Re: [PATCH net 1/2] nsh: limit recursion in nsh_gso_segment()

[Willem de Bruijn <willemdebruijn.kernel@gmail.com>]

Eric Dumazet wrote:
> nsh_gso_segment() calls skb_mac_gso_segment() for the inner packet,
> which calls nsh_gso_segment() again when the next protocol is NSH,
> either directly or behind an inner Ethernet header (ETH_P_TEB).
> 
> Nothing limits the depth: a GSO packet made of stacked 8-byte NSH
> headers recurses once per header, and a 64KB packet can hold about
> 8000 of them, overflowing the kernel stack.
> 
> Such a packet can be injected with a packet socket using
> PACKET_VNET_HDR, or with tun/tap or virtio_net, as nothing checks
> that a GSO packet with VIRTIO_NET_HDR_F_NEEDS_CSUM carries the
> protocol it claims. It is then segmented in software if the output
> device does not support the GSO type:
> 
> BUG: TASK stack guard page was hit at ffffcad5c0ab3ff8 (stack is ffffcad5c0ab4000..ffffcad5c0ab8000)
> Oops: stack guard page: 0000 [#1] SMP NOPTI
> CPU: 3 UID: 0 PID: 337 Comm: nsh_gso Tainted: G            E       7.4.0-rc1+ #118 PREEMPT(lazy)
> RIP: 0010:lock_acquire (kernel/locking/lockdep.c:5902)
> Call Trace:
>  <TASK>
>  skb_mac_gso_segment (include/linux/rcupdate.h:309 include/linux/rcupdate.h:849 net/core/gso.c:50)
>  nsh_gso_segment (net/nsh/nsh.c:110) nsh
>  skb_mac_gso_segment (net/core/gso.c:53)
>  nsh_gso_segment (net/nsh/nsh.c:110) nsh
>  [...]
>  skb_mac_gso_segment (net/core/gso.c:53)
>  __skb_gso_segment (net/core/gso.c:129)
>  validate_xmit_skb (net/core/dev.c:4238)
>  __dev_queue_xmit (net/core/dev.c:5087)
>  packet_sendmsg (net/packet/af_packet.c:3157 net/packet/af_packet.c:3189)
>  __sys_sendto (net/socket.c:800 net/socket.c:818 net/socket.c:2283)
>  __x64_sys_sendto (net/socket.c:2290 net/socket.c:2286 net/socket.c:2286)
>  do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
>  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
> 
> Use gso_recursion_inc_test(), added in commit 006c8b834aed ("net: gso:
> limit recursive IP-in-IP segmentation"), with the same limit as IPv4
> and IPv6. The counter is shared with them: a packet with four NSH
> headers in front of an IPv4 header is still segmented, one more NSH
> header and it is dropped.
> 
> The NSH -> ETH_P_TEB -> NSH route is covered as well, as each round
> goes through nsh_gso_segment().
> 
> Fixes: c411ed854584 ("nsh: add GSO support")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://lore.kernel.org/netdev/179443691180.2199510.148246238688217560@kernel.org/
> Cc: Jiri Benc <jbenc@redhat.com>
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>

Reviewed-by: Willem de Bruijn <willemb@google.com>