<div dir="auto">Acked-by: Sultan Alsawaf <<a href="mailto:sultan.alsawaf@canonical.com">sultan.alsawaf@canonical.com</a>></div> <div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Oct 9, 2019, 11:00 AM Tyler Hicks <<a href="mailto:tyhicks@canonical.com">tyhicks@canonical.com</a>> wrote: </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">BugLink: <a href="https://launchpad.net/bugs/1847478" rel="noreferrer noreferrer" target="_blank">https://launchpad.net/bugs/1847478</a> [Impact] An unprivileged local attacker could cause a denial of service, or possibly execute arbitrary code due to an ipv6 regression. [Test Case] An unpatched system will crash with the following command: $ unshare -rUn sh -c 'ip link add dummy1 type dummy && ip link set dummy1 up && ip -6 route add default dev dummy1 && ip -6 rule add table main suppress_prefixlength 0 && ping -f 1234::1' [Regression Potential] Low. The change could theoretically introduce a memory leak but that would still be an improvement over immediate loss of system availability. Clean cherry pick. Build logs are clean. I've successfully tested with the one-liner in the [Test Case]. I did not run the newly added net selftest since it is the same as the one-liner. Tyler Jason A. Donenfeld (1): ipv6: do not free rt if FIB_LOOKUP_NOREF is set on suppress rule net/ipv6/fib6_rules.c | 3 ++- tools/testing/selftests/net/fib_tests.sh | 17 ++++++++++++++++- 2 files changed, 18 insertions(+), 2 deletions(-) -- 2.17.1 -- kernel-team mailing list <a href="mailto:kernel-team@lists.ubuntu.com" target="_blank" rel="noreferrer">kernel-team@lists.ubuntu.com</a> <a href="https://lists.ubuntu.com/mailman/listinfo/kernel-team" rel="noreferrer noreferrer" target="_blank">https://lists.ubuntu.com/mailman/listinfo/kernel-team</a> </blockquote></div>