Re: [PATCH net 1/2] nsh: limit recursion in nsh_gso_segment()

[David Laight <david.laight.linux@gmail.com>]

On Thu, 12 Nov 2026 11:20:00 +0100
Eric Dumazet <edumazet@kernel.org> wrote:

> nsh_gso_segment() calls skb_mac_gso_segment() for the inner packet,
> which calls nsh_gso_segment() again when the next protocol is NSH,
> either directly or behind an inner Ethernet header (ETH_P_TEB).
> 
> Nothing limits the depth: a GSO packet made of stacked 8-byte NSH
> headers recurses once per header, and a 64KB packet can hold about
> 8000 of them, overflowing the kernel stack.
> 
> Such a packet can be injected with a packet socket using
> PACKET_VNET_HDR, or with tun/tap or virtio_net, as nothing checks
> that a GSO packet with VIRTIO_NET_HDR_F_NEEDS_CSUM carries the
> protocol it claims. It is then segmented in software if the output
> device does not support the GSO type:
> 
> BUG: TASK stack guard page was hit at ffffcad5c0ab3ff8 (stack is ffffcad5c0ab4000..ffffcad5c0ab8000)
> Oops: stack guard page: 0000 [#1] SMP NOPTI
> CPU: 3 UID: 0 PID: 337 Comm: nsh_gso Tainted: G            E       7.4.0-rc1+ #118 PREEMPT(lazy)
> RIP: 0010:lock_acquire (kernel/locking/lockdep.c:5902)
> Call Trace:
>  <TASK>
>  skb_mac_gso_segment (include/linux/rcupdate.h:309 include/linux/rcupdate.h:849 net/core/gso.c:50)
>  nsh_gso_segment (net/nsh/nsh.c:110) nsh
>  skb_mac_gso_segment (net/core/gso.c:53)
>  nsh_gso_segment (net/nsh/nsh.c:110) nsh
>  [...]
>  skb_mac_gso_segment (net/core/gso.c:53)
>  __skb_gso_segment (net/core/gso.c:129)
>  validate_xmit_skb (net/core/dev.c:4238)
>  __dev_queue_xmit (net/core/dev.c:5087)
>  packet_sendmsg (net/packet/af_packet.c:3157 net/packet/af_packet.c:3189)
>  __sys_sendto (net/socket.c:800 net/socket.c:818 net/socket.c:2283)
>  __x64_sys_sendto (net/socket.c:2290 net/socket.c:2286 net/socket.c:2286)
>  do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
>  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
> 
> Use gso_recursion_inc_test(), added in commit 006c8b834aed ("net: gso:
> limit recursive IP-in-IP segmentation"), with the same limit as IPv4
> and IPv6. The counter is shared with them: a packet with four NSH
> headers in front of an IPv4 header is still segmented, one more NSH
> header and it is dropped.

Might it make sense to get the amount of space left on the kernel
stack and compare to some architecture defined limit rather than
hardcoding a count?

In particular sparc64 is much more likely to run out of stack (even with
its massive stack size) than anything else.

David 

> 
> The NSH -> ETH_P_TEB -> NSH route is covered as well, as each round
> goes through nsh_gso_segment().
> 
> Fixes: c411ed854584 ("nsh: add GSO support")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://lore.kernel.org/netdev/179443691180.2199510.148246238688217560@kernel.org/
> Cc: Jiri Benc <jbenc@redhat.com>
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>
> ---
>  include/net/gso.h | 2 +-
>  net/nsh/nsh.c     | 7 +++++++
>  2 files changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/include/net/gso.h b/include/net/gso.h
> index fe3260b381d4..119fc4c170e1 100644
> --- a/include/net/gso.h
> +++ b/include/net/gso.h
> @@ -19,7 +19,7 @@ struct skb_gso_cb {
>  	int	encap_level;
>  	__wsum	csum;
>  	__u16	csum_start;
> -	/* Number of IPv4/IPv6 GSO handler entries for this packet. */
> +	/* Number of IPv4/IPv6/NSH GSO handler entries for this packet. */
>  	u8	recursion_counter;
>  	/* Max MSS segs per output skb, 0 = no limit */
>  	u8	max_segs;
> diff --git a/net/nsh/nsh.c b/net/nsh/nsh.c
> index bfb7758063f3..dd4de50fc38c 100644
> --- a/net/nsh/nsh.c
> +++ b/net/nsh/nsh.c
> @@ -9,6 +9,7 @@
>  #include <linux/netdevice.h>
>  #include <linux/skbuff.h>
>  #include <net/gso.h>
> +#include <net/ip_tunnels.h>
>  #include <net/nsh.h>
>  #include <net/tun_proto.h>
>  
> @@ -84,6 +85,12 @@ static struct sk_buff *nsh_gso_segment(struct sk_buff *skb,
>  
>  	skb_reset_network_header(skb);
>  
> +	/* NSH can carry NSH (directly, or in an inner Ethernet frame):
> +	 * limit the recursion, as IPv4 and IPv6 do.
> +	 */
> +	if (unlikely(gso_recursion_inc_test(skb, IP_TUNNEL_RECURSION_LIMIT)))
> +		goto out;
> +
>  	outer_proto = skb->protocol;
>  	outer_hlen = skb_mac_header_len(skb);
>  	mac_len = skb->mac_len;