Linux 2.6.16.3

Linux 2.6.16.3

[Greg KH]

We (the -stable team) are announcing the release of the 2.6.16.3 kernel.

The diffstat and short summary of the fixes are below.

I'll also be replying to this message with a copy of the patch between
2.6.16.2 and 2.6.16.3, as it is small enough to do so.

The updated 2.6.16.y git tree can be found at:
 	rsync://rsync.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.16.y.git
and can be browsed at the normal kernel.org git web browser:
	www.kernel.org/git/

thanks,

greg k-h

--------

 Makefile                |    2 +-
 security/keys/key.c     |    4 ++++
 security/keys/keyring.c |    1 +
 3 files changed, 6 insertions(+), 1 deletion(-)

Summary of changes from v2.6.16.2 to v2.6.16.3
==============================================

David Howells:
      Keys: Fix oops when adding key to non-keyring [CVE-2006-1522]

Greg Kroah-Hartman:
      Linux 2.6.16.3

Re: Linux 2.6.16.3

[Greg KH]

diff --git a/Makefile b/Makefile
index 3933cfc..1450dfe 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 16
-EXTRAVERSION = .2
+EXTRAVERSION = .3
 NAME=Sliding Snow Leopard
 
 # *DOCUMENTATION*
diff --git a/security/keys/key.c b/security/keys/key.c
index 99781b7..0e2584e 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -785,6 +785,10 @@ key_ref_t key_create_or_update(key_ref_t
 
 	key_check(keyring);
 
+	key_ref = ERR_PTR(-ENOTDIR);
+	if (keyring->type != &key_type_keyring)
+		goto error_2;
+
 	down_write(&keyring->sem);
 
 	/* if we're going to allocate a new key, we're going to have
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index d65a180..bffa924 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -437,6 +437,7 @@ EXPORT_SYMBOL(keyring_search);
 /*
  * search the given keyring only (no recursion)
  * - keyring must be locked by caller
+ * - caller must guarantee that the keyring is a keyring
  */
 key_ref_t __keyring_search_one(key_ref_t keyring_ref,
 			       const struct key_type *ktype,