++      Hot Fix 3 for Linux Kernel 2.4.30 - 2005/05/29 (rev@sync:1.1562)     ++
              Willy Tarreau - EXOSEC  < wtarreau at exosec.net >


Please read the "README" file first. Then, simply run "make" in the directory
containing this file to rebuild the patches referenced in this file.


1) Security fixes
=================
+ 2.4.30-vuln-CAN-2005-1263-1                           (Greg KH, Chris Wright)

  From Paul Starzetz: A locally exploitable flaw has been found in the Linux
  ELF binary format loader's core dump function that allows local users to
  gain root privileges and also execute arbitrary code at kernel privilege
  level.

+ 2.4.30-ipvs-unchecked-strcpy-1.diff                            (the PaX team)

  Replaced several unchecked strcpy() with strncpy().

+ 2.4.30-loop-off-by-one-1                                      (Julien Tinnes)

  There is an obvious off by one bug in loop.c in kernel 2.4.

+ 2.4.30-rtnetlink-off-by-one-1                                 (Julien Tinnes)

  [RTNETLINK]: Fix off-by-one error in rtnetlink.c

+ 2.4.30-random-poolsize-sysctl-fix-1                           (Vasily Averin)

  [PATCH] random poolsize sysctl fix
  SWSoft Linux kernel Team has discovered that your patch which should fix a
  random poolsize sysctl handler integer overflow, is wrong. You have changed
  a variable definition in function proc_do_poolsize(), but you had to fix an
  another function, poolsize_strategy()


2) Critical fixes
=================
+ 2.4.30-panic-if-more-than-one-moxa-1                         (David Monniaux)

  [PATCH] fix moxa crash with more than one 1 board.
  The current Moxa Intellio driver (moxa.c) panics when using > 1 board.
  Fixed build by declaring variable prior to usage - Willy.


3) Major bug fixes
==================
+ 2.4.30-bonding-rmmod-oops-1                                  (Mitch Williams)

  It fixes a stack dump when unloading the bonding module in 802.3ad mode
  if spinlock debugging is turned on, and it was already merged in 2.6.

+ 2.4.30-serial-null-dereference-1.diff                         (Julien Tinnes)

  Potential null pointer dereference in serial driver.

+ 2.4.30-mtrr-off-by-one-1.diff                   (Brad Spengler/Julien Tinnes)

  In mtrr_write(), if len==0, -1 is passed to copy_from_user(), which will
  trigger BUG_ON((long)n < 0). Brad found it, Julien explained it to me.

+ 2.4.30-jfs_read_super-oops-1                                    (Mike Kasick)

  [PATCH] JFS oops fix
  Specifically, the kernel attempts to mount root with JFS first, and upon
  aborting jfs_read_super(), the value of sbi->nls_tab is -1, a non-NULL
  value that causes unload_nls() to be called on garbage data leading to a
  NULL pointer dereference.
  
+ 2.4.30-usb-io_edgeport-oops-1                               (Marcelo Tosatti)

  USB: fix oops in io_edgeport.c driver (2.6 backport)


4) Minor bug fixes
==================
+ 2.4.30-madvise-must-return-EIO-1                               (Hugh Dickins)

  [PATCH] madvise_willneed -EIO beyond EOF.
  When the rlim_rss was removed from madvise_willneed, we unintentionally
  changed its error when applied to an area wholly beyond end of file: it
  used to report -EIO (whereas 2.6 reports success), it currently reports
  the confusingly inappropriate -EBADF.  Revert to -EIO in that case.

+ 2.4.30-rwsem-spinlocks-must-disable-interrupts-2              (David Howells)

  [PATCH] rwsem: Make rwsems use interrupt disabling spinlocks.
  The attached patch makes read/write semaphores use interrupt disabling
  spinlocks in the slow path, thus rendering the up functions and trylock
  functions available for use in interrupt context.  This matches the
  regular semaphore behaviour. Typo fixed by Mikael Pettersson.

+ 2.4.30-stretch-ack-kills-performance-1                         (David Miller)

  [TCP]: Fix stretch ACK performance killer when doing ucopy.
  
  When we are doing ucopy, we try to defer the ACK generation to
  cleanup_rbuf().  This works most of the time very well, but if the
  ucopy prequeue is large, this ACKing behavior kills performance.

  
5) Build fixes
==============

+ 2.4.30-xfs-build-without-debug-1                          (Christoph Hellwig)

  [PATCH] XFS: fix compilation error
  > 2.4.30 will not compile if XFS is turned on, but XFS debugging is not.
  Looks like a trivial one-liner got lost when merging from the SGI CVS tree.


6) Documentation fixes
======================
- None

END.