diff -urN linux-2.4.29-hf9/Makefile linux-2.4.29-hf10/Makefile
--- linux-2.4.29-hf9/Makefile	Sun May 29 23:46:17 2005
+++ linux-2.4.29-hf10/Makefile	Sun May 29 23:46:46 2005
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 4
 SUBLEVEL = 29
-EXTRAVERSION = -hf9
+EXTRAVERSION = -hf10
 
 KERNELRELEASE=$(VERSION).$(PATCHLEVEL).$(SUBLEVEL)$(EXTRAVERSION)
 
diff -urN linux-2.4.29-hf9/arch/i386/kernel/mtrr.c linux-2.4.29-hf10/arch/i386/kernel/mtrr.c
--- linux-2.4.29-hf9/arch/i386/kernel/mtrr.c	Sat Aug  7 23:00:08 2004
+++ linux-2.4.29-hf10/arch/i386/kernel/mtrr.c	Sun May 29 23:46:46 2005
@@ -1674,6 +1674,7 @@
     char *ptr;
     char line[LINE_SIZE];
 
+    if (!len) return -EINVAL;
     if ( !suser () ) return -EPERM;
     /*  Can't seek (pwrite) on this device  */
     if (ppos != &file->f_pos) return -ESPIPE;
diff -urN linux-2.4.29-hf9/drivers/block/loop.c linux-2.4.29-hf10/drivers/block/loop.c
--- linux-2.4.29-hf9/drivers/block/loop.c	Sat Sep 13 07:57:22 2003
+++ linux-2.4.29-hf10/drivers/block/loop.c	Sun May 29 23:46:46 2005
@@ -974,7 +974,7 @@
 
 int loop_register_transfer(struct loop_func_table *funcs)
 {
-	if ((unsigned)funcs->number > MAX_LO_CRYPT || xfer_funcs[funcs->number])
+	if ((unsigned)funcs->number >= MAX_LO_CRYPT || xfer_funcs[funcs->number])
 		return -EINVAL;
 	xfer_funcs[funcs->number] = funcs;
 	return 0; 
diff -urN linux-2.4.29-hf9/drivers/char/random.c linux-2.4.29-hf10/drivers/char/random.c
--- linux-2.4.29-hf9/drivers/char/random.c	Mon Jan 31 22:01:10 2005
+++ linux-2.4.29-hf10/drivers/char/random.c	Sun May 29 23:46:46 2005
@@ -1771,7 +1771,7 @@
 static int proc_do_poolsize(ctl_table *table, int write, struct file *filp,
 			    void *buffer, size_t *lenp)
 {
-	unsigned int	ret;
+	int	ret;
 
 	sysctl_poolsize = random_state->poolinfo.POOLBYTES;
 
@@ -1787,7 +1787,7 @@
 			     void *oldval, size_t *oldlenp,
 			     void *newval, size_t newlen, void **context)
 {
-	int	len;
+	unsigned int	len;
 	
 	sysctl_poolsize = random_state->poolinfo.POOLBYTES;
 
diff -urN linux-2.4.29-hf9/drivers/char/serial.c linux-2.4.29-hf10/drivers/char/serial.c
--- linux-2.4.29-hf9/drivers/char/serial.c	Wed Dec 22 22:26:14 2004
+++ linux-2.4.29-hf10/drivers/char/serial.c	Sun May 29 23:46:46 2005
@@ -1827,13 +1827,18 @@
 
 static void rs_put_char(struct tty_struct *tty, unsigned char ch)
 {
-	struct async_struct *info = (struct async_struct *)tty->driver_data;
+	struct async_struct *info;
 	unsigned long flags;
 
+	if (!tty)
+		return;
+	
+	info =  (struct async_struct *)tty->driver_data;
+	
 	if (serial_paranoia_check(info, tty->device, "rs_put_char"))
 		return;
 
-	if (!tty || !info->xmit.buf)
+	if (!info->xmit.buf)
 		return;
 
 	save_flags(flags); cli();
@@ -1873,13 +1878,18 @@
 		    const unsigned char *buf, int count)
 {
 	int	c, ret = 0;
-	struct async_struct *info = (struct async_struct *)tty->driver_data;
+	struct async_struct *info;
 	unsigned long flags;
 				
+	if (!tty)
+		return 0;
+
+	info = (struct async_struct *)tty->driver_data;
+	
 	if (serial_paranoia_check(info, tty->device, "rs_write"))
 		return 0;
 
