Linux 2.6.16.8

Linux 2.6.16.8

[Greg KH]

We (the -stable team) are announcing the release of the 2.6.16.8 kernel.

The diffstat and short summary of the fixes are below.

I'll also be replying to this message with a copy of the patch between
2.6.16.7 and 2.6.16.8, as it is small enough to do so.

The updated 2.6.16.y git tree can be found at:
 	rsync://rsync.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.16.y.git
and can be browsed at the normal kernel.org git web browser:
	www.kernel.org/git/

thanks,

greg k-h

--------

 Makefile         |    2 +-
 net/ipv4/route.c |    5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

Summary of changes from v2.6.16.7 to v2.6.16.8
==============================================

Greg Kroah-Hartman:
      Linux 2.6.16.8

Stephen Hemminger:
      ip_route_input panic fix (CVE-2006-1525)

Re: Linux 2.6.16.8

[Greg KH]

diff --git a/Makefile b/Makefile
index 06a8926..6346bb6 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 16
-EXTRAVERSION = .7
+EXTRAVERSION = .8
 NAME=Sliding Snow Leopard
 
 # *DOCUMENTATION*
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index fca5fe0..a67955e 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2750,7 +2750,10 @@ int inet_rtm_getroute(struct sk_buff *in
 	/* Reserve room for dummy headers, this skb can pass
 	   through good chunk of routing engine.
 	 */
-	skb->mac.raw = skb->data;
+	skb->mac.raw = skb->nh.raw = skb->data;
+
+	/* Bugfix: need to give ip_route_input enough of an IP header to not gag. */
+	skb->nh.iph->protocol = IPPROTO_ICMP;
 	skb_reserve(skb, MAX_HEADER + sizeof(struct iphdr));
 
 	if (rta[RTA_SRC - 1])