diff -u --recursive --new-file v1.2.12/linux/Makefile linux/Makefile
--- v1.2.12/linux/Makefile	Tue Jul 25 12:39:54 1995
+++ linux/Makefile	Wed Jul 26 09:43:44 1995
@@ -1,6 +1,6 @@
 VERSION = 1
 PATCHLEVEL = 2
-SUBLEVEL = 12
+SUBLEVEL = 13
 
 ARCH = i386
 
diff -u --recursive --new-file v1.2.12/linux/drivers/net/ppp.c linux/drivers/net/ppp.c
--- v1.2.12/linux/drivers/net/ppp.c	Tue Jul 25 12:39:54 1995
+++ linux/drivers/net/ppp.c	Thu Jul 27 09:08:11 1995
@@ -1262,6 +1262,12 @@
         } else goto wait;
       }
 
+      i = verify_area (VERIFY_WRITE,buf,nr);
+      if (i != 0) {
+	ppp->us_rbuff_lock = 0;
+	return i;
+      }
+
       /* reset the time of the last read operation */
       ppp->ddinfo.nip_rjiffies = jiffies;
 
@@ -1303,6 +1309,12 @@
     current->timeout = 0;
     PRINTKN (3,(KERN_DEBUG "ppp_read: sleeping\n"));
     interruptible_sleep_on (&ppp->read_wait);
+
+    /* Ensure that the ppp device is still attached. */
+    ppp = ppp_find(tty);
+    if (!ppp || ppp->magic != PPP_MAGIC || !ppp->inuse)
+      return 0;
+      
     if (current->signal & ~current->blocked)
       return -EINTR;
   } while (1);
@@ -1354,6 +1366,10 @@
     nr = ppp->mtu;
   }
 
+  i = verify_area (VERIFY_READ,buf,nr);
+  if (i != 0)
+    return i;
+
   if (ppp_debug >= 3)
     ppp_print_buffer ("write frame", buf, nr, USER_DS);
 
@@ -1363,6 +1379,12 @@
     current->timeout = 0;
     PRINTKN (3,(KERN_DEBUG "ppp_write: sleeping\n"));
     interruptible_sleep_on(&ppp->write_wait);
+
+    /* Ensure that the ppp device is still attached. */
+    ppp = ppp_find(tty);
+    if (!ppp || ppp->magic != PPP_MAGIC || !ppp->inuse)
+      return 0;
+
     if (current->signal & ~current->blocked)
       return -EINTR;
   }
diff -u --recursive --new-file v1.2.12/linux/fs/block_dev.c linux/fs/block_dev.c
--- v1.2.12/linux/fs/block_dev.c	Mon Jan 23 23:04:09 1995
+++ linux/fs/block_dev.c	Tue Aug  1 10:05:32 1995
@@ -197,6 +197,9 @@
 
 	if (offset > size)
 		left = 0;
+	/* size - offset might not fit into left, so check explicitly. */
+	else if (size - offset > INT_MAX)
+		left = INT_MAX;
 	else
 		left = size - offset;
 	if (left > count)
diff -u --recursive --new-file v1.2.12/linux/fs/hpfs/hpfs_fs.c linux/fs/hpfs/hpfs_fs.c
--- v1.2.12/linux/fs/hpfs/hpfs_fs.c	Sun Feb  5 14:44:32 1995
+++ linux/fs/hpfs/hpfs_fs.c	Wed Jul 26 09:43:32 1995
@@ -1297,7 +1297,7 @@
 	/*
 	 * name not found.
 	 */
-
+	brelse4(qbh);
 	return 0;
 }
 
diff -u --recursive --new-file v1.2.12/linux/fs/nfs/dir.c linux/fs/nfs/dir.c
--- v1.2.12/linux/fs/nfs/dir.c	Mon Jan 23 10:38:29 1995
+++ linux/fs/nfs/dir.c	Wed Aug  2 09:52:08 1995
@@ -248,7 +248,7 @@
 	entry->fhandle = *fhandle;
 	entry->fattr = *fattr;
 	entry->expiration_date = jiffies + (S_ISDIR(fattr->mode)
-		? NFS_SERVER(dir)->acdirmax : NFS_SERVER(dir)->acregmax);
+		? NFS_SERVER(dir)->acdirmin : NFS_SERVER(dir)->acregmin);
 }
 
 static void nfs_lookup_cache_remove(struct inode *dir, struct inode *inode,
diff -u --recursive --new-file v1.2.12/linux/fs/proc/inode.c linux/fs/proc/inode.c
--- v1.2.12/linux/fs/proc/inode.c	Tue Jul 25 12:39:54 1995
+++ linux/fs/proc/inode.c	Tue Aug  1 13:06:57 1995
@@ -194,10 +194,9 @@
 		return;
 	}
 	ino &= 0x0000ffff;
-	if (ino == PROC_PID_INO ||
-	    (p->dumpable && p->uid == p->euid && p->gid == p->egid)) {
-		inode->i_uid = p->uid;
-		inode->i_gid = p->gid;
+	if (ino == PROC_PID_INO || p->dumpable) {
+		inode->i_uid = p->euid;
+		inode->i_gid = p->egid;
 	}
 	switch (ino) {
 		case PROC_PID_INO: