++-
 net/ipv4/esp4_offload.c |  9 +++++++--
 net/ipv4/gre_offload.c  |  2 ++
 net/ipv4/udp_offload.c  |  4 +++-
 net/ipv6/esp6_offload.c |  9 +++++++--
 net/ipv6/ip6_offload.c  | 11 ++++++++++-
 net/mpls/mpls_gso.c     |  2 ++
 net/nsh/nsh.c           |  2 ++
 10 files changed, 73 insertions(+), 9 deletions(-)

diff --git a/include/net/gso.h b/include/net/gso.h
index 29975440c..c3d38f838 100644
--- a/include/net/gso.h
+++ b/include/net/gso.h
@@ -19,10 +19,39 @@ struct skb_gso_cb {
 	int	encap_level;
 	__wsum	csum;
 	__u16	csum_start;
+	/* Bytes charged to the current GSO callback chain. */
+	u16	gso_header_len;
 };
 #define SKB_GSO_CB_OFFSET	32
 #define SKB_GSO_CB(skb) ((struct skb_gso_cb *)((skb)->cb + SKB_GSO_CB_OFFSET))
 
+#define GSO_MAX_HEADER	256
+
+static inline bool gso_header_len_add(struct sk_buff *skb,
+				      unsigned int len)
+{
+	struct skb_gso_cb *cb = SKB_GSO_CB(skb);
+
+	if (unlikely(cb->gso_header_len > GSO_MAX_HEADER ||
+		     len > GSO_MAX_HEADER - cb->gso_header_len))
+		return true;
+
+	cb->gso_header_len += len;
+	return false;
+}
+
+static inline struct sk_buff *
+skb_gso_segment_cb(struct sk_buff *skb,
+		   struct sk_buff *(*gso_segment)(struct sk_buff *,
+						  netdev_features_t),
+			netdev_features_t features)
+{
+	if (unlikely(gso_header_len_add(skb, 0)))
+		return ERR_PTR(-EINVAL);
+
+	return gso_segment(skb, features);
+}
+
 static inline int skb_tnl_header_len(const struct sk_buff *inner_skb)
 {
 	return (skb_mac_header(inner_skb) - inner_skb->head) -
diff --git a/net/core/gso.c b/net/core/gso.c
index bcd156372..68e4acc11 100644
--- a/net/core/gso.c
+++ b/net/core/gso.c
@@ -19,7 +19,8 @@ struct sk_buff *skb_eth_gso_segment(struct sk_buff *skb,
 	rcu_read_lock();
 	list_for_each_entry_rcu(ptype, &net_hotdata.offload_base, list) {
 		if (ptype->type == type && ptype->callbacks.gso_segment) {
-			segs = ptype->callbacks.gso_segment(skb, features);
+			segs = skb_gso_segment_cb(skb, ptype->callbacks.gso_segment,
+						  features);
 			break;
 		}
 	}
@@ -50,7 +51,8 @@ struct sk_buff *skb_mac_gso_segment(struct sk_buff *skb,
 	rcu_read_lock();
 	list_for_each_entry_rcu(ptype, &net_hotdata.offload_base, list) {
 		if (ptype->type == type && ptype->callbacks.gso_segment) {
-			segs = ptype->callbacks.gso_segment(skb, features);
+			segs = skb_gso_segment_cb(skb, ptype->callbacks.gso_segment,
+						  features);
 			break;
 		}
 	}
@@ -117,6 +119,7 @@ struct sk_buff *__skb_gso_segment(struct sk_buff *skb,
 
 	SKB_GSO_CB(skb)->mac_offset = skb_headroom(skb);
 	SKB_GSO_CB(skb)->encap_level = 0;
+	SKB_GSO_CB(skb)->gso_header_len = 0;
 
 	skb_reset_mac_header(skb);
 	skb_reset_mac_len(skb);
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 32d006c1a..415274d49 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1375,6 +1375,8 @@ struct sk_buff *inet_gso_segment(struct sk_buff *skb,
 	int id;
 
 	skb_reset_network_header(skb);
+	if (unlikely(gso_header_len_add(skb, 0)))
+		goto out;
 	nhoff = skb_network_header(skb) - skb_mac_header(skb);
 	if (unlikely(!pskb_may_pull(skb, sizeof(*iph))))
 		goto out;
@@ -1390,6 +1392,8 @@ struct sk_buff *inet_gso_segment(struct sk_buff *skb,
 	/* Warning: after this point, iph might be no longer valid */
 	if (unlikely(!pskb_may_pull(skb, ihl)))
 		goto out;
+	if (unlikely(gso_header_len_add(skb, ihl)))
+		goto out;
 	__skb_pull(skb, ihl);
 