-	if (!tty || !info->xmit.buf || !tmp_buf)
+	if (!info->xmit.buf || !tmp_buf)
 		return 0;
 
 	save_flags(flags);
diff -urN linux-2.4.29-hf9/drivers/usb/serial/io_edgeport.c linux-2.4.29-hf10/drivers/usb/serial/io_edgeport.c
--- linux-2.4.29-hf9/drivers/usb/serial/io_edgeport.c	Wed Dec 22 22:26:14 2004
+++ linux-2.4.29-hf10/drivers/usb/serial/io_edgeport.c	Sun May 29 23:46:46 2005
@@ -2803,9 +2803,13 @@
 static void unicode_to_ascii (char *string, short *unicode, int unicode_size)
 {
 	int i;
-	for (i = 0; i < unicode_size; ++i) {
+
+	if (unicode_size <= 0)
+		return;
+	
+	for (i = 0; i < unicode_size; ++i)
 		string[i] = (char)(le16_to_cpu(unicode[i]));
-	}
+
 	string[unicode_size] = 0x00;
 }
 
diff -urN linux-2.4.29-hf9/fs/jfs/super.c linux-2.4.29-hf10/fs/jfs/super.c
--- linux-2.4.29-hf9/fs/jfs/super.c	Sat Jul 31 18:45:19 2004
+++ linux-2.4.29-hf10/fs/jfs/super.c	Sun May 29 23:46:46 2005
@@ -404,7 +404,7 @@
 		jfs_err("jfs_umount failed with return code %d", rc);
 	}
 out_kfree:
-	if (sbi->nls_tab)
+	if (sbi->nls_tab && sbi->nls_tab != (void *) -1)
 		unload_nls(sbi->nls_tab);
 	kfree(sbi);
 	return NULL;
diff -urN linux-2.4.29-hf9/fs/xfs/linux-2.4/xfs_buf.c linux-2.4.29-hf10/fs/xfs/linux-2.4/xfs_buf.c
--- linux-2.4.29-hf9/fs/xfs/linux-2.4/xfs_buf.c	Mon Jan 31 22:01:10 2005
+++ linux-2.4.29-hf10/fs/xfs/linux-2.4/xfs_buf.c	Sun May 29 23:46:46 2005
@@ -1073,7 +1073,7 @@
 	return(locked ? 0 : -EBUSY);
 }
 
-#ifdef DEBUG
+#if defined(DEBUG) || defined(XFS_BLI_TRACE)
 /*
  *	pagebuf_lock_value
  *
diff -urN linux-2.4.29-hf9/net/core/rtnetlink.c linux-2.4.29-hf10/net/core/rtnetlink.c
--- linux-2.4.29-hf9/net/core/rtnetlink.c	Sat Sep 13 07:57:34 2003
+++ linux-2.4.29-hf10/net/core/rtnetlink.c	Sun May 29 23:46:46 2005
@@ -303,7 +303,7 @@
 		return 0;
 
