add open 2.6.16.31 fixes

svn path=/dists/sid/linux-2.6/; revision=8048

debian/changelog

@@ -48,6 +48,9 @@ linux-2.6 (2.6.18-9) UNRELEASED; urgency=low
   [ maximilian attems ]
   * Hand-picked from stable release 2.6.16.30:
     - [PPPOE]: Advertise PPPoE MTU
+  * Hand-picked from stable release 2.6.16.31:
+    - [NETFILTER]: Fix ip6_tables extension header bypass bug (CVE-2006-4572)
+    - fix RARP ic_servaddr breakage
   * Hand-picked from stable release 2.6.16.33:
     - Add new PHY to sis900 supported list
     - ipmi_si_intf.c: fix "&& 0xff" typos
@@ -77,7 +80,7 @@ linux-2.6 (2.6.18-9) UNRELEASED; urgency=low
     - softirq: remove BUG_ONs which can incorrectly trigger
     - Fix SUNRPC wakeup/execute race condition
 
- -- maximilian attems <maks@sternwelten.at>  Fri, 29 Dec 2006 00:02:11 +0100
+ -- maximilian attems <maks@sternwelten.at>  Fri, 29 Dec 2006 00:22:43 +0100
 
 linux-2.6 (2.6.18-8) unstable; urgency=low
 

debian/patches/bugfix/2.6.16.31

@@ -0,0 +1,38 @@
+diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
+index bb3613e..1b5d039 100644
+--- a/net/ipv4/ipconfig.c
++++ b/net/ipv4/ipconfig.c
+@@ -421,7 +421,7 @@ ic_rarp_recv(struct sk_buff *skb, struct
+ {
+ 	struct arphdr *rarp;
+ 	unsigned char *rarp_ptr;
+-	unsigned long sip, tip;
++	u32 sip, tip;
+ 	unsigned char *sha, *tha;		/* s for "source", t for "target" */
+ 	struct ic_device *d;
+ 
+diff --git a/net/ipv6/netfilter/ip6t_dst.c b/net/ipv6/netfilter/ip6t_dst.c
+index b4c153a..2441228 100644
+--- a/net/ipv6/netfilter/ip6t_dst.c
++++ b/net/ipv6/netfilter/ip6t_dst.c
+@@ -69,13 +69,18 @@ match(const struct sk_buff *skb,
+ 	u8 _opttype, *tp = NULL;
+ 	u8 _optlen, *lp = NULL;
+ 	unsigned int optlen;
++	int err;
+ 
+ #if HOPBYHOP
+-	if (ipv6_find_hdr(skb, &ptr, NEXTHDR_HOP, NULL) < 0)
++	err = ipv6_find_hdr(skb, &ptr, NEXTHDR_HOP, NULL);
+ #else
+-	if (ipv6_find_hdr(skb, &ptr, NEXTHDR_DEST, NULL) < 0)
++	err = ipv6_find_hdr(skb, &ptr, NEXTHDR_DEST, NULL);
+ #endif
++	if (err < 0) {
++		if (err != -ENOENT)
++			*hotdrop = 1;
+ 		return 0;
++	}
+ 
+ 	oh = skb_header_pointer(skb, ptr, sizeof(_optsh), &_optsh);
+ 	if (oh == NULL) {

debian/patches/series/9

@@ -17,6 +17,7 @@
 + bugfix/mincore-error-value-cases.patch
 + bugfix/mincore-typo.patch
 + bugfix/2.6.16.30
++ bugfix/2.6.16.31
 + bugfix/2.6.16.33
 + bugfix/2.6.16.34
 + bugfix/2.6.16.35