[PATCH net 1/2] nsh: limit recursion in nsh_gso_segment()

[Eric Dumazet <edumazet@kernel.org>]

nsh_gso_segment() calls skb_mac_gso_segment() for the inner packet,
which calls nsh_gso_segment() again when the next protocol is NSH,
either directly or behind an inner Ethernet header (ETH_P_TEB).

Nothing limits the depth: a GSO packet made of stacked 8-byte NSH
headers recurses once per header, and a 64KB packet can hold about
8000 of them, overflowing the kernel stack.

Such a packet can be injected with a packet socket using
PACKET_VNET_HDR, or with tun/tap or virtio_net, as nothing checks
that a GSO packet with VIRTIO_NET_HDR_F_NEEDS_CSUM carries the
protocol it claims. It is then segmented in software if the output
device does not support the GSO type:

BUG: TASK stack guard page was hit at ffffcad5c0ab3ff8 (stack is ffffcad5c0ab4000..ffffcad5c0ab8000)
Oops: stack guard page: 0000 [#1] SMP NOPTI
CPU: 3 UID: 0 PID: 337 Comm: nsh_gso Tainted: G            E       7.4.0-rc1+ #118 PREEMPT(lazy)
RIP: 0010:lock_acquire (kernel/locking/lockdep.c:5902)
Call Trace:
 <TASK>
 skb_mac_gso_segment (include/linux/rcupdate.h:309 include/linux/rcupdate.h:849 net/core/gso.c:50)
 nsh_gso_segment (net/nsh/nsh.c:110) nsh
 skb_mac_gso_segment (net/core/gso.c:53)
 nsh_gso_segment (net/nsh/nsh.c:110) nsh
 [...]
 skb_mac_gso_segment (net/core/gso.c:53)
 __skb_gso_segment (net/core/gso.c:129)
 validate_xmit_skb (net/core/dev.c:4238)
 __dev_queue_xmit (net/core/dev.c:5087)
 packet_sendmsg (net/packet/af_packet.c:3157 net/packet/af_packet.c:3189)
 __sys_sendto (net/socket.c:800 net/socket.c:818 net/socket.c:2283)
 __x64_sys_sendto (net/socket.c:2290 net/socket.c:2286 net/socket.c:2286)
 do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
 entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)

Use gso_recursion_inc_test(), added in commit 006c8b834aed ("net: gso:
limit recursive IP-in-IP segmentation"), with the same limit as IPv4
and IPv6. The counter is shared with them: a packet with four NSH
headers in front of an IPv4 header is still segmented, one more NSH
header and it is dropped.

The NSH -> ETH_P_TEB -> NSH route is covered as well, as each round
goes through nsh_gso_segment().

Fixes: c411ed854584 ("nsh: add GSO support")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/netdev/179443691180.2199510.148246238688217560@kernel.org/
Cc: Jiri Benc <jbenc@redhat.com>
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
---
 include/net/gso.h | 2 +-
 net/nsh/nsh.c     | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/include/net/gso.h b/include/net/gso.h
index fe3260b381d4..119fc4c170e1 100644
--- a/include/net/gso.h
+++ b/include/net/gso.h
@@ -19,7 +19,7 @@ struct skb_gso_cb {
 	int	encap_level;
 	__wsum	csum;
 	__u16	csum_start;
-	/* Number of IPv4/IPv6 GSO handler entries for this packet. */
+	/* Number of IPv4/IPv6/NSH GSO handler entries for this packet. */
 	u8	recursion_counter;
 	/* Max MSS segs per output skb, 0 = no limit */
 	u8	max_segs;
diff --git a/net/nsh/nsh.c b/net/nsh/nsh.c
index bfb7758063f3..dd4de50fc38c 100644
--- a/net/nsh/nsh.c
+++ b/net/nsh/nsh.c
@@ -9,6 +9,7 @@
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
 #include <net/gso.h>
+#include <net/ip_tunnels.h>
 #include <net/nsh.h>
 #include <net/tun_proto.h>
 
@@ -84,6 +85,12 @@ static struct sk_buff *nsh_gso_segment(struct sk_buff *skb,
 
 	skb_reset_network_header(skb);
 
+	/* NSH can carry NSH (directly, or in an inner Ethernet frame):
+	 * limit the recursion, as IPv4 and IPv6 do.
+	 */
+	if (unlikely(gso_recursion_inc_test(skb, IP_TUNNEL_RECURSION_LIMIT)))
+		goto out;
+
 	outer_proto = skb->protocol;
 	outer_hlen = skb_mac_header_len(skb);
 	mac_len = skb->mac_len;
-- 
2.53.0