 	encap = SKB_GSO_CB(skb)->encap_level > 0;
@@ -1408,7 +1412,8 @@ struct sk_buff *inet_gso_segment(struct sk_buff *skb,
 
 	ops = rcu_dereference(inet_offloads[proto]);
 	if (likely(ops && ops->callbacks.gso_segment)) {
-		segs = ops->callbacks.gso_segment(skb, features);
+		segs = skb_gso_segment_cb(skb, ops->callbacks.gso_segment,
+					  features);
 		if (!segs)
 			skb->network_header = skb_mac_header(skb) + nhoff - skb->head;
 	}
diff --git a/net/ipv4/esp4_offload.c b/net/ipv4/esp4_offload.c
index abd77162f..cb2c4bbe6 100644
--- a/net/ipv4/esp4_offload.c
+++ b/net/ipv4/esp4_offload.c
@@ -141,7 +141,8 @@ static struct sk_buff *xfrm4_transport_gso_segment(struct xfrm_state *x,
 	skb->transport_header += x->props.header_len;
 	ops = rcu_dereference(inet_offloads[xo->proto]);
 	if (likely(ops && ops->callbacks.gso_segment))
-		segs = ops->callbacks.gso_segment(skb, features);
+		segs = skb_gso_segment_cb(skb, ops->callbacks.gso_segment,
+					  features);
 
 	return segs;
 }
@@ -182,7 +183,8 @@ static struct sk_buff *xfrm4_beet_gso_segment(struct xfrm_state *x,
 	__skb_pull(skb, skb_transport_offset(skb));
 	ops = rcu_dereference(inet_offloads[proto]);
 	if (likely(ops && ops->callbacks.gso_segment))
-		segs = ops->callbacks.gso_segment(skb, features);
+		segs = skb_gso_segment_cb(skb, ops->callbacks.gso_segment,
+					  features);
 
 	return segs;
 }
@@ -229,6 +231,9 @@ static struct sk_buff *esp4_gso_segment(struct sk_buff *skb,
 
 	if (!pskb_may_pull(skb, sizeof(*esph) + crypto_aead_ivsize(aead)))
 		return ERR_PTR(-EINVAL);
+	if (unlikely(gso_header_len_add(skb,
+					sizeof(*esph) + crypto_aead_ivsize(aead))))
+		return ERR_PTR(-EINVAL);
 
 	__skb_pull(skb, sizeof(*esph) + crypto_aead_ivsize(aead));
 
diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c
index 5028c72d4..a973b552b 100644
--- a/net/ipv4/gre_offload.c
+++ b/net/ipv4/gre_offload.c
@@ -32,6 +32,8 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
 
 	if (unlikely(!pskb_may_pull(skb, tnl_hlen)))
 		goto out;
+	if (unlikely(gso_header_len_add(skb, tnl_hlen)))
+		goto out;
 
 	/* setup inner skb. */
 	skb->encapsulation = 0;
diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index cf07c3c66..bcba85c6c 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -188,6 +188,8 @@ static struct sk_buff *__skb_udp_tunnel_segment(struct sk_buff *skb,
 
 	if (unlikely(!pskb_may_pull(skb, tnl_hlen)))
 		goto out;
+	if (unlikely(gso_header_len_add(skb, tnl_hlen)))
+		goto out;
 
 	uh = udp_hdr(skb);
 
@@ -242,7 +244,7 @@ static struct sk_buff *__skb_udp_tunnel_segment(struct sk_buff *skb,
 	}
 
