Linux kernel caps NSH recursion that could crash the stack

The Linux kernel's Network Service Header code could recurse without bound while splitting a large packet for transmission, and a crafted packet was enough to overflow the kernel stack and panic the machine.

Sashiko spotted the hole while reviewing an unrelated virtio series. Eric Dumazet fixed it. Segmentation called itself once for every stacked NSH header. A 64KB packet built from the minimum 8-byte headers can hold about 8000 of them, far more recursion than a kernel stack can absorb. Anyone who can send packets through a packet socket, or through tun/tap and virtio_net, can inject such a packet when the nsh module is loaded. If the output device does not offload that segmentation type, the kernel walks the headers in software until the stack guard page is hit.

The fix reuses the recursion counter already used to limit nested IP-in-IP segmentation, with the same depth cap as IPv4 and IPv6. The counter is shared: four NSH headers in front of an IPv4 header are still segmented, and a fifth is dropped. A selftest sends packets with one through thousands of headers and checks that only the shallow ones leave the device. Jakub Kicinski merged the series into the net tree.