[PATCH net 0/2] nsh: limit recursion in nsh_gso_segment()

[Eric Dumazet <edumazet@kernel.org>]

Sashiko found that nsh_gso_segment() can call itself, through
skb_mac_gso_segment(), once per stacked NSH header. Nothing limits the
depth, and a 64KB GSO packet made of 8-byte NSH headers overflows the
kernel stack. It was reported while reviewing an unrelated virtio
series [1].

Such a packet can be sent with a packet socket using PACKET_VNET_HDR,
when the nsh module is loaded.

Patch 1 uses the recursion counter added in commit 006c8b834aed ("net:
gso: limit recursive IP-in-IP segmentation"), with the same limit as
IPv4 and IPv6.

Patch 2 adds a selftest: it panics an unfixed kernel, and passes with
patch 1.

[1] https://lore.kernel.org/netdev/179443691180.2199510.148246238688217560@kernel.org/

Eric Dumazet (2):
  nsh: limit recursion in nsh_gso_segment()
  selftests: net: add a test for NSH GSO

 include/net/gso.h                      |   2 +-
 net/nsh/nsh.c                          |   7 ++
 tools/testing/selftests/net/.gitignore |   1 +
 tools/testing/selftests/net/Makefile   |   2 +
 tools/testing/selftests/net/config     |   1 +
 tools/testing/selftests/net/nsh_gso.c  | 126 +++++++++++++++++++++++++
 tools/testing/selftests/net/nsh_gso.sh |  71 ++++++++++++++
 7 files changed, 209 insertions(+), 1 deletion(-)
 create mode 100644 tools/testing/selftests/net/nsh_gso.c
 create mode 100755 tools/testing/selftests/net/nsh_gso.sh


base-commit: 145480b28ca82e9fae789427cc4569e596515a32
-- 
2.53.0