 	/* segment inner packet. */
-	segs = gso_inner_segment(skb, features);
+	segs = skb_gso_segment_cb(skb, gso_inner_segment, features);
 	if (IS_ERR_OR_NULL(segs)) {
 		skb_gso_error_unwind(skb, protocol, tnl_hlen, mac_offset,
 				     mac_len);
diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c
index 22895521a..9f4fc9dae 100644
--- a/net/ipv6/esp6_offload.c
+++ b/net/ipv6/esp6_offload.c
@@ -177,7 +177,8 @@ static struct sk_buff *xfrm6_transport_gso_segment(struct xfrm_state *x,
 	skb->transport_header += x->props.header_len;
 	ops = rcu_dereference(inet6_offloads[xo->proto]);
 	if (likely(ops && ops->callbacks.gso_segment))
-		segs = ops->callbacks.gso_segment(skb, features);
+		segs = skb_gso_segment_cb(skb, ops->callbacks.gso_segment,
+					  features);
 
 	return segs;
 }
@@ -222,7 +223,8 @@ static struct sk_buff *xfrm6_beet_gso_segment(struct xfrm_state *x,
 	__skb_pull(skb, skb_transport_offset(skb));
 	ops = rcu_dereference(inet6_offloads[proto]);
 	if (likely(ops && ops->callbacks.gso_segment))
-		segs = ops->callbacks.gso_segment(skb, features);
+		segs = skb_gso_segment_cb(skb, ops->callbacks.gso_segment,
+					  features);
 
 	return segs;
 }
@@ -269,6 +271,9 @@ static struct sk_buff *esp6_gso_segment(struct sk_buff *skb,
 
 	if (!pskb_may_pull(skb, sizeof(*esph) + crypto_aead_ivsize(aead)))
 		return ERR_PTR(-EINVAL);
+	if (unlikely(gso_header_len_add(skb,
+					sizeof(*esph) + crypto_aead_ivsize(aead))))
+		return ERR_PTR(-EINVAL);
 
 	__skb_pull(skb, sizeof(*esph) + crypto_aead_ivsize(aead));
 
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 78f50c93c..2182e77ae 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -79,6 +79,8 @@ static int ipv6_gso_pull_exthdrs(struct sk_buff *skb, int proto)
 
 		if (unlikely(!pskb_may_pull(skb, len)))
 			break;
+		if (unlikely(gso_header_len_add(skb, len)))
+			return -EINVAL;
 
 		opth = (void *)skb->data;
 		proto = opth->nexthdr;
@@ -104,9 +106,13 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
 	bool gso_partial;
 
 	skb_reset_network_header(skb);
+	if (unlikely(gso_header_len_add(skb, 0)))
+		goto out;
 	nhoff = skb_network_header(skb) - skb_mac_header(skb);
 	if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h))))
 		goto out;
+	if (unlikely(gso_header_len_add(skb, sizeof(*ipv6h))))
+		goto out;
 
 	encap = SKB_GSO_CB(skb)->encap_level > 0;
 	if (encap)
@@ -118,6 +124,8 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
 	segs = ERR_PTR(-EPROTONOSUPPORT);
 
 	proto = ipv6_gso_pull_exthdrs(skb, ipv6h->nexthdr);
+	if (unlikely(proto < 0))
+		goto out;
 
 	if (skb->encapsulation &&
 	    skb_shinfo(skb)->gso_type & (SKB_GSO_IPXIP4 | SKB_GSO_IPXIP6))
@@ -132,7 +140,8 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
 		if (!skb_reset_transport_header_careful(skb))
 			goto out;
 
-		segs = ops->callbacks.gso_segment(skb, features);
+		segs = skb_gso_segment_cb(skb, ops->callbacks.gso_segment,
+					  features);
 		if (!segs)
 			skb->network_header = skb_mac_header(skb) + nhoff - skb->head;
 	}
diff --git a/net/mpls/mpls_gso.c b/net/mpls/mpls_gso.c
index 34ab659f5..a535f4988 100644
--- a/net/mpls/mpls_gso.c
+++ b/net/mpls/mpls_gso.c
@@ -36,6 +36,8 @@ static struct sk_buff *mpls_gso_segment(struct sk_buff *skb,
 		goto out;
 	if (unlikely(!pskb_may_pull(skb, mpls_hlen)))
 		goto out;
+	if (unlikely(gso_header_len_add(skb, mpls_hlen)))
+		goto out;
 
 	/* Setup inner SKB. */
 	mpls_protocol = skb->protocol;
diff --git a/net/nsh/nsh.c b/net/nsh/nsh.c
index bfb775806..49d16283b 100644
--- a/net/nsh/nsh.c
+++ b/net/nsh/nsh.c
@@ -95,6 +95,8 @@ static struct sk_buff *nsh_gso_segment(struct sk_buff *skb,
 		goto out;
 	if (unlikely(!pskb_may_pull(skb, nsh_len)))
 		goto out;
+	if (unlikely(gso_header_len_add(skb, nsh_len)))
+		goto out;
 
 	proto = tun_p_to_eth_p(nsh_hdr(skb)->np);
 	if (!proto)
-- 
2.43.0

Re: [PATCH net v2 1/1] net: gso: limit recursive IP-in-IP segmentation

[kernel test robot]