 	family = ((struct rtgenmsg*)NLMSG_DATA(nlh))->rtgen_family;
-	if (family > NPROTO) {
+	if (family >= NPROTO) {
 		*errp = -EAFNOSUPPORT;
 		return -1;
 	}
diff -urN linux-2.4.29-hf9/net/ipv4/ipvs/ip_vs_ctl.c linux-2.4.29-hf10/net/ipv4/ipvs/ip_vs_ctl.c
--- linux-2.4.29-hf9/net/ipv4/ipvs/ip_vs_ctl.c	Mon Jan 31 22:01:10 2005
+++ linux-2.4.29-hf10/net/ipv4/ipvs/ip_vs_ctl.c	Sun May 29 23:46:46 2005
@@ -1842,7 +1842,8 @@
 			entry.addr = svc->addr;
 			entry.port = svc->port;
 			entry.fwmark = svc->fwmark;
-			strcpy(entry.sched_name, svc->scheduler->name);
+			strncpy(entry.sched_name, svc->scheduler->name, sizeof(entry.sched_name));
+			entry.sched_name[sizeof(entry.sched_name) - 1] = 0;
 			entry.flags = svc->flags;
 			entry.timeout = svc->timeout / HZ;
 			entry.netmask = svc->netmask;
@@ -1866,7 +1867,8 @@
 			entry.addr = svc->addr;
 			entry.port = svc->port;
 			entry.fwmark = svc->fwmark;
-			strcpy(entry.sched_name, svc->scheduler->name);
+			strncpy(entry.sched_name, svc->scheduler->name, sizeof(entry.sched_name));
+			entry.sched_name[sizeof(entry.sched_name) - 1] = 0;
 			entry.flags = svc->flags;
 			entry.timeout = svc->timeout / HZ;
 			entry.netmask = svc->netmask;
@@ -2020,7 +2022,8 @@
 			svc = __ip_vs_service_get(get.protocol,
 						  get.addr, get.port);
 		if (svc) {
-			strcpy(get.sched_name, svc->scheduler->name);
+			strncpy(get.sched_name, svc->scheduler->name, sizeof(get.sched_name));
+			get.sched_name[sizeof(get.sched_name) - 1] = 0;
 			get.flags = svc->flags;
 			get.timeout = svc->timeout / HZ;
 			get.netmask = svc->netmask;
@@ -2083,10 +2086,14 @@
 			goto out;
 		}
 		u.state = ip_vs_sync_state;
-		if (ip_vs_sync_state & IP_VS_STATE_MASTER)
-			strcpy(u.mcast_master_ifn, ip_vs_mcast_master_ifn);
-		if (ip_vs_sync_state & IP_VS_STATE_BACKUP)
-			strcpy(u.mcast_backup_ifn, ip_vs_mcast_backup_ifn);
+		if (ip_vs_sync_state & IP_VS_STATE_MASTER) {
+			strncpy(u.mcast_master_ifn, ip_vs_mcast_master_ifn, sizeof(u.mcast_master_ifn));
+			u.mcast_master_ifn[sizeof(u.mcast_master_ifn) - 1] = 0;
+		}
+		if (ip_vs_sync_state & IP_VS_STATE_BACKUP) {
+			strncpy(u.mcast_backup_ifn, ip_vs_mcast_backup_ifn, sizeof(u.mcast_backup_ifn));
+			u.mcast_backup_ifn[sizeof(u.mcast_backup_ifn) - 1] = 0;
+		}
 		if (copy_to_user(user, &u, sizeof(u)) != 0)
 			ret = -EFAULT;
 	}
diff -urN linux-2.4.29-hf9/net/ipv4/ipvs/ip_vs_sched.c linux-2.4.29-hf10/net/ipv4/ipvs/ip_vs_sched.c
--- linux-2.4.29-hf9/net/ipv4/ipvs/ip_vs_sched.c	Sat Mar 20 10:08:21 2004
+++ linux-2.4.29-hf10/net/ipv4/ipvs/ip_vs_sched.c	Sun May 29 23:46:46 2005
@@ -156,7 +156,7 @@
 	 */
 	if (sched == NULL) {
 		char module_name[IP_VS_SCHEDNAME_MAXLEN+8];
-		sprintf(module_name,"ip_vs_%s", sched_name);
+		snprintf(module_name, sizeof(module_name), "ip_vs_%s", sched_name);
 		request_module(module_name);
 		sched = ip_vs_sched_getbyname(sched_name);
 	}
diff -urN linux-2.4.29-hf9/net/ipv4/ipvs/ip_vs_sync.c linux-2.4.29-hf10/net/ipv4/ipvs/ip_vs_sync.c
--- linux-2.4.29-hf9/net/ipv4/ipvs/ip_vs_sync.c	Mon Jan 31 22:01:10 2005
+++ linux-2.4.29-hf10/net/ipv4/ipvs/ip_vs_sync.c	Sun May 29 23:46:46 2005
@@ -808,10 +808,12 @@
 
 	ip_vs_sync_state |= state;
 	if (state == IP_VS_STATE_MASTER) {
-		strcpy(ip_vs_mcast_master_ifn, mcast_ifn);
+		strncpy(ip_vs_mcast_master_ifn, mcast_ifn, sizeof(ip_vs_mcast_master_ifn));
+		ip_vs_mcast_master_ifn[sizeof(ip_vs_mcast_master_ifn) - 1] = 0;
 		ip_vs_master_syncid = syncid;
 	} else {
-		strcpy(ip_vs_mcast_backup_ifn, mcast_ifn);
+		strncpy(ip_vs_mcast_backup_ifn, mcast_ifn, sizeof(ip_vs_mcast_backup_ifn));
+		ip_vs_mcast_backup_ifn[sizeof(ip_vs_mcast_backup_ifn) - 1] = 0;
 		ip_vs_backup_syncid = syncid;
 	}
 
diff -urN linux-2.4.29-hf9/net/ipv4/tcp_input.c linux-2.4.29-hf10/net/ipv4/tcp_input.c
--- linux-2.4.29-hf9/net/ipv4/tcp_input.c	Sun May 29 23:46:17 2005
+++ linux-2.4.29-hf10/net/ipv4/tcp_input.c	Sun May 29 23:46:46 2005
@@ -4243,16 +4243,7 @@
 					goto no_ack;
 			}
 
-			if (eaten) {
-				if (tcp_in_quickack_mode(tp)) {
-					tcp_send_ack(sk);
-				} else {
-					tcp_send_delayed_ack(sk);
-				}
-			} else {
-				__tcp_ack_snd_check(sk, 0);
-			}
-
+			__tcp_ack_snd_check(sk, 0);
 no_ack:
 			if (eaten)
 				__kfree_skb(skb);