Hi Linux kernel maintainers,

This reroll uses IP_TUNNEL_RECURSION_LIMIT directly for the shared
IPv4/IPv6 GSO recursion check and adds the requested Closes tag.

The v5 cover letter has the bug details, PoC, and validation evidence:
https://lore.kernel.org/all/cover.1790157745.git.zihanx@nebusec.ai/

The v6 code was rebuilt and the PoC was rerun on x86_64. The BPF/veth
path sent 65536 bytes; tracefs observed six inet_gso_segment() entries,
with the sixth returning -EINVAL. The UID 65534 namespace-only path
completed with depth 180, gso_size 1400, and sendmsg() returning 3676.
No stack-guard, BUG, Oops, or panic was observed. IPv6 was build-enabled
but was not separately exercised at runtime.

Best regards,
Zihan Xi

Zihan Xi (1):
  net: gso: limit recursive IP-in-IP segmentation

 include/net/gso.h      | 8 ++++++++
 net/core/gso.c         | 1 +
 net/ipv4/af_inet.c     | 3 +++
 net/ipv6/ip6_offload.c | 4 ++++
 4 files changed, 16 insertions(+)

-- 
2.25.1