:::::: 
:::::: Manual check reason: "low confidence static check warning: include/net/gso.h:35:13: sparse: sparse: unsigned value that used to be signed checked against zero?"
:::::: 

BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
In-Reply-To: <33280f6e07bccaaeef2c70f1754017e9517f5aa5.1789618203.git.zihanx@nebusec.ai>
References: <33280f6e07bccaaeef2c70f1754017e9517f5aa5.1789618203.git.zihanx@nebusec.ai>
TO: Zihan Xi <zihanx@nebusec.ai>
TO: netdev@vger.kernel.org
CC: zihanx@nebusec.ai
CC: davem@davemloft.net
CC: edumazet@google.com
CC: kuba@kernel.org
CC: pabeni@redhat.com
CC: horms@kernel.org
CC: steffen.klassert@secunet.com
CC: herbert@gondor.apana.org.au
CC: dsahern@kernel.org
CC: idosch@nvidia.com
CC: linux-kernel@vger.kernel.org
CC: stable@vger.kernel.org

Hi Zihan,

kernel test robot noticed the following build warnings:

[auto build test WARNING on net/main]
[also build test WARNING on klassert-ipsec-next/master klassert-ipsec/master net-next/main linus/master v7.3-rc3 next-20260916]
[cannot apply to linux-review/Zihan-Xi/net-gso-limit-recursive-IP-in-IP-segmentation/20260913-141212]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Zihan-Xi/net-gso-limit-recursive-IP-in-IP-segmentation/20260917-160041
base:   net/main
patch link:    https://lore.kernel.org/r/33280f6e07bccaaeef2c70f1754017e9517f5aa5.1789618203.git.zihanx%40nebusec.ai
patch subject: [PATCH net v2 1/1] net: gso: limit recursive IP-in-IP segmentation
:::::: branch date: 18 hours ago
:::::: commit date: 18 hours ago
config: sh-randconfig-r1307-20260918 (https://download.01.org/0day-ci/archive/20260918/202609181814.iLdC7fhe-lkp@intel.com/config)
compiler: sh4-linux-gcc (GCC) 16.1.0
sparse: v0.6.5-rc1
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260918/202609181814.iLdC7fhe-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/r/202609181814.iLdC7fhe-lkp@intel.com/

sparse warnings: (new ones prefixed by >>)
   net/ipv6/ip6_offload.c: note: in included file (through include/net/udp.h):
>> include/net/gso.h:35:13: sparse: sparse: unsigned value that used to be signed checked against zero?
   include/net/gso.h:35:13: sparse: signed value source
>> include/net/gso.h:35:13: sparse: sparse: unsigned value that used to be signed checked against zero?
   include/net/gso.h:35:13: sparse: signed value source

vim +35 include/net/gso.h

16f1d23d914a29 Zihan Xi 2026-09-17  29  
16f1d23d914a29 Zihan Xi 2026-09-17  30  static inline bool gso_header_len_add(struct sk_buff *skb,
16f1d23d914a29 Zihan Xi 2026-09-17  31  				      unsigned int len)
16f1d23d914a29 Zihan Xi 2026-09-17  32  {
16f1d23d914a29 Zihan Xi 2026-09-17  33  	struct skb_gso_cb *cb = SKB_GSO_CB(skb);
16f1d23d914a29 Zihan Xi 2026-09-17  34  
16f1d23d914a29 Zihan Xi 2026-09-17 @35  	if (unlikely(cb->gso_header_len > GSO_MAX_HEADER ||
16f1d23d914a29 Zihan Xi 2026-09-17  36  		     len > GSO_MAX_HEADER - cb->gso_header_len))
16f1d23d914a29 Zihan Xi 2026-09-17  37  		return true;
16f1d23d914a29 Zihan Xi 2026-09-17  38  
16f1d23d914a29 Zihan Xi 2026-09-17  39  	cb->gso_header_len += len;
16f1d23d914a29 Zihan Xi 2026-09-17  40  	return false;
16f1d23d914a29 Zihan Xi 2026-09-17  41  }
16f1d23d914a29 Zihan Xi 2026-09-17  42  

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki