diff --git linux-libre-4.14.325-gnu1/Makefile linux-libre-4.14.326-gnu1/Makefile
index 47cbb458e5a9..b1374a305d79 100644
--- linux-libre-4.14.325-gnu1/Makefile
+++ linux-libre-4.14.326-gnu1/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 14
-SUBLEVEL = 325
+SUBLEVEL = 326
 EXTRAVERSION = -gnu1
 NAME = Petit Gorille
 
diff --git linux-libre-4.14.325-gnu1/arch/arm/boot/dts/bcm53573.dtsi linux-libre-4.14.326-gnu1/arch/arm/boot/dts/bcm53573.dtsi
index c698a565b8ae..99cc83b911c1 100644
--- linux-libre-4.14.325-gnu1/arch/arm/boot/dts/bcm53573.dtsi
+++ linux-libre-4.14.326-gnu1/arch/arm/boot/dts/bcm53573.dtsi
@@ -119,6 +119,9 @@
 
 		pcie0: pcie@2000 {
 			reg = <0x00002000 0x1000>;
+
+			#address-cells = <3>;
+			#size-cells = <2>;
 		};
 
 		usb2: usb2@4000 {
diff --git linux-libre-4.14.325-gnu1/arch/arm/boot/dts/s3c6410-mini6410.dts linux-libre-4.14.326-gnu1/arch/arm/boot/dts/s3c6410-mini6410.dts
index de04d8764b0f..98de4ea8b8bc 100644
--- linux-libre-4.14.325-gnu1/arch/arm/boot/dts/s3c6410-mini6410.dts
+++ linux-libre-4.14.326-gnu1/arch/arm/boot/dts/s3c6410-mini6410.dts
@@ -61,7 +61,7 @@
 
 		ethernet@18000000 {
 			compatible = "davicom,dm9000";
-			reg = <0x18000000 0x2 0x18000004 0x2>;
+			reg = <0x18000000 0x2>, <0x18000004 0x2>;
 			interrupt-parent = <&gpn>;
 			interrupts = <7 IRQ_TYPE_LEVEL_HIGH>;
 			davicom,no-eeprom;
diff --git linux-libre-4.14.325-gnu1/arch/arm/boot/dts/s5pv210-smdkv210.dts linux-libre-4.14.326-gnu1/arch/arm/boot/dts/s5pv210-smdkv210.dts
index 75398318ed57..4e17023684c9 100644
--- linux-libre-4.14.325-gnu1/arch/arm/boot/dts/s5pv210-smdkv210.dts
+++ linux-libre-4.14.326-gnu1/arch/arm/boot/dts/s5pv210-smdkv210.dts
@@ -36,7 +36,7 @@
 
 	ethernet@18000000 {
 		compatible = "davicom,dm9000";
-		reg = <0xA8000000 0x2 0xA8000002 0x2>;
+		reg = <0xa8000000 0x2>, <0xa8000002 0x2>;
 		interrupt-parent = <&gph1>;
 		interrupts = <1 4>;
 		local-mac-address = [00 00 de ad be ef];
diff --git linux-libre-4.14.325-gnu1/arch/arm/kernel/hw_breakpoint.c linux-libre-4.14.326-gnu1/arch/arm/kernel/hw_breakpoint.c
index a8783964ebde..6f5907970143 100644
--- linux-libre-4.14.325-gnu1/arch/arm/kernel/hw_breakpoint.c
+++ linux-libre-4.14.326-gnu1/arch/arm/kernel/hw_breakpoint.c
@@ -631,7 +631,7 @@ int arch_validate_hwbkpt_settings(struct perf_event *bp)
 	info->address &= ~alignment_mask;
 	info->ctrl.len <<= offset;
 
-	if (is_default_overflow_handler(bp)) {
+	if (uses_default_overflow_handler(bp)) {
 		/*
 		 * Mismatch breakpoints are required for single-stepping
 		 * breakpoints.
@@ -803,7 +803,7 @@ static void watchpoint_handler(unsigned long addr, unsigned int fsr,
 		 * Otherwise, insert a temporary mismatch breakpoint so that
 		 * we can single-step over the watchpoint trigger.
 		 */
-		if (!is_default_overflow_handler(wp))
+		if (!uses_default_overflow_handler(wp))
 			continue;
 step:
 		enable_single_step(wp, instruction_pointer(regs));
@@ -816,7 +816,7 @@ step:
 		info->trigger = addr;
 		pr_debug("watchpoint fired: address = 0x%x\n", info->trigger);
 		perf_bp_event(wp, regs);
-		if (is_default_overflow_handler(wp))
+		if (uses_default_overflow_handler(wp))
 			enable_single_step(wp, instruction_pointer(regs));
 	}
 
@@ -891,7 +891,7 @@ static void breakpoint_handler(unsigned long unknown, struct pt_regs *regs)
 			info->trigger = addr;
 			pr_debug("breakpoint fired: address = 0x%x\n", addr);
 			perf_bp_event(bp, regs);
-			if (is_default_overflow_handler(bp))
+			if (uses_default_overflow_handler(bp))
 				enable_single_step(bp, addr);
 			goto unlock;
 		}
diff --git linux-libre-4.14.325-gnu1/arch/arm/mach-omap2/powerdomain.c linux-libre-4.14.326-gnu1/arch/arm/mach-omap2/powerdomain.c
index 1e6a967cd2d5..d1b95576545c 100644
--- linux-libre-4.14.325-gnu1/arch/arm/mach-omap2/powerdomain.c
+++ linux-libre-4.14.326-gnu1/arch/arm/mach-omap2/powerdomain.c
@@ -173,7 +173,7 @@ static int _pwrdm_state_switch(struct powerdomain *pwrdm, int flag)
 		break;
 	case PWRDM_STATE_PREV:
 		prev = pwrdm_read_prev_pwrst(pwrdm);
-		if (pwrdm->state != prev)
+		if (prev >= 0 && pwrdm->state != prev)
 			pwrdm->state_counter[prev]++;
 		if (prev == PWRDM_POWER_RET)
 			_update_logic_membank_counters(pwrdm);
diff --git linux-libre-4.14.325-gnu1/arch/arm/mach-pxa/sharpsl_pm.c linux-libre-4.14.326-gnu1/arch/arm/mach-pxa/sharpsl_pm.c
index 249b7bd5fbc4..3ae2eec37109 100644
--- linux-libre-4.14.325-gnu1/arch/arm/mach-pxa/sharpsl_pm.c
+++ linux-libre-4.14.326-gnu1/arch/arm/mach-pxa/sharpsl_pm.c
@@ -224,8 +224,6 @@ void sharpsl_battery_kick(void)
 {
 	schedule_delayed_work(&sharpsl_bat, msecs_to_jiffies(125));
 }
-EXPORT_SYMBOL(sharpsl_battery_kick);
-
 
 static void sharpsl_battery_thread(struct work_struct *private_)
 {
diff --git linux-libre-4.14.325-gnu1/arch/arm/mach-pxa/spitz.c linux-libre-4.14.326-gnu1/arch/arm/mach-pxa/spitz.c
index 67d66c702574..e9385a80cc6b 100644
--- linux-libre-4.14.325-gnu1/arch/arm/mach-pxa/spitz.c
+++ linux-libre-4.14.326-gnu1/arch/arm/mach-pxa/spitz.c
@@ -13,7 +13,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/module.h>	/* symbol_get ; symbol_put */
 #include <linux/platform_device.h>
 #include <linux/delay.h>
 #include <linux/gpio_keys.h>
@@ -517,17 +516,6 @@ static struct pxa2xx_spi_chip spitz_ads7846_chip = {
 	.gpio_cs		= SPITZ_GPIO_ADS7846_CS,
 };
 
-static void spitz_bl_kick_battery(void)
-{
-	void (*kick_batt)(void);
-
-	kick_batt = symbol_get(sharpsl_battery_kick);
-	if (kick_batt) {
-		kick_batt();
-		symbol_put(sharpsl_battery_kick);
-	}
-}
-
 static struct corgi_lcd_platform_data spitz_lcdcon_info = {
 	.init_mode		= CORGI_LCD_MODE_VGA,
 	.max_intensity		= 0x2f,
@@ -535,7 +523,7 @@ static struct corgi_lcd_platform_data spitz_lcdcon_info = {
 	.limit_mask		= 0x0b,
 	.gpio_backlight_cont	= SPITZ_GPIO_BACKLIGHT_CONT,
 	.gpio_backlight_on	= SPITZ_GPIO_BACKLIGHT_ON,
-	.kick_battery		= spitz_bl_kick_battery,
+	.kick_battery		= sharpsl_battery_kick,
 };
 
 static struct pxa2xx_spi_chip spitz_lcdcon_chip = {
diff --git linux-libre-4.14.325-gnu1/arch/arm64/kernel/hw_breakpoint.c linux-libre-4.14.326-gnu1/arch/arm64/kernel/hw_breakpoint.c
index 6e96cea99a4e..7f608a8d4386 100644
--- linux-libre-4.14.325-gnu1/arch/arm64/kernel/hw_breakpoint.c
+++ linux-libre-4.14.326-gnu1/arch/arm64/kernel/hw_breakpoint.c
@@ -662,7 +662,7 @@ static int breakpoint_handler(unsigned long unused, unsigned int esr,
 		perf_bp_event(bp, regs);
 
 		/* Do we need to handle the stepping? */
-		if (is_default_overflow_handler(bp))
+		if (uses_default_overflow_handler(bp))
 			step = 1;
 unlock:
 		rcu_read_unlock();
@@ -741,7 +741,7 @@ static u64 get_distance_from_watchpoint(unsigned long addr, u64 val,
 static int watchpoint_report(struct perf_event *wp, unsigned long addr,
 			     struct pt_regs *regs)
 {
-	int step = is_default_overflow_handler(wp);
+	int step = uses_default_overflow_handler(wp);
 	struct arch_hw_breakpoint *info = counter_arch_bp(wp);
 
 	info->trigger = addr;
diff --git linux-libre-4.14.325-gnu1/arch/m68k/fpsp040/skeleton.S linux-libre-4.14.326-gnu1/arch/m68k/fpsp040/skeleton.S
index a8f41615d94a..31a9c634c81e 100644
--- linux-libre-4.14.325-gnu1/arch/m68k/fpsp040/skeleton.S
+++ linux-libre-4.14.326-gnu1/arch/m68k/fpsp040/skeleton.S
@@ -499,12 +499,12 @@ in_ea:
 	dbf	%d0,morein
 	rts
 
-	.section .fixup,#alloc,#execinstr
+	.section .fixup,"ax"
 	.even
 1:
 	jbra	fpsp040_die
 
-	.section __ex_table,#alloc
+	.section __ex_table,"a"
 	.align	4
 
 	.long	in_ea,1b
diff --git linux-libre-4.14.325-gnu1/arch/m68k/ifpsp060/os.S linux-libre-4.14.326-gnu1/arch/m68k/ifpsp060/os.S
index 7a0d6e428066..89e2ec224ab6 100644
--- linux-libre-4.14.325-gnu1/arch/m68k/ifpsp060/os.S
+++ linux-libre-4.14.326-gnu1/arch/m68k/ifpsp060/os.S
@@ -379,11 +379,11 @@ _060_real_access:
 
 
 | Execption handling for movs access to illegal memory
-	.section .fixup,#alloc,#execinstr
+	.section .fixup,"ax"
 	.even
 1:	moveq		#-1,%d1
 	rts
-.section __ex_table,#alloc
+.section __ex_table,"a"
 	.align 4
 	.long	dmrbuae,1b
 	.long	dmrwuae,1b
diff --git linux-libre-4.14.325-gnu1/arch/m68k/kernel/relocate_kernel.S linux-libre-4.14.326-gnu1/arch/m68k/kernel/relocate_kernel.S
index ab0f1e7d4653..f7667079e08e 100644
--- linux-libre-4.14.325-gnu1/arch/m68k/kernel/relocate_kernel.S
+++ linux-libre-4.14.326-gnu1/arch/m68k/kernel/relocate_kernel.S
@@ -26,7 +26,7 @@ ENTRY(relocate_new_kernel)
 	lea %pc@(.Lcopy),%a4
 2:	addl #0x00000000,%a4		/* virt_to_phys() */
 
-	.section ".m68k_fixup","aw"
+	.section .m68k_fixup,"aw"
 	.long M68K_FIXUP_MEMOFFSET, 2b+2
 	.previous
 
@@ -49,7 +49,7 @@ ENTRY(relocate_new_kernel)
 	lea %pc@(.Lcont040),%a4
 5:	addl #0x00000000,%a4		/* virt_to_phys() */
 
-	.section ".m68k_fixup","aw"
+	.section .m68k_fixup,"aw"
 	.long M68K_FIXUP_MEMOFFSET, 5b+2
 	.previous
 
diff --git linux-libre-4.14.325-gnu1/arch/mips/alchemy/devboards/db1000.c linux-libre-4.14.326-gnu1/arch/mips/alchemy/devboards/db1000.c
index 433c4b9a9f0a..2854f959a65c 100644
--- linux-libre-4.14.325-gnu1/arch/mips/alchemy/devboards/db1000.c
+++ linux-libre-4.14.326-gnu1/arch/mips/alchemy/devboards/db1000.c
@@ -26,7 +26,6 @@
 #include <linux/interrupt.h>
 #include <linux/leds.h>
 #include <linux/mmc/host.h>
-#include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/pm.h>
 #include <linux/spi/spi.h>
@@ -175,12 +174,7 @@ static struct platform_device db1x00_audio_dev = {
 
 static irqreturn_t db1100_mmc_cd(int irq, void *ptr)
 {
-	void (*mmc_cd)(struct mmc_host *, unsigned long);
-	/* link against CONFIG_MMC=m */
-	mmc_cd = symbol_get(mmc_detect_change);
-	mmc_cd(ptr, msecs_to_jiffies(500));
-	symbol_put(mmc_detect_change);
-
+	mmc_detect_change(ptr, msecs_to_jiffies(500));
 	return IRQ_HANDLED;
 }
 
diff --git linux-libre-4.14.325-gnu1/arch/mips/alchemy/devboards/db1200.c linux-libre-4.14.326-gnu1/arch/mips/alchemy/devboards/db1200.c
index da7663770425..ae81e05fcb2c 100644
--- linux-libre-4.14.325-gnu1/arch/mips/alchemy/devboards/db1200.c
+++ linux-libre-4.14.326-gnu1/arch/mips/alchemy/devboards/db1200.c
@@ -23,7 +23,6 @@
 #include <linux/gpio.h>
 #include <linux/i2c.h>
 #include <linux/init.h>
-#include <linux/module.h>
 #include <linux/interrupt.h>
 #include <linux/io.h>
 #include <linux/leds.h>
@@ -355,14 +354,7 @@ static irqreturn_t db1200_mmc_cd(int irq, void *ptr)
 
 static irqreturn_t db1200_mmc_cdfn(int irq, void *ptr)
 {
-	void (*mmc_cd)(struct mmc_host *, unsigned long);
-
-	/* link against CONFIG_MMC=m */
-	mmc_cd = symbol_get(mmc_detect_change);
-	if (mmc_cd) {
-		mmc_cd(ptr, msecs_to_jiffies(200));
-		symbol_put(mmc_detect_change);
-	}
+	mmc_detect_change(ptr, msecs_to_jiffies(200));
 
 	msleep(100);	/* debounce */
 	if (irq == DB1200_SD0_INSERT_INT)
@@ -446,14 +438,7 @@ static irqreturn_t pb1200_mmc1_cd(int irq, void *ptr)
 
 static irqreturn_t pb1200_mmc1_cdfn(int irq, void *ptr)
 {
-	void (*mmc_cd)(struct mmc_host *, unsigned long);
-
-	/* link against CONFIG_MMC=m */
-	mmc_cd = symbol_get(mmc_detect_change);
-	if (mmc_cd) {
-		mmc_cd(ptr, msecs_to_jiffies(200));
-		symbol_put(mmc_detect_change);
-	}
+	mmc_detect_change(ptr, msecs_to_jiffies(200));
 
 	msleep(100);	/* debounce */
 	if (irq == PB1200_SD1_INSERT_INT)
diff --git linux-libre-4.14.325-gnu1/arch/mips/alchemy/devboards/db1300.c linux-libre-4.14.326-gnu1/arch/mips/alchemy/devboards/db1300.c
index efb318e03e0a..0c12fbc07117 100644
--- linux-libre-4.14.325-gnu1/arch/mips/alchemy/devboards/db1300.c
+++ linux-libre-4.14.326-gnu1/arch/mips/alchemy/devboards/db1300.c
@@ -17,7 +17,6 @@
 #include <linux/interrupt.h>
 #include <linux/ata_platform.h>
 #include <linux/mmc/host.h>
-#include <linux/module.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/rawnand.h>
 #include <linux/mtd/partitions.h>
@@ -457,14 +456,7 @@ static irqreturn_t db1300_mmc_cd(int irq, void *ptr)
 
 static irqreturn_t db1300_mmc_cdfn(int irq, void *ptr)
 {
-	void (*mmc_cd)(struct mmc_host *, unsigned long);
-
-	/* link against CONFIG_MMC=m.  We can only be called once MMC core has
-	 * initialized the controller, so symbol_get() should always succeed.
-	 */
-	mmc_cd = symbol_get(mmc_detect_change);
-	mmc_cd(ptr, msecs_to_jiffies(200));
-	symbol_put(mmc_detect_change);
+	mmc_detect_change(ptr, msecs_to_jiffies(200));
 
 	msleep(100);	/* debounce */
 	if (irq == DB1300_SD1_INSERT_INT)
diff --git linux-libre-4.14.325-gnu1/arch/parisc/include/asm/led.h linux-libre-4.14.326-gnu1/arch/parisc/include/asm/led.h
index 6de13d08a388..b70b9094fb7c 100644
--- linux-libre-4.14.325-gnu1/arch/parisc/include/asm/led.h
+++ linux-libre-4.14.326-gnu1/arch/parisc/include/asm/led.h
@@ -11,8 +11,8 @@
 #define	LED1		0x02
 #define	LED0		0x01		/* bottom (or furthest left) LED */
 
-#define	LED_LAN_TX	LED0		/* for LAN transmit activity */
-#define	LED_LAN_RCV	LED1		/* for LAN receive activity */
+#define	LED_LAN_RCV	LED0		/* for LAN receive activity */
+#define	LED_LAN_TX	LED1		/* for LAN transmit activity */
 #define	LED_DISK_IO	LED2		/* for disk activity */
 #define	LED_HEARTBEAT	LED3		/* heartbeat */
 
diff --git linux-libre-4.14.325-gnu1/arch/parisc/include/asm/processor.h linux-libre-4.14.326-gnu1/arch/parisc/include/asm/processor.h
index 2dbe5580a1a4..d98f4cb549b9 100644
--- linux-libre-4.14.325-gnu1/arch/parisc/include/asm/processor.h
+++ linux-libre-4.14.326-gnu1/arch/parisc/include/asm/processor.h
@@ -108,7 +108,6 @@ struct cpuinfo_parisc {
 	unsigned long cpu_loc;      /* CPU location from PAT firmware */
 	unsigned int state;
 	struct parisc_device *dev;
-	unsigned long loops_per_jiffy;
 };
 
 extern struct system_cpuinfo_parisc boot_cpu_data;
diff --git linux-libre-4.14.325-gnu1/arch/parisc/kernel/processor.c linux-libre-4.14.326-gnu1/arch/parisc/kernel/processor.c
index 58ece781a176..e87bb36b3fca 100644
--- linux-libre-4.14.325-gnu1/arch/parisc/kernel/processor.c
+++ linux-libre-4.14.326-gnu1/arch/parisc/kernel/processor.c
@@ -177,7 +177,6 @@ static int __init processor_probe(struct parisc_device *dev)
 	if (cpuid)
 		memset(p, 0, sizeof(struct cpuinfo_parisc));
 
-	p->loops_per_jiffy = loops_per_jiffy;
 	p->dev = dev;		/* Save IODC data in case we need it */
 	p->hpa = dev->hpa.start;	/* save CPU hpa */
 	p->cpuid = cpuid;	/* save CPU id */
@@ -370,10 +369,18 @@ int
 show_cpuinfo (struct seq_file *m, void *v)
 {
 	unsigned long cpu;
+	char cpu_name[60], *p;
+
+	/* strip PA path from CPU name to not confuse lscpu */
+	strlcpy(cpu_name, per_cpu(cpu_data, 0).dev->name, sizeof(cpu_name));
+	p = strrchr(cpu_name, '[');
+	if (p)
+		*(--p) = 0;
 
 	for_each_online_cpu(cpu) {
-		const struct cpuinfo_parisc *cpuinfo = &per_cpu(cpu_data, cpu);
 #ifdef CONFIG_SMP
+		const struct cpuinfo_parisc *cpuinfo = &per_cpu(cpu_data, cpu);
+
 		if (0 == cpuinfo->hpa)
 			continue;
 #endif
@@ -410,8 +417,7 @@ show_cpuinfo (struct seq_file *m, void *v)
 
 		seq_printf(m, "model\t\t: %s - %s\n",
 				 boot_cpu_data.pdc.sys_model_name,
-				 cpuinfo->dev ?
-				 cpuinfo->dev->name : "Unknown");
+				 cpu_name);
 
 		seq_printf(m, "hversion\t: 0x%08x\n"
 			        "sversion\t: 0x%08x\n",
@@ -422,8 +428,8 @@ show_cpuinfo (struct seq_file *m, void *v)
 		show_cache_info(m);
 
 		seq_printf(m, "bogomips\t: %lu.%02lu\n",
-			     cpuinfo->loops_per_jiffy / (500000 / HZ),
-			     (cpuinfo->loops_per_jiffy / (5000 / HZ)) % 100);
+			     loops_per_jiffy / (500000 / HZ),
+			     loops_per_jiffy / (5000 / HZ) % 100);
 
 		seq_printf(m, "software id\t: %ld\n\n",
 				boot_cpu_data.pdc.model.sw_id);
diff --git linux-libre-4.14.325-gnu1/arch/powerpc/kernel/head_32.S linux-libre-4.14.326-gnu1/arch/powerpc/kernel/head_32.S
index 29b2fed93289..1fb98efd5404 100644
--- linux-libre-4.14.325-gnu1/arch/powerpc/kernel/head_32.S
+++ linux-libre-4.14.326-gnu1/arch/powerpc/kernel/head_32.S
@@ -986,7 +986,7 @@ start_here:
 	 */
 	lis	r5, abatron_pteptrs@h
 	ori	r5, r5, abatron_pteptrs@l
-	stw	r5, 0xf0(r0)	/* This much match your Abatron config */
+	stw	r5, 0xf0(0)	/* This much match your Abatron config */
 	lis	r6, swapper_pg_dir@h
 	ori	r6, r6, swapper_pg_dir@l
 	tophys(r5, r5)
diff --git linux-libre-4.14.325-gnu1/arch/powerpc/kernel/iommu.c linux-libre-4.14.326-gnu1/arch/powerpc/kernel/iommu.c
index 87af91937c8a..410fb08a2c31 100644
--- linux-libre-4.14.325-gnu1/arch/powerpc/kernel/iommu.c
+++ linux-libre-4.14.326-gnu1/arch/powerpc/kernel/iommu.c
@@ -145,17 +145,28 @@ static int fail_iommu_bus_notify(struct notifier_block *nb,
 	return 0;
 }
 
-static struct notifier_block fail_iommu_bus_notifier = {
+/*
+ * PCI and VIO buses need separate notifier_block structs, since they're linked
+ * list nodes.  Sharing a notifier_block would mean that any notifiers later
+ * registered for PCI buses would also get called by VIO buses and vice versa.
+ */
+static struct notifier_block fail_iommu_pci_bus_notifier = {
 	.notifier_call = fail_iommu_bus_notify
 };
 
+#ifdef CONFIG_IBMVIO
+static struct notifier_block fail_iommu_vio_bus_notifier = {
+	.notifier_call = fail_iommu_bus_notify
+};
+#endif
+
 static int __init fail_iommu_setup(void)
 {
 #ifdef CONFIG_PCI
-	bus_register_notifier(&pci_bus_type, &fail_iommu_bus_notifier);
+	bus_register_notifier(&pci_bus_type, &fail_iommu_pci_bus_notifier);
 #endif
 #ifdef CONFIG_IBMVIO
-	bus_register_notifier(&vio_bus_type, &fail_iommu_bus_notifier);
+	bus_register_notifier(&vio_bus_type, &fail_iommu_vio_bus_notifier);
 #endif
 
 	return 0;
diff --git linux-libre-4.14.325-gnu1/arch/powerpc/kernel/vmlinux.lds.S linux-libre-4.14.326-gnu1/arch/powerpc/kernel/vmlinux.lds.S
index efb9a6982561..7346875ac61d 100644
--- linux-libre-4.14.325-gnu1/arch/powerpc/kernel/vmlinux.lds.S
+++ linux-libre-4.14.326-gnu1/arch/powerpc/kernel/vmlinux.lds.S
@@ -322,6 +322,7 @@ SECTIONS
 		*(.sdata2)
 		*(.got.plt) *(.got)
 		*(.plt)
+		*(.branch_lt)
 	}
 #else
 	.data : AT(ADDR(.data) - LOAD_OFFSET) {
diff --git linux-libre-4.14.325-gnu1/arch/powerpc/platforms/pseries/ibmebus.c linux-libre-4.14.326-gnu1/arch/powerpc/platforms/pseries/ibmebus.c
index 408a86044133..a3d6d064754e 100644
--- linux-libre-4.14.325-gnu1/arch/powerpc/platforms/pseries/ibmebus.c
+++ linux-libre-4.14.326-gnu1/arch/powerpc/platforms/pseries/ibmebus.c
@@ -452,6 +452,7 @@ static int __init ibmebus_bus_init(void)
 	if (err) {
 		printk(KERN_WARNING "%s: device_register returned %i\n",
 		       __func__, err);
+		put_device(&ibmebus_bus_device);
 		bus_unregister(&ibmebus_bus_type);
 
 		return err;
diff --git linux-libre-4.14.325-gnu1/arch/x86/include/asm/virtext.h linux-libre-4.14.326-gnu1/arch/x86/include/asm/virtext.h
index 4699acd602af..62810550024d 100644
--- linux-libre-4.14.325-gnu1/arch/x86/include/asm/virtext.h
+++ linux-libre-4.14.326-gnu1/arch/x86/include/asm/virtext.h
@@ -89,12 +89,6 @@ static inline int cpu_has_svm(const char **msg)
 		return 0;
 	}
 
-	if (boot_cpu_data.extended_cpuid_level < SVM_CPUID_FUNC) {
-		if (msg)
-			*msg = "can't execute cpuid_8000000a";
-		return 0;
-	}
-
 	if (!boot_cpu_has(X86_FEATURE_SVM)) {
 		if (msg)
 			*msg = "svm not available";
diff --git linux-libre-4.14.325-gnu1/arch/x86/kernel/apm_32.c linux-libre-4.14.326-gnu1/arch/x86/kernel/apm_32.c
index 63d3e6a6b5ef..558ac8bb8c7f 100644
--- linux-libre-4.14.325-gnu1/arch/x86/kernel/apm_32.c
+++ linux-libre-4.14.326-gnu1/arch/x86/kernel/apm_32.c
@@ -246,12 +246,6 @@
 extern int (*console_blank_hook)(int);
 #endif
 
-/*
- * The apm_bios device is one of the misc char devices.
- * This is its minor number.
- */
-#define	APM_MINOR_DEV	134
-
 /*
  * Various options can be changed at boot time as follows:
  * (We allow underscores for compatibility with the modules code)
diff --git linux-libre-4.14.325-gnu1/crypto/asymmetric_keys/x509_public_key.c linux-libre-4.14.326-gnu1/crypto/asymmetric_keys/x509_public_key.c
index 1bd0cf71a22d..e1160a7c33bc 100644
--- linux-libre-4.14.325-gnu1/crypto/asymmetric_keys/x509_public_key.c
+++ linux-libre-4.14.326-gnu1/crypto/asymmetric_keys/x509_public_key.c
@@ -138,6 +138,11 @@ int x509_check_for_self_signed(struct x509_certificate *cert)
 	if (strcmp(cert->pub->pkey_algo, cert->sig->pkey_algo) != 0)
 		goto out;
 
+	if (cert->unsupported_sig) {
+		ret = 0;
+		goto out;
+	}
+
 	ret = public_key_verify_signature(cert->pub, cert->sig);
 	if (ret < 0) {
 		if (ret == -ENOPKG) {
diff --git linux-libre-4.14.325-gnu1/drivers/acpi/acpica/psopcode.c linux-libre-4.14.326-gnu1/drivers/acpi/acpica/psopcode.c
index a402ad772a1e..c561d35d441b 100644
--- linux-libre-4.14.325-gnu1/drivers/acpi/acpica/psopcode.c
+++ linux-libre-4.14.326-gnu1/drivers/acpi/acpica/psopcode.c
@@ -637,7 +637,7 @@ const struct acpi_opcode_info acpi_gbl_aml_op_info[AML_NUM_OPCODES] = {
 
 /* 7E */ ACPI_OP("Timer", ARGP_TIMER_OP, ARGI_TIMER_OP, ACPI_TYPE_ANY,
 			 AML_CLASS_EXECUTE, AML_TYPE_EXEC_0A_0T_1R,
-			 AML_FLAGS_EXEC_0A_0T_1R),
+			 AML_FLAGS_EXEC_0A_0T_1R | AML_NO_OPERAND_RESOLVE),
 
 /* ACPI 5.0 opcodes */
 
diff --git linux-libre-4.14.325-gnu1/drivers/acpi/video_detect.c linux-libre-4.14.326-gnu1/drivers/acpi/video_detect.c
index b4f16073ef43..866bc20c8239 100644
--- linux-libre-4.14.325-gnu1/drivers/acpi/video_detect.c
+++ linux-libre-4.14.326-gnu1/drivers/acpi/video_detect.c
@@ -294,6 +294,15 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
 		DMI_MATCH(DMI_BOARD_NAME, "Lenovo IdeaPad S405"),
 		},
 	},
+	{
+	 /* https://bugzilla.suse.com/show_bug.cgi?id=1208724 */
+	 .callback = video_detect_force_native,
+	 /* Lenovo Ideapad Z470 */
+	 .matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+		DMI_MATCH(DMI_PRODUCT_VERSION, "IdeaPad Z470"),
+		},
+	},
 	{
 	 /* https://bugzilla.redhat.com/show_bug.cgi?id=1187004 */
 	 .callback = video_detect_force_native,
diff --git linux-libre-4.14.325-gnu1/drivers/amba/bus.c linux-libre-4.14.326-gnu1/drivers/amba/bus.c
index 8ea401fc8996..e07d6a4d3f03 100644
--- linux-libre-4.14.325-gnu1/drivers/amba/bus.c
+++ linux-libre-4.14.326-gnu1/drivers/amba/bus.c
@@ -344,6 +344,7 @@ static void amba_device_release(struct device *dev)
 {
 	struct amba_device *d = to_amba_device(dev);
 
+	of_node_put(d->dev.of_node);
 	if (d->res.parent)
 		release_resource(&d->res);
 	kfree(d);
diff --git linux-libre-4.14.325-gnu1/drivers/ata/pata_ftide010.c linux-libre-4.14.326-gnu1/drivers/ata/pata_ftide010.c
index 569a4a662dcd..9da2e14a0108 100644
--- linux-libre-4.14.325-gnu1/drivers/ata/pata_ftide010.c
+++ linux-libre-4.14.326-gnu1/drivers/ata/pata_ftide010.c
@@ -569,6 +569,7 @@ static struct platform_driver pata_ftide010_driver = {
 };
 module_platform_driver(pata_ftide010_driver);
 
+MODULE_DESCRIPTION("low level driver for Faraday Technology FTIDE010");
 MODULE_AUTHOR("Linus Walleij <linus.walleij@linaro.org>");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:" DRV_NAME);
diff --git linux-libre-4.14.325-gnu1/drivers/ata/sata_gemini.c linux-libre-4.14.326-gnu1/drivers/ata/sata_gemini.c
index 46950e0267e0..64b43943f650 100644
--- linux-libre-4.14.325-gnu1/drivers/ata/sata_gemini.c
+++ linux-libre-4.14.326-gnu1/drivers/ata/sata_gemini.c
@@ -434,6 +434,7 @@ static struct platform_driver gemini_sata_driver = {
 };
 module_platform_driver(gemini_sata_driver);
 
+MODULE_DESCRIPTION("low level driver for Cortina Systems Gemini SATA bridge");
 MODULE_AUTHOR("Linus Walleij <linus.walleij@linaro.org>");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:" DRV_NAME);
diff --git linux-libre-4.14.325-gnu1/drivers/base/regmap/regcache-rbtree.c linux-libre-4.14.326-gnu1/drivers/base/regmap/regcache-rbtree.c
index e9b7ce8c272c..7353c5527087 100644
--- linux-libre-4.14.325-gnu1/drivers/base/regmap/regcache-rbtree.c
+++ linux-libre-4.14.326-gnu1/drivers/base/regmap/regcache-rbtree.c
@@ -291,7 +291,7 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
 
 	blk = krealloc(rbnode->block,
 		       blklen * map->cache_word_size,
-		       GFP_KERNEL);
+		       map->alloc_flags);
 	if (!blk)
 		return -ENOMEM;
 
@@ -300,7 +300,7 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
 	if (BITS_TO_LONGS(blklen) > BITS_TO_LONGS(rbnode->blklen)) {
 		present = krealloc(rbnode->cache_present,
 				   BITS_TO_LONGS(blklen) * sizeof(*present),
-				   GFP_KERNEL);
+				   map->alloc_flags);
 		if (!present)
 			return -ENOMEM;
 
@@ -334,7 +334,7 @@ regcache_rbtree_node_alloc(struct regmap *map, unsigned int reg)
 	const struct regmap_range *range;
 	int i;
 
-	rbnode = kzalloc(sizeof(*rbnode), GFP_KERNEL);
+	rbnode = kzalloc(sizeof(*rbnode), map->alloc_flags);
 	if (!rbnode)
 		return NULL;
 
@@ -360,13 +360,13 @@ regcache_rbtree_node_alloc(struct regmap *map, unsigned int reg)
 	}
 
 	rbnode->block = kmalloc_array(rbnode->blklen, map->cache_word_size,
-				      GFP_KERNEL);
+				      map->alloc_flags);
 	if (!rbnode->block)
 		goto err_free;
 
 	rbnode->cache_present = kcalloc(BITS_TO_LONGS(rbnode->blklen),
 					sizeof(*rbnode->cache_present),
-					GFP_KERNEL);
+					map->alloc_flags);
 	if (!rbnode->cache_present)
 		goto err_free_block;
 
diff --git linux-libre-4.14.325-gnu1/drivers/bluetooth/btsdio.c linux-libre-4.14.326-gnu1/drivers/bluetooth/btsdio.c
index 20142bc77554..1325b1df4a8e 100644
--- linux-libre-4.14.325-gnu1/drivers/bluetooth/btsdio.c
+++ linux-libre-4.14.326-gnu1/drivers/bluetooth/btsdio.c
@@ -356,6 +356,7 @@ static void btsdio_remove(struct sdio_func *func)
 	if (!data)
 		return;
 
+	cancel_work_sync(&data->work);
 	hdev = data->hdev;
 
 	sdio_set_drvdata(func, NULL);
diff --git linux-libre-4.14.325-gnu1/drivers/bluetooth/hci_nokia.c linux-libre-4.14.326-gnu1/drivers/bluetooth/hci_nokia.c
index c4952c0481a3..0181b3d092d3 100644
--- linux-libre-4.14.325-gnu1/drivers/bluetooth/hci_nokia.c
+++ linux-libre-4.14.326-gnu1/drivers/bluetooth/hci_nokia.c
@@ -746,7 +746,11 @@ static int nokia_bluetooth_serdev_probe(struct serdev_device *serdev)
 		return err;
 	}
 
-	clk_prepare_enable(sysclk);
+	err = clk_prepare_enable(sysclk);
+	if (err) {
+		dev_err(dev, "could not enable sysclk: %d", err);
+		return err;
+	}
 	btdev->sysclk_speed = clk_get_rate(sysclk);
 	clk_disable_unprepare(sysclk);
 
diff --git linux-libre-4.14.325-gnu1/drivers/char/tpm/tpm_tis_core.c linux-libre-4.14.326-gnu1/drivers/char/tpm/tpm_tis_core.c
index 325581558509..9d731e265594 100644
--- linux-libre-4.14.325-gnu1/drivers/char/tpm/tpm_tis_core.c
+++ linux-libre-4.14.326-gnu1/drivers/char/tpm/tpm_tis_core.c
@@ -364,10 +364,17 @@ static int tpm_tis_send_main(struct tpm_chip *chip, const u8 *buf, size_t len)
 	int rc;
 	u32 ordinal;
 	unsigned long dur;
-
-	rc = tpm_tis_send_data(chip, buf, len);
-	if (rc < 0)
-		return rc;
+	unsigned int try;
+
+	for (try = 0; try < TPM_RETRY; try++) {
+		rc = tpm_tis_send_data(chip, buf, len);
+		if (rc >= 0)
+			/* Data transfer done successfully */
+			break;
+		else if (rc != -EIO)
+			/* Data transfer failed, not recoverable */
+			return rc;
+	}
 
 	/* go and do it */
 	rc = tpm_tis_write8(priv, TPM_STS(priv->locality), TPM_STS_GO);
diff --git linux-libre-4.14.325-gnu1/drivers/clk/keystone/pll.c linux-libre-4.14.326-gnu1/drivers/clk/keystone/pll.c
index e7e840fb74ea..526694c2a6c9 100644
--- linux-libre-4.14.325-gnu1/drivers/clk/keystone/pll.c
+++ linux-libre-4.14.326-gnu1/drivers/clk/keystone/pll.c
@@ -213,7 +213,7 @@ static void __init _of_pll_clk_init(struct device_node *node, bool pllctrl)
 	}
 
 	clk = clk_register_pll(NULL, node->name, parent_name, pll_data);
-	if (clk) {
+	if (!IS_ERR_OR_NULL(clk)) {
 		of_clk_add_provider(node, of_clk_src_simple_get, clk);
 		return;
 	}
diff --git linux-libre-4.14.325-gnu1/drivers/clk/qcom/gcc-mdm9615.c linux-libre-4.14.326-gnu1/drivers/clk/qcom/gcc-mdm9615.c
index b99dd406e907..2fa5880027ca 100644
--- linux-libre-4.14.325-gnu1/drivers/clk/qcom/gcc-mdm9615.c
+++ linux-libre-4.14.326-gnu1/drivers/clk/qcom/gcc-mdm9615.c
@@ -66,7 +66,7 @@ static struct clk_regmap pll0_vote = {
 	.enable_mask = BIT(0),
 	.hw.init = &(struct clk_init_data){
 		.name = "pll0_vote",
-		.parent_names = (const char *[]){ "pll8" },
+		.parent_names = (const char *[]){ "pll0" },
 		.num_parents = 1,
 		.ops = &clk_pll_vote_ops,
 	},
diff --git linux-libre-4.14.325-gnu1/drivers/clk/sunxi-ng/ccu_mmc_timing.c linux-libre-4.14.326-gnu1/drivers/clk/sunxi-ng/ccu_mmc_timing.c
index f9869f7353c0..9356dc157156 100644
--- linux-libre-4.14.325-gnu1/drivers/clk/sunxi-ng/ccu_mmc_timing.c
+++ linux-libre-4.14.326-gnu1/drivers/clk/sunxi-ng/ccu_mmc_timing.c
@@ -50,7 +50,7 @@ int sunxi_ccu_set_mmc_timing_mode(struct clk *clk, bool new_mode)
 EXPORT_SYMBOL_GPL(sunxi_ccu_set_mmc_timing_mode);
 
 /**
- * sunxi_ccu_set_mmc_timing_mode: Get the current MMC clock timing mode
+ * sunxi_ccu_get_mmc_timing_mode: Get the current MMC clock timing mode
  * @clk: clock to query
  *
  * Returns 0 if the clock is in old timing mode, > 0 if it is in
diff --git linux-libre-4.14.325-gnu1/drivers/cpufreq/powernow-k8.c linux-libre-4.14.326-gnu1/drivers/cpufreq/powernow-k8.c
index 32bb00a6fe09..3b9aa473ae8f 100644
--- linux-libre-4.14.325-gnu1/drivers/cpufreq/powernow-k8.c
+++ linux-libre-4.14.326-gnu1/drivers/cpufreq/powernow-k8.c
@@ -1120,7 +1120,8 @@ static int powernowk8_cpu_exit(struct cpufreq_policy *pol)
 
 	kfree(data->powernow_table);
 	kfree(data);
-	for_each_cpu(cpu, pol->cpus)
+	/* pol->cpus will be empty here, use related_cpus instead. */
+	for_each_cpu(cpu, pol->related_cpus)
 		per_cpu(powernow_data, cpu) = NULL;
 
 	return 0;
diff --git linux-libre-4.14.325-gnu1/drivers/crypto/caam/caampkc.c linux-libre-4.14.326-gnu1/drivers/crypto/caam/caampkc.c
index 6f3f81bb880b..01f9053db287 100644
--- linux-libre-4.14.325-gnu1/drivers/crypto/caam/caampkc.c
+++ linux-libre-4.14.326-gnu1/drivers/crypto/caam/caampkc.c
@@ -194,7 +194,9 @@ static int caam_rsa_count_leading_zeros(struct scatterlist *sgl,
 		if (len && *buff)
 			break;
 
-		sg_miter_next(&miter);
+		if (!sg_miter_next(&miter))
+			break;
+
 		buff = miter.addr;
 		len = miter.length;
 
diff --git linux-libre-4.14.325-gnu1/drivers/crypto/stm32/stm32-hash.c linux-libre-4.14.326-gnu1/drivers/crypto/stm32/stm32-hash.c
index 4909f820e953..263f79cecc25 100644
--- linux-libre-4.14.325-gnu1/drivers/crypto/stm32/stm32-hash.c
+++ linux-libre-4.14.326-gnu1/drivers/crypto/stm32/stm32-hash.c
@@ -574,9 +574,9 @@ static int stm32_hash_dma_send(struct stm32_hash_dev *hdev)
 	}
 
 	for_each_sg(rctx->sg, tsg, rctx->nents, i) {
+		sg[0] = *tsg;
 		len = sg->length;
 
-		sg[0] = *tsg;
 		if (sg_is_last(sg)) {
 			if (hdev->dma_mode == 1) {
 				len = (ALIGN(sg->length, 16) - 16);
diff --git linux-libre-4.14.325-gnu1/drivers/devfreq/devfreq.c linux-libre-4.14.326-gnu1/drivers/devfreq/devfreq.c
index b05e6a15221c..e6674448a0bc 100644
--- linux-libre-4.14.325-gnu1/drivers/devfreq/devfreq.c
+++ linux-libre-4.14.326-gnu1/drivers/devfreq/devfreq.c
@@ -495,6 +495,7 @@ static void devfreq_dev_release(struct device *dev)
 		devfreq->profile->exit(devfreq->dev.parent);
 
 	mutex_destroy(&devfreq->lock);
+	srcu_cleanup_notifier_head(&devfreq->transition_notifier_list);
 	kfree(devfreq);
 }
 
diff --git linux-libre-4.14.325-gnu1/drivers/dma/Kconfig linux-libre-4.14.326-gnu1/drivers/dma/Kconfig
index 5ea37d133f24..6abb80b09db3 100644
--- linux-libre-4.14.325-gnu1/drivers/dma/Kconfig
+++ linux-libre-4.14.326-gnu1/drivers/dma/Kconfig
@@ -209,6 +209,7 @@ config FSL_DMA
 config FSL_EDMA
 	tristate "Freescale eDMA engine support"
 	depends on OF
+	depends on HAS_IOMEM
 	select DMA_ENGINE
 	select DMA_VIRTUAL_CHANNELS
 	help
@@ -254,6 +255,7 @@ config IMX_SDMA
 
 config INTEL_IDMA64
 	tristate "Intel integrated DMA 64-bit support"
+	depends on HAS_IOMEM
 	select DMA_ENGINE
 	select DMA_VIRTUAL_CHANNELS
 	help
diff --git linux-libre-4.14.325-gnu1/drivers/dma/ste_dma40.c linux-libre-4.14.326-gnu1/drivers/dma/ste_dma40.c
index ee15d4fefbad..498d9886ed9b 100644
--- linux-libre-4.14.325-gnu1/drivers/dma/ste_dma40.c
+++ linux-libre-4.14.326-gnu1/drivers/dma/ste_dma40.c
@@ -3577,6 +3577,10 @@ static int __init d40_probe(struct platform_device *pdev)
 	spin_lock_init(&base->lcla_pool.lock);
 
 	base->irq = platform_get_irq(pdev, 0);
+	if (base->irq < 0) {
+		ret = base->irq;
+		goto destroy_cache;
+	}
 
 	ret = request_irq(base->irq, d40_handle_interrupt, 0, D40_NAME, base);
 	if (ret) {
diff --git linux-libre-4.14.325-gnu1/drivers/gpu/drm/ast/ast_post.c linux-libre-4.14.326-gnu1/drivers/gpu/drm/ast/ast_post.c
index c1d1ac51d1c2..1f09cb9691f8 100644
--- linux-libre-4.14.325-gnu1/drivers/gpu/drm/ast/ast_post.c
+++ linux-libre-4.14.326-gnu1/drivers/gpu/drm/ast/ast_post.c
@@ -291,7 +291,7 @@ static void ast_init_dram_reg(struct drm_device *dev)
 				;
 			} while (ast_read32(ast, 0x10100) != 0xa8);
 		} else {/* AST2100/1100 */
-			if (ast->chip == AST2100 || ast->chip == 2200)
+			if (ast->chip == AST2100 || ast->chip == AST2200)
 				dram_reg_info = ast2100_dram_table_data;
 			else
 				dram_reg_info = ast1100_dram_table_data;
diff --git linux-libre-4.14.325-gnu1/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c linux-libre-4.14.326-gnu1/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
index f5195d9841f8..687c68e0a59d 100644
--- linux-libre-4.14.325-gnu1/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+++ linux-libre-4.14.326-gnu1/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
@@ -744,8 +744,13 @@ static void adv7511_mode_set(struct adv7511 *adv7511,
 	else
 		low_refresh_rate = ADV7511_LOW_REFRESH_RATE_NONE;
 
-	regmap_update_bits(adv7511->regmap, 0xfb,
-		0x6, low_refresh_rate << 1);
+	if (adv7511->type == ADV7511)
+		regmap_update_bits(adv7511->regmap, 0xfb,
+				   0x6, low_refresh_rate << 1);
+	else
+		regmap_update_bits(adv7511->regmap, 0x4a,
+				   0xc, low_refresh_rate << 2);
+
 	regmap_update_bits(adv7511->regmap, 0x17,
 		0x60, (vsync_polarity << 6) | (hsync_polarity << 5));
 
diff --git linux-libre-4.14.325-gnu1/drivers/gpu/drm/exynos/exynos_drm_crtc.c linux-libre-4.14.326-gnu1/drivers/gpu/drm/exynos/exynos_drm_crtc.c
index 4787560bf93e..e1aa518ea0ba 100644
--- linux-libre-4.14.325-gnu1/drivers/gpu/drm/exynos/exynos_drm_crtc.c
+++ linux-libre-4.14.326-gnu1/drivers/gpu/drm/exynos/exynos_drm_crtc.c
@@ -43,13 +43,12 @@ static void exynos_drm_crtc_atomic_disable(struct drm_crtc *crtc,
 	if (exynos_crtc->ops->disable)
 		exynos_crtc->ops->disable(exynos_crtc);
 
+	spin_lock_irq(&crtc->dev->event_lock);
 	if (crtc->state->event && !crtc->state->active) {
-		spin_lock_irq(&crtc->dev->event_lock);
 		drm_crtc_send_vblank_event(crtc, crtc->state->event);
-		spin_unlock_irq(&crtc->dev->event_lock);
-
 		crtc->state->event = NULL;
 	}
+	spin_unlock_irq(&crtc->dev->event_lock);
 }
 
 static int exynos_crtc_atomic_check(struct drm_crtc *crtc,
diff --git linux-libre-4.14.325-gnu1/drivers/hid/hid-multitouch.c linux-libre-4.14.326-gnu1/drivers/hid/hid-multitouch.c
index 0fa3bd2b035e..55b1023af31f 100644
--- linux-libre-4.14.325-gnu1/drivers/hid/hid-multitouch.c
+++ linux-libre-4.14.326-gnu1/drivers/hid/hid-multitouch.c
@@ -1136,7 +1136,6 @@ static void mt_post_parse(struct mt_device *td)
 static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
 {
 	struct mt_device *td = hid_get_drvdata(hdev);
-	char *name;
 	const char *suffix = NULL;
 	struct hid_field *field = hi->report->field[0];
 	int ret;
@@ -1196,15 +1195,9 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
 		}
 	}
 
-	if (suffix) {
-		name = devm_kzalloc(&hi->input->dev,
-				    strlen(hdev->name) + strlen(suffix) + 2,
-				    GFP_KERNEL);
-		if (name) {
-			sprintf(name, "%s %s", hdev->name, suffix);
-			hi->input->name = name;
-		}
-	}
+	if (suffix)
+		hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL,
+						 "%s %s", hdev->name, suffix);
 
 	return 0;
 }
diff --git linux-libre-4.14.325-gnu1/drivers/hid/wacom.h linux-libre-4.14.326-gnu1/drivers/hid/wacom.h
index 9c0900c35b23..3dc4a819b175 100644
--- linux-libre-4.14.325-gnu1/drivers/hid/wacom.h
+++ linux-libre-4.14.326-gnu1/drivers/hid/wacom.h
@@ -155,6 +155,7 @@ struct wacom_remote {
 		struct input_dev *input;
 		bool registered;
 		struct wacom_battery battery;
+		ktime_t active_time;
 	} remotes[WACOM_MAX_REMOTES];
 };
 
diff --git linux-libre-4.14.325-gnu1/drivers/hid/wacom_sys.c linux-libre-4.14.326-gnu1/drivers/hid/wacom_sys.c
index 28e7a4950b74..3ca50505c78c 100644
--- linux-libre-4.14.325-gnu1/drivers/hid/wacom_sys.c
+++ linux-libre-4.14.326-gnu1/drivers/hid/wacom_sys.c
@@ -2361,6 +2361,18 @@ fail:
 	return;
 }
 
+static void wacom_remote_destroy_battery(struct wacom *wacom, int index)
+{
+	struct wacom_remote *remote = wacom->remote;
+
+	if (remote->remotes[index].battery.battery) {
+		devres_release_group(&wacom->hdev->dev,
+				     &remote->remotes[index].battery.bat_desc);
+		remote->remotes[index].battery.battery = NULL;
+		remote->remotes[index].active_time = 0;
+	}
+}
+
 static void wacom_remote_destroy_one(struct wacom *wacom, unsigned int index)
 {
 	struct wacom_remote *remote = wacom->remote;
@@ -2375,9 +2387,7 @@ static void wacom_remote_destroy_one(struct wacom *wacom, unsigned int index)
 			remote->remotes[i].registered = false;
 			spin_unlock_irqrestore(&remote->remote_lock, flags);
 
-			if (remote->remotes[i].battery.battery)
-				devres_release_group(&wacom->hdev->dev,
-						     &remote->remotes[i].battery.bat_desc);
+			wacom_remote_destroy_battery(wacom, i);
 
 			if (remote->remotes[i].group.name)
 				devres_release_group(&wacom->hdev->dev,
@@ -2385,7 +2395,6 @@ static void wacom_remote_destroy_one(struct wacom *wacom, unsigned int index)
 
 			remote->remotes[i].serial = 0;
 			remote->remotes[i].group.name = NULL;
-			remote->remotes[i].battery.battery = NULL;
 			wacom->led.groups[i].select = WACOM_STATUS_UNKNOWN;
 		}
 	}
@@ -2470,6 +2479,9 @@ static int wacom_remote_attach_battery(struct wacom *wacom, int index)
 	if (remote->remotes[index].battery.battery)
 		return 0;
 
+	if (!remote->remotes[index].active_time)
+		return 0;
+
 	if (wacom->led.groups[index].select == WACOM_STATUS_UNKNOWN)
 		return 0;
 
@@ -2485,6 +2497,7 @@ static void wacom_remote_work(struct work_struct *work)
 {
 	struct wacom *wacom = container_of(work, struct wacom, remote_work);
 	struct wacom_remote *remote = wacom->remote;
+	ktime_t kt = ktime_get();
 	struct wacom_remote_data data;
 	unsigned long flags;
 	unsigned int count;
@@ -2511,6 +2524,10 @@ static void wacom_remote_work(struct work_struct *work)
 		serial = data.remote[i].serial;
 		if (data.remote[i].connected) {
 
+			if (kt - remote->remotes[i].active_time > WACOM_REMOTE_BATTERY_TIMEOUT
+			    && remote->remotes[i].active_time != 0)
+				wacom_remote_destroy_battery(wacom, i);
+
 			if (remote->remotes[i].serial == serial) {
 				wacom_remote_attach_battery(wacom, i);
 				continue;
diff --git linux-libre-4.14.325-gnu1/drivers/hid/wacom_wac.c linux-libre-4.14.326-gnu1/drivers/hid/wacom_wac.c
index be30fdbc37c5..19a798eb395c 100644
--- linux-libre-4.14.325-gnu1/drivers/hid/wacom_wac.c
+++ linux-libre-4.14.326-gnu1/drivers/hid/wacom_wac.c
@@ -1039,6 +1039,7 @@ static int wacom_remote_irq(struct wacom_wac *wacom_wac, size_t len)
 	if (index < 0 || !remote->remotes[index].registered)
 		goto out;
 
+	remote->remotes[i].active_time = ktime_get();
 	input = remote->remotes[index].input;
 
 	input_report_key(input, BTN_0, (data[9] & 0x01));
diff --git linux-libre-4.14.325-gnu1/drivers/hid/wacom_wac.h linux-libre-4.14.326-gnu1/drivers/hid/wacom_wac.h
index a5c61096fa45..899c6c7bfea4 100644
--- linux-libre-4.14.325-gnu1/drivers/hid/wacom_wac.h
+++ linux-libre-4.14.326-gnu1/drivers/hid/wacom_wac.h
@@ -18,6 +18,7 @@
 #define WACOM_NAME_MAX		64
 #define WACOM_MAX_REMOTES	5
 #define WACOM_STATUS_UNKNOWN	255
+#define WACOM_REMOTE_BATTERY_TIMEOUT	21000000000ll
 
 /* packet length for individual models */
 #define WACOM_PKGLEN_BBFUN	 9
diff --git linux-libre-4.14.325-gnu1/drivers/iio/industrialio-core.c linux-libre-4.14.326-gnu1/drivers/iio/industrialio-core.c
index 97b7266ee0ff..12d73ebcadfa 100644
--- linux-libre-4.14.325-gnu1/drivers/iio/industrialio-core.c
+++ linux-libre-4.14.326-gnu1/drivers/iio/industrialio-core.c
@@ -328,7 +328,7 @@ static ssize_t iio_debugfs_write_reg(struct file *file,
 	char buf[80];
 	int ret;
 
-	count = min_t(size_t, count, (sizeof(buf)-1));
+	count = min(count, sizeof(buf) - 1);
 	if (copy_from_user(buf, userbuf, count))
 		return -EFAULT;
 
diff --git linux-libre-4.14.325-gnu1/drivers/infiniband/ulp/isert/ib_isert.c linux-libre-4.14.326-gnu1/drivers/infiniband/ulp/isert/ib_isert.c
index 598e2bb005c8..0d9b53c6e265 100644
--- linux-libre-4.14.325-gnu1/drivers/infiniband/ulp/isert/ib_isert.c
+++ linux-libre-4.14.326-gnu1/drivers/infiniband/ulp/isert/ib_isert.c
@@ -2652,6 +2652,8 @@ static void isert_wait_conn(struct iscsi_conn *conn)
 	isert_put_unsol_pending_cmds(conn);
 	isert_wait4cmds(conn);
 	isert_wait4logout(isert_conn);
+
+	queue_work(isert_release_wq, &isert_conn->release_work);
 }
 
 static void isert_free_conn(struct iscsi_conn *conn)
diff --git linux-libre-4.14.325-gnu1/drivers/md/raid1.c linux-libre-4.14.326-gnu1/drivers/md/raid1.c
index 28f78199de3b..7e37e4b2ec6a 100644
--- linux-libre-4.14.325-gnu1/drivers/md/raid1.c
+++ linux-libre-4.14.326-gnu1/drivers/md/raid1.c
@@ -1777,6 +1777,9 @@ static int raid1_remove_disk(struct mddev *mddev, struct md_rdev *rdev)
 	int number = rdev->raid_disk;
 	struct raid1_info *p = conf->mirrors + number;
 
+	if (unlikely(number >= conf->raid_disks))
+		goto abort;
+
 	if (rdev != p->rdev)
 		p = conf->mirrors + conf->raid_disks + number;
 
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/ascot2e.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/ascot2e.c
index 79d5d89bc95e..c9c3bfb2348a 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/ascot2e.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/ascot2e.c
@@ -542,7 +542,7 @@ struct dvb_frontend *ascot2e_attach(struct dvb_frontend *fe,
 		priv->i2c_address, priv->i2c);
 	return fe;
 }
-EXPORT_SYMBOL(ascot2e_attach);
+EXPORT_SYMBOL_GPL(ascot2e_attach);
 
 MODULE_DESCRIPTION("Sony ASCOT2E terr/cab tuner driver");
 MODULE_AUTHOR("info@netup.ru");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/atbm8830.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/atbm8830.c
index 05850b32d6c6..ca9ae02ee436 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/atbm8830.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/atbm8830.c
@@ -498,7 +498,7 @@ error_out:
 	return NULL;
 
 }
-EXPORT_SYMBOL(atbm8830_attach);
+EXPORT_SYMBOL_GPL(atbm8830_attach);
 
 MODULE_DESCRIPTION("AltoBeam ATBM8830/8831 GB20600 demodulator driver");
 MODULE_AUTHOR("David T. L. Wong <davidtlwong@gmail.com>");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/au8522_dig.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/au8522_dig.c
index 3f3635f5a06a..3d92593cf892 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/au8522_dig.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/au8522_dig.c
@@ -891,7 +891,7 @@ error:
 	au8522_release_state(state);
 	return NULL;
 }
-EXPORT_SYMBOL(au8522_attach);
+EXPORT_SYMBOL_GPL(au8522_attach);
 
 static const struct dvb_frontend_ops au8522_ops = {
 	.delsys = { SYS_ATSC, SYS_DVBC_ANNEX_B },
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/bcm3510.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/bcm3510.c
index 713787c7017e..6ae1a6f0d5ac 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/bcm3510.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/bcm3510.c
@@ -833,7 +833,7 @@ error:
 	kfree(state);
 	return NULL;
 }
-EXPORT_SYMBOL(bcm3510_attach);
+EXPORT_SYMBOL_GPL(bcm3510_attach);
 
 static const struct dvb_frontend_ops bcm3510_ops = {
 	.delsys = { SYS_ATSC, SYS_DVBC_ANNEX_B },
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/cx22700.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/cx22700.c
index 2b629e23ceeb..28872671a20f 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/cx22700.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/cx22700.c
@@ -444,4 +444,4 @@ MODULE_DESCRIPTION("Conexant CX22700 DVB-T Demodulator driver");
 MODULE_AUTHOR("Holger Waechtler");
 MODULE_LICENSE("GPL");
 
-EXPORT_SYMBOL(cx22700_attach);
+EXPORT_SYMBOL_GPL(cx22700_attach);
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/cx22702.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/cx22702.c
index c0e54c59cccf..8a3679769829 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/cx22702.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/cx22702.c
@@ -616,7 +616,7 @@ error:
 	kfree(state);
 	return NULL;
 }
-EXPORT_SYMBOL(cx22702_attach);
+EXPORT_SYMBOL_GPL(cx22702_attach);
 
 static const struct dvb_frontend_ops cx22702_ops = {
 	.delsys = { SYS_DVBT },
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/cx24110.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/cx24110.c
index cf1bc99d1f32..7688e4abb1ef 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/cx24110.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/cx24110.c
@@ -666,4 +666,4 @@ MODULE_DESCRIPTION("Conexant CX24110 DVB-S Demodulator driver");
 MODULE_AUTHOR("Peter Hettkamp");
 MODULE_LICENSE("GPL");
 
-EXPORT_SYMBOL(cx24110_attach);
+EXPORT_SYMBOL_GPL(cx24110_attach);
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/cx24113.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/cx24113.c
index 0118c2658cf7..8b72e3ea9e61 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/cx24113.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/cx24113.c
@@ -602,7 +602,7 @@ error:
 
 	return NULL;
 }
-EXPORT_SYMBOL(cx24113_attach);
+EXPORT_SYMBOL_GPL(cx24113_attach);
 
 module_param(debug, int, 0644);
 MODULE_PARM_DESC(debug, "Activates frontend debugging (default:0)");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/cx24116.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/cx24116.c
index 04236f8400d0..3a9f74d7dbda 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/cx24116.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/cx24116.c
@@ -1151,7 +1151,7 @@ struct dvb_frontend *cx24116_attach(const struct cx24116_config *config,
 error2: kfree(state);
 error1: return NULL;
 }
-EXPORT_SYMBOL(cx24116_attach);
+EXPORT_SYMBOL_GPL(cx24116_attach);
 
 /*
  * Initialise or wake up device
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/cx24120.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/cx24120.c
index f503a0664786..1f09d48809d5 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/cx24120.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/cx24120.c
@@ -313,7 +313,7 @@ error:
 	kfree(state);
 	return NULL;
 }
-EXPORT_SYMBOL(cx24120_attach);
+EXPORT_SYMBOL_GPL(cx24120_attach);
 
 static int cx24120_test_rom(struct cx24120_state *state)
 {
@@ -980,7 +980,9 @@ static void cx24120_set_clock_ratios(struct dvb_frontend *fe)
 	cmd.arg[8] = (clock_ratios_table[idx].rate >> 8) & 0xff;
 	cmd.arg[9] = (clock_ratios_table[idx].rate >> 0) & 0xff;
 
-	cx24120_message_send(state, &cmd);
+	ret = cx24120_message_send(state, &cmd);
+	if (ret != 0)
+		return;
 
 	/* Calculate ber window rates for stat work */
 	cx24120_calculate_ber_window(state, clock_ratios_table[idx].rate);
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/cx24123.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/cx24123.c
index 1d59d1d3bd82..0f03b9798a75 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/cx24123.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/cx24123.c
@@ -1105,7 +1105,7 @@ error:
 
 	return NULL;
 }
-EXPORT_SYMBOL(cx24123_attach);
+EXPORT_SYMBOL_GPL(cx24123_attach);
 
 static const struct dvb_frontend_ops cx24123_ops = {
 	.delsys = { SYS_DVBS },
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/cxd2820r_core.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/cxd2820r_core.c
index f6ebbb47b9b2..4b74fba17a7a 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/cxd2820r_core.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/cxd2820r_core.c
@@ -549,7 +549,7 @@ struct dvb_frontend *cxd2820r_attach(const struct cxd2820r_config *config,
 
 	return pdata.get_dvb_frontend(client);
 }
-EXPORT_SYMBOL(cxd2820r_attach);
+EXPORT_SYMBOL_GPL(cxd2820r_attach);
 
 static struct dvb_frontend *cxd2820r_get_dvb_frontend(struct i2c_client *client)
 {
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/cxd2841er.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/cxd2841er.c
index ccbd84fd6428..27e2f52c54cb 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/cxd2841er.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/cxd2841er.c
@@ -3926,14 +3926,14 @@ struct dvb_frontend *cxd2841er_attach_s(struct cxd2841er_config *cfg,
 {
 	return cxd2841er_attach(cfg, i2c, SYS_DVBS);
 }
-EXPORT_SYMBOL(cxd2841er_attach_s);
+EXPORT_SYMBOL_GPL(cxd2841er_attach_s);
 
 struct dvb_frontend *cxd2841er_attach_t_c(struct cxd2841er_config *cfg,
 					struct i2c_adapter *i2c)
 {
 	return cxd2841er_attach(cfg, i2c, 0);
 }
-EXPORT_SYMBOL(cxd2841er_attach_t_c);
+EXPORT_SYMBOL_GPL(cxd2841er_attach_t_c);
 
 static const struct dvb_frontend_ops cxd2841er_dvbs_s2_ops = {
 	.delsys = { SYS_DVBS, SYS_DVBS2 },
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/dib0070.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/dib0070.c
index d7614b8b8782..9e0adbff483c 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/dib0070.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/dib0070.c
@@ -767,7 +767,7 @@ free_mem:
 	fe->tuner_priv = NULL;
 	return NULL;
 }
-EXPORT_SYMBOL(dib0070_attach);
+EXPORT_SYMBOL_GPL(dib0070_attach);
 
 MODULE_AUTHOR("Patrick Boettcher <patrick.boettcher@posteo.de>");
 MODULE_DESCRIPTION("Driver for the DiBcom 0070 base-band RF Tuner");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/dib0090.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/dib0090.c
index d9d730dfe0b1..7ea46abf9f0e 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/dib0090.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/dib0090.c
@@ -2643,7 +2643,7 @@ struct dvb_frontend *dib0090_register(struct dvb_frontend *fe, struct i2c_adapte
 	return NULL;
 }
 
-EXPORT_SYMBOL(dib0090_register);
+EXPORT_SYMBOL_GPL(dib0090_register);
 
 struct dvb_frontend *dib0090_fw_register(struct dvb_frontend *fe, struct i2c_adapter *i2c, const struct dib0090_config *config)
 {
@@ -2669,7 +2669,7 @@ free_mem:
 	fe->tuner_priv = NULL;
 	return NULL;
 }
-EXPORT_SYMBOL(dib0090_fw_register);
+EXPORT_SYMBOL_GPL(dib0090_fw_register);
 
 MODULE_AUTHOR("Patrick Boettcher <patrick.boettcher@posteo.de>");
 MODULE_AUTHOR("Olivier Grenie <olivier.grenie@parrot.com>");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/dib3000mb.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/dib3000mb.c
index 068bec104e29..d4d6dd6ed19e 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/dib3000mb.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/dib3000mb.c
@@ -819,4 +819,4 @@ MODULE_AUTHOR(DRIVER_AUTHOR);
 MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_LICENSE("GPL");
 
-EXPORT_SYMBOL(dib3000mb_attach);
+EXPORT_SYMBOL_GPL(dib3000mb_attach);
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/dib3000mc.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/dib3000mc.c
index 4d086a7248e9..9dcc05fa97a7 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/dib3000mc.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/dib3000mc.c
@@ -938,7 +938,7 @@ error:
 	kfree(st);
 	return NULL;
 }
-EXPORT_SYMBOL(dib3000mc_attach);
+EXPORT_SYMBOL_GPL(dib3000mc_attach);
 
 static const struct dvb_frontend_ops dib3000mc_ops = {
 	.delsys = { SYS_DVBT },
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/dib7000m.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/dib7000m.c
index 5ce9f93a65c3..b46a9571c4b3 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/dib7000m.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/dib7000m.c
@@ -1437,7 +1437,7 @@ error:
 	kfree(st);
 	return NULL;
 }
-EXPORT_SYMBOL(dib7000m_attach);
+EXPORT_SYMBOL_GPL(dib7000m_attach);
 
 static const struct dvb_frontend_ops dib7000m_ops = {
 	.delsys = { SYS_DVBT },
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/dib7000p.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/dib7000p.c
index 0fbaabe43682..e2299a91bcc8 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/dib7000p.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/dib7000p.c
@@ -500,7 +500,7 @@ static int dib7000p_update_pll(struct dvb_frontend *fe, struct dibx000_bandwidth
 	prediv = reg_1856 & 0x3f;
 	loopdiv = (reg_1856 >> 6) & 0x3f;
 
-	if ((bw != NULL) && (bw->pll_prediv != prediv || bw->pll_ratio != loopdiv)) {
+	if (loopdiv && bw && (bw->pll_prediv != prediv || bw->pll_ratio != loopdiv)) {
 		dprintk("Updating pll (prediv: old =  %d new = %d ; loopdiv : old = %d new = %d)\n", prediv, bw->pll_prediv, loopdiv, bw->pll_ratio);
 		reg_1856 &= 0xf000;
 		reg_1857 = dib7000p_read_word(state, 1857);
@@ -2818,7 +2818,7 @@ void *dib7000p_attach(struct dib7000p_ops *ops)
 
 	return ops;
 }
-EXPORT_SYMBOL(dib7000p_attach);
+EXPORT_SYMBOL_GPL(dib7000p_attach);
 
 static const struct dvb_frontend_ops dib7000p_ops = {
 	.delsys = { SYS_DVBT },
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/dib8000.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/dib8000.c
index c429392ebbe6..c17bae942902 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/dib8000.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/dib8000.c
@@ -4530,7 +4530,7 @@ void *dib8000_attach(struct dib8000_ops *ops)
 
 	return ops;
 }
-EXPORT_SYMBOL(dib8000_attach);
+EXPORT_SYMBOL_GPL(dib8000_attach);
 
 MODULE_AUTHOR("Olivier Grenie <Olivier.Grenie@parrot.com, Patrick Boettcher <patrick.boettcher@posteo.de>");
 MODULE_DESCRIPTION("Driver for the DiBcom 8000 ISDB-T demodulator");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/dib9000.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/dib9000.c
index 1b7a4331af05..8be71123e110 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/dib9000.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/dib9000.c
@@ -2547,7 +2547,7 @@ error:
 	kfree(st);
 	return NULL;
 }
-EXPORT_SYMBOL(dib9000_attach);
+EXPORT_SYMBOL_GPL(dib9000_attach);
 
 static const struct dvb_frontend_ops dib9000_ops = {
 	.delsys = { SYS_DVBT },
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/drx39xyj/drxj.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/drx39xyj/drxj.c
index 83e8e3c8abe1..182b5b55c1f5 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/drx39xyj/drxj.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/drx39xyj/drxj.c
@@ -12364,7 +12364,7 @@ error:
 
 	return NULL;
 }
-EXPORT_SYMBOL(drx39xxj_attach);
+EXPORT_SYMBOL_GPL(drx39xxj_attach);
 
 static const struct dvb_frontend_ops drx39xxj_ops = {
 	.delsys = { SYS_ATSC, SYS_DVBC_ANNEX_B },
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/drxd_hard.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/drxd_hard.c
index 993ccd7b3741..0347ee0d6e2d 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/drxd_hard.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/drxd_hard.c
@@ -2981,7 +2981,7 @@ error:
 	kfree(state);
 	return NULL;
 }
-EXPORT_SYMBOL(drxd_attach);
+EXPORT_SYMBOL_GPL(drxd_attach);
 
 MODULE_DESCRIPTION("DRXD driver");
 MODULE_AUTHOR("Micronas");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/drxk_hard.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/drxk_hard.c
index 423ba6f62049..89aded57ef56 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/drxk_hard.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/drxk_hard.c
@@ -6873,7 +6873,7 @@ error:
 	kfree(state);
 	return NULL;
 }
-EXPORT_SYMBOL(drxk_attach);
+EXPORT_SYMBOL_GPL(drxk_attach);
 
 MODULE_DESCRIPTION("DRX-K driver");
 MODULE_AUTHOR("Ralph Metzler");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/ds3000.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/ds3000.c
index 51c7b7f40b0d..c07f71938810 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/ds3000.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/ds3000.c
@@ -877,7 +877,7 @@ error3:
 error2:
 	return NULL;
 }
-EXPORT_SYMBOL(ds3000_attach);
+EXPORT_SYMBOL_GPL(ds3000_attach);
 
 static int ds3000_set_carrier_offset(struct dvb_frontend *fe,
 					s32 carrier_offset_khz)
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/dvb-pll.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/dvb-pll.c
index 5553b89b804e..3bcb528b2718 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/dvb-pll.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/dvb-pll.c
@@ -825,7 +825,7 @@ struct dvb_frontend *dvb_pll_attach(struct dvb_frontend *fe, int pll_addr,
 
 	return fe;
 }
-EXPORT_SYMBOL(dvb_pll_attach);
+EXPORT_SYMBOL_GPL(dvb_pll_attach);
 
 MODULE_DESCRIPTION("dvb pll library");
 MODULE_AUTHOR("Gerd Knorr");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/ec100.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/ec100.c
index fa2a96d5f94e..a499a0eb0f0f 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/ec100.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/ec100.c
@@ -309,7 +309,7 @@ error:
 	kfree(state);
 	return NULL;
 }
-EXPORT_SYMBOL(ec100_attach);
+EXPORT_SYMBOL_GPL(ec100_attach);
 
 static const struct dvb_frontend_ops ec100_ops = {
 	.delsys = { SYS_DVBT },
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/helene.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/helene.c
index fcfe658a4328..63e137d3ecb4 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/helene.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/helene.c
@@ -1007,7 +1007,7 @@ struct dvb_frontend *helene_attach_s(struct dvb_frontend *fe,
 			priv->i2c_address, priv->i2c);
 	return fe;
 }
-EXPORT_SYMBOL(helene_attach_s);
+EXPORT_SYMBOL_GPL(helene_attach_s);
 
 struct dvb_frontend *helene_attach(struct dvb_frontend *fe,
 		const struct helene_config *config,
@@ -1043,7 +1043,7 @@ struct dvb_frontend *helene_attach(struct dvb_frontend *fe,
 			priv->i2c_address, priv->i2c);
 	return fe;
 }
-EXPORT_SYMBOL(helene_attach);
+EXPORT_SYMBOL_GPL(helene_attach);
 
 MODULE_DESCRIPTION("Sony HELENE Sat/Ter tuner driver");
 MODULE_AUTHOR("Abylay Ospan <aospan@netup.ru>");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/horus3a.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/horus3a.c
index 5c8b405f2ddc..be7d3277e0f6 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/horus3a.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/horus3a.c
@@ -404,7 +404,7 @@ struct dvb_frontend *horus3a_attach(struct dvb_frontend *fe,
 		priv->i2c_address, priv->i2c);
 	return fe;
 }
-EXPORT_SYMBOL(horus3a_attach);
+EXPORT_SYMBOL_GPL(horus3a_attach);
 
 MODULE_DESCRIPTION("Sony HORUS3A satellite tuner driver");
 MODULE_AUTHOR("Sergey Kozlov <serjk@netup.ru>");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/isl6405.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/isl6405.c
index 2fc8d3c72c11..c00933b93562 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/isl6405.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/isl6405.c
@@ -155,7 +155,7 @@ struct dvb_frontend *isl6405_attach(struct dvb_frontend *fe, struct i2c_adapter
 
 	return fe;
 }
-EXPORT_SYMBOL(isl6405_attach);
+EXPORT_SYMBOL_GPL(isl6405_attach);
 
 MODULE_DESCRIPTION("Driver for lnb supply and control ic isl6405");
 MODULE_AUTHOR("Hartmut Hackmann & Oliver Endriss");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/isl6421.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/isl6421.c
index 3f3487887672..534ffd1d34c0 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/isl6421.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/isl6421.c
@@ -227,7 +227,7 @@ struct dvb_frontend *isl6421_attach(struct dvb_frontend *fe, struct i2c_adapter
 
 	return fe;
 }
-EXPORT_SYMBOL(isl6421_attach);
+EXPORT_SYMBOL_GPL(isl6421_attach);
 
 MODULE_DESCRIPTION("Driver for lnb supply and control ic isl6421");
 MODULE_AUTHOR("Andrew de Quincey & Oliver Endriss");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/isl6423.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/isl6423.c
index dca5bebfeeb5..388f2f49fe82 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/isl6423.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/isl6423.c
@@ -301,7 +301,7 @@ exit:
 	fe->sec_priv = NULL;
 	return NULL;
 }
-EXPORT_SYMBOL(isl6423_attach);
+EXPORT_SYMBOL_GPL(isl6423_attach);
 
 MODULE_DESCRIPTION("ISL6423 SEC");
 MODULE_AUTHOR("Manu Abraham");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/itd1000.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/itd1000.c
index ce7c443d3eac..1903f9a5b579 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/itd1000.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/itd1000.c
@@ -399,7 +399,7 @@ struct dvb_frontend *itd1000_attach(struct dvb_frontend *fe, struct i2c_adapter
 
 	return fe;
 }
-EXPORT_SYMBOL(itd1000_attach);
+EXPORT_SYMBOL_GPL(itd1000_attach);
 
 MODULE_AUTHOR("Patrick Boettcher <pb@linuxtv.org>");
 MODULE_DESCRIPTION("Integrant ITD1000 driver");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/ix2505v.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/ix2505v.c
index 534b24fa2b95..0edcc3b35b95 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/ix2505v.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/ix2505v.c
@@ -311,7 +311,7 @@ error:
 	kfree(state);
 	return NULL;
 }
-EXPORT_SYMBOL(ix2505v_attach);
+EXPORT_SYMBOL_GPL(ix2505v_attach);
 
 module_param_named(debug, ix2505v_debug, int, 0644);
 MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/l64781.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/l64781.c
index 68923c84679a..971664673fcb 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/l64781.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/l64781.c
@@ -606,4 +606,4 @@ MODULE_DESCRIPTION("LSI L64781 DVB-T Demodulator driver");
 MODULE_AUTHOR("Holger Waechtler, Marko Kohtala");
 MODULE_LICENSE("GPL");
 
-EXPORT_SYMBOL(l64781_attach);
+EXPORT_SYMBOL_GPL(l64781_attach);
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/lg2160.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/lg2160.c
index 5798079add10..dd0cf5f6644a 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/lg2160.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/lg2160.c
@@ -1450,7 +1450,7 @@ struct dvb_frontend *lg2160_attach(const struct lg2160_config *config,
 
 	return &state->frontend;
 }
-EXPORT_SYMBOL(lg2160_attach);
+EXPORT_SYMBOL_GPL(lg2160_attach);
 
 MODULE_DESCRIPTION("LG Electronics LG216x ATSC/MH Demodulator Driver");
 MODULE_AUTHOR("Michael Krufky <mkrufky@linuxtv.org>");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/lgdt3305.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/lgdt3305.c
index 0af4d9104761..65e744b9f254 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/lgdt3305.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/lgdt3305.c
@@ -1158,7 +1158,7 @@ fail:
 	kfree(state);
 	return NULL;
 }
-EXPORT_SYMBOL(lgdt3305_attach);
+EXPORT_SYMBOL_GPL(lgdt3305_attach);
 
 static const struct dvb_frontend_ops lgdt3304_ops = {
 	.delsys = { SYS_ATSC, SYS_DVBC_ANNEX_B },
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/lgdt3306a.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/lgdt3306a.c
index fbb3b2f49d2d..52fb8623d512 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/lgdt3306a.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/lgdt3306a.c
@@ -1846,7 +1846,7 @@ fail:
 	kfree(state);
 	return NULL;
 }
-EXPORT_SYMBOL(lgdt3306a_attach);
+EXPORT_SYMBOL_GPL(lgdt3306a_attach);
 
 #ifdef DBG_DUMP
 
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/lgs8gxx.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/lgs8gxx.c
index e6b009ab395f..59ac13ac88b8 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/lgs8gxx.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/lgs8gxx.c
@@ -1053,7 +1053,7 @@ error_out:
 	return NULL;
 
 }
-EXPORT_SYMBOL(lgs8gxx_attach);
+EXPORT_SYMBOL_GPL(lgs8gxx_attach);
 
 MODULE_DESCRIPTION("Legend Silicon LGS8913/LGS8GXX DMB-TH demodulator driver");
 MODULE_AUTHOR("David T. L. Wong <davidtlwong@gmail.com>");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/lnbh25.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/lnbh25.c
index cb486e879fdd..b8cb301f4f2e 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/lnbh25.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/lnbh25.c
@@ -182,7 +182,7 @@ struct dvb_frontend *lnbh25_attach(struct dvb_frontend *fe,
 		__func__, priv->i2c_address);
 	return fe;
 }
-EXPORT_SYMBOL(lnbh25_attach);
+EXPORT_SYMBOL_GPL(lnbh25_attach);
 
 MODULE_DESCRIPTION("ST LNBH25 driver");
 MODULE_AUTHOR("info@netup.ru");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/lnbp21.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/lnbp21.c
index 392d7be93774..5c5681bdc773 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/lnbp21.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/lnbp21.c
@@ -169,7 +169,7 @@ struct dvb_frontend *lnbh24_attach(struct dvb_frontend *fe,
 	return lnbx2x_attach(fe, i2c, override_set, override_clear,
 							i2c_addr, LNBH24_TTX);
 }
-EXPORT_SYMBOL(lnbh24_attach);
+EXPORT_SYMBOL_GPL(lnbh24_attach);
 
 struct dvb_frontend *lnbp21_attach(struct dvb_frontend *fe,
 				struct i2c_adapter *i2c, u8 override_set,
@@ -178,7 +178,7 @@ struct dvb_frontend *lnbp21_attach(struct dvb_frontend *fe,
 	return lnbx2x_attach(fe, i2c, override_set, override_clear,
 							0x08, LNBP21_ISEL);
 }
-EXPORT_SYMBOL(lnbp21_attach);
+EXPORT_SYMBOL_GPL(lnbp21_attach);
 
 MODULE_DESCRIPTION("Driver for lnb supply and control ic lnbp21, lnbh24");
 MODULE_AUTHOR("Oliver Endriss, Igor M. Liplianin");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/lnbp22.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/lnbp22.c
index 39326a2ebab2..690de7679b1d 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/lnbp22.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/lnbp22.c
@@ -139,7 +139,7 @@ struct dvb_frontend *lnbp22_attach(struct dvb_frontend *fe,
 
 	return fe;
 }
-EXPORT_SYMBOL(lnbp22_attach);
+EXPORT_SYMBOL_GPL(lnbp22_attach);
 
 MODULE_DESCRIPTION("Driver for lnb supply and control ic lnbp22");
 MODULE_AUTHOR("Dominik Kuhlen");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/m88ds3103.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/m88ds3103.c
index 53f2d16dd056..11418b74f8a7 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/m88ds3103.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/m88ds3103.c
@@ -1293,7 +1293,7 @@ struct dvb_frontend *m88ds3103_attach(const struct m88ds3103_config *cfg,
 	*tuner_i2c_adapter = pdata.get_i2c_adapter(client);
 	return pdata.get_dvb_frontend(client);
 }
-EXPORT_SYMBOL(m88ds3103_attach);
+EXPORT_SYMBOL_GPL(m88ds3103_attach);
 
 static const struct dvb_frontend_ops m88ds3103_ops = {
 	.delsys = {SYS_DVBS, SYS_DVBS2},
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/m88rs2000.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/m88rs2000.c
index ce6c21d405ee..0f4455bafd62 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/m88rs2000.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/m88rs2000.c
@@ -816,7 +816,7 @@ error:
 
 	return NULL;
 }
-EXPORT_SYMBOL(m88rs2000_attach);
+EXPORT_SYMBOL_GPL(m88rs2000_attach);
 
 MODULE_DESCRIPTION("M88RS2000 DVB-S Demodulator driver");
 MODULE_AUTHOR("Malcolm Priestley tvboxspy@gmail.com");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/mb86a16.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/mb86a16.c
index dfe322eccaa1..d2baf3940834 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/mb86a16.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/mb86a16.c
@@ -1865,6 +1865,6 @@ error:
 	kfree(state);
 	return NULL;
 }
-EXPORT_SYMBOL(mb86a16_attach);
+EXPORT_SYMBOL_GPL(mb86a16_attach);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Manu Abraham");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/mb86a20s.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/mb86a20s.c
index e8ac8c3e2ec0..10bb4de8624b 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/mb86a20s.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/mb86a20s.c
@@ -2106,7 +2106,7 @@ error:
 	kfree(state);
 	return NULL;
 }
-EXPORT_SYMBOL(mb86a20s_attach);
+EXPORT_SYMBOL_GPL(mb86a20s_attach);
 
 static const struct dvb_frontend_ops mb86a20s_ops = {
 	.delsys = { SYS_ISDBT },
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/mt312.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/mt312.c
index 0b23cbc021b8..ff5eae92a91e 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/mt312.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/mt312.c
@@ -840,7 +840,7 @@ error:
 	kfree(state);
 	return NULL;
 }
-EXPORT_SYMBOL(mt312_attach);
+EXPORT_SYMBOL_GPL(mt312_attach);
 
 module_param(debug, int, 0644);
 MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/mt352.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/mt352.c
index d5fa96f0a6cd..5fb646ff9386 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/mt352.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/mt352.c
@@ -604,4 +604,4 @@ MODULE_DESCRIPTION("Zarlink MT352 DVB-T Demodulator driver");
 MODULE_AUTHOR("Holger Waechtler, Daniel Mack, Antonio Mancuso");
 MODULE_LICENSE("GPL");
 
-EXPORT_SYMBOL(mt352_attach);
+EXPORT_SYMBOL_GPL(mt352_attach);
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/nxt200x.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/nxt200x.c
index 253a3571176a..3612f815a96e 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/nxt200x.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/nxt200x.c
@@ -1228,5 +1228,5 @@ MODULE_DESCRIPTION("NXT200X (ATSC 8VSB & ITU-T J.83 AnnexB 64/256 QAM) Demodulat
 MODULE_AUTHOR("Kirk Lapray, Michael Krufky, Jean-Francois Thibert, and Taylor Jacob");
 MODULE_LICENSE("GPL");
 
-EXPORT_SYMBOL(nxt200x_attach);
+EXPORT_SYMBOL_GPL(nxt200x_attach);
 
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/nxt6000.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/nxt6000.c
index 1ce5ea28489b..377940cf8d3b 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/nxt6000.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/nxt6000.c
@@ -633,4 +633,4 @@ MODULE_DESCRIPTION("NxtWave NXT6000 DVB-T demodulator driver");
 MODULE_AUTHOR("Florian Schirmer");
 MODULE_LICENSE("GPL");
 
-EXPORT_SYMBOL(nxt6000_attach);
+EXPORT_SYMBOL_GPL(nxt6000_attach);
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/or51132.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/or51132.c
index dca70686a039..24fed6b18116 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/or51132.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/or51132.c
@@ -611,4 +611,4 @@ MODULE_AUTHOR("Kirk Lapray");
 MODULE_AUTHOR("Trent Piepho");
 MODULE_LICENSE("GPL");
 
-EXPORT_SYMBOL(or51132_attach);
+EXPORT_SYMBOL_GPL(or51132_attach);
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/or51211.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/or51211.c
index d03c67069f68..ab9964cae0ea 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/or51211.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/or51211.c
@@ -555,5 +555,5 @@ MODULE_DESCRIPTION("Oren OR51211 VSB [pcHDTV HD-2000] Demodulator Driver");
 MODULE_AUTHOR("Kirk Lapray");
 MODULE_LICENSE("GPL");
 
-EXPORT_SYMBOL(or51211_attach);
+EXPORT_SYMBOL_GPL(or51211_attach);
 
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/s5h1409.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/s5h1409.c
index f370c6df0a8b..e47fe34a1fd9 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/s5h1409.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/s5h1409.c
@@ -993,7 +993,7 @@ error:
 	kfree(state);
 	return NULL;
 }
-EXPORT_SYMBOL(s5h1409_attach);
+EXPORT_SYMBOL_GPL(s5h1409_attach);
 
 static const struct dvb_frontend_ops s5h1409_ops = {
 	.delsys = { SYS_ATSC, SYS_DVBC_ANNEX_B },
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/s5h1411.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/s5h1411.c
index dd09336a135b..baacd048712d 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/s5h1411.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/s5h1411.c
@@ -912,7 +912,7 @@ error:
 	kfree(state);
 	return NULL;
 }
-EXPORT_SYMBOL(s5h1411_attach);
+EXPORT_SYMBOL_GPL(s5h1411_attach);
 
 static const struct dvb_frontend_ops s5h1411_ops = {
 	.delsys = { SYS_ATSC, SYS_DVBC_ANNEX_B },
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/s5h1420.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/s5h1420.c
index fd427a29c001..f8baac271ff2 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/s5h1420.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/s5h1420.c
@@ -928,7 +928,7 @@ error:
 	kfree(state);
 	return NULL;
 }
-EXPORT_SYMBOL(s5h1420_attach);
+EXPORT_SYMBOL_GPL(s5h1420_attach);
 
 static const struct dvb_frontend_ops s5h1420_ops = {
 	.delsys = { SYS_DVBS },
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/s5h1432.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/s5h1432.c
index 4de50fe0c638..f098abe2b158 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/s5h1432.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/s5h1432.c
@@ -364,7 +364,7 @@ struct dvb_frontend *s5h1432_attach(const struct s5h1432_config *config,
 
 	return &state->frontend;
 }
-EXPORT_SYMBOL(s5h1432_attach);
+EXPORT_SYMBOL_GPL(s5h1432_attach);
 
 static const struct dvb_frontend_ops s5h1432_ops = {
 	.delsys = { SYS_DVBT },
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/s921.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/s921.c
index 274544a3ae0e..5cf649930982 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/s921.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/s921.c
@@ -503,7 +503,7 @@ struct dvb_frontend *s921_attach(const struct s921_config *config,
 
 	return &state->frontend;
 }
-EXPORT_SYMBOL(s921_attach);
+EXPORT_SYMBOL_GPL(s921_attach);
 
 static const struct dvb_frontend_ops s921_ops = {
 	.delsys = { SYS_ISDBT },
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/si21xx.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/si21xx.c
index 4e8c3ac4303f..9d8f9e8ed9ba 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/si21xx.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/si21xx.c
@@ -944,7 +944,7 @@ error:
 	kfree(state);
 	return NULL;
 }
-EXPORT_SYMBOL(si21xx_attach);
+EXPORT_SYMBOL_GPL(si21xx_attach);
 
 module_param(debug, int, 0644);
 MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/sp887x.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/sp887x.c
index de44cf3766ff..403ffbb2aa40 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/sp887x.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/sp887x.c
@@ -619,4 +619,4 @@ MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
 MODULE_DESCRIPTION("Spase sp887x DVB-T demodulator driver");
 MODULE_LICENSE("GPL");
 
-EXPORT_SYMBOL(sp887x_attach);
+EXPORT_SYMBOL_GPL(sp887x_attach);
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/stb0899_drv.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/stb0899_drv.c
index db5dde3215f0..0631b10a082f 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/stb0899_drv.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/stb0899_drv.c
@@ -1652,7 +1652,7 @@ error:
 	kfree(state);
 	return NULL;
 }
-EXPORT_SYMBOL(stb0899_attach);
+EXPORT_SYMBOL_GPL(stb0899_attach);
 MODULE_PARM_DESC(verbose, "Set Verbosity level");
 MODULE_AUTHOR("Manu Abraham");
 MODULE_DESCRIPTION("STB0899 Multi-Std frontend");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/stb6000.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/stb6000.c
index 69c03892f2da..b1c447f378c3 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/stb6000.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/stb6000.c
@@ -245,7 +245,7 @@ struct dvb_frontend *stb6000_attach(struct dvb_frontend *fe, int addr,
 
 	return fe;
 }
-EXPORT_SYMBOL(stb6000_attach);
+EXPORT_SYMBOL_GPL(stb6000_attach);
 
 module_param(debug, int, 0644);
 MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/stb6100.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/stb6100.c
index 75509bec66e4..ed4272bf7909 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/stb6100.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/stb6100.c
@@ -570,7 +570,7 @@ static void stb6100_release(struct dvb_frontend *fe)
 	kfree(state);
 }
 
-EXPORT_SYMBOL(stb6100_attach);
+EXPORT_SYMBOL_GPL(stb6100_attach);
 MODULE_PARM_DESC(verbose, "Set Verbosity level");
 
 MODULE_AUTHOR("Manu Abraham");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/stv0288.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/stv0288.c
index 65f92e51c31e..83603ebbae53 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/stv0288.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/stv0288.c
@@ -610,7 +610,7 @@ error:
 
 	return NULL;
 }
-EXPORT_SYMBOL(stv0288_attach);
+EXPORT_SYMBOL_GPL(stv0288_attach);
 
 module_param(debug_legacy_dish_switch, int, 0444);
 MODULE_PARM_DESC(debug_legacy_dish_switch,
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/stv0297.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/stv0297.c
index db94d4d109f9..572095a8b62d 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/stv0297.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/stv0297.c
@@ -722,4 +722,4 @@ MODULE_DESCRIPTION("ST STV0297 DVB-C Demodulator driver");
 MODULE_AUTHOR("Dennis Noermann and Andrew de Quincey");
 MODULE_LICENSE("GPL");
 
-EXPORT_SYMBOL(stv0297_attach);
+EXPORT_SYMBOL_GPL(stv0297_attach);
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/stv0299.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/stv0299.c
index b36b21a13201..d417c36dba03 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/stv0299.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/stv0299.c
@@ -764,4 +764,4 @@ MODULE_DESCRIPTION("ST STV0299 DVB Demodulator driver");
 MODULE_AUTHOR("Ralph Metzler, Holger Waechtler, Peter Schildmann, Felix Domke, Andreas Oberritter, Andrew de Quincey, Kenneth Aafly");
 MODULE_LICENSE("GPL");
 
-EXPORT_SYMBOL(stv0299_attach);
+EXPORT_SYMBOL_GPL(stv0299_attach);
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/stv0367.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/stv0367.c
index 1a726196c126..02abe485f18f 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/stv0367.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/stv0367.c
@@ -1763,7 +1763,7 @@ error:
 	kfree(state);
 	return NULL;
 }
-EXPORT_SYMBOL(stv0367ter_attach);
+EXPORT_SYMBOL_GPL(stv0367ter_attach);
 
 static int stv0367cab_gate_ctrl(struct dvb_frontend *fe, int enable)
 {
@@ -2936,7 +2936,7 @@ error:
 	kfree(state);
 	return NULL;
 }
-EXPORT_SYMBOL(stv0367cab_attach);
+EXPORT_SYMBOL_GPL(stv0367cab_attach);
 
 /*
  * Functions for operation on Digital Devices hardware
@@ -3358,7 +3358,7 @@ error:
 	kfree(state);
 	return NULL;
 }
-EXPORT_SYMBOL(stv0367ddb_attach);
+EXPORT_SYMBOL_GPL(stv0367ddb_attach);
 
 MODULE_PARM_DESC(debug, "Set debug");
 MODULE_PARM_DESC(i2c_debug, "Set i2c debug");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/stv0900_core.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/stv0900_core.c
index 0b739725e3c0..bc691d80f7f3 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/stv0900_core.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/stv0900_core.c
@@ -1968,7 +1968,7 @@ error:
 	kfree(state);
 	return NULL;
 }
-EXPORT_SYMBOL(stv0900_attach);
+EXPORT_SYMBOL_GPL(stv0900_attach);
 
 MODULE_PARM_DESC(debug, "Set debug");
 
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/stv6110.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/stv6110.c
index e4fd9c1b0560..5a13399ec56f 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/stv6110.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/stv6110.c
@@ -446,7 +446,7 @@ struct dvb_frontend *stv6110_attach(struct dvb_frontend *fe,
 
 	return fe;
 }
-EXPORT_SYMBOL(stv6110_attach);
+EXPORT_SYMBOL_GPL(stv6110_attach);
 
 module_param(debug, int, 0644);
 MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/stv6110x.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/stv6110x.c
index 7e8e01389c55..8c6a83dd2f9f 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/stv6110x.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/stv6110x.c
@@ -409,7 +409,7 @@ const struct stv6110x_devctl *stv6110x_attach(struct dvb_frontend *fe,
 	printk(KERN_INFO "%s: Attaching STV6110x\n", __func__);
 	return stv6110x->devctl;
 }
-EXPORT_SYMBOL(stv6110x_attach);
+EXPORT_SYMBOL_GPL(stv6110x_attach);
 
 MODULE_AUTHOR("Manu Abraham");
 MODULE_DESCRIPTION("STV6110x Silicon tuner");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/tda10021.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/tda10021.c
index 32ba8401e743..b5ce9fef5020 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/tda10021.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/tda10021.c
@@ -525,4 +525,4 @@ MODULE_DESCRIPTION("Philips TDA10021 DVB-C demodulator driver");
 MODULE_AUTHOR("Ralph Metzler, Holger Waechtler, Markus Schulz");
 MODULE_LICENSE("GPL");
 
-EXPORT_SYMBOL(tda10021_attach);
+EXPORT_SYMBOL_GPL(tda10021_attach);
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/tda10023.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/tda10023.c
index 8028007c68eb..d7120a9cf666 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/tda10023.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/tda10023.c
@@ -606,4 +606,4 @@ MODULE_DESCRIPTION("Philips TDA10023 DVB-C demodulator driver");
 MODULE_AUTHOR("Georg Acher, Hartmut Birr");
 MODULE_LICENSE("GPL");
 
-EXPORT_SYMBOL(tda10023_attach);
+EXPORT_SYMBOL_GPL(tda10023_attach);
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/tda10048.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/tda10048.c
index 0ae156c15d64..173158756b11 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/tda10048.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/tda10048.c
@@ -1150,7 +1150,7 @@ error:
 	kfree(state);
 	return NULL;
 }
-EXPORT_SYMBOL(tda10048_attach);
+EXPORT_SYMBOL_GPL(tda10048_attach);
 
 static const struct dvb_frontend_ops tda10048_ops = {
 	.delsys = { SYS_DVBT },
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/tda1004x.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/tda1004x.c
index 838805ba05a4..da268cc34839 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/tda1004x.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/tda1004x.c
@@ -1383,5 +1383,5 @@ MODULE_DESCRIPTION("Philips TDA10045H & TDA10046H DVB-T Demodulator");
 MODULE_AUTHOR("Andrew de Quincey & Robert Schlabbach");
 MODULE_LICENSE("GPL");
 
-EXPORT_SYMBOL(tda10045_attach);
-EXPORT_SYMBOL(tda10046_attach);
+EXPORT_SYMBOL_GPL(tda10045_attach);
+EXPORT_SYMBOL_GPL(tda10046_attach);
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/tda10086.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/tda10086.c
index b6d16c05904d..90b731b75ea8 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/tda10086.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/tda10086.c
@@ -777,4 +777,4 @@ MODULE_DESCRIPTION("Philips TDA10086 DVB-S Demodulator");
 MODULE_AUTHOR("Andrew de Quincey");
 MODULE_LICENSE("GPL");
 
-EXPORT_SYMBOL(tda10086_attach);
+EXPORT_SYMBOL_GPL(tda10086_attach);
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/tda665x.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/tda665x.c
index a63dec44295b..887ce34597f5 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/tda665x.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/tda665x.c
@@ -239,7 +239,7 @@ struct dvb_frontend *tda665x_attach(struct dvb_frontend *fe,
 
 	return fe;
 }
-EXPORT_SYMBOL(tda665x_attach);
+EXPORT_SYMBOL_GPL(tda665x_attach);
 
 MODULE_DESCRIPTION("TDA665x driver");
 MODULE_AUTHOR("Manu Abraham");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/tda8083.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/tda8083.c
index aa3200d3c352..e94924a06f73 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/tda8083.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/tda8083.c
@@ -494,4 +494,4 @@ MODULE_DESCRIPTION("Philips TDA8083 DVB-S Demodulator");
 MODULE_AUTHOR("Ralph Metzler, Holger Waechtler");
 MODULE_LICENSE("GPL");
 
-EXPORT_SYMBOL(tda8083_attach);
+EXPORT_SYMBOL_GPL(tda8083_attach);
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/tda8261.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/tda8261.c
index 4eb294f330bc..fe54742731d9 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/tda8261.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/tda8261.c
@@ -201,7 +201,7 @@ exit:
 	return NULL;
 }
 
-EXPORT_SYMBOL(tda8261_attach);
+EXPORT_SYMBOL_GPL(tda8261_attach);
 
 MODULE_AUTHOR("Manu Abraham");
 MODULE_DESCRIPTION("TDA8261 8PSK/QPSK Tuner");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/tda826x.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/tda826x.c
index da427b4c2aaa..4b9550e70077 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/tda826x.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/tda826x.c
@@ -177,7 +177,7 @@ struct dvb_frontend *tda826x_attach(struct dvb_frontend *fe, int addr, struct i2
 
 	return fe;
 }
-EXPORT_SYMBOL(tda826x_attach);
+EXPORT_SYMBOL_GPL(tda826x_attach);
 
 module_param(debug, int, 0644);
 MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/ts2020.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/ts2020.c
index b879e1571469..d18802dccf52 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/ts2020.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/ts2020.c
@@ -534,7 +534,7 @@ struct dvb_frontend *ts2020_attach(struct dvb_frontend *fe,
 
 	return fe;
 }
-EXPORT_SYMBOL(ts2020_attach);
+EXPORT_SYMBOL_GPL(ts2020_attach);
 
 /*
  * We implement own regmap locking due to legacy DVB attach which uses frontend
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/tua6100.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/tua6100.c
index 859fa14b319c..5541ffa4d2f3 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/tua6100.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/tua6100.c
@@ -194,7 +194,7 @@ struct dvb_frontend *tua6100_attach(struct dvb_frontend *fe, int addr, struct i2
 	fe->tuner_priv = priv;
 	return fe;
 }
-EXPORT_SYMBOL(tua6100_attach);
+EXPORT_SYMBOL_GPL(tua6100_attach);
 
 MODULE_DESCRIPTION("DVB tua6100 driver");
 MODULE_AUTHOR("Andrew de Quincey");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/ves1820.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/ves1820.c
index 178363704bd4..ede3859a10c6 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/ves1820.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/ves1820.c
@@ -446,4 +446,4 @@ MODULE_DESCRIPTION("VLSI VES1820 DVB-C Demodulator driver");
 MODULE_AUTHOR("Ralph Metzler, Holger Waechtler");
 MODULE_LICENSE("GPL");
 
-EXPORT_SYMBOL(ves1820_attach);
+EXPORT_SYMBOL_GPL(ves1820_attach);
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/ves1x93.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/ves1x93.c
index d0ee52f66a8e..f8064ced80b7 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/ves1x93.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/ves1x93.c
@@ -553,4 +553,4 @@ MODULE_DESCRIPTION("VLSI VES1x93 DVB-S Demodulator driver");
 MODULE_AUTHOR("Ralph Metzler");
 MODULE_LICENSE("GPL");
 
-EXPORT_SYMBOL(ves1x93_attach);
+EXPORT_SYMBOL_GPL(ves1x93_attach);
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/zl10036.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/zl10036.c
index 062282739ce5..6cd4fb8bc271 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/zl10036.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/zl10036.c
@@ -504,7 +504,7 @@ error:
 	kfree(state);
 	return NULL;
 }
-EXPORT_SYMBOL(zl10036_attach);
+EXPORT_SYMBOL_GPL(zl10036_attach);
 
 module_param_named(debug, zl10036_debug, int, 0644);
 MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/zl10039.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/zl10039.c
index 3208b866d1cb..49327a9f5047 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/zl10039.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/zl10039.c
@@ -304,7 +304,7 @@ error:
 	kfree(state);
 	return NULL;
 }
-EXPORT_SYMBOL(zl10039_attach);
+EXPORT_SYMBOL_GPL(zl10039_attach);
 
 module_param(debug, int, 0644);
 MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
diff --git linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/zl10353.c linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/zl10353.c
index 1c689f7f4ab8..8f5bb3c126ca 100644
--- linux-libre-4.14.325-gnu1/drivers/media/dvb-frontends/zl10353.c
+++ linux-libre-4.14.326-gnu1/drivers/media/dvb-frontends/zl10353.c
@@ -676,4 +676,4 @@ MODULE_DESCRIPTION("Zarlink ZL10353 DVB-T demodulator driver");
 MODULE_AUTHOR("Chris Pascoe");
 MODULE_LICENSE("GPL");
 
-EXPORT_SYMBOL(zl10353_attach);
+EXPORT_SYMBOL_GPL(zl10353_attach);
diff --git linux-libre-4.14.325-gnu1/drivers/media/pci/bt8xx/dst.c linux-libre-4.14.326-gnu1/drivers/media/pci/bt8xx/dst.c
index 7166d2279465..121f269ec562 100644
--- linux-libre-4.14.325-gnu1/drivers/media/pci/bt8xx/dst.c
+++ linux-libre-4.14.326-gnu1/drivers/media/pci/bt8xx/dst.c
@@ -1733,7 +1733,7 @@ struct dst_state *dst_attach(struct dst_state *state, struct dvb_adapter *dvb_ad
 	return state;				/*	Manu (DST is a card not a frontend)	*/
 }
 
-EXPORT_SYMBOL(dst_attach);
+EXPORT_SYMBOL_GPL(dst_attach);
 
 static const struct dvb_frontend_ops dst_dvbt_ops = {
 	.delsys = { SYS_DVBT },
diff --git linux-libre-4.14.325-gnu1/drivers/media/pci/bt8xx/dst_ca.c linux-libre-4.14.326-gnu1/drivers/media/pci/bt8xx/dst_ca.c
index 530b3e9764ce..51ad5897a1b9 100644
--- linux-libre-4.14.325-gnu1/drivers/media/pci/bt8xx/dst_ca.c
+++ linux-libre-4.14.326-gnu1/drivers/media/pci/bt8xx/dst_ca.c
@@ -680,7 +680,7 @@ struct dvb_device *dst_ca_attach(struct dst_state *dst, struct dvb_adapter *dvb_
 	return NULL;
 }
 
-EXPORT_SYMBOL(dst_ca_attach);
+EXPORT_SYMBOL_GPL(dst_ca_attach);
 
 MODULE_DESCRIPTION("DST DVB-S/T/C Combo CA driver");
 MODULE_AUTHOR("Manu Abraham");
diff --git linux-libre-4.14.325-gnu1/drivers/media/pci/cx23885/cx23885-video.c linux-libre-4.14.326-gnu1/drivers/media/pci/cx23885/cx23885-video.c
index c62641e8a2f6..9b597d9250eb 100644
--- linux-libre-4.14.325-gnu1/drivers/media/pci/cx23885/cx23885-video.c
+++ linux-libre-4.14.326-gnu1/drivers/media/pci/cx23885/cx23885-video.c
@@ -418,7 +418,7 @@ static int buffer_prepare(struct vb2_buffer *vb)
 				dev->height >> 1);
 		break;
 	default:
-		BUG();
+		return -EINVAL; /* should not happen */
 	}
 	dprintk(2, "[%p/%d] buffer_init - %dx%d %dbpp \"%s\" - dma=0x%08lx\n",
 		buf, buf->vb.vb2_buf.index,
diff --git linux-libre-4.14.325-gnu1/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c linux-libre-4.14.326-gnu1/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c
index bc8349bc2e80..2c0d89a46410 100644
--- linux-libre-4.14.325-gnu1/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c
+++ linux-libre-4.14.326-gnu1/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c
@@ -230,10 +230,11 @@ static struct vdec_fb *vp9_rm_from_fb_use_list(struct vdec_vp9_inst
 		if (fb->base_y.va == addr) {
 			list_move_tail(&node->list,
 				       &inst->available_fb_node_list);
-			break;
+			return fb;
 		}
 	}
-	return fb;
+
+	return NULL;
 }
 
 static void vp9_add_to_fb_free_list(struct vdec_vp9_inst *inst,
diff --git linux-libre-4.14.325-gnu1/drivers/media/tuners/fc0011.c linux-libre-4.14.326-gnu1/drivers/media/tuners/fc0011.c
index 145407dee3db..7a7b853c9a9b 100644
--- linux-libre-4.14.325-gnu1/drivers/media/tuners/fc0011.c
+++ linux-libre-4.14.326-gnu1/drivers/media/tuners/fc0011.c
@@ -508,7 +508,7 @@ struct dvb_frontend *fc0011_attach(struct dvb_frontend *fe,
 
 	return fe;
 }
-EXPORT_SYMBOL(fc0011_attach);
+EXPORT_SYMBOL_GPL(fc0011_attach);
 
 MODULE_DESCRIPTION("Fitipower FC0011 silicon tuner driver");
 MODULE_AUTHOR("Michael Buesch <m@bues.ch>");
diff --git linux-libre-4.14.325-gnu1/drivers/media/tuners/fc0012.c linux-libre-4.14.326-gnu1/drivers/media/tuners/fc0012.c
index 625ac6f51c39..64d0774061a5 100644
--- linux-libre-4.14.325-gnu1/drivers/media/tuners/fc0012.c
+++ linux-libre-4.14.326-gnu1/drivers/media/tuners/fc0012.c
@@ -505,7 +505,7 @@ err:
 
 	return fe;
 }
-EXPORT_SYMBOL(fc0012_attach);
+EXPORT_SYMBOL_GPL(fc0012_attach);
 
 MODULE_DESCRIPTION("Fitipower FC0012 silicon tuner driver");
 MODULE_AUTHOR("Hans-Frieder Vogt <hfvogt@gmx.net>");
diff --git linux-libre-4.14.325-gnu1/drivers/media/tuners/fc0013.c linux-libre-4.14.326-gnu1/drivers/media/tuners/fc0013.c
index e606118d1a9b..74a6af3a1384 100644
--- linux-libre-4.14.325-gnu1/drivers/media/tuners/fc0013.c
+++ linux-libre-4.14.326-gnu1/drivers/media/tuners/fc0013.c
@@ -619,7 +619,7 @@ struct dvb_frontend *fc0013_attach(struct dvb_frontend *fe,
 
 	return fe;
 }
-EXPORT_SYMBOL(fc0013_attach);
+EXPORT_SYMBOL_GPL(fc0013_attach);
 
 MODULE_DESCRIPTION("Fitipower FC0013 silicon tuner driver");
 MODULE_AUTHOR("Hans-Frieder Vogt <hfvogt@gmx.net>");
diff --git linux-libre-4.14.325-gnu1/drivers/media/tuners/max2165.c linux-libre-4.14.326-gnu1/drivers/media/tuners/max2165.c
index a86c08114915..e1f47463376a 100644
--- linux-libre-4.14.325-gnu1/drivers/media/tuners/max2165.c
+++ linux-libre-4.14.326-gnu1/drivers/media/tuners/max2165.c
@@ -420,7 +420,7 @@ struct dvb_frontend *max2165_attach(struct dvb_frontend *fe,
 
 	return fe;
 }
-EXPORT_SYMBOL(max2165_attach);
+EXPORT_SYMBOL_GPL(max2165_attach);
 
 MODULE_AUTHOR("David T. L. Wong <davidtlwong@gmail.com>");
 MODULE_DESCRIPTION("Maxim MAX2165 silicon tuner driver");
diff --git linux-libre-4.14.325-gnu1/drivers/media/tuners/mc44s803.c linux-libre-4.14.326-gnu1/drivers/media/tuners/mc44s803.c
index 12f545ef1243..36314805680b 100644
--- linux-libre-4.14.325-gnu1/drivers/media/tuners/mc44s803.c
+++ linux-libre-4.14.326-gnu1/drivers/media/tuners/mc44s803.c
@@ -366,7 +366,7 @@ error:
 	kfree(priv);
 	return NULL;
 }
-EXPORT_SYMBOL(mc44s803_attach);
+EXPORT_SYMBOL_GPL(mc44s803_attach);
 
 MODULE_AUTHOR("Jochen Friedrich");
 MODULE_DESCRIPTION("Freescale MC44S803 silicon tuner driver");
diff --git linux-libre-4.14.325-gnu1/drivers/media/tuners/mt2060.c linux-libre-4.14.326-gnu1/drivers/media/tuners/mt2060.c
index 4983eeb39f36..acc9e2d05851 100644
--- linux-libre-4.14.325-gnu1/drivers/media/tuners/mt2060.c
+++ linux-libre-4.14.326-gnu1/drivers/media/tuners/mt2060.c
@@ -450,7 +450,7 @@ struct dvb_frontend * mt2060_attach(struct dvb_frontend *fe, struct i2c_adapter
 
 	return fe;
 }
-EXPORT_SYMBOL(mt2060_attach);
+EXPORT_SYMBOL_GPL(mt2060_attach);
 
 static int mt2060_probe(struct i2c_client *client,
 			const struct i2c_device_id *id)
diff --git linux-libre-4.14.325-gnu1/drivers/media/tuners/mt2131.c linux-libre-4.14.326-gnu1/drivers/media/tuners/mt2131.c
index dd85d58fa8d0..4be7cf6eff93 100644
--- linux-libre-4.14.325-gnu1/drivers/media/tuners/mt2131.c
+++ linux-libre-4.14.326-gnu1/drivers/media/tuners/mt2131.c
@@ -284,7 +284,7 @@ struct dvb_frontend * mt2131_attach(struct dvb_frontend *fe,
 	fe->tuner_priv = priv;
 	return fe;
 }
-EXPORT_SYMBOL(mt2131_attach);
+EXPORT_SYMBOL_GPL(mt2131_attach);
 
 MODULE_AUTHOR("Steven Toth");
 MODULE_DESCRIPTION("Microtune MT2131 silicon tuner driver");
diff --git linux-libre-4.14.325-gnu1/drivers/media/tuners/mt2266.c linux-libre-4.14.326-gnu1/drivers/media/tuners/mt2266.c
index 88edcc031e3c..aa63ce6b5b50 100644
--- linux-libre-4.14.325-gnu1/drivers/media/tuners/mt2266.c
+++ linux-libre-4.14.326-gnu1/drivers/media/tuners/mt2266.c
@@ -345,7 +345,7 @@ struct dvb_frontend * mt2266_attach(struct dvb_frontend *fe, struct i2c_adapter
 	mt2266_calibrate(priv);
 	return fe;
 }
-EXPORT_SYMBOL(mt2266_attach);
+EXPORT_SYMBOL_GPL(mt2266_attach);
 
 MODULE_AUTHOR("Olivier DANET");
 MODULE_DESCRIPTION("Microtune MT2266 silicon tuner driver");
diff --git linux-libre-4.14.325-gnu1/drivers/media/tuners/mxl5005s.c linux-libre-4.14.326-gnu1/drivers/media/tuners/mxl5005s.c
index dd59c2c0e4a5..417596cdb1ff 100644
--- linux-libre-4.14.325-gnu1/drivers/media/tuners/mxl5005s.c
+++ linux-libre-4.14.326-gnu1/drivers/media/tuners/mxl5005s.c
@@ -4109,7 +4109,7 @@ struct dvb_frontend *mxl5005s_attach(struct dvb_frontend *fe,
 	fe->tuner_priv = state;
 	return fe;
 }
-EXPORT_SYMBOL(mxl5005s_attach);
+EXPORT_SYMBOL_GPL(mxl5005s_attach);
 
 MODULE_DESCRIPTION("MaxLinear MXL5005S silicon tuner driver");
 MODULE_AUTHOR("Steven Toth");
diff --git linux-libre-4.14.325-gnu1/drivers/media/tuners/qt1010.c linux-libre-4.14.326-gnu1/drivers/media/tuners/qt1010.c
index ee33b7cc7682..37a1db02a304 100644
--- linux-libre-4.14.325-gnu1/drivers/media/tuners/qt1010.c
+++ linux-libre-4.14.326-gnu1/drivers/media/tuners/qt1010.c
@@ -351,11 +351,12 @@ static int qt1010_init(struct dvb_frontend *fe)
 			else
 				valptr = &tmpval;
 
-			BUG_ON(i >= ARRAY_SIZE(i2c_data) - 1);
-
-			err = qt1010_init_meas1(priv, i2c_data[i+1].reg,
-						i2c_data[i].reg,
-						i2c_data[i].val, valptr);
+			if (i >= ARRAY_SIZE(i2c_data) - 1)
+				err = -EIO;
+			else
+				err = qt1010_init_meas1(priv, i2c_data[i + 1].reg,
+							i2c_data[i].reg,
+							i2c_data[i].val, valptr);
 			i++;
 			break;
 		}
@@ -446,7 +447,7 @@ struct dvb_frontend * qt1010_attach(struct dvb_frontend *fe,
 	fe->tuner_priv = priv;
 	return fe;
 }
-EXPORT_SYMBOL(qt1010_attach);
+EXPORT_SYMBOL_GPL(qt1010_attach);
 
 MODULE_DESCRIPTION("Quantek QT1010 silicon tuner driver");
 MODULE_AUTHOR("Antti Palosaari <crope@iki.fi>");
diff --git linux-libre-4.14.325-gnu1/drivers/media/tuners/tda18218.c linux-libre-4.14.326-gnu1/drivers/media/tuners/tda18218.c
index c56fcf5d48e3..78078ff331a6 100644
--- linux-libre-4.14.325-gnu1/drivers/media/tuners/tda18218.c
+++ linux-libre-4.14.326-gnu1/drivers/media/tuners/tda18218.c
@@ -345,7 +345,7 @@ struct dvb_frontend *tda18218_attach(struct dvb_frontend *fe,
 
 	return fe;
 }
-EXPORT_SYMBOL(tda18218_attach);
+EXPORT_SYMBOL_GPL(tda18218_attach);
 
 MODULE_DESCRIPTION("NXP TDA18218HN silicon tuner driver");
 MODULE_AUTHOR("Antti Palosaari <crope@iki.fi>");
diff --git linux-libre-4.14.325-gnu1/drivers/media/tuners/xc4000.c linux-libre-4.14.326-gnu1/drivers/media/tuners/xc4000.c
index d318b10d13ad..c40d2412f420 100644
--- linux-libre-4.14.325-gnu1/drivers/media/tuners/xc4000.c
+++ linux-libre-4.14.326-gnu1/drivers/media/tuners/xc4000.c
@@ -1751,7 +1751,7 @@ fail2:
 	xc4000_release(fe);
 	return NULL;
 }
-EXPORT_SYMBOL(xc4000_attach);
+EXPORT_SYMBOL_GPL(xc4000_attach);
 
 MODULE_AUTHOR("Steven Toth, Davide Ferri");
 MODULE_DESCRIPTION("Xceive xc4000 silicon tuner driver");
diff --git linux-libre-4.14.325-gnu1/drivers/media/tuners/xc5000.c linux-libre-4.14.326-gnu1/drivers/media/tuners/xc5000.c
index 004b9556590e..2527b3b2e560 100644
--- linux-libre-4.14.325-gnu1/drivers/media/tuners/xc5000.c
+++ linux-libre-4.14.326-gnu1/drivers/media/tuners/xc5000.c
@@ -1464,7 +1464,7 @@ fail:
 	xc5000_release(fe);
 	return NULL;
 }
-EXPORT_SYMBOL(xc5000_attach);
+EXPORT_SYMBOL_GPL(xc5000_attach);
 
 MODULE_AUTHOR("Steven Toth");
 MODULE_DESCRIPTION("Xceive xc5000 silicon tuner driver");
diff --git linux-libre-4.14.325-gnu1/drivers/media/usb/dvb-usb-v2/af9035.c linux-libre-4.14.326-gnu1/drivers/media/usb/dvb-usb-v2/af9035.c
index 116af613a8dc..d059ccb5b5e0 100644
--- linux-libre-4.14.325-gnu1/drivers/media/usb/dvb-usb-v2/af9035.c
+++ linux-libre-4.14.326-gnu1/drivers/media/usb/dvb-usb-v2/af9035.c
@@ -284,6 +284,7 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
 	struct dvb_usb_device *d = i2c_get_adapdata(adap);
 	struct state *state = d_to_priv(d);
 	int ret;
+	u32 reg;
 
 	if (mutex_lock_interruptible(&d->i2c_mutex) < 0)
 		return -EAGAIN;
@@ -336,8 +337,10 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
 			ret = -EOPNOTSUPP;
 		} else if ((msg[0].addr == state->af9033_i2c_addr[0]) ||
 			   (msg[0].addr == state->af9033_i2c_addr[1])) {
+			if (msg[0].len < 3 || msg[1].len < 1)
+				return -EOPNOTSUPP;
 			/* demod access via firmware interface */
-			u32 reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |
+			reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |
 					msg[0].buf[2];
 
 			if (msg[0].addr == state->af9033_i2c_addr[1])
@@ -395,17 +398,16 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
 			ret = -EOPNOTSUPP;
 		} else if ((msg[0].addr == state->af9033_i2c_addr[0]) ||
 			   (msg[0].addr == state->af9033_i2c_addr[1])) {
+			if (msg[0].len < 3)
+				return -EOPNOTSUPP;
 			/* demod access via firmware interface */
-			u32 reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |
+			reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |
 					msg[0].buf[2];
 
 			if (msg[0].addr == state->af9033_i2c_addr[1])
 				reg |= 0x100000;
 
-			ret = (msg[0].len >= 3) ? af9035_wr_regs(d, reg,
-							         &msg[0].buf[3],
-							         msg[0].len - 3)
-					        : -EOPNOTSUPP;
+			ret = af9035_wr_regs(d, reg, &msg[0].buf[3], msg[0].len - 3);
 		} else {
 			/* I2C write */
 			u8 buf[MAX_XFER_SIZE];
diff --git linux-libre-4.14.325-gnu1/drivers/media/usb/dvb-usb-v2/anysee.c linux-libre-4.14.326-gnu1/drivers/media/usb/dvb-usb-v2/anysee.c
index 20ee7eea2a91..83af86505363 100644
--- linux-libre-4.14.325-gnu1/drivers/media/usb/dvb-usb-v2/anysee.c
+++ linux-libre-4.14.326-gnu1/drivers/media/usb/dvb-usb-v2/anysee.c
@@ -211,7 +211,7 @@ static int anysee_master_xfer(struct i2c_adapter *adap, struct i2c_msg *msg,
 
 	while (i < num) {
 		if (num > i + 1 && (msg[i+1].flags & I2C_M_RD)) {
-			if (msg[i].len > 2 || msg[i+1].len > 60) {
+			if (msg[i].len != 2 || msg[i + 1].len > 60) {
 				ret = -EOPNOTSUPP;
 				break;
 			}
diff --git linux-libre-4.14.325-gnu1/drivers/media/usb/dvb-usb-v2/az6007.c linux-libre-4.14.326-gnu1/drivers/media/usb/dvb-usb-v2/az6007.c
index 82ba8203a08b..08b076dc336f 100644
--- linux-libre-4.14.325-gnu1/drivers/media/usb/dvb-usb-v2/az6007.c
+++ linux-libre-4.14.326-gnu1/drivers/media/usb/dvb-usb-v2/az6007.c
@@ -796,6 +796,10 @@ static int az6007_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
 			if (az6007_xfer_debug)
 				printk(KERN_DEBUG "az6007: I2C W addr=0x%x len=%d\n",
 				       addr, msgs[i].len);
+			if (msgs[i].len < 1) {
+				ret = -EIO;
+				goto err;
+			}
 			req = AZ6007_I2C_WR;
 			index = msgs[i].buf[0];
 			value = addr | (1 << 8);
@@ -810,6 +814,10 @@ static int az6007_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
 			if (az6007_xfer_debug)
 				printk(KERN_DEBUG "az6007: I2C R addr=0x%x len=%d\n",
 				       addr, msgs[i].len);
+			if (msgs[i].len < 1) {
+				ret = -EIO;
+				goto err;
+			}
 			req = AZ6007_I2C_RD;
 			index = msgs[i].buf[0];
 			value = addr;
diff --git linux-libre-4.14.325-gnu1/drivers/media/usb/dvb-usb/af9005.c linux-libre-4.14.326-gnu1/drivers/media/usb/dvb-usb/af9005.c
index d39fa71f048c..8dd4fc2613f6 100644
--- linux-libre-4.14.325-gnu1/drivers/media/usb/dvb-usb/af9005.c
+++ linux-libre-4.14.326-gnu1/drivers/media/usb/dvb-usb/af9005.c
@@ -431,6 +431,10 @@ static int af9005_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
 		if (ret == 0)
 			ret = 2;
 	} else {
+		if (msg[0].len < 2) {
+			ret = -EOPNOTSUPP;
+			goto unlock;
+		}
 		/* write one or more registers */
 		reg = msg[0].buf[0];
 		addr = msg[0].addr;
@@ -440,6 +444,7 @@ static int af9005_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
 			ret = 1;
 	}
 
+unlock:
 	mutex_unlock(&d->i2c_mutex);
 	return ret;
 }
diff --git linux-libre-4.14.325-gnu1/drivers/media/usb/dvb-usb/dw2102.c linux-libre-4.14.326-gnu1/drivers/media/usb/dvb-usb/dw2102.c
index 68d653df5cf4..4dc306299a7c 100644
--- linux-libre-4.14.325-gnu1/drivers/media/usb/dvb-usb/dw2102.c
+++ linux-libre-4.14.326-gnu1/drivers/media/usb/dvb-usb/dw2102.c
@@ -133,6 +133,10 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
 
 	switch (num) {
 	case 2:
+		if (msg[0].len < 1) {
+			num = -EOPNOTSUPP;
+			break;
+		}
 		/* read stv0299 register */
 		value = msg[0].buf[0];/* register */
 		for (i = 0; i < msg[1].len; i++) {
@@ -144,6 +148,10 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
 	case 1:
 		switch (msg[0].addr) {
 		case 0x68:
+			if (msg[0].len < 2) {
+				num = -EOPNOTSUPP;
+				break;
+			}
 			/* write to stv0299 register */
 			buf6[0] = 0x2a;
 			buf6[1] = msg[0].buf[0];
@@ -153,6 +161,10 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
 			break;
 		case 0x60:
 			if (msg[0].flags == 0) {
+				if (msg[0].len < 4) {
+					num = -EOPNOTSUPP;
+					break;
+				}
 			/* write to tuner pll */
 				buf6[0] = 0x2c;
 				buf6[1] = 5;
@@ -164,6 +176,10 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
 				dw210x_op_rw(d->udev, 0xb2, 0, 0,
 						buf6, 7, DW210X_WRITE_MSG);
 			} else {
+				if (msg[0].len < 1) {
+					num = -EOPNOTSUPP;
+					break;
+				}
 			/* read from tuner */
 				dw210x_op_rw(d->udev, 0xb5, 0, 0,
 						buf6, 1, DW210X_READ_MSG);
@@ -171,12 +187,20 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
 			}
 			break;
 		case (DW2102_RC_QUERY):
+			if (msg[0].len < 2) {
+				num = -EOPNOTSUPP;
+				break;
+			}
 			dw210x_op_rw(d->udev, 0xb8, 0, 0,
 					buf6, 2, DW210X_READ_MSG);
 			msg[0].buf[0] = buf6[0];
 			msg[0].buf[1] = buf6[1];
 			break;
 		case (DW2102_VOLTAGE_CTRL):
+			if (msg[0].len < 1) {
+				num = -EOPNOTSUPP;
+				break;
+			}
 			buf6[0] = 0x30;
 			buf6[1] = msg[0].buf[0];
 			dw210x_op_rw(d->udev, 0xb2, 0, 0,
diff --git linux-libre-4.14.325-gnu1/drivers/media/usb/dvb-usb/m920x.c linux-libre-4.14.326-gnu1/drivers/media/usb/dvb-usb/m920x.c
index 00f3e88ab99f..c59a8ee06034 100644
--- linux-libre-4.14.325-gnu1/drivers/media/usb/dvb-usb/m920x.c
+++ linux-libre-4.14.326-gnu1/drivers/media/usb/dvb-usb/m920x.c
@@ -283,7 +283,6 @@ static int m920x_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int nu
 			char *read = kmalloc(1, GFP_KERNEL);
 			if (!read) {
 				ret = -ENOMEM;
-				kfree(read);
 				goto unlock;
 			}
 
@@ -294,8 +293,10 @@ static int m920x_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int nu
 
 				if ((ret = m920x_read(d->udev, M9206_I2C, 0x0,
 						      0x20 | stop,
-						      read, 1)) != 0)
+						      read, 1)) != 0) {
+					kfree(read);
 					goto unlock;
+				}
 				msg[i].buf[j] = read[0];
 			}
 
diff --git linux-libre-4.14.325-gnu1/drivers/media/usb/go7007/go7007-i2c.c linux-libre-4.14.326-gnu1/drivers/media/usb/go7007/go7007-i2c.c
index c084bf794b56..64f25d4e52b2 100644
--- linux-libre-4.14.325-gnu1/drivers/media/usb/go7007/go7007-i2c.c
+++ linux-libre-4.14.326-gnu1/drivers/media/usb/go7007/go7007-i2c.c
@@ -173,8 +173,6 @@ static int go7007_i2c_master_xfer(struct i2c_adapter *adapter,
 		} else if (msgs[i].len == 3) {
 			if (msgs[i].flags & I2C_M_RD)
 				return -EIO;
-			if (msgs[i].len != 3)
-				return -EIO;
 			if (go7007_i2c_xfer(go, msgs[i].addr, 0,
 					(msgs[i].buf[0] << 8) | msgs[i].buf[1],
 					0x01, &msgs[i].buf[2]) < 0)
diff --git linux-libre-4.14.325-gnu1/drivers/media/usb/siano/smsusb.c linux-libre-4.14.326-gnu1/drivers/media/usb/siano/smsusb.c
index e33a0702d4fe..2cd343ec3910 100644
--- linux-libre-4.14.325-gnu1/drivers/media/usb/siano/smsusb.c
+++ linux-libre-4.14.326-gnu1/drivers/media/usb/siano/smsusb.c
@@ -467,12 +467,7 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id)
 	rc = smscore_register_device(&params, &dev->coredev, mdev);
 	if (rc < 0) {
 		pr_err("smscore_register_device(...) failed, rc %d\n", rc);
-		smsusb_term_device(intf);
-#ifdef CONFIG_MEDIA_CONTROLLER_DVB
-		media_device_unregister(mdev);
-#endif
-		kfree(mdev);
-		return rc;
+		goto err_unregister_device;
 	}
 
 	smscore_set_board_id(dev->coredev, board_id);
@@ -489,8 +484,7 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id)
 	rc = smsusb_start_streaming(dev);
 	if (rc < 0) {
 		pr_err("smsusb_start_streaming(...) failed\n");
-		smsusb_term_device(intf);
-		return rc;
+		goto err_unregister_device;
 	}
 
 	dev->state = SMSUSB_ACTIVE;
@@ -498,13 +492,20 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id)
 	rc = smscore_start_device(dev->coredev);
 	if (rc < 0) {
 		pr_err("smscore_start_device(...) failed\n");
-		smsusb_term_device(intf);
-		return rc;
+		goto err_unregister_device;
 	}
 
 	pr_debug("device 0x%p created\n", dev);
 
 	return rc;
+
+err_unregister_device:
+	smsusb_term_device(intf);
+#ifdef CONFIG_MEDIA_CONTROLLER_DVB
+	media_device_unregister(mdev);
+#endif
+	kfree(mdev);
+	return rc;
 }
 
 static int smsusb_probe(struct usb_interface *intf,
diff --git linux-libre-4.14.325-gnu1/drivers/mmc/host/Kconfig linux-libre-4.14.326-gnu1/drivers/mmc/host/Kconfig
index 50d5a9922501..9fb1ceceba10 100644
--- linux-libre-4.14.325-gnu1/drivers/mmc/host/Kconfig
+++ linux-libre-4.14.326-gnu1/drivers/mmc/host/Kconfig
@@ -407,11 +407,12 @@ config MMC_WBSD
 	  If unsure, say N.
 
 config MMC_AU1X
-	tristate "Alchemy AU1XX0 MMC Card Interface support"
+	bool "Alchemy AU1XX0 MMC Card Interface support"
 	depends on MIPS_ALCHEMY
+	depends on MMC=y
 	help
 	  This selects the AMD Alchemy(R) Multimedia card interface.
-	  If you have a Alchemy platform with a MMC slot, say Y or M here.
+	  If you have a Alchemy platform with a MMC slot, say Y here.
 
 	  If unsure, say N.
 
diff --git linux-libre-4.14.325-gnu1/drivers/mtd/nand/brcmnand/brcmnand.c linux-libre-4.14.326-gnu1/drivers/mtd/nand/brcmnand/brcmnand.c
index 2741147481c0..fa66663df6e8 100644
--- linux-libre-4.14.325-gnu1/drivers/mtd/nand/brcmnand/brcmnand.c
+++ linux-libre-4.14.326-gnu1/drivers/mtd/nand/brcmnand/brcmnand.c
@@ -152,6 +152,7 @@ struct brcmnand_controller {
 	unsigned int		max_page_size;
 	const unsigned int	*page_sizes;
 	unsigned int		max_oob;
+	u32			ecc_level_shift;
 	u32			features;
 
 	/* for low-power standby/resume only */
@@ -441,6 +442,34 @@ enum {
 	INTFC_CTLR_READY		= BIT(31),
 };
 
+/***********************************************************************
+ * NAND ACC CONTROL bitfield
+ *
+ * Some bits have remained constant throughout hardware revision, while
+ * others have shifted around.
+ ***********************************************************************/
+
+/* Constant for all versions (where supported) */
+enum {
+	/* See BRCMNAND_HAS_CACHE_MODE */
+	ACC_CONTROL_CACHE_MODE				= BIT(22),
+
+	/* See BRCMNAND_HAS_PREFETCH */
+	ACC_CONTROL_PREFETCH				= BIT(23),
+
+	ACC_CONTROL_PAGE_HIT				= BIT(24),
+	ACC_CONTROL_WR_PREEMPT				= BIT(25),
+	ACC_CONTROL_PARTIAL_PAGE			= BIT(26),
+	ACC_CONTROL_RD_ERASED				= BIT(27),
+	ACC_CONTROL_FAST_PGM_RDIN			= BIT(28),
+	ACC_CONTROL_WR_ECC				= BIT(30),
+	ACC_CONTROL_RD_ECC				= BIT(31),
+};
+
+#define	ACC_CONTROL_ECC_SHIFT			16
+/* Only for v7.2 */
+#define	ACC_CONTROL_ECC_EXT_SHIFT		13
+
 static inline u32 nand_readreg(struct brcmnand_controller *ctrl, u32 offs)
 {
 	return brcmnand_readl(ctrl->nand_base + offs);
@@ -544,6 +573,12 @@ static int brcmnand_revision_init(struct brcmnand_controller *ctrl)
 	else if (of_property_read_bool(ctrl->dev->of_node, "brcm,nand-has-wp"))
 		ctrl->features |= BRCMNAND_HAS_WP;
 
+	/* v7.2 has different ecc level shift in the acc register */
+	if (ctrl->nand_version == 0x0702)
+		ctrl->ecc_level_shift = ACC_CONTROL_ECC_EXT_SHIFT;
+	else
+		ctrl->ecc_level_shift = ACC_CONTROL_ECC_SHIFT;
+
 	return 0;
 }
 
@@ -697,30 +732,6 @@ static inline int brcmnand_cmd_shift(struct brcmnand_controller *ctrl)
 	return 0;
 }
 
-/***********************************************************************
- * NAND ACC CONTROL bitfield
- *
- * Some bits have remained constant throughout hardware revision, while
- * others have shifted around.
- ***********************************************************************/
-
-/* Constant for all versions (where supported) */
-enum {
-	/* See BRCMNAND_HAS_CACHE_MODE */
-	ACC_CONTROL_CACHE_MODE				= BIT(22),
-
-	/* See BRCMNAND_HAS_PREFETCH */
-	ACC_CONTROL_PREFETCH				= BIT(23),
-
-	ACC_CONTROL_PAGE_HIT				= BIT(24),
-	ACC_CONTROL_WR_PREEMPT				= BIT(25),
-	ACC_CONTROL_PARTIAL_PAGE			= BIT(26),
-	ACC_CONTROL_RD_ERASED				= BIT(27),
-	ACC_CONTROL_FAST_PGM_RDIN			= BIT(28),
-	ACC_CONTROL_WR_ECC				= BIT(30),
-	ACC_CONTROL_RD_ECC				= BIT(31),
-};
-
 static inline u32 brcmnand_spare_area_mask(struct brcmnand_controller *ctrl)
 {
 	if (ctrl->nand_version >= 0x0702)
@@ -731,18 +742,15 @@ static inline u32 brcmnand_spare_area_mask(struct brcmnand_controller *ctrl)
 		return GENMASK(5, 0);
 }
 
-#define NAND_ACC_CONTROL_ECC_SHIFT	16
-#define NAND_ACC_CONTROL_ECC_EXT_SHIFT	13
-
 static inline u32 brcmnand_ecc_level_mask(struct brcmnand_controller *ctrl)
 {
 	u32 mask = (ctrl->nand_version >= 0x0600) ? 0x1f : 0x0f;
 
-	mask <<= NAND_ACC_CONTROL_ECC_SHIFT;
+	mask <<= ACC_CONTROL_ECC_SHIFT;
 
 	/* v7.2 includes additional ECC levels */
-	if (ctrl->nand_version >= 0x0702)
-		mask |= 0x7 << NAND_ACC_CONTROL_ECC_EXT_SHIFT;
+	if (ctrl->nand_version == 0x0702)
+		mask |= 0x7 << ACC_CONTROL_ECC_EXT_SHIFT;
 
 	return mask;
 }
@@ -756,8 +764,8 @@ static void brcmnand_set_ecc_enabled(struct brcmnand_host *host, int en)
 
 	if (en) {
 		acc_control |= ecc_flags; /* enable RD/WR ECC */
-		acc_control |= host->hwcfg.ecc_level
-			       << NAND_ACC_CONTROL_ECC_SHIFT;
+		acc_control &= ~brcmnand_ecc_level_mask(ctrl);
+		acc_control |= host->hwcfg.ecc_level << ctrl->ecc_level_shift;
 	} else {
 		acc_control &= ~ecc_flags; /* disable RD/WR ECC */
 		acc_control &= ~brcmnand_ecc_level_mask(ctrl);
@@ -836,6 +844,14 @@ static int bcmnand_ctrl_poll_status(struct brcmnand_controller *ctrl,
 		cpu_relax();
 	} while (time_after(limit, jiffies));
 
+	/*
+	 * do a final check after time out in case the CPU was busy and the driver
+	 * did not get enough time to perform the polling to avoid false alarms
+	 */
+	val = brcmnand_read_reg(ctrl, BRCMNAND_INTFC_STATUS);
+	if ((val & mask) == expected_val)
+		return 0;
+
 	dev_warn(ctrl->dev, "timeout on status poll (expected %x got %x)\n",
 		 expected_val, val & mask);
 
@@ -1213,19 +1229,33 @@ static int write_oob_to_regs(struct brcmnand_controller *ctrl, int i,
 			     const u8 *oob, int sas, int sector_1k)
 {
 	int tbytes = sas << sector_1k;
-	int j;
+	int j, k = 0;
+	u32 last = 0xffffffff;
+	u8 *plast = (u8 *)&last;
 
 	/* Adjust OOB values for 1K sector size */
 	if (sector_1k && (i & 0x01))
 		tbytes = max(0, tbytes - (int)ctrl->max_oob);
 	tbytes = min_t(int, tbytes, ctrl->max_oob);
 
-	for (j = 0; j < tbytes; j += 4)
+	/*
+	 * tbytes may not be multiple of words. Make sure we don't read out of
+	 * the boundary and stop at last word.
+	 */
+	for (j = 0; (j + 3) < tbytes; j += 4)
 		oob_reg_write(ctrl, j,
 				(oob[j + 0] << 24) |
 				(oob[j + 1] << 16) |
 				(oob[j + 2] <<  8) |
 				(oob[j + 3] <<  0));
+
+	/* handle the remaing bytes */
+	while (j < tbytes)
+		plast[k++] = oob[j++];
+
+	if (tbytes & 0x3)
+		oob_reg_write(ctrl, (tbytes & ~0x3), (__force u32)cpu_to_be32(last));
+
 	return tbytes;
 }
 
@@ -1271,7 +1301,17 @@ static void brcmnand_send_cmd(struct brcmnand_host *host, int cmd)
 
 	dev_dbg(ctrl->dev, "send native cmd %d addr 0x%llx\n", cmd, cmd_addr);
 
-	BUG_ON(ctrl->cmd_pending != 0);
+	/*
+	 * If we came here through _panic_write and there is a pending
+	 * command, try to wait for it. If it times out, rather than
+	 * hitting BUG_ON, just return so we don't crash while crashing.
+	 */
+	if (oops_in_progress) {
+		if (ctrl->cmd_pending &&
+			bcmnand_ctrl_poll_status(ctrl, NAND_CTRL_RDY, NAND_CTRL_RDY, 0))
+			return;
+	} else
+		BUG_ON(ctrl->cmd_pending != 0);
 	ctrl->cmd_pending = cmd;
 
 	ret = bcmnand_ctrl_poll_status(ctrl, NAND_CTRL_RDY, NAND_CTRL_RDY, 0);
@@ -2064,7 +2104,7 @@ static int brcmnand_set_cfg(struct brcmnand_host *host,
 
 	tmp = nand_readreg(ctrl, acc_control_offs);
 	tmp &= ~brcmnand_ecc_level_mask(ctrl);
-	tmp |= cfg->ecc_level << NAND_ACC_CONTROL_ECC_SHIFT;
+	tmp |= cfg->ecc_level << ctrl->ecc_level_shift;
 	tmp &= ~brcmnand_spare_area_mask(ctrl);
 	tmp |= cfg->spare_area_size;
 	nand_writereg(ctrl, acc_control_offs, tmp);
diff --git linux-libre-4.14.325-gnu1/drivers/net/arcnet/arcnet.c linux-libre-4.14.326-gnu1/drivers/net/arcnet/arcnet.c
index 998bc7bc7d1f..0f02d2b3438f 100644
--- linux-libre-4.14.325-gnu1/drivers/net/arcnet/arcnet.c
+++ linux-libre-4.14.326-gnu1/drivers/net/arcnet/arcnet.c
@@ -433,7 +433,7 @@ static void arcnet_reply_tasklet(unsigned long data)
 
 	ret = sock_queue_err_skb(sk, ackskb);
 	if (ret)
-		kfree_skb(ackskb);
+		dev_kfree_skb_irq(ackskb);
 
 	local_irq_enable();
 };
diff --git linux-libre-4.14.325-gnu1/drivers/net/can/usb/gs_usb.c linux-libre-4.14.326-gnu1/drivers/net/can/usb/gs_usb.c
index a43f25de8574..893fa5580c77 100644
--- linux-libre-4.14.325-gnu1/drivers/net/can/usb/gs_usb.c
+++ linux-libre-4.14.326-gnu1/drivers/net/can/usb/gs_usb.c
@@ -389,6 +389,9 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
 	}
 
 	if (hf->flags & GS_CAN_FLAG_OVERFLOW) {
+		stats->rx_over_errors++;
+		stats->rx_errors++;
+
 		skb = alloc_can_err_skb(netdev, &cf);
 		if (!skb)
 			goto resubmit_urb;
@@ -396,8 +399,6 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
 		cf->can_id |= CAN_ERR_CRTL;
 		cf->can_dlc = CAN_ERR_DLC;
 		cf->data[1] = CAN_ERR_CRTL_RX_OVERFLOW;
-		stats->rx_over_errors++;
-		stats->rx_errors++;
 		netif_rx(skb);
 	}
 
diff --git linux-libre-4.14.325-gnu1/drivers/net/ethernet/atheros/alx/ethtool.c linux-libre-4.14.326-gnu1/drivers/net/ethernet/atheros/alx/ethtool.c
index 2f4eabf652e8..51e5aa2c74b3 100644
--- linux-libre-4.14.325-gnu1/drivers/net/ethernet/atheros/alx/ethtool.c
+++ linux-libre-4.14.326-gnu1/drivers/net/ethernet/atheros/alx/ethtool.c
@@ -281,9 +281,8 @@ static void alx_get_ethtool_stats(struct net_device *netdev,
 	spin_lock(&alx->stats_lock);
 
 	alx_update_hw_stats(hw);
-	BUILD_BUG_ON(sizeof(hw->stats) - offsetof(struct alx_hw_stats, rx_ok) <
-		     ALX_NUM_STATS * sizeof(u64));
-	memcpy(data, &hw->stats.rx_ok, ALX_NUM_STATS * sizeof(u64));
+	BUILD_BUG_ON(sizeof(hw->stats) != ALX_NUM_STATS * sizeof(u64));
+	memcpy(data, &hw->stats, sizeof(hw->stats));
 
 	spin_unlock(&alx->stats_lock);
 }
diff --git linux-libre-4.14.325-gnu1/drivers/net/ethernet/atheros/atl1c/atl1c_main.c linux-libre-4.14.326-gnu1/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index 3615c2a06fda..6f5c7c1401ce 100644
--- linux-libre-4.14.325-gnu1/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ linux-libre-4.14.326-gnu1/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -2001,8 +2001,11 @@ static int atl1c_tso_csum(struct atl1c_adapter *adapter,
 			real_len = (((unsigned char *)ip_hdr(skb) - skb->data)
 					+ ntohs(ip_hdr(skb)->tot_len));
 
-			if (real_len < skb->len)
-				pskb_trim(skb, real_len);
+			if (real_len < skb->len) {
+				err = pskb_trim(skb, real_len);
+				if (err)
+					return err;
+			}
 
 			hdr_len = (skb_transport_offset(skb) + tcp_hdrlen(skb));
 			if (unlikely(skb->len == hdr_len)) {
diff --git linux-libre-4.14.325-gnu1/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c linux-libre-4.14.326-gnu1/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 73bb53d4d417..e67bf9453825 100644
--- linux-libre-4.14.325-gnu1/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ linux-libre-4.14.326-gnu1/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -14420,11 +14420,16 @@ static void bnx2x_io_resume(struct pci_dev *pdev)
 	bp->fw_seq = SHMEM_RD(bp, func_mb[BP_FW_MB_IDX(bp)].drv_mb_header) &
 							DRV_MSG_SEQ_NUMBER_MASK;
 
-	if (netif_running(dev))
-		bnx2x_nic_load(bp, LOAD_NORMAL);
+	if (netif_running(dev)) {
+		if (bnx2x_nic_load(bp, LOAD_NORMAL)) {
+			netdev_err(bp->dev, "Error during driver initialization, try unloading/reloading the driver\n");
+			goto done;
+		}
+	}
 
 	netif_device_attach(dev);
 
+done:
 	rtnl_unlock();
 }
 
diff --git linux-libre-4.14.325-gnu1/drivers/net/ethernet/intel/igb/igb.h linux-libre-4.14.326-gnu1/drivers/net/ethernet/intel/igb/igb.h
index 1113bf322f45..a1e924391ae5 100644
--- linux-libre-4.14.325-gnu1/drivers/net/ethernet/intel/igb/igb.h
+++ linux-libre-4.14.326-gnu1/drivers/net/ethernet/intel/igb/igb.h
@@ -52,11 +52,11 @@ struct igb_adapter;
 /* TX/RX descriptor defines */
 #define IGB_DEFAULT_TXD		256
 #define IGB_DEFAULT_TX_WORK	128
-#define IGB_MIN_TXD		80
+#define IGB_MIN_TXD		64
 #define IGB_MAX_TXD		4096
 
 #define IGB_DEFAULT_RXD		256
-#define IGB_MIN_RXD		80
+#define IGB_MIN_RXD		64
 #define IGB_MAX_RXD		4096
 
 #define IGB_DEFAULT_ITR		3 /* dynamic */
diff --git linux-libre-4.14.325-gnu1/drivers/net/ethernet/intel/igb/igb_main.c linux-libre-4.14.326-gnu1/drivers/net/ethernet/intel/igb/igb_main.c
index d7b531eae819..d679b31c9a13 100644
--- linux-libre-4.14.325-gnu1/drivers/net/ethernet/intel/igb/igb_main.c
+++ linux-libre-4.14.326-gnu1/drivers/net/ethernet/intel/igb/igb_main.c
@@ -3026,8 +3026,9 @@ static void igb_probe_vfs(struct igb_adapter *adapter)
 	struct pci_dev *pdev = adapter->pdev;
 	struct e1000_hw *hw = &adapter->hw;
 
-	/* Virtualization features not supported on i210 family. */
-	if ((hw->mac.type == e1000_i210) || (hw->mac.type == e1000_i211))
+	/* Virtualization features not supported on i210 and 82580 family. */
+	if ((hw->mac.type == e1000_i210) || (hw->mac.type == e1000_i211) ||
+	    (hw->mac.type == e1000_82580))
 		return;
 
 	/* Of the below we really only want the effect of getting
@@ -3856,6 +3857,10 @@ void igb_configure_rx_ring(struct igb_adapter *adapter,
 static void igb_set_rx_buffer_len(struct igb_adapter *adapter,
 				  struct igb_ring *rx_ring)
 {
+#if (PAGE_SIZE < 8192)
+	struct e1000_hw *hw = &adapter->hw;
+#endif
+
 	/* set build_skb and buffer size flags */
 	clear_ring_build_skb_enabled(rx_ring);
 	clear_ring_uses_large_buffer(rx_ring);
@@ -3866,10 +3871,9 @@ static void igb_set_rx_buffer_len(struct igb_adapter *adapter,
 	set_ring_build_skb_enabled(rx_ring);
 
 #if (PAGE_SIZE < 8192)
-	if (adapter->max_frame_size <= IGB_MAX_FRAME_BUILD_SKB)
-		return;
-
-	set_ring_uses_large_buffer(rx_ring);
+	if (adapter->max_frame_size > IGB_MAX_FRAME_BUILD_SKB ||
+	    rd32(E1000_RCTL) & E1000_RCTL_SBP)
+		set_ring_uses_large_buffer(rx_ring);
 #endif
 }
 
diff --git linux-libre-4.14.325-gnu1/drivers/net/ethernet/intel/igbvf/igbvf.h linux-libre-4.14.326-gnu1/drivers/net/ethernet/intel/igbvf/igbvf.h
index bf69f01f8467..f69a7787a590 100644
--- linux-libre-4.14.325-gnu1/drivers/net/ethernet/intel/igbvf/igbvf.h
+++ linux-libre-4.14.326-gnu1/drivers/net/ethernet/intel/igbvf/igbvf.h
@@ -62,11 +62,11 @@ enum latency_range {
 /* Tx/Rx descriptor defines */
 #define IGBVF_DEFAULT_TXD	256
 #define IGBVF_MAX_TXD		4096
-#define IGBVF_MIN_TXD		80
+#define IGBVF_MIN_TXD		64
 
 #define IGBVF_DEFAULT_RXD	256
 #define IGBVF_MAX_RXD		4096
-#define IGBVF_MIN_RXD		80
+#define IGBVF_MIN_RXD		64
 
 #define IGBVF_MIN_ITR_USECS	10 /* 100000 irq/sec */
 #define IGBVF_MAX_ITR_USECS	10000 /* 100    irq/sec */
diff --git linux-libre-4.14.325-gnu1/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c linux-libre-4.14.326-gnu1/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
index ad51b521e693..72df6544d419 100644
--- linux-libre-4.14.325-gnu1/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
+++ linux-libre-4.14.326-gnu1/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
@@ -868,6 +868,7 @@ static int ixgbe_ptp_set_timestamp_mode(struct ixgbe_adapter *adapter,
 	u32 tsync_tx_ctl = IXGBE_TSYNCTXCTL_ENABLED;
 	u32 tsync_rx_ctl = IXGBE_TSYNCRXCTL_ENABLED;
 	u32 tsync_rx_mtrl = PTP_EV_PORT << 16;
+	u32 aflags = adapter->flags;
 	bool is_l2 = false;
 	u32 regval;
 
@@ -888,20 +889,20 @@ static int ixgbe_ptp_set_timestamp_mode(struct ixgbe_adapter *adapter,
 	case HWTSTAMP_FILTER_NONE:
 		tsync_rx_ctl = 0;
 		tsync_rx_mtrl = 0;
-		adapter->flags &= ~(IXGBE_FLAG_RX_HWTSTAMP_ENABLED |
-				    IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER);
+		aflags &= ~(IXGBE_FLAG_RX_HWTSTAMP_ENABLED |
+			    IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER);
 		break;
 	case HWTSTAMP_FILTER_PTP_V1_L4_SYNC:
 		tsync_rx_ctl |= IXGBE_TSYNCRXCTL_TYPE_L4_V1;
 		tsync_rx_mtrl |= IXGBE_RXMTRL_V1_SYNC_MSG;
-		adapter->flags |= (IXGBE_FLAG_RX_HWTSTAMP_ENABLED |
-				   IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER);
+		aflags |= (IXGBE_FLAG_RX_HWTSTAMP_ENABLED |
+			   IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER);
 		break;
 	case HWTSTAMP_FILTER_PTP_V1_L4_DELAY_REQ:
 		tsync_rx_ctl |= IXGBE_TSYNCRXCTL_TYPE_L4_V1;
 		tsync_rx_mtrl |= IXGBE_RXMTRL_V1_DELAY_REQ_MSG;
-		adapter->flags |= (IXGBE_FLAG_RX_HWTSTAMP_ENABLED |
-				   IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER);
+		aflags |= (IXGBE_FLAG_RX_HWTSTAMP_ENABLED |
+			   IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER);
 		break;
 	case HWTSTAMP_FILTER_PTP_V2_EVENT:
 	case HWTSTAMP_FILTER_PTP_V2_L2_EVENT:
@@ -915,8 +916,8 @@ static int ixgbe_ptp_set_timestamp_mode(struct ixgbe_adapter *adapter,
 		tsync_rx_ctl |= IXGBE_TSYNCRXCTL_TYPE_EVENT_V2;
 		is_l2 = true;
 		config->rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT;
-		adapter->flags |= (IXGBE_FLAG_RX_HWTSTAMP_ENABLED |
-				   IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER);
+		aflags |= (IXGBE_FLAG_RX_HWTSTAMP_ENABLED |
+			   IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER);
 		break;
 	case HWTSTAMP_FILTER_PTP_V1_L4_EVENT:
 	case HWTSTAMP_FILTER_NTP_ALL:
@@ -927,7 +928,7 @@ static int ixgbe_ptp_set_timestamp_mode(struct ixgbe_adapter *adapter,
 		if (hw->mac.type >= ixgbe_mac_X550) {
 			tsync_rx_ctl |= IXGBE_TSYNCRXCTL_TYPE_ALL;
 			config->rx_filter = HWTSTAMP_FILTER_ALL;
-			adapter->flags |= IXGBE_FLAG_RX_HWTSTAMP_ENABLED;
+			aflags |= IXGBE_FLAG_RX_HWTSTAMP_ENABLED;
 			break;
 		}
 		/* fall through */
@@ -938,8 +939,6 @@ static int ixgbe_ptp_set_timestamp_mode(struct ixgbe_adapter *adapter,
 		 * Delay_Req messages and hardware does not support
 		 * timestamping all packets => return error
 		 */
-		adapter->flags &= ~(IXGBE_FLAG_RX_HWTSTAMP_ENABLED |
-				    IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER);
 		config->rx_filter = HWTSTAMP_FILTER_NONE;
 		return -ERANGE;
 	}
@@ -971,8 +970,8 @@ static int ixgbe_ptp_set_timestamp_mode(struct ixgbe_adapter *adapter,
 			       IXGBE_TSYNCRXCTL_TYPE_ALL |
 			       IXGBE_TSYNCRXCTL_TSIP_UT_EN;
 		config->rx_filter = HWTSTAMP_FILTER_ALL;
-		adapter->flags |= IXGBE_FLAG_RX_HWTSTAMP_ENABLED;
-		adapter->flags &= ~IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER;
+		aflags |= IXGBE_FLAG_RX_HWTSTAMP_ENABLED;
+		aflags &= ~IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER;
 		is_l2 = true;
 		break;
 	default:
@@ -1005,6 +1004,9 @@ static int ixgbe_ptp_set_timestamp_mode(struct ixgbe_adapter *adapter,
 
 	IXGBE_WRITE_FLUSH(hw);
 
+	/* configure adapter flags only when HW is actually configured */
+	adapter->flags = aflags;
+
 	/* clear TX/RX time stamp registers, just to be sure */
 	ixgbe_ptp_clear_tx_timestamp(adapter);
 	IXGBE_READ_REG(hw, IXGBE_RXSTMPH);
diff --git linux-libre-4.14.325-gnu1/drivers/net/ethernet/mediatek/mtk_eth_soc.c linux-libre-4.14.326-gnu1/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index fb48efa70797..ff7c267df6e4 100644
--- linux-libre-4.14.325-gnu1/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ linux-libre-4.14.326-gnu1/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -1625,6 +1625,9 @@ static int mtk_hwlro_get_fdir_all(struct net_device *dev,
 	int i;
 
 	for (i = 0; i < MTK_MAX_LRO_IP_CNT; i++) {
+		if (cnt == cmd->rule_cnt)
+			return -EMSGSIZE;
+
 		if (mac->hwlro_ip[i]) {
 			rule_locs[cnt] = i;
 			cnt++;
diff --git linux-libre-4.14.325-gnu1/drivers/net/macsec.c linux-libre-4.14.326-gnu1/drivers/net/macsec.c
index 6b10d68e3e53..577b7804ed66 100644
--- linux-libre-4.14.325-gnu1/drivers/net/macsec.c
+++ linux-libre-4.14.326-gnu1/drivers/net/macsec.c
@@ -1311,8 +1311,7 @@ static struct crypto_aead *macsec_alloc_tfm(char *key, int key_len, int icv_len)
 	struct crypto_aead *tfm;
 	int ret;
 
-	/* Pick a sync gcm(aes) cipher to ensure order is preserved. */
-	tfm = crypto_alloc_aead("gcm(aes)", 0, CRYPTO_ALG_ASYNC);
+	tfm = crypto_alloc_aead("gcm(aes)", 0, 0);
 
 	if (IS_ERR(tfm))
 		return tfm;
diff --git linux-libre-4.14.325-gnu1/drivers/net/usb/qmi_wwan.c linux-libre-4.14.326-gnu1/drivers/net/usb/qmi_wwan.c
index 8cdf822dfda0..880aa7f6a779 100644
--- linux-libre-4.14.325-gnu1/drivers/net/usb/qmi_wwan.c
+++ linux-libre-4.14.326-gnu1/drivers/net/usb/qmi_wwan.c
@@ -1365,6 +1365,7 @@ static const struct usb_device_id products[] = {
 	{QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)},	/* Quectel EG91 */
 	{QMI_QUIRK_SET_DTR(0x2c7c, 0x0195, 4)},	/* Quectel EG95 */
 	{QMI_FIXED_INTF(0x2c7c, 0x0296, 4)},	/* Quectel BG96 */
+	{QMI_QUIRK_SET_DTR(0x2c7c, 0x030e, 4)},	/* Quectel EM05GV2 */
 	{QMI_QUIRK_SET_DTR(0x2cb7, 0x0104, 4)},	/* Fibocom NL678 series */
 	{QMI_FIXED_INTF(0x0489, 0xe0b4, 0)},	/* Foxconn T77W968 LTE */
 	{QMI_FIXED_INTF(0x0489, 0xe0b5, 0)},	/* Foxconn T77W968 LTE with eSIM support*/
diff --git linux-libre-4.14.325-gnu1/drivers/net/wireless/ath/ath10k/pci.c linux-libre-4.14.326-gnu1/drivers/net/wireless/ath/ath10k/pci.c
index 95c076758052..259d01bbf2d0 100644
--- linux-libre-4.14.325-gnu1/drivers/net/wireless/ath/ath10k/pci.c
+++ linux-libre-4.14.326-gnu1/drivers/net/wireless/ath/ath10k/pci.c
@@ -1661,8 +1661,9 @@ static int ath10k_pci_hif_start(struct ath10k *ar)
 	ath10k_pci_irq_enable(ar);
 	ath10k_pci_rx_post(ar);
 
-	pcie_capability_write_word(ar_pci->pdev, PCI_EXP_LNKCTL,
-				   ar_pci->link_ctl);
+	pcie_capability_clear_and_set_word(ar_pci->pdev, PCI_EXP_LNKCTL,
+					   PCI_EXP_LNKCTL_ASPMC,
+					   ar_pci->link_ctl & PCI_EXP_LNKCTL_ASPMC);
 
 	return 0;
 }
@@ -2516,8 +2517,8 @@ static int ath10k_pci_hif_power_up(struct ath10k *ar)
 
 	pcie_capability_read_word(ar_pci->pdev, PCI_EXP_LNKCTL,
 				  &ar_pci->link_ctl);
-	pcie_capability_write_word(ar_pci->pdev, PCI_EXP_LNKCTL,
-				   ar_pci->link_ctl & ~PCI_EXP_LNKCTL_ASPMC);
+	pcie_capability_clear_word(ar_pci->pdev, PCI_EXP_LNKCTL,
+				   PCI_EXP_LNKCTL_ASPMC);
 
 	/*
 	 * Bring the target up cleanly.
diff --git linux-libre-4.14.325-gnu1/drivers/net/wireless/ath/ath9k/ahb.c linux-libre-4.14.326-gnu1/drivers/net/wireless/ath/ath9k/ahb.c
index 2bd982c3a479..375628dc654e 100644
--- linux-libre-4.14.325-gnu1/drivers/net/wireless/ath/ath9k/ahb.c
+++ linux-libre-4.14.326-gnu1/drivers/net/wireless/ath/ath9k/ahb.c
@@ -135,8 +135,8 @@ static int ath_ahb_probe(struct platform_device *pdev)
 
 	ah = sc->sc_ah;
 	ath9k_hw_name(ah, hw_name, sizeof(hw_name));
-	wiphy_info(hw->wiphy, "%s mem=0x%lx, irq=%d\n",
-		   hw_name, (unsigned long)mem, irq);
+	wiphy_info(hw->wiphy, "%s mem=0x%p, irq=%d\n",
+		   hw_name, mem, irq);
 
 	return 0;
 
diff --git linux-libre-4.14.325-gnu1/drivers/net/wireless/ath/ath9k/htc_drv_debug.c linux-libre-4.14.326-gnu1/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
index dc79afd7e151..b711b2e1ce93 100644
--- linux-libre-4.14.325-gnu1/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
+++ linux-libre-4.14.326-gnu1/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
@@ -491,7 +491,7 @@ int ath9k_htc_init_debug(struct ath_hw *ah)
 
 	priv->debug.debugfs_phy = debugfs_create_dir(KBUILD_MODNAME,
 					     priv->hw->wiphy->debugfsdir);
-	if (!priv->debug.debugfs_phy)
+	if (IS_ERR(priv->debug.debugfs_phy))
 		return -ENOMEM;
 
 	ath9k_cmn_spectral_init_debug(&priv->spec_priv, priv->debug.debugfs_phy);
diff --git linux-libre-4.14.325-gnu1/drivers/net/wireless/ath/ath9k/pci.c linux-libre-4.14.326-gnu1/drivers/net/wireless/ath/ath9k/pci.c
index 223606311261..7ab050cad4a2 100644
--- linux-libre-4.14.325-gnu1/drivers/net/wireless/ath/ath9k/pci.c
+++ linux-libre-4.14.326-gnu1/drivers/net/wireless/ath/ath9k/pci.c
@@ -975,8 +975,8 @@ static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	}
 
 	ath9k_hw_name(sc->sc_ah, hw_name, sizeof(hw_name));
-	wiphy_info(hw->wiphy, "%s mem=0x%lx, irq=%d\n",
-		   hw_name, (unsigned long)sc->mem, pdev->irq);
+	wiphy_info(hw->wiphy, "%s mem=0x%p, irq=%d\n",
+		   hw_name, sc->mem, pdev->irq);
 
 	return 0;
 
diff --git linux-libre-4.14.325-gnu1/drivers/net/wireless/ath/ath9k/wmi.c linux-libre-4.14.326-gnu1/drivers/net/wireless/ath/ath9k/wmi.c
index 7b4e92218119..e0ecd2e86747 100644
--- linux-libre-4.14.325-gnu1/drivers/net/wireless/ath/ath9k/wmi.c
+++ linux-libre-4.14.326-gnu1/drivers/net/wireless/ath/ath9k/wmi.c
@@ -279,7 +279,8 @@ int ath9k_wmi_connect(struct htc_target *htc, struct wmi *wmi,
 
 static int ath9k_wmi_cmd_issue(struct wmi *wmi,
 			       struct sk_buff *skb,
-			       enum wmi_cmd_id cmd, u16 len)
+			       enum wmi_cmd_id cmd, u16 len,
+			       u8 *rsp_buf, u32 rsp_len)
 {
 	struct wmi_cmd_hdr *hdr;
 	unsigned long flags;
@@ -289,6 +290,11 @@ static int ath9k_wmi_cmd_issue(struct wmi *wmi,
 	hdr->seq_no = cpu_to_be16(++wmi->tx_seq_id);
 
 	spin_lock_irqsave(&wmi->wmi_lock, flags);
+
+	/* record the rsp buffer and length */
+	wmi->cmd_rsp_buf = rsp_buf;
+	wmi->cmd_rsp_len = rsp_len;
+
 	wmi->last_seq_id = wmi->tx_seq_id;
 	spin_unlock_irqrestore(&wmi->wmi_lock, flags);
 
@@ -329,11 +335,7 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
 		goto out;
 	}
 
-	/* record the rsp buffer and length */
-	wmi->cmd_rsp_buf = rsp_buf;
-	wmi->cmd_rsp_len = rsp_len;
-
-	ret = ath9k_wmi_cmd_issue(wmi, skb, cmd_id, cmd_len);
+	ret = ath9k_wmi_cmd_issue(wmi, skb, cmd_id, cmd_len, rsp_buf, rsp_len);
 	if (ret)
 		goto out;
 
diff --git linux-libre-4.14.325-gnu1/drivers/net/wireless/marvell/mwifiex/debugfs.c linux-libre-4.14.326-gnu1/drivers/net/wireless/marvell/mwifiex/debugfs.c
index 49ca84ef1a99..b843be87112c 100644
--- linux-libre-4.14.325-gnu1/drivers/net/wireless/marvell/mwifiex/debugfs.c
+++ linux-libre-4.14.326-gnu1/drivers/net/wireless/marvell/mwifiex/debugfs.c
@@ -288,8 +288,11 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf,
 	if (!p)
 		return -ENOMEM;
 
-	if (!priv || !priv->hist_data)
-		return -EFAULT;
+	if (!priv || !priv->hist_data) {
+		ret = -EFAULT;
+		goto free_and_exit;
+	}
+
 	phist_data = priv->hist_data;
 
 	p += sprintf(p, "\n"
@@ -344,6 +347,8 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf,
 	ret = simple_read_from_buffer(ubuf, count, ppos, (char *)page,
 				      (unsigned long)p - page);
 
+free_and_exit:
+	free_page(page);
 	return ret;
 }
 
diff --git linux-libre-4.14.325-gnu1/drivers/net/wireless/marvell/mwifiex/sta_rx.c linux-libre-4.14.326-gnu1/drivers/net/wireless/marvell/mwifiex/sta_rx.c
index 00fcbda09349..f3c6daeba1b8 100644
--- linux-libre-4.14.325-gnu1/drivers/net/wireless/marvell/mwifiex/sta_rx.c
+++ linux-libre-4.14.326-gnu1/drivers/net/wireless/marvell/mwifiex/sta_rx.c
@@ -98,6 +98,15 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv,
 	rx_pkt_len = le16_to_cpu(local_rx_pd->rx_pkt_length);
 	rx_pkt_hdr = (void *)local_rx_pd + rx_pkt_off;
 
+	if (sizeof(*rx_pkt_hdr) + rx_pkt_off > skb->len) {
+		mwifiex_dbg(priv->adapter, ERROR,
+			    "wrong rx packet offset: len=%d, rx_pkt_off=%d\n",
+			    skb->len, rx_pkt_off);
+		priv->stats.rx_dropped++;
+		dev_kfree_skb_any(skb);
+		return -1;
+	}
+
 	if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,
 		     sizeof(bridge_tunnel_header))) ||
 	    (!memcmp(&rx_pkt_hdr->rfc1042_hdr, rfc1042_header,
@@ -203,7 +212,8 @@ int mwifiex_process_sta_rx_packet(struct mwifiex_private *priv,
 
 	rx_pkt_hdr = (void *)local_rx_pd + rx_pkt_offset;
 
-	if ((rx_pkt_offset + rx_pkt_length) > (u16) skb->len) {
+	if ((rx_pkt_offset + rx_pkt_length) > skb->len ||
+	    sizeof(rx_pkt_hdr->eth803_hdr) + rx_pkt_offset > skb->len) {
 		mwifiex_dbg(adapter, ERROR,
 			    "wrong rx packet: len=%d, rx_pkt_offset=%d, rx_pkt_length=%d\n",
 			    skb->len, rx_pkt_offset, rx_pkt_length);
diff --git linux-libre-4.14.325-gnu1/drivers/net/wireless/marvell/mwifiex/tdls.c linux-libre-4.14.326-gnu1/drivers/net/wireless/marvell/mwifiex/tdls.c
index 80d20fb6f348..a69b4983747f 100644
--- linux-libre-4.14.325-gnu1/drivers/net/wireless/marvell/mwifiex/tdls.c
+++ linux-libre-4.14.326-gnu1/drivers/net/wireless/marvell/mwifiex/tdls.c
@@ -737,6 +737,7 @@ mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv,
 	int ret;
 	u16 capab;
 	struct ieee80211_ht_cap *ht_cap;
+	unsigned int extra;
 	u8 radio, *pos;
 
 	capab = priv->curr_bss_params.bss_descriptor.cap_info_bitmap;
@@ -755,7 +756,10 @@ mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv,
 
 	switch (action_code) {
 	case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
-		skb_put(skb, sizeof(mgmt->u.action.u.tdls_discover_resp) + 1);
+		/* See the layout of 'struct ieee80211_mgmt'. */
+		extra = sizeof(mgmt->u.action.u.tdls_discover_resp) +
+			sizeof(mgmt->u.action.category);
+		skb_put(skb, extra);
 		mgmt->u.action.category = WLAN_CATEGORY_PUBLIC;
 		mgmt->u.action.u.tdls_discover_resp.action_code =
 					      WLAN_PUB_ACTION_TDLS_DISCOVER_RES;
@@ -764,8 +768,7 @@ mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv,
 		mgmt->u.action.u.tdls_discover_resp.capability =
 							     cpu_to_le16(capab);
 		/* move back for addr4 */
-		memmove(pos + ETH_ALEN, &mgmt->u.action.category,
-			sizeof(mgmt->u.action.u.tdls_discover_resp));
+		memmove(pos + ETH_ALEN, &mgmt->u.action, extra);
 		/* init address 4 */
 		memcpy(pos, bc_addr, ETH_ALEN);
 
diff --git linux-libre-4.14.325-gnu1/drivers/net/wireless/marvell/mwifiex/uap_txrx.c linux-libre-4.14.326-gnu1/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
index 1e6a62c69ac5..a887d7a9b7c0 100644
--- linux-libre-4.14.325-gnu1/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
+++ linux-libre-4.14.326-gnu1/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
@@ -116,6 +116,16 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,
 		return;
 	}
 
+	if (sizeof(*rx_pkt_hdr) +
+	    le16_to_cpu(uap_rx_pd->rx_pkt_offset) > skb->len) {
+		mwifiex_dbg(adapter, ERROR,
+			    "wrong rx packet offset: len=%d,rx_pkt_offset=%d\n",
+			    skb->len, le16_to_cpu(uap_rx_pd->rx_pkt_offset));
+		priv->stats.rx_dropped++;
+		dev_kfree_skb_any(skb);
+		return;
+	}
+
 	if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,
 		     sizeof(bridge_tunnel_header))) ||
 	    (!memcmp(&rx_pkt_hdr->rfc1042_hdr, rfc1042_header,
@@ -256,7 +266,15 @@ int mwifiex_handle_uap_rx_forward(struct mwifiex_private *priv,
 
 	if (is_multicast_ether_addr(ra)) {
 		skb_uap = skb_copy(skb, GFP_ATOMIC);
-		mwifiex_uap_queue_bridged_pkt(priv, skb_uap);
+		if (likely(skb_uap)) {
+			mwifiex_uap_queue_bridged_pkt(priv, skb_uap);
+		} else {
+			mwifiex_dbg(adapter, ERROR,
+				    "failed to copy skb for uAP\n");
+			priv->stats.rx_dropped++;
+			dev_kfree_skb_any(skb);
+			return -1;
+		}
 	} else {
 		if (mwifiex_get_sta_entry(priv, ra)) {
 			/* Requeue Intra-BSS packet */
@@ -385,6 +403,16 @@ int mwifiex_process_uap_rx_packet(struct mwifiex_private *priv,
 	rx_pkt_type = le16_to_cpu(uap_rx_pd->rx_pkt_type);
 	rx_pkt_hdr = (void *)uap_rx_pd + le16_to_cpu(uap_rx_pd->rx_pkt_offset);
 
+	if (le16_to_cpu(uap_rx_pd->rx_pkt_offset) +
+	    sizeof(rx_pkt_hdr->eth803_hdr) > skb->len) {
+		mwifiex_dbg(adapter, ERROR,
+			    "wrong rx packet for struct ethhdr: len=%d, offset=%d\n",
+			    skb->len, le16_to_cpu(uap_rx_pd->rx_pkt_offset));
+		priv->stats.rx_dropped++;
+		dev_kfree_skb_any(skb);
+		return 0;
+	}
+
 	ether_addr_copy(ta, rx_pkt_hdr->eth803_hdr.h_source);
 
 	if ((le16_to_cpu(uap_rx_pd->rx_pkt_offset) +
diff --git linux-libre-4.14.325-gnu1/drivers/net/wireless/marvell/mwifiex/util.c linux-libre-4.14.326-gnu1/drivers/net/wireless/marvell/mwifiex/util.c
index 51ccf10f4413..4fccdf01b8a0 100644
--- linux-libre-4.14.325-gnu1/drivers/net/wireless/marvell/mwifiex/util.c
+++ linux-libre-4.14.326-gnu1/drivers/net/wireless/marvell/mwifiex/util.c
@@ -403,11 +403,15 @@ mwifiex_process_mgmt_packet(struct mwifiex_private *priv,
 	}
 
 	rx_pd = (struct rxpd *)skb->data;
+	pkt_len = le16_to_cpu(rx_pd->rx_pkt_length);
+	if (pkt_len < sizeof(struct ieee80211_hdr) + sizeof(pkt_len)) {
+		mwifiex_dbg(priv->adapter, ERROR, "invalid rx_pkt_length");
+		return -1;
+	}
 
 	skb_pull(skb, le16_to_cpu(rx_pd->rx_pkt_offset));
 	skb_pull(skb, sizeof(pkt_len));
-
-	pkt_len = le16_to_cpu(rx_pd->rx_pkt_length);
+	pkt_len -= sizeof(pkt_len);
 
 	ieee_hdr = (void *)skb->data;
 	if (ieee80211_is_mgmt(ieee_hdr->frame_control)) {
@@ -420,7 +424,7 @@ mwifiex_process_mgmt_packet(struct mwifiex_private *priv,
 		skb->data + sizeof(struct ieee80211_hdr),
 		pkt_len - sizeof(struct ieee80211_hdr));
 
-	pkt_len -= ETH_ALEN + sizeof(pkt_len);
+	pkt_len -= ETH_ALEN;
 	rx_pd->rx_pkt_length = cpu_to_le16(pkt_len);
 
 	cfg80211_rx_mgmt(&priv->wdev, priv->roc_cfg.chan.center_freq,
diff --git linux-libre-4.14.325-gnu1/drivers/ntb/ntb_transport.c linux-libre-4.14.326-gnu1/drivers/ntb/ntb_transport.c
index a58ced5d6043..4e1a061fcc14 100644
--- linux-libre-4.14.325-gnu1/drivers/ntb/ntb_transport.c
+++ linux-libre-4.14.326-gnu1/drivers/ntb/ntb_transport.c
@@ -741,7 +741,7 @@ static int ntb_set_mw(struct ntb_transport_ctx *nt, int num_mw,
 	return 0;
 }
 
-static void ntb_qp_link_down_reset(struct ntb_transport_qp *qp)
+static void ntb_qp_link_context_reset(struct ntb_transport_qp *qp)
 {
 	qp->link_is_up = false;
 	qp->active = false;
@@ -764,6 +764,13 @@ static void ntb_qp_link_down_reset(struct ntb_transport_qp *qp)
 	qp->tx_async = 0;
 }
 
+static void ntb_qp_link_down_reset(struct ntb_transport_qp *qp)
+{
+	ntb_qp_link_context_reset(qp);
+	if (qp->remote_rx_info)
+		qp->remote_rx_info->entry = qp->rx_max_entry - 1;
+}
+
 static void ntb_qp_link_cleanup(struct ntb_transport_qp *qp)
 {
 	struct ntb_transport_ctx *nt = qp->transport;
@@ -988,7 +995,7 @@ static int ntb_transport_init_queue(struct ntb_transport_ctx *nt,
 	qp->ndev = nt->ndev;
 	qp->client_ready = false;
 	qp->event_handler = NULL;
-	ntb_qp_link_down_reset(qp);
+	ntb_qp_link_context_reset(qp);
 
 	if (mw_num < qp_count % mw_count)
 		num_qps_mw = qp_count / mw_count + 1;
@@ -2046,9 +2053,13 @@ int ntb_transport_tx_enqueue(struct ntb_transport_qp *qp, void *cb, void *data,
 	struct ntb_queue_entry *entry;
 	int rc;
 
-	if (!qp || !qp->link_is_up || !len)
+	if (!qp || !len)
 		return -EINVAL;
 
+	/* If the qp link is down already, just ignore. */
+	if (!qp->link_is_up)
+		return 0;
+
 	entry = ntb_list_rm(&qp->ntb_tx_free_q_lock, &qp->tx_free_q);
 	if (!entry) {
 		qp->tx_err_no_buf++;
@@ -2188,7 +2199,7 @@ unsigned int ntb_transport_tx_free_entry(struct ntb_transport_qp *qp)
 	unsigned int head = qp->tx_index;
 	unsigned int tail = qp->remote_rx_info->entry;
 
-	return tail > head ? tail - head : qp->tx_max_entry + tail - head;
+	return tail >= head ? tail - head : qp->tx_max_entry + tail - head;
 }
 EXPORT_SYMBOL_GPL(ntb_transport_tx_free_entry);
 
diff --git linux-libre-4.14.325-gnu1/drivers/of/unittest.c linux-libre-4.14.326-gnu1/drivers/of/unittest.c
index 55c98f119df2..89d1011d5b32 100644
--- linux-libre-4.14.325-gnu1/drivers/of/unittest.c
+++ linux-libre-4.14.326-gnu1/drivers/of/unittest.c
@@ -51,7 +51,7 @@ static void __init of_unittest_find_node_by_name(void)
 
 	np = of_find_node_by_path("/testcase-data");
 	name = kasprintf(GFP_KERNEL, "%pOF", np);
-	unittest(np && !strcmp("/testcase-data", name),
+	unittest(np && name && !strcmp("/testcase-data", name),
 		"find /testcase-data failed\n");
 	of_node_put(np);
 	kfree(name);
@@ -62,14 +62,14 @@ static void __init of_unittest_find_node_by_name(void)
 
 	np = of_find_node_by_path("/testcase-data/phandle-tests/consumer-a");
 	name = kasprintf(GFP_KERNEL, "%pOF", np);
-	unittest(np && !strcmp("/testcase-data/phandle-tests/consumer-a", name),
+	unittest(np && name && !strcmp("/testcase-data/phandle-tests/consumer-a", name),
 		"find /testcase-data/phandle-tests/consumer-a failed\n");
 	of_node_put(np);
 	kfree(name);
 
 	np = of_find_node_by_path("testcase-alias");
 	name = kasprintf(GFP_KERNEL, "%pOF", np);
-	unittest(np && !strcmp("/testcase-data", name),
+	unittest(np && name && !strcmp("/testcase-data", name),
 		"find testcase-alias failed\n");
 	of_node_put(np);
 	kfree(name);
@@ -80,7 +80,7 @@ static void __init of_unittest_find_node_by_name(void)
 
 	np = of_find_node_by_path("testcase-alias/phandle-tests/consumer-a");
 	name = kasprintf(GFP_KERNEL, "%pOF", np);
-	unittest(np && !strcmp("/testcase-data/phandle-tests/consumer-a", name),
+	unittest(np && name && !strcmp("/testcase-data/phandle-tests/consumer-a", name),
 		"find testcase-alias/phandle-tests/consumer-a failed\n");
 	of_node_put(np);
 	kfree(name);
@@ -966,6 +966,8 @@ static void attach_node_and_children(struct device_node *np)
 	const char *full_name;
 
 	full_name = kasprintf(GFP_KERNEL, "%pOF", np);
+	if (!full_name)
+		return;
 
 	if (!strcmp(full_name, "/__local_fixups__") ||
 	    !strcmp(full_name, "/__fixups__")) {
diff --git linux-libre-4.14.325-gnu1/drivers/parisc/led.c linux-libre-4.14.326-gnu1/drivers/parisc/led.c
index 6c25796fcfa9..acd1dbb6adfb 100644
--- linux-libre-4.14.325-gnu1/drivers/parisc/led.c
+++ linux-libre-4.14.326-gnu1/drivers/parisc/led.c
@@ -60,8 +60,8 @@
 static int led_type __read_mostly = -1;
 static unsigned char lastleds;	/* LED state from most recent update */
 static unsigned int led_heartbeat __read_mostly = 1;
-static unsigned int led_diskio    __read_mostly = 1;
-static unsigned int led_lanrxtx   __read_mostly = 1;
+static unsigned int led_diskio    __read_mostly;
+static unsigned int led_lanrxtx   __read_mostly;
 static char lcd_text[32]          __read_mostly;
 static char lcd_text_default[32]  __read_mostly;
 static int  lcd_no_led_support    __read_mostly = 0; /* KittyHawk doesn't support LED on its LCD */
diff --git linux-libre-4.14.325-gnu1/drivers/pci/hotplug/pciehp_hpc.c linux-libre-4.14.326-gnu1/drivers/pci/hotplug/pciehp_hpc.c
index c2dd297d4007..2ec015d1f671 100644
--- linux-libre-4.14.325-gnu1/drivers/pci/hotplug/pciehp_hpc.c
+++ linux-libre-4.14.326-gnu1/drivers/pci/hotplug/pciehp_hpc.c
@@ -338,17 +338,11 @@ int pciehp_check_link_status(struct controller *ctrl)
 static int __pciehp_link_set(struct controller *ctrl, bool enable)
 {
 	struct pci_dev *pdev = ctrl_dev(ctrl);
-	u16 lnk_ctrl;
 
-	pcie_capability_read_word(pdev, PCI_EXP_LNKCTL, &lnk_ctrl);
+	pcie_capability_clear_and_set_word(pdev, PCI_EXP_LNKCTL,
+					   PCI_EXP_LNKCTL_LD,
+					   enable ? 0 : PCI_EXP_LNKCTL_LD);
 
-	if (enable)
-		lnk_ctrl &= ~PCI_EXP_LNKCTL_LD;
-	else
-		lnk_ctrl |= PCI_EXP_LNKCTL_LD;
-
-	pcie_capability_write_word(pdev, PCI_EXP_LNKCTL, lnk_ctrl);
-	ctrl_dbg(ctrl, "%s: lnk_ctrl = %x\n", __func__, lnk_ctrl);
 	return 0;
 }
 
diff --git linux-libre-4.14.325-gnu1/drivers/pinctrl/pinctrl-amd.c linux-libre-4.14.326-gnu1/drivers/pinctrl/pinctrl-amd.c
index fbec8a07e942..509ba4bceefc 100644
--- linux-libre-4.14.325-gnu1/drivers/pinctrl/pinctrl-amd.c
+++ linux-libre-4.14.326-gnu1/drivers/pinctrl/pinctrl-amd.c
@@ -609,7 +609,7 @@ static int amd_pinconf_get(struct pinctrl_dev *pctldev,
 		break;
 
 	default:
-		dev_err(&gpio_dev->pdev->dev, "Invalid config param %04x\n",
+		dev_dbg(&gpio_dev->pdev->dev, "Invalid config param %04x\n",
 			param);
 		return -ENOTSUPP;
 	}
@@ -662,7 +662,7 @@ static int amd_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin,
 			break;
 
 		default:
-			dev_err(&gpio_dev->pdev->dev,
+			dev_dbg(&gpio_dev->pdev->dev,
 				"Invalid config param %04x\n", param);
 			ret = -ENOTSUPP;
 		}
diff --git linux-libre-4.14.325-gnu1/drivers/pwm/pwm-lpc32xx.c linux-libre-4.14.326-gnu1/drivers/pwm/pwm-lpc32xx.c
index ed8e9406b4af..b5f8b86b328a 100644
--- linux-libre-4.14.325-gnu1/drivers/pwm/pwm-lpc32xx.c
+++ linux-libre-4.14.326-gnu1/drivers/pwm/pwm-lpc32xx.c
@@ -55,10 +55,10 @@ static int lpc32xx_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
 	if (duty_cycles > 255)
 		duty_cycles = 255;
 
-	val = readl(lpc32xx->base + (pwm->hwpwm << 2));
+	val = readl(lpc32xx->base);
 	val &= ~0xFFFF;
 	val |= (period_cycles << 8) | duty_cycles;
-	writel(val, lpc32xx->base + (pwm->hwpwm << 2));
+	writel(val, lpc32xx->base);
 
 	return 0;
 }
@@ -73,9 +73,9 @@ static int lpc32xx_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm)
 	if (ret)
 		return ret;
 
-	val = readl(lpc32xx->base + (pwm->hwpwm << 2));
+	val = readl(lpc32xx->base);
 	val |= PWM_ENABLE;
-	writel(val, lpc32xx->base + (pwm->hwpwm << 2));
+	writel(val, lpc32xx->base);
 
 	return 0;
 }
@@ -85,9 +85,9 @@ static void lpc32xx_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm)
 	struct lpc32xx_pwm_chip *lpc32xx = to_lpc32xx_pwm_chip(chip);
 	u32 val;
 
-	val = readl(lpc32xx->base + (pwm->hwpwm << 2));
+	val = readl(lpc32xx->base);
 	val &= ~PWM_ENABLE;
-	writel(val, lpc32xx->base + (pwm->hwpwm << 2));
+	writel(val, lpc32xx->base);
 
 	clk_disable_unprepare(lpc32xx->clk);
 }
@@ -125,9 +125,9 @@ static int lpc32xx_pwm_probe(struct platform_device *pdev)
 	lpc32xx->chip.base = -1;
 
 	/* If PWM is disabled, configure the output to the default value */
-	val = readl(lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2));
+	val = readl(lpc32xx->base);
 	val &= ~PWM_PIN_LEVEL;
-	writel(val, lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2));
+	writel(val, lpc32xx->base);
 
 	ret = pwmchip_add(&lpc32xx->chip);
 	if (ret < 0) {
diff --git linux-libre-4.14.325-gnu1/drivers/rpmsg/qcom_glink_native.c linux-libre-4.14.326-gnu1/drivers/rpmsg/qcom_glink_native.c
index 0fb185e0620a..c1dfad298685 100644
--- linux-libre-4.14.325-gnu1/drivers/rpmsg/qcom_glink_native.c
+++ linux-libre-4.14.326-gnu1/drivers/rpmsg/qcom_glink_native.c
@@ -225,6 +225,10 @@ static struct glink_channel *qcom_glink_alloc_channel(struct qcom_glink *glink,
 
 	channel->glink = glink;
 	channel->name = kstrdup(name, GFP_KERNEL);
+	if (!channel->name) {
+		kfree(channel);
+		return ERR_PTR(-ENOMEM);
+	}
 
 	init_completion(&channel->open_req);
 	init_completion(&channel->open_ack);
diff --git linux-libre-4.14.325-gnu1/drivers/rtc/rtc-ds1685.c linux-libre-4.14.326-gnu1/drivers/rtc/rtc-ds1685.c
index ed43b4311660..3abc75103cc4 100644
--- linux-libre-4.14.325-gnu1/drivers/rtc/rtc-ds1685.c
+++ linux-libre-4.14.326-gnu1/drivers/rtc/rtc-ds1685.c
@@ -2228,7 +2228,7 @@ ds1685_rtc_poweroff(struct platform_device *pdev)
 		unreachable();
 	}
 }
-EXPORT_SYMBOL(ds1685_rtc_poweroff);
+EXPORT_SYMBOL_GPL(ds1685_rtc_poweroff);
 /* ----------------------------------------------------------------------- */
 
 
diff --git linux-libre-4.14.325-gnu1/drivers/s390/block/dasd_3990_erp.c linux-libre-4.14.326-gnu1/drivers/s390/block/dasd_3990_erp.c
index ee14d8e45c97..6d26343b12f2 100644
--- linux-libre-4.14.325-gnu1/drivers/s390/block/dasd_3990_erp.c
+++ linux-libre-4.14.326-gnu1/drivers/s390/block/dasd_3990_erp.c
@@ -2423,7 +2423,7 @@ static struct dasd_ccw_req *dasd_3990_erp_add_erp(struct dasd_ccw_req *cqr)
 	erp->block    = cqr->block;
 	erp->magic    = cqr->magic;
 	erp->expires  = cqr->expires;
-	erp->retries  = 256;
+	erp->retries  = device->default_retries;
 	erp->buildclk = get_tod_clock();
 	erp->status = DASD_CQR_FILLED;
 
diff --git linux-libre-4.14.325-gnu1/drivers/scsi/be2iscsi/be_iscsi.c linux-libre-4.14.326-gnu1/drivers/scsi/be2iscsi/be_iscsi.c
index 43a80ce5ce6a..0e95bccac32e 100644
--- linux-libre-4.14.325-gnu1/drivers/scsi/be2iscsi/be_iscsi.c
+++ linux-libre-4.14.326-gnu1/drivers/scsi/be2iscsi/be_iscsi.c
@@ -442,6 +442,10 @@ int beiscsi_iface_set_param(struct Scsi_Host *shost,
 	}
 
 	nla_for_each_attr(attrib, data, dt_len, rm_len) {
+		/* ignore nla_type as it is never used */
+		if (nla_len(attrib) < sizeof(*iface_param))
+			return -EINVAL;
+
 		iface_param = nla_data(attrib);
 
 		if (iface_param->param_type != ISCSI_NET_PARAM)
diff --git linux-libre-4.14.325-gnu1/drivers/scsi/fcoe/fcoe_ctlr.c linux-libre-4.14.326-gnu1/drivers/scsi/fcoe/fcoe_ctlr.c
index 1c8fa41aa3ab..57826f7bb9f2 100644
--- linux-libre-4.14.325-gnu1/drivers/scsi/fcoe/fcoe_ctlr.c
+++ linux-libre-4.14.326-gnu1/drivers/scsi/fcoe/fcoe_ctlr.c
@@ -330,16 +330,17 @@ static void fcoe_ctlr_announce(struct fcoe_ctlr *fip)
 {
 	struct fcoe_fcf *sel;
 	struct fcoe_fcf *fcf;
+	unsigned long flags;
 
 	mutex_lock(&fip->ctlr_mutex);
-	spin_lock_bh(&fip->ctlr_lock);
+	spin_lock_irqsave(&fip->ctlr_lock, flags);
 
 	kfree_skb(fip->flogi_req);
 	fip->flogi_req = NULL;
 	list_for_each_entry(fcf, &fip->fcfs, list)
 		fcf->flogi_sent = 0;
 
-	spin_unlock_bh(&fip->ctlr_lock);
+	spin_unlock_irqrestore(&fip->ctlr_lock, flags);
 	sel = fip->sel_fcf;
 
 	if (sel && ether_addr_equal(sel->fcf_mac, fip->dest_addr))
@@ -709,6 +710,7 @@ int fcoe_ctlr_els_send(struct fcoe_ctlr *fip, struct fc_lport *lport,
 {
 	struct fc_frame *fp;
 	struct fc_frame_header *fh;
+	unsigned long flags;
 	u16 old_xid;
 	u8 op;
 	u8 mac[ETH_ALEN];
@@ -742,11 +744,11 @@ int fcoe_ctlr_els_send(struct fcoe_ctlr *fip, struct fc_lport *lport,
 		op = FIP_DT_FLOGI;
 		if (fip->mode == FIP_MODE_VN2VN)
 			break;
-		spin_lock_bh(&fip->ctlr_lock);
+		spin_lock_irqsave(&fip->ctlr_lock, flags);
 		kfree_skb(fip->flogi_req);
 		fip->flogi_req = skb;
 		fip->flogi_req_send = 1;
-		spin_unlock_bh(&fip->ctlr_lock);
+		spin_unlock_irqrestore(&fip->ctlr_lock, flags);
 		schedule_work(&fip->timer_work);
 		return -EINPROGRESS;
 	case ELS_FDISC:
@@ -1723,10 +1725,11 @@ static int fcoe_ctlr_flogi_send_locked(struct fcoe_ctlr *fip)
 static int fcoe_ctlr_flogi_retry(struct fcoe_ctlr *fip)
 {
 	struct fcoe_fcf *fcf;
+	unsigned long flags;
 	int error;
 
 	mutex_lock(&fip->ctlr_mutex);
-	spin_lock_bh(&fip->ctlr_lock);
+	spin_lock_irqsave(&fip->ctlr_lock, flags);
 	LIBFCOE_FIP_DBG(fip, "re-sending FLOGI - reselect\n");
 	fcf = fcoe_ctlr_select(fip);
 	if (!fcf || fcf->flogi_sent) {
@@ -1737,7 +1740,7 @@ static int fcoe_ctlr_flogi_retry(struct fcoe_ctlr *fip)
 		fcoe_ctlr_solicit(fip, NULL);
 		error = fcoe_ctlr_flogi_send_locked(fip);
 	}
-	spin_unlock_bh(&fip->ctlr_lock);
+	spin_unlock_irqrestore(&fip->ctlr_lock, flags);
 	mutex_unlock(&fip->ctlr_mutex);
 	return error;
 }
@@ -1754,8 +1757,9 @@ static int fcoe_ctlr_flogi_retry(struct fcoe_ctlr *fip)
 static void fcoe_ctlr_flogi_send(struct fcoe_ctlr *fip)
 {
 	struct fcoe_fcf *fcf;
+	unsigned long flags;
 
-	spin_lock_bh(&fip->ctlr_lock);
+	spin_lock_irqsave(&fip->ctlr_lock, flags);
 	fcf = fip->sel_fcf;
 	if (!fcf || !fip->flogi_req_send)
 		goto unlock;
@@ -1782,7 +1786,7 @@ static void fcoe_ctlr_flogi_send(struct fcoe_ctlr *fip)
 	} else /* XXX */
 		LIBFCOE_FIP_DBG(fip, "No FCF selected - defer send\n");
 unlock:
-	spin_unlock_bh(&fip->ctlr_lock);
+	spin_unlock_irqrestore(&fip->ctlr_lock, flags);
 }
 
 /**
diff --git linux-libre-4.14.325-gnu1/drivers/scsi/hosts.c linux-libre-4.14.326-gnu1/drivers/scsi/hosts.c
index 27609b2ae544..493700ae19b4 100644
--- linux-libre-4.14.325-gnu1/drivers/scsi/hosts.c
+++ linux-libre-4.14.326-gnu1/drivers/scsi/hosts.c
@@ -555,7 +555,7 @@ EXPORT_SYMBOL(scsi_unregister);
 static int __scsi_host_match(struct device *dev, const void *data)
 {
 	struct Scsi_Host *p;
-	const unsigned short *hostnum = data;
+	const unsigned int *hostnum = data;
 
 	p = class_to_shost(dev);
 	return p->host_no == *hostnum;
@@ -572,7 +572,7 @@ static int __scsi_host_match(struct device *dev, const void *data)
  *	that scsi_host_get() took. The put_device() below dropped
  *	the reference from class_find_device().
  **/
-struct Scsi_Host *scsi_host_lookup(unsigned short hostnum)
+struct Scsi_Host *scsi_host_lookup(unsigned int hostnum)
 {
 	struct device *cdev;
 	struct Scsi_Host *shost = NULL;
diff --git linux-libre-4.14.325-gnu1/drivers/scsi/qedf/qedf_dbg.h linux-libre-4.14.326-gnu1/drivers/scsi/qedf/qedf_dbg.h
index 50083cae84c3..9fa5da44971a 100644
--- linux-libre-4.14.325-gnu1/drivers/scsi/qedf/qedf_dbg.h
+++ linux-libre-4.14.326-gnu1/drivers/scsi/qedf/qedf_dbg.h
@@ -63,6 +63,8 @@ extern uint qedf_debug;
 #define QEDF_LOG_NOTICE	0x40000000	/* Notice logs */
 #define QEDF_LOG_WARN		0x80000000	/* Warning logs */
 
+#define QEDF_DEBUGFS_LOG_LEN (2 * PAGE_SIZE)
+
 /* Debug context structure */
 struct qedf_dbg_ctx {
 	unsigned int host_no;
diff --git linux-libre-4.14.325-gnu1/drivers/scsi/qedf/qedf_debugfs.c linux-libre-4.14.326-gnu1/drivers/scsi/qedf/qedf_debugfs.c
index 2b1ef3075e93..41fa846f0bdb 100644
--- linux-libre-4.14.325-gnu1/drivers/scsi/qedf/qedf_debugfs.c
+++ linux-libre-4.14.326-gnu1/drivers/scsi/qedf/qedf_debugfs.c
@@ -11,6 +11,7 @@
 #include <linux/uaccess.h>
 #include <linux/debugfs.h>
 #include <linux/module.h>
+#include <linux/vmalloc.h>
 
 #include "qedf.h"
 #include "qedf_dbg.h"
@@ -117,7 +118,9 @@ static ssize_t
 qedf_dbg_fp_int_cmd_read(struct file *filp, char __user *buffer, size_t count,
 			 loff_t *ppos)
 {
+	ssize_t ret;
 	size_t cnt = 0;
+	char *cbuf;
 	int id;
 	struct qedf_fastpath *fp = NULL;
 	struct qedf_dbg_ctx *qedf_dbg =
@@ -127,19 +130,25 @@ qedf_dbg_fp_int_cmd_read(struct file *filp, char __user *buffer, size_t count,
 
 	QEDF_INFO(qedf_dbg, QEDF_LOG_DEBUGFS, "entered\n");
 
-	cnt = sprintf(buffer, "\nFastpath I/O completions\n\n");
+	cbuf = vmalloc(QEDF_DEBUGFS_LOG_LEN);
+	if (!cbuf)
+		return 0;
+
+	cnt += scnprintf(cbuf + cnt, QEDF_DEBUGFS_LOG_LEN - cnt, "\nFastpath I/O completions\n\n");
 
 	for (id = 0; id < qedf->num_queues; id++) {
 		fp = &(qedf->fp_array[id]);
 		if (fp->sb_id == QEDF_SB_ID_NULL)
 			continue;
-		cnt += sprintf((buffer + cnt), "#%d: %lu\n", id,
-			       fp->completions);
+		cnt += scnprintf(cbuf + cnt, QEDF_DEBUGFS_LOG_LEN - cnt,
+				 "#%d: %lu\n", id, fp->completions);
 	}
 
-	cnt = min_t(int, count, cnt - *ppos);
-	*ppos += cnt;
-	return cnt;
+	ret = simple_read_from_buffer(buffer, count, ppos, cbuf, cnt);
+
+	vfree(cbuf);
+
+	return ret;
 }
 
 static ssize_t
@@ -204,18 +213,17 @@ qedf_dbg_stop_io_on_error_cmd_read(struct file *filp, char __user *buffer,
 				   size_t count, loff_t *ppos)
 {
 	int cnt;
+	char cbuf[7];
 	struct qedf_dbg_ctx *qedf_dbg =
 				(struct qedf_dbg_ctx *)filp->private_data;
 	struct qedf_ctx *qedf = container_of(qedf_dbg,
 	    struct qedf_ctx, dbg_ctx);
 
 	QEDF_INFO(qedf_dbg, QEDF_LOG_DEBUGFS, "entered\n");
-	cnt = sprintf(buffer, "%s\n",
+	cnt = scnprintf(cbuf, sizeof(cbuf), "%s\n",
 	    qedf->stop_io_on_error ? "true" : "false");
 
-	cnt = min_t(int, count, cnt - *ppos);
-	*ppos += cnt;
-	return cnt;
+	return simple_read_from_buffer(buffer, count, ppos, cbuf, cnt);
 }
 
 static ssize_t
diff --git linux-libre-4.14.325-gnu1/drivers/scsi/qedi/qedi_main.c linux-libre-4.14.326-gnu1/drivers/scsi/qedi/qedi_main.c
index 09f57ef35990..b8b177018031 100644
--- linux-libre-4.14.325-gnu1/drivers/scsi/qedi/qedi_main.c
+++ linux-libre-4.14.326-gnu1/drivers/scsi/qedi/qedi_main.c
@@ -1669,8 +1669,9 @@ static int qedi_cpu_offline(unsigned int cpu)
 	struct qedi_percpu_s *p = this_cpu_ptr(&qedi_percpu);
 	struct qedi_work *work, *tmp;
 	struct task_struct *thread;
+	unsigned long flags;
 
-	spin_lock_bh(&p->p_work_lock);
+	spin_lock_irqsave(&p->p_work_lock, flags);
 	thread = p->iothread;
 	p->iothread = NULL;
 
@@ -1681,7 +1682,7 @@ static int qedi_cpu_offline(unsigned int cpu)
 			kfree(work);
 	}
 
-	spin_unlock_bh(&p->p_work_lock);
+	spin_unlock_irqrestore(&p->p_work_lock, flags);
 	if (thread)
 		kthread_stop(thread);
 	return 0;
diff --git linux-libre-4.14.325-gnu1/drivers/scsi/qla2xxx/qla_isr.c linux-libre-4.14.326-gnu1/drivers/scsi/qla2xxx/qla_isr.c
index b2056714804c..c138679e8940 100644
--- linux-libre-4.14.325-gnu1/drivers/scsi/qla2xxx/qla_isr.c
+++ linux-libre-4.14.326-gnu1/drivers/scsi/qla2xxx/qla_isr.c
@@ -2622,7 +2622,6 @@ check_scsi_status:
 	case CS_PORT_BUSY:
 	case CS_INCOMPLETE:
 	case CS_PORT_UNAVAILABLE:
-	case CS_TIMEOUT:
 	case CS_RESET:
 
 		/*
diff --git linux-libre-4.14.325-gnu1/drivers/scsi/qla2xxx/qla_nvme.c linux-libre-4.14.326-gnu1/drivers/scsi/qla2xxx/qla_nvme.c
index c756298c0562..3944a9ebb0d9 100644
--- linux-libre-4.14.325-gnu1/drivers/scsi/qla2xxx/qla_nvme.c
+++ linux-libre-4.14.326-gnu1/drivers/scsi/qla2xxx/qla_nvme.c
@@ -535,7 +535,7 @@ static int qla_nvme_post_cmd(struct nvme_fc_local_port *lport,
 
 	rval = qla2x00_start_nvme_mq(sp);
 	if (rval != QLA_SUCCESS) {
-		ql_log(ql_log_warn, vha, 0x212d,
+		ql_dbg(ql_dbg_io + ql_dbg_verbose, vha, 0x212d,
 		    "qla2x00_start_nvme_mq failed = %d\n", rval);
 		atomic_dec(&sp->ref_count);
 		wake_up(&sp->nvme_ls_waitq);
diff --git linux-libre-4.14.325-gnu1/drivers/scsi/qla4xxx/ql4_os.c linux-libre-4.14.326-gnu1/drivers/scsi/qla4xxx/ql4_os.c
index 62022a66e9ee..d6e9717cb0fb 100644
--- linux-libre-4.14.325-gnu1/drivers/scsi/qla4xxx/ql4_os.c
+++ linux-libre-4.14.326-gnu1/drivers/scsi/qla4xxx/ql4_os.c
@@ -942,6 +942,11 @@ static int qla4xxx_set_chap_entry(struct Scsi_Host *shost, void *data, int len)
 	memset(&chap_rec, 0, sizeof(chap_rec));
 
 	nla_for_each_attr(attr, data, len, rem) {
+		if (nla_len(attr) < sizeof(*param_info)) {
+			rc = -EINVAL;
+			goto exit_set_chap;
+		}
+
 		param_info = nla_data(attr);
 
 		switch (param_info->param) {
@@ -2727,6 +2732,11 @@ qla4xxx_iface_set_param(struct Scsi_Host *shost, void *data, uint32_t len)
 	}
 
 	nla_for_each_attr(attr, data, len, rem) {
+		if (nla_len(attr) < sizeof(*iface_param)) {
+			rval = -EINVAL;
+			goto exit_init_fw_cb;
+		}
+
 		iface_param = nla_data(attr);
 
 		if (iface_param->param_type == ISCSI_NET_PARAM) {
@@ -8102,6 +8112,11 @@ qla4xxx_sysfs_ddb_set_param(struct iscsi_bus_flash_session *fnode_sess,
 
 	memset((void *)&chap_tbl, 0, sizeof(chap_tbl));
 	nla_for_each_attr(attr, data, len, rem) {
+		if (nla_len(attr) < sizeof(*fnode_param)) {
+			rc = -EINVAL;
+			goto exit_set_param;
+		}
+
 		fnode_param = nla_data(attr);
 
 		switch (fnode_param->param) {
diff --git linux-libre-4.14.325-gnu1/drivers/scsi/scsi_transport_iscsi.c linux-libre-4.14.326-gnu1/drivers/scsi/scsi_transport_iscsi.c
index 26c6f1b28801..d90fdfbb69de 100644
--- linux-libre-4.14.325-gnu1/drivers/scsi/scsi_transport_iscsi.c
+++ linux-libre-4.14.326-gnu1/drivers/scsi/scsi_transport_iscsi.c
@@ -2765,6 +2765,10 @@ iscsi_set_param(struct iscsi_transport *transport, struct iscsi_uevent *ev)
 	if (!conn || !session)
 		return -EINVAL;
 
+	/* data will be regarded as NULL-ended string, do length check */
+	if (strlen(data) > ev->u.set_param.len)
+		return -EINVAL;
+
 	switch (ev->u.set_param.param) {
 	case ISCSI_PARAM_SESS_RECOVERY_TMO:
 		sscanf(data, "%d", &value);
@@ -2917,6 +2921,10 @@ iscsi_set_host_param(struct iscsi_transport *transport,
 		return -ENODEV;
 	}
 
+	/* see similar check in iscsi_if_set_param() */
+	if (strlen(data) > ev->u.set_host_param.len)
+		return -EINVAL;
+
 	err = transport->set_host_param(shost, ev->u.set_host_param.param,
 					data, ev->u.set_host_param.len);
 	scsi_host_put(shost);
diff --git linux-libre-4.14.325-gnu1/drivers/spi/spi-tegra20-sflash.c linux-libre-4.14.326-gnu1/drivers/spi/spi-tegra20-sflash.c
index 749288310c36..2989795272a1 100644
--- linux-libre-4.14.325-gnu1/drivers/spi/spi-tegra20-sflash.c
+++ linux-libre-4.14.326-gnu1/drivers/spi/spi-tegra20-sflash.c
@@ -469,7 +469,11 @@ static int tegra_sflash_probe(struct platform_device *pdev)
 		goto exit_free_master;
 	}
 
-	tsd->irq = platform_get_irq(pdev, 0);
+	ret = platform_get_irq(pdev, 0);
+	if (ret < 0)
+		goto exit_free_master;
+	tsd->irq = ret;
+
 	ret = request_irq(tsd->irq, tegra_sflash_isr, 0,
 			dev_name(&pdev->dev), tsd);
 	if (ret < 0) {
diff --git linux-libre-4.14.325-gnu1/drivers/target/iscsi/iscsi_target_configfs.c linux-libre-4.14.326-gnu1/drivers/target/iscsi/iscsi_target_configfs.c
index 4191e4a8a9ed..b3d445ef8423 100644
--- linux-libre-4.14.325-gnu1/drivers/target/iscsi/iscsi_target_configfs.c
+++ linux-libre-4.14.326-gnu1/drivers/target/iscsi/iscsi_target_configfs.c
@@ -516,102 +516,102 @@ static ssize_t lio_target_nacl_info_show(struct config_item *item, char *page)
 	spin_lock_bh(&se_nacl->nacl_sess_lock);
 	se_sess = se_nacl->nacl_sess;
 	if (!se_sess) {
-		rb += sprintf(page+rb, "No active iSCSI Session for Initiator"
+		rb += sysfs_emit_at(page, rb, "No active iSCSI Session for Initiator"
 			" Endpoint: %s\n", se_nacl->initiatorname);
 	} else {
 		sess = se_sess->fabric_sess_ptr;
 
-		rb += sprintf(page+rb, "InitiatorName: %s\n",
+		rb += sysfs_emit_at(page, rb, "InitiatorName: %s\n",
 			sess->sess_ops->InitiatorName);
-		rb += sprintf(page+rb, "InitiatorAlias: %s\n",
+		rb += sysfs_emit_at(page, rb, "InitiatorAlias: %s\n",
 			sess->sess_ops->InitiatorAlias);
 
-		rb += sprintf(page+rb,
+		rb += sysfs_emit_at(page, rb,
 			      "LIO Session ID: %u   ISID: 0x%6ph  TSIH: %hu  ",
 			      sess->sid, sess->isid, sess->tsih);
-		rb += sprintf(page+rb, "SessionType: %s\n",
+		rb += sysfs_emit_at(page, rb, "SessionType: %s\n",
 				(sess->sess_ops->SessionType) ?
 				"Discovery" : "Normal");
-		rb += sprintf(page+rb, "Session State: ");
+		rb += sysfs_emit_at(page, rb, "Session State: ");
 		switch (sess->session_state) {
 		case TARG_SESS_STATE_FREE:
-			rb += sprintf(page+rb, "TARG_SESS_FREE\n");
+			rb += sysfs_emit_at(page, rb, "TARG_SESS_FREE\n");
 			break;
 		case TARG_SESS_STATE_ACTIVE:
-			rb += sprintf(page+rb, "TARG_SESS_STATE_ACTIVE\n");
+			rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_ACTIVE\n");
 			break;
 		case TARG_SESS_STATE_LOGGED_IN:
-			rb += sprintf(page+rb, "TARG_SESS_STATE_LOGGED_IN\n");
+			rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_LOGGED_IN\n");
 			break;
 		case TARG_SESS_STATE_FAILED:
-			rb += sprintf(page+rb, "TARG_SESS_STATE_FAILED\n");
+			rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_FAILED\n");
 			break;
 		case TARG_SESS_STATE_IN_CONTINUE:
-			rb += sprintf(page+rb, "TARG_SESS_STATE_IN_CONTINUE\n");
+			rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_IN_CONTINUE\n");
 			break;
 		default:
-			rb += sprintf(page+rb, "ERROR: Unknown Session"
+			rb += sysfs_emit_at(page, rb, "ERROR: Unknown Session"
 					" State!\n");
 			break;
 		}
 
-		rb += sprintf(page+rb, "---------------------[iSCSI Session"
+		rb += sysfs_emit_at(page, rb, "---------------------[iSCSI Session"
 				" Values]-----------------------\n");
-		rb += sprintf(page+rb, "  CmdSN/WR  :  CmdSN/WC  :  ExpCmdSN"
+		rb += sysfs_emit_at(page, rb, "  CmdSN/WR  :  CmdSN/WC  :  ExpCmdSN"
 				"  :  MaxCmdSN  :     ITT    :     TTT\n");
 		max_cmd_sn = (u32) atomic_read(&sess->max_cmd_sn);
-		rb += sprintf(page+rb, " 0x%08x   0x%08x   0x%08x   0x%08x"
+		rb += sysfs_emit_at(page, rb, " 0x%08x   0x%08x   0x%08x   0x%08x"
 				"   0x%08x   0x%08x\n",
 			sess->cmdsn_window,
 			(max_cmd_sn - sess->exp_cmd_sn) + 1,
 			sess->exp_cmd_sn, max_cmd_sn,
 			sess->init_task_tag, sess->targ_xfer_tag);
-		rb += sprintf(page+rb, "----------------------[iSCSI"
+		rb += sysfs_emit_at(page, rb, "----------------------[iSCSI"
 				" Connections]-------------------------\n");
 
 		spin_lock(&sess->conn_lock);
 		list_for_each_entry(conn, &sess->sess_conn_list, conn_list) {
-			rb += sprintf(page+rb, "CID: %hu  Connection"
+			rb += sysfs_emit_at(page, rb, "CID: %hu  Connection"
 					" State: ", conn->cid);
 			switch (conn->conn_state) {
 			case TARG_CONN_STATE_FREE:
-				rb += sprintf(page+rb,
+				rb += sysfs_emit_at(page, rb,
 					"TARG_CONN_STATE_FREE\n");
 				break;
 			case TARG_CONN_STATE_XPT_UP:
-				rb += sprintf(page+rb,
+				rb += sysfs_emit_at(page, rb,
 					"TARG_CONN_STATE_XPT_UP\n");
 				break;
 			case TARG_CONN_STATE_IN_LOGIN:
-				rb += sprintf(page+rb,
+				rb += sysfs_emit_at(page, rb,
 					"TARG_CONN_STATE_IN_LOGIN\n");
 				break;
 			case TARG_CONN_STATE_LOGGED_IN:
-				rb += sprintf(page+rb,
+				rb += sysfs_emit_at(page, rb,
 					"TARG_CONN_STATE_LOGGED_IN\n");
 				break;
 			case TARG_CONN_STATE_IN_LOGOUT:
-				rb += sprintf(page+rb,
+				rb += sysfs_emit_at(page, rb,
 					"TARG_CONN_STATE_IN_LOGOUT\n");
 				break;
 			case TARG_CONN_STATE_LOGOUT_REQUESTED:
-				rb += sprintf(page+rb,
+				rb += sysfs_emit_at(page, rb,
 					"TARG_CONN_STATE_LOGOUT_REQUESTED\n");
 				break;
 			case TARG_CONN_STATE_CLEANUP_WAIT:
-				rb += sprintf(page+rb,
+				rb += sysfs_emit_at(page, rb,
 					"TARG_CONN_STATE_CLEANUP_WAIT\n");
 				break;
 			default:
-				rb += sprintf(page+rb,
+				rb += sysfs_emit_at(page, rb,
 					"ERROR: Unknown Connection State!\n");
 				break;
 			}
 
-			rb += sprintf(page+rb, "   Address %pISc %s", &conn->login_sockaddr,
+			rb += sysfs_emit_at(page, rb, "   Address %pISc %s", &conn->login_sockaddr,
 				(conn->network_transport == ISCSI_TCP) ?
 				"TCP" : "SCTP");
-			rb += sprintf(page+rb, "  StatSN: 0x%08x\n",
+			rb += sysfs_emit_at(page, rb, "  StatSN: 0x%08x\n",
 				conn->stat_sn);
 		}
 		spin_unlock(&sess->conn_lock);
diff --git linux-libre-4.14.325-gnu1/drivers/tty/serial/cpm_uart/cpm_uart_core.c linux-libre-4.14.326-gnu1/drivers/tty/serial/cpm_uart/cpm_uart_core.c
index 8f5a5a16cb3b..f0af8a6de0aa 100644
--- linux-libre-4.14.325-gnu1/drivers/tty/serial/cpm_uart/cpm_uart_core.c
+++ linux-libre-4.14.326-gnu1/drivers/tty/serial/cpm_uart/cpm_uart_core.c
@@ -1283,19 +1283,14 @@ static void cpm_uart_console_write(struct console *co, const char *s,
 {
 	struct uart_cpm_port *pinfo = &cpm_uart_ports[co->index];
 	unsigned long flags;
-	int nolock = oops_in_progress;
 
-	if (unlikely(nolock)) {
+	if (unlikely(oops_in_progress)) {
 		local_irq_save(flags);
-	} else {
-		spin_lock_irqsave(&pinfo->port.lock, flags);
-	}
-
-	cpm_uart_early_write(pinfo, s, count, true);
-
-	if (unlikely(nolock)) {
+		cpm_uart_early_write(pinfo, s, count, true);
 		local_irq_restore(flags);
 	} else {
+		spin_lock_irqsave(&pinfo->port.lock, flags);
+		cpm_uart_early_write(pinfo, s, count, true);
 		spin_unlock_irqrestore(&pinfo->port.lock, flags);
 	}
 }
diff --git linux-libre-4.14.325-gnu1/drivers/tty/serial/sc16is7xx.c linux-libre-4.14.326-gnu1/drivers/tty/serial/sc16is7xx.c
index 590acca60134..21be0cf6a48c 100644
--- linux-libre-4.14.325-gnu1/drivers/tty/serial/sc16is7xx.c
+++ linux-libre-4.14.326-gnu1/drivers/tty/serial/sc16is7xx.c
@@ -1171,9 +1171,18 @@ static int sc16is7xx_gpio_direction_output(struct gpio_chip *chip,
 		state |= BIT(offset);
 	else
 		state &= ~BIT(offset);
-	sc16is7xx_port_write(port, SC16IS7XX_IOSTATE_REG, state);
+
+	/*
+	 * If we write IOSTATE first, and then IODIR, the output value is not
+	 * transferred to the corresponding I/O pin.
+	 * The datasheet states that each register bit will be transferred to
+	 * the corresponding I/O pin programmed as output when writing to
+	 * IOSTATE. Therefore, configure direction first with IODIR, and then
+	 * set value after with IOSTATE.
+	 */
 	sc16is7xx_port_update(port, SC16IS7XX_IODIR_REG, BIT(offset),
 			      BIT(offset));
+	sc16is7xx_port_write(port, SC16IS7XX_IOSTATE_REG, state);
 
 	return 0;
 }
diff --git linux-libre-4.14.325-gnu1/drivers/tty/serial/serial-tegra.c linux-libre-4.14.326-gnu1/drivers/tty/serial/serial-tegra.c
index a13d6d4674bc..05e522be9466 100644
--- linux-libre-4.14.325-gnu1/drivers/tty/serial/serial-tegra.c
+++ linux-libre-4.14.326-gnu1/drivers/tty/serial/serial-tegra.c
@@ -827,7 +827,11 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup)
 	tup->ier_shadow = 0;
 	tup->current_baud = 0;
 
-	clk_prepare_enable(tup->uart_clk);
+	ret = clk_prepare_enable(tup->uart_clk);
+	if (ret) {
+		dev_err(tup->uport.dev, "could not enable clk\n");
+		return ret;
+	}
 
 	/* Reset the UART controller to clear all previous status.*/
 	reset_control_assert(tup->rst);
diff --git linux-libre-4.14.325-gnu1/drivers/usb/gadget/function/f_mass_storage.c linux-libre-4.14.326-gnu1/drivers/usb/gadget/function/f_mass_storage.c
index 41b5baa1f43b..6aee3cf50c74 100644
--- linux-libre-4.14.325-gnu1/drivers/usb/gadget/function/f_mass_storage.c
+++ linux-libre-4.14.326-gnu1/drivers/usb/gadget/function/f_mass_storage.c
@@ -952,7 +952,7 @@ static void invalidate_sub(struct fsg_lun *curlun)
 {
 	struct file	*filp = curlun->filp;
 	struct inode	*inode = file_inode(filp);
-	unsigned long	rc;
+	unsigned long __maybe_unused	rc;
 
 	rc = invalidate_mapping_pages(inode->i_mapping, 0, -1);
 	VLDBG(curlun, "invalidate_mapping_pages -> %ld\n", rc);
diff --git linux-libre-4.14.325-gnu1/drivers/usb/gadget/udc/fsl_qe_udc.c linux-libre-4.14.326-gnu1/drivers/usb/gadget/udc/fsl_qe_udc.c
index a3e72d690eef..c14d5870d99f 100644
--- linux-libre-4.14.325-gnu1/drivers/usb/gadget/udc/fsl_qe_udc.c
+++ linux-libre-4.14.326-gnu1/drivers/usb/gadget/udc/fsl_qe_udc.c
@@ -1954,9 +1954,13 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value,
 	} else if ((request_type & USB_RECIP_MASK) == USB_RECIP_ENDPOINT) {
 		/* Get endpoint status */
 		int pipe = index & USB_ENDPOINT_NUMBER_MASK;
-		struct qe_ep *target_ep = &udc->eps[pipe];
+		struct qe_ep *target_ep;
 		u16 usep;
 
+		if (pipe >= USB_MAX_ENDPOINTS)
+			goto stall;
+		target_ep = &udc->eps[pipe];
+
 		/* stall if endpoint doesn't exist */
 		if (!target_ep->ep.desc)
 			goto stall;
diff --git linux-libre-4.14.325-gnu1/drivers/usb/phy/phy-mxs-usb.c linux-libre-4.14.326-gnu1/drivers/usb/phy/phy-mxs-usb.c
index 0e2f1a36d315..6e462a8d8309 100644
--- linux-libre-4.14.325-gnu1/drivers/usb/phy/phy-mxs-usb.c
+++ linux-libre-4.14.326-gnu1/drivers/usb/phy/phy-mxs-usb.c
@@ -303,14 +303,8 @@ static void __mxs_phy_disconnect_line(struct mxs_phy *mxs_phy, bool disconnect)
 
 static bool mxs_phy_is_otg_host(struct mxs_phy *mxs_phy)
 {
-	void __iomem *base = mxs_phy->phy.io_priv;
-	u32 phyctrl = readl(base + HW_USBPHY_CTRL);
-
-	if (IS_ENABLED(CONFIG_USB_OTG) &&
-			!(phyctrl & BM_USBPHY_CTRL_OTG_ID_VALUE))
-		return true;
-
-	return false;
+	return IS_ENABLED(CONFIG_USB_OTG) &&
+		mxs_phy->phy.last_event == USB_EVENT_ID;
 }
 
 static void mxs_phy_disconnect_line(struct mxs_phy *mxs_phy, bool on)
diff --git linux-libre-4.14.325-gnu1/drivers/usb/serial/option.c linux-libre-4.14.326-gnu1/drivers/usb/serial/option.c
index 22fd7293adb1..8792aca5bc27 100644
--- linux-libre-4.14.325-gnu1/drivers/usb/serial/option.c
+++ linux-libre-4.14.326-gnu1/drivers/usb/serial/option.c
@@ -262,6 +262,7 @@ static void option_instat_callback(struct urb *urb);
 #define QUECTEL_PRODUCT_EM05G			0x030a
 #define QUECTEL_PRODUCT_EM060K			0x030b
 #define QUECTEL_PRODUCT_EM05G_CS		0x030c
+#define QUECTEL_PRODUCT_EM05GV2			0x030e
 #define QUECTEL_PRODUCT_EM05CN_SG		0x0310
 #define QUECTEL_PRODUCT_EM05G_SG		0x0311
 #define QUECTEL_PRODUCT_EM05CN			0x0312
@@ -1193,6 +1194,8 @@ static const struct usb_device_id option_ids[] = {
 	  .driver_info = RSVD(6) | ZLP },
 	{ USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_GR, 0xff),
 	  .driver_info = RSVD(6) | ZLP },
+	{ USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05GV2, 0xff),
+	  .driver_info = RSVD(4) | ZLP },
 	{ USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_CS, 0xff),
 	  .driver_info = RSVD(6) | ZLP },
 	{ USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_RS, 0xff),
@@ -2234,6 +2237,10 @@ static const struct usb_device_id option_ids[] = {
 	  .driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0db, 0xff),			/* Foxconn T99W265 MBIM */
 	  .driver_info = RSVD(3) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0ee, 0xff),			/* Foxconn T99W368 MBIM */
+	  .driver_info = RSVD(3) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0f0, 0xff),			/* Foxconn T99W373 MBIM */
+	  .driver_info = RSVD(3) },
 	{ USB_DEVICE(0x1508, 0x1001),						/* Fibocom NL668 (IOT version) */
 	  .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
 	{ USB_DEVICE(0x1782, 0x4d10) },						/* Fibocom L610 (AT mode) */
diff --git linux-libre-4.14.325-gnu1/drivers/video/backlight/bd6107.c linux-libre-4.14.326-gnu1/drivers/video/backlight/bd6107.c
index fdb2f7e2c6b5..3eaa250f10de 100644
--- linux-libre-4.14.325-gnu1/drivers/video/backlight/bd6107.c
+++ linux-libre-4.14.326-gnu1/drivers/video/backlight/bd6107.c
@@ -110,7 +110,7 @@ static int bd6107_backlight_check_fb(struct backlight_device *backlight,
 {
 	struct bd6107 *bd = bl_get_data(backlight);
 
-	return bd->pdata->fbdev == NULL || bd->pdata->fbdev == info->dev;
+	return bd->pdata->fbdev == NULL || bd->pdata->fbdev == info->device;
 }
 
 static const struct backlight_ops bd6107_backlight_ops = {
diff --git linux-libre-4.14.325-gnu1/drivers/video/backlight/gpio_backlight.c linux-libre-4.14.326-gnu1/drivers/video/backlight/gpio_backlight.c
index e470da95d806..cd7a97f11320 100644
--- linux-libre-4.14.325-gnu1/drivers/video/backlight/gpio_backlight.c
+++ linux-libre-4.14.326-gnu1/drivers/video/backlight/gpio_backlight.c
@@ -48,7 +48,7 @@ static int gpio_backlight_check_fb(struct backlight_device *bl,
 {
 	struct gpio_backlight *gbl = bl_get_data(bl);
 
-	return gbl->fbdev == NULL || gbl->fbdev == info->dev;
+	return gbl->fbdev == NULL || gbl->fbdev == info->device;
 }
 
 static const struct backlight_ops gpio_backlight_ops = {
diff --git linux-libre-4.14.325-gnu1/drivers/video/backlight/lv5207lp.c linux-libre-4.14.326-gnu1/drivers/video/backlight/lv5207lp.c
index 8ab7297b118a..08aa615cb2a9 100644
--- linux-libre-4.14.325-gnu1/drivers/video/backlight/lv5207lp.c
+++ linux-libre-4.14.326-gnu1/drivers/video/backlight/lv5207lp.c
@@ -75,7 +75,7 @@ static int lv5207lp_backlight_check_fb(struct backlight_device *backlight,
 {
 	struct lv5207lp *lv = bl_get_data(backlight);
 
-	return lv->pdata->fbdev == NULL || lv->pdata->fbdev == info->dev;
+	return lv->pdata->fbdev == NULL || lv->pdata->fbdev == info->device;
 }
 
 static const struct backlight_ops lv5207lp_backlight_ops = {
diff --git linux-libre-4.14.325-gnu1/drivers/video/fbdev/ep93xx-fb.c linux-libre-4.14.326-gnu1/drivers/video/fbdev/ep93xx-fb.c
index 75f0db25d19f..e81593a93d23 100644
--- linux-libre-4.14.325-gnu1/drivers/video/fbdev/ep93xx-fb.c
+++ linux-libre-4.14.326-gnu1/drivers/video/fbdev/ep93xx-fb.c
@@ -478,7 +478,6 @@ static int ep93xxfb_probe(struct platform_device *pdev)
 	if (!info)
 		return -ENOMEM;
 
-	info->dev = &pdev->dev;
 	platform_set_drvdata(pdev, info);
 	fbi = info->par;
 	fbi->mach_info = mach_info;
diff --git linux-libre-4.14.325-gnu1/drivers/watchdog/intel-mid_wdt.c linux-libre-4.14.326-gnu1/drivers/watchdog/intel-mid_wdt.c
index 72c108a12c19..0dec3fba02b9 100644
--- linux-libre-4.14.325-gnu1/drivers/watchdog/intel-mid_wdt.c
+++ linux-libre-4.14.326-gnu1/drivers/watchdog/intel-mid_wdt.c
@@ -186,3 +186,4 @@ module_platform_driver(mid_wdt_driver);
 MODULE_AUTHOR("David Cohen <david.a.cohen@linux.intel.com>");
 MODULE_DESCRIPTION("Watchdog Driver for Intel MID platform");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:intel_mid_wdt");
diff --git linux-libre-4.14.325-gnu1/fs/attr.c linux-libre-4.14.326-gnu1/fs/attr.c
index 9d14a61d4b6f..a125db98f2ef 100644
--- linux-libre-4.14.325-gnu1/fs/attr.c
+++ linux-libre-4.14.326-gnu1/fs/attr.c
@@ -235,9 +235,25 @@ int notify_change(struct dentry * dentry, struct iattr * attr, struct inode **de
 	}
 
 	if ((ia_valid & ATTR_MODE)) {
-		umode_t amode = attr->ia_mode;
+		/*
+		 * Don't allow changing the mode of symlinks:
+		 *
+		 * (1) The vfs doesn't take the mode of symlinks into account
+		 *     during permission checking.
+		 * (2) This has never worked correctly. Most major filesystems
+		 *     did return EOPNOTSUPP due to interactions with POSIX ACLs
+		 *     but did still updated the mode of the symlink.
+		 *     This inconsistency led system call wrapper providers such
+		 *     as libc to block changing the mode of symlinks with
+		 *     EOPNOTSUPP already.
+		 * (3) To even do this in the first place one would have to use
+		 *     specific file descriptors and quite some effort.
+		 */
+		if (S_ISLNK(inode->i_mode))
+			return -EOPNOTSUPP;
+
 		/* Flag setting protected by i_mutex */
-		if (is_sxid(amode))
+		if (is_sxid(attr->ia_mode))
 			inode->i_flags &= ~S_NOSEC;
 	}
 
diff --git linux-libre-4.14.325-gnu1/fs/autofs4/waitq.c linux-libre-4.14.326-gnu1/fs/autofs4/waitq.c
index 961a12dc6dc8..5863532675e3 100644
--- linux-libre-4.14.325-gnu1/fs/autofs4/waitq.c
+++ linux-libre-4.14.326-gnu1/fs/autofs4/waitq.c
@@ -42,8 +42,9 @@ void autofs4_catatonic_mode(struct autofs_sb_info *sbi)
 		wq->status = -ENOENT; /* Magic is gone - report failure */
 		kfree(wq->name.name);
 		wq->name.name = NULL;
-		wq->wait_ctr--;
 		wake_up_interruptible(&wq->queue);
+		if (!--wq->wait_ctr)
+			kfree(wq);
 		wq = nwq;
 	}
 	fput(sbi->pipe);	/* Close the pipe */
diff --git linux-libre-4.14.325-gnu1/fs/btrfs/delayed-inode.c linux-libre-4.14.326-gnu1/fs/btrfs/delayed-inode.c
index 9f276d1dd29c..a09ad3fb04e1 100644
--- linux-libre-4.14.325-gnu1/fs/btrfs/delayed-inode.c
+++ linux-libre-4.14.326-gnu1/fs/btrfs/delayed-inode.c
@@ -1205,20 +1205,33 @@ static int __btrfs_run_delayed_items(struct btrfs_trans_handle *trans,
 		ret = __btrfs_commit_inode_delayed_items(trans, path,
 							 curr_node);
 		if (ret) {
-			btrfs_release_delayed_node(curr_node);
-			curr_node = NULL;
 			btrfs_abort_transaction(trans, ret);
 			break;
 		}
 
 		prev_node = curr_node;
 		curr_node = btrfs_next_delayed_node(curr_node);
+		/*
+		 * See the comment below about releasing path before releasing
+		 * node. If the commit of delayed items was successful the path
+		 * should always be released, but in case of an error, it may
+		 * point to locked extent buffers (a leaf at the very least).
+		 */
+		ASSERT(path->nodes[0] == NULL);
 		btrfs_release_delayed_node(prev_node);
 	}
 
+	/*
+	 * Release the path to avoid a potential deadlock and lockdep splat when
+	 * releasing the delayed node, as that requires taking the delayed node's
+	 * mutex. If another task starts running delayed items before we take
+	 * the mutex, it will first lock the mutex and then it may try to lock
+	 * the same btree path (leaf).
+	 */
+	btrfs_free_path(path);
+
 	if (curr_node)
 		btrfs_release_delayed_node(curr_node);
-	btrfs_free_path(path);
 	trans->block_rsv = block_rsv;
 
 	return ret;
diff --git linux-libre-4.14.325-gnu1/fs/btrfs/extent-tree.c linux-libre-4.14.326-gnu1/fs/btrfs/extent-tree.c
index e59987385673..deb01e59da02 100644
--- linux-libre-4.14.325-gnu1/fs/btrfs/extent-tree.c
+++ linux-libre-4.14.326-gnu1/fs/btrfs/extent-tree.c
@@ -1703,6 +1703,11 @@ again:
 		err = -ENOENT;
 		goto out;
 	} else if (WARN_ON(ret)) {
+		btrfs_print_leaf(path->nodes[0]);
+		btrfs_err(fs_info,
+"extent item not found for insert, bytenr %llu num_bytes %llu parent %llu root_objectid %llu owner %llu offset %llu",
+			  bytenr, num_bytes, parent, root_objectid, owner,
+			  offset);
 		err = -EIO;
 		goto out;
 	}
diff --git linux-libre-4.14.325-gnu1/fs/cifs/smb2ops.c linux-libre-4.14.326-gnu1/fs/cifs/smb2ops.c
index dec306a3b0f4..3287795c648e 100644
--- linux-libre-4.14.325-gnu1/fs/cifs/smb2ops.c
+++ linux-libre-4.14.326-gnu1/fs/cifs/smb2ops.c
@@ -78,6 +78,7 @@ smb2_add_credits(struct TCP_Server_Info *server, const unsigned int add,
 		*val = 65000; /* Don't get near 64K credits, avoid srv bugs */
 		printk_once(KERN_WARNING "server overflowed SMB3 credits\n");
 	}
+	WARN_ON_ONCE(server->in_flight == 0);
 	server->in_flight--;
 	if (server->in_flight == 0 && (optype & CIFS_OP_MASK) != CIFS_NEG_OP)
 		rc = change_conf(server);
diff --git linux-libre-4.14.325-gnu1/fs/ext2/xattr.c linux-libre-4.14.326-gnu1/fs/ext2/xattr.c
index bd1d68ff3a9f..437175bce22e 100644
--- linux-libre-4.14.325-gnu1/fs/ext2/xattr.c
+++ linux-libre-4.14.326-gnu1/fs/ext2/xattr.c
@@ -664,10 +664,10 @@ ext2_xattr_set2(struct inode *inode, struct buffer_head *old_bh,
 			/* We need to allocate a new block */
 			ext2_fsblk_t goal = ext2_group_first_block_no(sb,
 						EXT2_I(inode)->i_block_group);
-			int block = ext2_new_block(inode, goal, &error);
+			ext2_fsblk_t block = ext2_new_block(inode, goal, &error);
 			if (error)
 				goto cleanup;
-			ea_idebug(inode, "creating block %d", block);
+			ea_idebug(inode, "creating block %lu", block);
 
 			new_bh = sb_getblk(sb, block);
 			if (unlikely(!new_bh)) {
diff --git linux-libre-4.14.325-gnu1/fs/jfs/jfs_dmap.c linux-libre-4.14.326-gnu1/fs/jfs/jfs_dmap.c
index 464ddaf8ebd1..95e8f031c3f1 100644
--- linux-libre-4.14.325-gnu1/fs/jfs/jfs_dmap.c
+++ linux-libre-4.14.326-gnu1/fs/jfs/jfs_dmap.c
@@ -282,6 +282,7 @@ int dbUnmount(struct inode *ipbmap, int mounterror)
 
 	/* free the memory for the in-memory bmap. */
 	kfree(bmp);
+	JFS_SBI(ipbmap->i_sb)->bmap = NULL;
 
 	return (0);
 }
diff --git linux-libre-4.14.325-gnu1/fs/jfs/jfs_extent.c linux-libre-4.14.326-gnu1/fs/jfs/jfs_extent.c
index 2ae7d59ab10a..c971e8a6525d 100644
--- linux-libre-4.14.325-gnu1/fs/jfs/jfs_extent.c
+++ linux-libre-4.14.326-gnu1/fs/jfs/jfs_extent.c
@@ -521,6 +521,11 @@ extBalloc(struct inode *ip, s64 hint, s64 * nblocks, s64 * blkno)
 	 * blocks in the map. in that case, we'll start off with the
 	 * maximum free.
 	 */
+
+	/* give up if no space left */
+	if (bmp->db_maxfreebud == -1)
+		return -ENOSPC;
+
 	max = (s64) 1 << bmp->db_maxfreebud;
 	if (*nblocks >= max && *nblocks > nbperpage)
 		nb = nblks = (max > nbperpage) ? max : nbperpage;
diff --git linux-libre-4.14.325-gnu1/fs/jfs/jfs_imap.c linux-libre-4.14.326-gnu1/fs/jfs/jfs_imap.c
index f36ef68905a7..12fc01624458 100644
--- linux-libre-4.14.325-gnu1/fs/jfs/jfs_imap.c
+++ linux-libre-4.14.326-gnu1/fs/jfs/jfs_imap.c
@@ -208,6 +208,7 @@ int diUnmount(struct inode *ipimap, int mounterror)
 	 * free in-memory control structure
 	 */
 	kfree(imap);
+	JFS_IP(ipimap)->i_imap = NULL;
 
 	return (0);
 }
diff --git linux-libre-4.14.325-gnu1/fs/lockd/mon.c linux-libre-4.14.326-gnu1/fs/lockd/mon.c
index 9fbbd11f9ecb..4a2da67fc255 100644
--- linux-libre-4.14.325-gnu1/fs/lockd/mon.c
+++ linux-libre-4.14.326-gnu1/fs/lockd/mon.c
@@ -274,6 +274,9 @@ static struct nsm_handle *nsm_create_handle(const struct sockaddr *sap,
 {
 	struct nsm_handle *new;
 
+	if (!hostname)
+		return NULL;
+
 	new = kzalloc(sizeof(*new) + hostname_len + 1, GFP_KERNEL);
 	if (unlikely(new == NULL))
 		return NULL;
diff --git linux-libre-4.14.325-gnu1/fs/namei.c linux-libre-4.14.326-gnu1/fs/namei.c
index a8c36363e6b1..b6de8f0a1607 100644
--- linux-libre-4.14.325-gnu1/fs/namei.c
+++ linux-libre-4.14.326-gnu1/fs/namei.c
@@ -2615,7 +2615,7 @@ int path_pts(struct path *path)
 	this.name = "pts";
 	this.len = 3;
 	child = d_hash_and_lookup(parent, &this);
-	if (!child)
+	if (IS_ERR_OR_NULL(child))
 		return -ENOENT;
 
 	path->dentry = child;
diff --git linux-libre-4.14.325-gnu1/fs/nfs/blocklayout/dev.c linux-libre-4.14.326-gnu1/fs/nfs/blocklayout/dev.c
index 70c4165d2d74..a16c85241262 100644
--- linux-libre-4.14.325-gnu1/fs/nfs/blocklayout/dev.c
+++ linux-libre-4.14.326-gnu1/fs/nfs/blocklayout/dev.c
@@ -422,7 +422,7 @@ bl_parse_concat(struct nfs_server *server, struct pnfs_block_dev *d,
 	int ret, i;
 
 	d->children = kcalloc(v->concat.volumes_count,
-			sizeof(struct pnfs_block_dev), GFP_KERNEL);
+			sizeof(struct pnfs_block_dev), gfp_mask);
 	if (!d->children)
 		return -ENOMEM;
 
@@ -451,7 +451,7 @@ bl_parse_stripe(struct nfs_server *server, struct pnfs_block_dev *d,
 	int ret, i;
 
 	d->children = kcalloc(v->stripe.volumes_count,
-			sizeof(struct pnfs_block_dev), GFP_KERNEL);
+			sizeof(struct pnfs_block_dev), gfp_mask);
 	if (!d->children)
 		return -ENOMEM;
 
diff --git linux-libre-4.14.325-gnu1/fs/nfs/pnfs_dev.c linux-libre-4.14.326-gnu1/fs/nfs/pnfs_dev.c
index 2961fcd7a2df..da3852ff1fb3 100644
--- linux-libre-4.14.325-gnu1/fs/nfs/pnfs_dev.c
+++ linux-libre-4.14.326-gnu1/fs/nfs/pnfs_dev.c
@@ -153,7 +153,7 @@ nfs4_get_device_info(struct nfs_server *server,
 		set_bit(NFS_DEVICEID_NOCACHE, &d->flags);
 
 out_free_pages:
-	for (i = 0; i < max_pages; i++)
+	while (--i >= 0)
 		__free_page(pages[i]);
 	kfree(pages);
 out_free_pdev:
diff --git linux-libre-4.14.325-gnu1/fs/nfsd/blocklayoutxdr.c linux-libre-4.14.326-gnu1/fs/nfsd/blocklayoutxdr.c
index 442543304930..2455dc8be18a 100644
--- linux-libre-4.14.325-gnu1/fs/nfsd/blocklayoutxdr.c
+++ linux-libre-4.14.326-gnu1/fs/nfsd/blocklayoutxdr.c
@@ -82,6 +82,15 @@ nfsd4_block_encode_getdeviceinfo(struct xdr_stream *xdr,
 	int len = sizeof(__be32), ret, i;
 	__be32 *p;
 
+	/*
+	 * See paragraph 5 of RFC 8881 S18.40.3.
+	 */
+	if (!gdp->gd_maxcount) {
+		if (xdr_stream_encode_u32(xdr, 0) != XDR_UNIT)
+			return nfserr_resource;
+		return nfs_ok;
+	}
+
 	p = xdr_reserve_space(xdr, len + sizeof(__be32));
 	if (!p)
 		return nfserr_resource;
diff --git linux-libre-4.14.325-gnu1/fs/nfsd/flexfilelayoutxdr.c linux-libre-4.14.326-gnu1/fs/nfsd/flexfilelayoutxdr.c
index e81d2a5cf381..bb205328e043 100644
--- linux-libre-4.14.325-gnu1/fs/nfsd/flexfilelayoutxdr.c
+++ linux-libre-4.14.326-gnu1/fs/nfsd/flexfilelayoutxdr.c
@@ -85,6 +85,15 @@ nfsd4_ff_encode_getdeviceinfo(struct xdr_stream *xdr,
 	int addr_len;
 	__be32 *p;
 
+	/*
+	 * See paragraph 5 of RFC 8881 S18.40.3.
+	 */
+	if (!gdp->gd_maxcount) {
+		if (xdr_stream_encode_u32(xdr, 0) != XDR_UNIT)
+			return nfserr_resource;
+		return nfs_ok;
+	}
+
 	/* len + padding for two strings */
 	addr_len = 16 + da->netaddr.netid_len + da->netaddr.addr_len;
 	ver_len = 20;
diff --git linux-libre-4.14.325-gnu1/fs/nfsd/nfs4proc.c linux-libre-4.14.326-gnu1/fs/nfsd/nfs4proc.c
index aec99cd4080a..48bdea57ad68 100644
--- linux-libre-4.14.325-gnu1/fs/nfsd/nfs4proc.c
+++ linux-libre-4.14.326-gnu1/fs/nfsd/nfs4proc.c
@@ -870,8 +870,8 @@ nfsd4_rename(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 			     rename->rn_tname, rename->rn_tnamelen);
 	if (status)
 		return status;
-	set_change_info(&rename->rn_sinfo, &cstate->current_fh);
-	set_change_info(&rename->rn_tinfo, &cstate->save_fh);
+	set_change_info(&rename->rn_sinfo, &cstate->save_fh);
+	set_change_info(&rename->rn_tinfo, &cstate->current_fh);
 	return nfs_ok;
 }
 
diff --git linux-libre-4.14.325-gnu1/fs/nfsd/nfs4xdr.c linux-libre-4.14.326-gnu1/fs/nfsd/nfs4xdr.c
index d34ed6575e8f..997d3134beb3 100644
--- linux-libre-4.14.325-gnu1/fs/nfsd/nfs4xdr.c
+++ linux-libre-4.14.326-gnu1/fs/nfsd/nfs4xdr.c
@@ -4091,20 +4091,17 @@ nfsd4_encode_getdeviceinfo(struct nfsd4_compoundres *resp, __be32 nfserr,
 
 	*p++ = cpu_to_be32(gdev->gd_layout_type);
 
-	/* If maxcount is 0 then just update notifications */
-	if (gdev->gd_maxcount != 0) {
-		ops = nfsd4_layout_ops[gdev->gd_layout_type];
-		nfserr = ops->encode_getdeviceinfo(xdr, gdev);
-		if (nfserr) {
-			/*
-			 * We don't bother to burden the layout drivers with
-			 * enforcing gd_maxcount, just tell the client to
-			 * come back with a bigger buffer if it's not enough.
-			 */
-			if (xdr->buf->len + 4 > gdev->gd_maxcount)
-				goto toosmall;
-			return nfserr;
-		}
+	ops = nfsd4_layout_ops[gdev->gd_layout_type];
+	nfserr = ops->encode_getdeviceinfo(xdr, gdev);
+	if (nfserr) {
+		/*
+		 * We don't bother to burden the layout drivers with
+		 * enforcing gd_maxcount, just tell the client to
+		 * come back with a bigger buffer if it's not enough.
+		 */
+		if (xdr->buf->len + 4 > gdev->gd_maxcount)
+			goto toosmall;
+		return nfserr;
 	}
 
 	if (gdev->gd_notify_types) {
diff --git linux-libre-4.14.325-gnu1/fs/nilfs2/alloc.c linux-libre-4.14.326-gnu1/fs/nilfs2/alloc.c
index 03b8ba933eb2..095cf8b5049a 100644
--- linux-libre-4.14.325-gnu1/fs/nilfs2/alloc.c
+++ linux-libre-4.14.326-gnu1/fs/nilfs2/alloc.c
@@ -214,7 +214,8 @@ static int nilfs_palloc_get_block(struct inode *inode, unsigned long blkoff,
 	int ret;
 
 	spin_lock(lock);
-	if (prev->bh && blkoff == prev->blkoff) {
+	if (prev->bh && blkoff == prev->blkoff &&
+	    likely(buffer_uptodate(prev->bh))) {
 		get_bh(prev->bh);
 		*bhp = prev->bh;
 		spin_unlock(lock);
diff --git linux-libre-4.14.325-gnu1/fs/nilfs2/inode.c linux-libre-4.14.326-gnu1/fs/nilfs2/inode.c
index bc5f447d93bd..7fe5b55b6476 100644
--- linux-libre-4.14.325-gnu1/fs/nilfs2/inode.c
+++ linux-libre-4.14.326-gnu1/fs/nilfs2/inode.c
@@ -1045,7 +1045,7 @@ int nilfs_load_inode_block(struct inode *inode, struct buffer_head **pbh)
 	int err;
 
 	spin_lock(&nilfs->ns_inode_lock);
-	if (ii->i_bh == NULL) {
+	if (ii->i_bh == NULL || unlikely(!buffer_uptodate(ii->i_bh))) {
 		spin_unlock(&nilfs->ns_inode_lock);
 		err = nilfs_ifile_get_inode_block(ii->i_root->ifile,
 						  inode->i_ino, pbh);
@@ -1054,7 +1054,10 @@ int nilfs_load_inode_block(struct inode *inode, struct buffer_head **pbh)
 		spin_lock(&nilfs->ns_inode_lock);
 		if (ii->i_bh == NULL)
 			ii->i_bh = *pbh;
-		else {
+		else if (unlikely(!buffer_uptodate(ii->i_bh))) {
+			__brelse(ii->i_bh);
+			ii->i_bh = *pbh;
+		} else {
 			brelse(*pbh);
 			*pbh = ii->i_bh;
 		}
diff --git linux-libre-4.14.325-gnu1/fs/nilfs2/segment.c linux-libre-4.14.326-gnu1/fs/nilfs2/segment.c
index f4215dbaca0d..ca4b1675c147 100644
--- linux-libre-4.14.325-gnu1/fs/nilfs2/segment.c
+++ linux-libre-4.14.326-gnu1/fs/nilfs2/segment.c
@@ -743,6 +743,11 @@ static size_t nilfs_lookup_dirty_data_buffers(struct inode *inode,
 			break;
 
 		lock_page(page);
+		if (unlikely(page->mapping != mapping)) {
+			/* Exclude pages removed from the address space */
+			unlock_page(page);
+			continue;
+		}
 		if (!page_has_buffers(page))
 			create_empty_buffers(page, i_blocksize(inode), 0);
 		unlock_page(page);
diff --git linux-libre-4.14.325-gnu1/fs/nls/nls_base.c linux-libre-4.14.326-gnu1/fs/nls/nls_base.c
index 52ccd34b1e79..a026dbd3593f 100644
--- linux-libre-4.14.325-gnu1/fs/nls/nls_base.c
+++ linux-libre-4.14.326-gnu1/fs/nls/nls_base.c
@@ -272,7 +272,7 @@ int unregister_nls(struct nls_table * nls)
 	return -EINVAL;
 }
 
-static struct nls_table *find_nls(char *charset)
+static struct nls_table *find_nls(const char *charset)
 {
 	struct nls_table *nls;
 	spin_lock(&nls_lock);
@@ -288,7 +288,7 @@ static struct nls_table *find_nls(char *charset)
 	return nls;
 }
 
-struct nls_table *load_nls(char *charset)
+struct nls_table *load_nls(const char *charset)
 {
 	return try_then_request_module(find_nls(charset), "nls_%s", charset);
 }
diff --git linux-libre-4.14.325-gnu1/fs/ocfs2/namei.c linux-libre-4.14.326-gnu1/fs/ocfs2/namei.c
index 6ec15ffeb562..f36a338bf727 100644
--- linux-libre-4.14.325-gnu1/fs/ocfs2/namei.c
+++ linux-libre-4.14.326-gnu1/fs/ocfs2/namei.c
@@ -1537,6 +1537,10 @@ static int ocfs2_rename(struct inode *old_dir,
 		status = ocfs2_add_entry(handle, new_dentry, old_inode,
 					 OCFS2_I(old_inode)->ip_blkno,
 					 new_dir_bh, &target_insert);
+		if (status < 0) {
+			mlog_errno(status);
+			goto bail;
+		}
 	}
 
 	old_inode->i_ctime = current_time(old_inode);
diff --git linux-libre-4.14.325-gnu1/fs/proc/base.c linux-libre-4.14.326-gnu1/fs/proc/base.c
index 5f68454cf421..1230e732755b 100644
--- linux-libre-4.14.325-gnu1/fs/proc/base.c
+++ linux-libre-4.14.326-gnu1/fs/proc/base.c
@@ -3335,7 +3335,8 @@ static int proc_tid_comm_permission(struct inode *inode, int mask)
 }
 
 static const struct inode_operations proc_tid_comm_inode_operations = {
-		.permission = proc_tid_comm_permission,
+		.setattr	= proc_setattr,
+		.permission	= proc_tid_comm_permission,
 };
 
 /*
diff --git linux-libre-4.14.325-gnu1/fs/pstore/ram_core.c linux-libre-4.14.326-gnu1/fs/pstore/ram_core.c
index b56cf56ae926..58ac4e1a61a3 100644
--- linux-libre-4.14.325-gnu1/fs/pstore/ram_core.c
+++ linux-libre-4.14.326-gnu1/fs/pstore/ram_core.c
@@ -492,7 +492,7 @@ static int persistent_ram_post_init(struct persistent_ram_zone *prz, u32 sig,
 	sig ^= PERSISTENT_RAM_SIG;
 
 	if (prz->buffer->sig == sig) {
-		if (buffer_size(prz) == 0) {
+		if (buffer_size(prz) == 0 && buffer_start(prz) == 0) {
 			pr_debug("found existing empty buffer\n");
 			return 0;
 		}
diff --git linux-libre-4.14.325-gnu1/fs/reiserfs/journal.c linux-libre-4.14.326-gnu1/fs/reiserfs/journal.c
index 1a6e6343fed3..53d2e397c123 100644
--- linux-libre-4.14.325-gnu1/fs/reiserfs/journal.c
+++ linux-libre-4.14.326-gnu1/fs/reiserfs/journal.c
@@ -2333,7 +2333,7 @@ static struct buffer_head *reiserfs_breada(struct block_device *dev,
 	int i, j;
 
 	bh = __getblk(dev, block, bufsize);
-	if (buffer_uptodate(bh))
+	if (!bh || buffer_uptodate(bh))
 		return (bh);
 
 	if (block + BUFNR > max_block) {
@@ -2343,6 +2343,8 @@ static struct buffer_head *reiserfs_breada(struct block_device *dev,
 	j = 1;
 	for (i = 1; i < blocks; i++) {
 		bh = __getblk(dev, block + i, bufsize);
+		if (!bh)
+			break;
 		if (buffer_uptodate(bh)) {
 			brelse(bh);
 			break;
diff --git linux-libre-4.14.325-gnu1/fs/udf/balloc.c linux-libre-4.14.326-gnu1/fs/udf/balloc.c
index f4f1a278771f..6aaca99dcc9d 100644
--- linux-libre-4.14.325-gnu1/fs/udf/balloc.c
+++ linux-libre-4.14.326-gnu1/fs/udf/balloc.c
@@ -36,18 +36,41 @@ static int read_block_bitmap(struct super_block *sb,
 			     unsigned long bitmap_nr)
 {
 	struct buffer_head *bh = NULL;
-	int retval = 0;
+	int i;
+	int max_bits, off, count;
 	struct kernel_lb_addr loc;
 
 	loc.logicalBlockNum = bitmap->s_extPosition;
 	loc.partitionReferenceNum = UDF_SB(sb)->s_partition;
 
 	bh = udf_tread(sb, udf_get_lb_pblock(sb, &loc, block));
+	bitmap->s_block_bitmap[bitmap_nr] = bh;
 	if (!bh)
-		retval = -EIO;
+		return -EIO;
 
-	bitmap->s_block_bitmap[bitmap_nr] = bh;
-	return retval;
+	/* Check consistency of Space Bitmap buffer. */
+	max_bits = sb->s_blocksize * 8;
+	if (!bitmap_nr) {
+		off = sizeof(struct spaceBitmapDesc) << 3;
+		count = min(max_bits - off, bitmap->s_nr_groups);
+	} else {
+		/*
+		 * Rough check if bitmap number is too big to have any bitmap
+		 * blocks reserved.
+		 */
+		if (bitmap_nr >
+		    (bitmap->s_nr_groups >> (sb->s_blocksize_bits + 3)) + 2)
+			return 0;
+		off = 0;
+		count = bitmap->s_nr_groups - bitmap_nr * max_bits +
+				(sizeof(struct spaceBitmapDesc) << 3);
+		count = min(count, max_bits);
+	}
+
+	for (i = 0; i < count; i++)
+		if (udf_test_bit(i + off, bh->b_data))
+			return -EFSCORRUPTED;
+	return 0;
 }
 
 static int __load_block_bitmap(struct super_block *sb,
diff --git linux-libre-4.14.325-gnu1/fs/udf/inode.c linux-libre-4.14.326-gnu1/fs/udf/inode.c
index c47b9c3a97ef..a9fef5bb9d25 100644
--- linux-libre-4.14.325-gnu1/fs/udf/inode.c
+++ linux-libre-4.14.326-gnu1/fs/udf/inode.c
@@ -50,15 +50,15 @@ static int udf_update_inode(struct inode *, int);
 static int udf_sync_inode(struct inode *inode);
 static int udf_alloc_i_data(struct inode *inode, size_t size);
 static sector_t inode_getblk(struct inode *, sector_t, int *, int *);
-static int8_t udf_insert_aext(struct inode *, struct extent_position,
-			      struct kernel_lb_addr, uint32_t);
+static int udf_insert_aext(struct inode *, struct extent_position,
+			   struct kernel_lb_addr, uint32_t);
 static void udf_split_extents(struct inode *, int *, int, int,
 			      struct kernel_long_ad *, int *);
 static void udf_prealloc_extents(struct inode *, int, int,
 				 struct kernel_long_ad *, int *);
 static void udf_merge_extents(struct inode *, struct kernel_long_ad *, int *);
-static void udf_update_extents(struct inode *, struct kernel_long_ad *, int,
-			       int, struct extent_position *);
+static int udf_update_extents(struct inode *, struct kernel_long_ad *, int,
+			      int, struct extent_position *);
 static int udf_get_block(struct inode *, sector_t, struct buffer_head *, int);
 
 static void __udf_clear_extent_cache(struct inode *inode)
@@ -883,7 +883,9 @@ static sector_t inode_getblk(struct inode *inode, sector_t block,
 	/* write back the new extents, inserting new extents if the new number
 	 * of extents is greater than the old number, and deleting extents if
 	 * the new number of extents is less than the old number */
-	udf_update_extents(inode, laarr, startnum, endnum, &prev_epos);
+	*err = udf_update_extents(inode, laarr, startnum, endnum, &prev_epos);
+	if (*err < 0)
+		goto out_free;
 
 	newblock = udf_get_pblock(inode->i_sb, newblocknum,
 				iinfo->i_location.partitionReferenceNum, 0);
@@ -1151,21 +1153,30 @@ static void udf_merge_extents(struct inode *inode, struct kernel_long_ad *laarr,
 	}
 }
 
-static void udf_update_extents(struct inode *inode, struct kernel_long_ad *laarr,
-			       int startnum, int endnum,
-			       struct extent_position *epos)
+static int udf_update_extents(struct inode *inode, struct kernel_long_ad *laarr,
+			      int startnum, int endnum,
+			      struct extent_position *epos)
 {
 	int start = 0, i;
 	struct kernel_lb_addr tmploc;
 	uint32_t tmplen;
+	int err;
 
 	if (startnum > endnum) {
 		for (i = 0; i < (startnum - endnum); i++)
 			udf_delete_aext(inode, *epos);
 	} else if (startnum < endnum) {
 		for (i = 0; i < (endnum - startnum); i++) {
-			udf_insert_aext(inode, *epos, laarr[i].extLocation,
-					laarr[i].extLength);
+			err = udf_insert_aext(inode, *epos,
+					      laarr[i].extLocation,
+					      laarr[i].extLength);
+			/*
+			 * If we fail here, we are likely corrupting the extent
+			 * list and leaking blocks. At least stop early to
+			 * limit the damage.
+			 */
+			if (err < 0)
+				return err;
 			udf_next_aext(inode, epos, &laarr[i].extLocation,
 				      &laarr[i].extLength, 1);
 			start++;
@@ -1177,6 +1188,7 @@ static void udf_update_extents(struct inode *inode, struct kernel_long_ad *laarr
 		udf_write_aext(inode, epos, &laarr[i].extLocation,
 			       laarr[i].extLength, 1);
 	}
+	return 0;
 }
 
 struct buffer_head *udf_bread(struct inode *inode, int block,
@@ -2172,12 +2184,13 @@ int8_t udf_current_aext(struct inode *inode, struct extent_position *epos,
 	return etype;
 }
 
-static int8_t udf_insert_aext(struct inode *inode, struct extent_position epos,
-			      struct kernel_lb_addr neloc, uint32_t nelen)
+static int udf_insert_aext(struct inode *inode, struct extent_position epos,
+			   struct kernel_lb_addr neloc, uint32_t nelen)
 {
 	struct kernel_lb_addr oeloc;
 	uint32_t oelen;
 	int8_t etype;
+	int err;
 
 	if (epos.bh)
 		get_bh(epos.bh);
@@ -2187,10 +2200,10 @@ static int8_t udf_insert_aext(struct inode *inode, struct extent_position epos,
 		neloc = oeloc;
 		nelen = (etype << 30) | oelen;
 	}
-	udf_add_aext(inode, &epos, &neloc, nelen, 1);
+	err = udf_add_aext(inode, &epos, &neloc, nelen, 1);
 	brelse(epos.bh);
 
-	return (nelen >> 30);
+	return err;
 }
 
 int8_t udf_delete_aext(struct inode *inode, struct extent_position epos)
diff --git linux-libre-4.14.325-gnu1/include/linux/if_arp.h linux-libre-4.14.326-gnu1/include/linux/if_arp.h
index a9b09c7c2ce0..c5a2e0446570 100644
--- linux-libre-4.14.325-gnu1/include/linux/if_arp.h
+++ linux-libre-4.14.326-gnu1/include/linux/if_arp.h
@@ -56,6 +56,10 @@ static inline bool dev_is_mac_header_xmit(const struct net_device *dev)
 	case ARPHRD_NONE:
 	case ARPHRD_RAWIP:
 	case ARPHRD_PIMREG:
+	/* PPP adds its l2 header automatically in ppp_start_xmit().
+	 * This makes it look like an l3 device to __bpf_redirect() and tcf_mirred_init().
+	 */
+	case ARPHRD_PPP:
 		return false;
 	default:
 		return true;
diff --git linux-libre-4.14.325-gnu1/include/linux/nls.h linux-libre-4.14.326-gnu1/include/linux/nls.h
index 499e486b3722..e0bf8367b274 100644
--- linux-libre-4.14.325-gnu1/include/linux/nls.h
+++ linux-libre-4.14.326-gnu1/include/linux/nls.h
@@ -47,7 +47,7 @@ enum utf16_endian {
 /* nls_base.c */
 extern int __register_nls(struct nls_table *, struct module *);
 extern int unregister_nls(struct nls_table *);
-extern struct nls_table *load_nls(char *);
+extern struct nls_table *load_nls(const char *charset);
 extern void unload_nls(struct nls_table *);
 extern struct nls_table *load_nls_default(void);
 #define register_nls(nls) __register_nls((nls), THIS_MODULE)
diff --git linux-libre-4.14.325-gnu1/include/linux/perf_event.h linux-libre-4.14.326-gnu1/include/linux/perf_event.h
index 5efd8109ad0a..e175d5e3acd6 100644
--- linux-libre-4.14.325-gnu1/include/linux/perf_event.h
+++ linux-libre-4.14.326-gnu1/include/linux/perf_event.h
@@ -985,15 +985,31 @@ extern void perf_event_output(struct perf_event *event,
 			      struct pt_regs *regs);
 
 static inline bool
-is_default_overflow_handler(struct perf_event *event)
+__is_default_overflow_handler(perf_overflow_handler_t overflow_handler)
 {
-	if (likely(event->overflow_handler == perf_event_output_forward))
+	if (likely(overflow_handler == perf_event_output_forward))
 		return true;
-	if (unlikely(event->overflow_handler == perf_event_output_backward))
+	if (unlikely(overflow_handler == perf_event_output_backward))
 		return true;
 	return false;
 }
 
+#define is_default_overflow_handler(event) \
+	__is_default_overflow_handler((event)->overflow_handler)
+
+#ifdef CONFIG_BPF_SYSCALL
+static inline bool uses_default_overflow_handler(struct perf_event *event)
+{
+	if (likely(is_default_overflow_handler(event)))
+		return true;
+
+	return __is_default_overflow_handler(event->orig_overflow_handler);
+}
+#else
+#define uses_default_overflow_handler(event) \
+	is_default_overflow_handler(event)
+#endif
+
 extern void
 perf_event_header__init_id(struct perf_event_header *header,
 			   struct perf_sample_data *data,
diff --git linux-libre-4.14.325-gnu1/include/net/lwtunnel.h linux-libre-4.14.326-gnu1/include/net/lwtunnel.h
index d747ef975cd8..0ab4647ccc24 100644
--- linux-libre-4.14.325-gnu1/include/net/lwtunnel.h
+++ linux-libre-4.14.326-gnu1/include/net/lwtunnel.h
@@ -16,9 +16,12 @@
 #define LWTUNNEL_STATE_INPUT_REDIRECT	BIT(1)
 #define LWTUNNEL_STATE_XMIT_REDIRECT	BIT(2)
 
+/* LWTUNNEL_XMIT_CONTINUE should be distinguishable from dst_output return
+ * values (NET_XMIT_xxx and NETDEV_TX_xxx in linux/netdevice.h) for safety.
+ */
 enum {
 	LWTUNNEL_XMIT_DONE,
-	LWTUNNEL_XMIT_CONTINUE,
+	LWTUNNEL_XMIT_CONTINUE = 0x100,
 };
 
 
diff --git linux-libre-4.14.325-gnu1/include/scsi/scsi_host.h linux-libre-4.14.326-gnu1/include/scsi/scsi_host.h
index 9c1e4bad6581..1294b6ce9884 100644
--- linux-libre-4.14.325-gnu1/include/scsi/scsi_host.h
+++ linux-libre-4.14.326-gnu1/include/scsi/scsi_host.h
@@ -786,7 +786,7 @@ extern void scsi_rescan_device(struct device *);
 extern void scsi_remove_host(struct Scsi_Host *);
 extern struct Scsi_Host *scsi_host_get(struct Scsi_Host *);
 extern void scsi_host_put(struct Scsi_Host *t);
-extern struct Scsi_Host *scsi_host_lookup(unsigned short);
+extern struct Scsi_Host *scsi_host_lookup(unsigned int hostnum);
 extern const char *scsi_host_state_name(enum scsi_host_state);
 extern void scsi_cmd_get_serial(struct Scsi_Host *, struct scsi_cmnd *);
 
diff --git linux-libre-4.14.325-gnu1/include/uapi/linux/sync_file.h linux-libre-4.14.326-gnu1/include/uapi/linux/sync_file.h
index ee2dcfb3d660..d7f7c04a6e0c 100644
--- linux-libre-4.14.325-gnu1/include/uapi/linux/sync_file.h
+++ linux-libre-4.14.326-gnu1/include/uapi/linux/sync_file.h
@@ -52,7 +52,7 @@ struct sync_fence_info {
  * @name:	name of fence
  * @status:	status of fence. 1: signaled 0:active <0:error
  * @flags:	sync_file_info flags
- * @num_fences	number of fences in the sync_file
+ * @num_fences:	number of fences in the sync_file
  * @pad:	padding for 64-bit alignment, should always be zero
  * @sync_fence_info: pointer to array of structs sync_fence_info with all
  *		 fences in the sync_file
diff --git linux-libre-4.14.325-gnu1/kernel/auditsc.c linux-libre-4.14.326-gnu1/kernel/auditsc.c
index ffa8d64f6fef..fb474e36c971 100644
--- linux-libre-4.14.325-gnu1/kernel/auditsc.c
+++ linux-libre-4.14.326-gnu1/kernel/auditsc.c
@@ -1899,6 +1899,8 @@ void __audit_inode_child(struct inode *parent,
 		}
 	}
 
+	cond_resched();
+
 	/* is there a matching child entry? */
 	list_for_each_entry(n, &context->names_list, list) {
 		/* can only match entries that have a name */
diff --git linux-libre-4.14.325-gnu1/kernel/cgroup/namespace.c linux-libre-4.14.326-gnu1/kernel/cgroup/namespace.c
index b05f1dd58a62..313e66b8c662 100644
--- linux-libre-4.14.325-gnu1/kernel/cgroup/namespace.c
+++ linux-libre-4.14.326-gnu1/kernel/cgroup/namespace.c
@@ -148,9 +148,3 @@ const struct proc_ns_operations cgroupns_operations = {
 	.install	= cgroupns_install,
 	.owner		= cgroupns_owner,
 };
-
-static __init int cgroup_namespaces_init(void)
-{
-	return 0;
-}
-subsys_initcall(cgroup_namespaces_init);
diff --git linux-libre-4.14.325-gnu1/kernel/module.c linux-libre-4.14.326-gnu1/kernel/module.c
index 2cd7de23cb1f..b9f582545b77 100644
--- linux-libre-4.14.325-gnu1/kernel/module.c
+++ linux-libre-4.14.326-gnu1/kernel/module.c
@@ -2227,15 +2227,26 @@ static void free_module(struct module *mod)
 void *__symbol_get(const char *symbol)
 {
 	struct module *owner;
+	enum mod_license license;
 	const struct kernel_symbol *sym;
 
 	preempt_disable();
-	sym = find_symbol(symbol, &owner, NULL, NULL, true, true);
-	if (sym && strong_try_module_get(owner))
+	sym = find_symbol(symbol, &owner, NULL, &license, true, true);
+	if (!sym)
+		goto fail;
+	if (license != GPL_ONLY) {
+		pr_warn("failing symbol_get of non-GPLONLY symbol %s.\n",
+			symbol);
+		goto fail;
+	}
+	if (strong_try_module_get(owner))
 		sym = NULL;
 	preempt_enable();
 
 	return sym ? (void *)sym->value : NULL;
+fail:
+	preempt_enable();
+	return NULL;
 }
 EXPORT_SYMBOL_GPL(__symbol_get);
 
diff --git linux-libre-4.14.325-gnu1/lib/kobject.c linux-libre-4.14.326-gnu1/lib/kobject.c
index bbbb067de8ec..b908655c5812 100644
--- linux-libre-4.14.325-gnu1/lib/kobject.c
+++ linux-libre-4.14.326-gnu1/lib/kobject.c
@@ -814,6 +814,11 @@ int kset_register(struct kset *k)
 	if (!k)
 		return -EINVAL;
 
+	if (!k->kobj.ktype) {
+		pr_err("must have a ktype to be initialized properly!\n");
+		return -EINVAL;
+	}
+
 	kset_init(k);
 	err = kobject_add_internal(&k->kobj);
 	if (err)
diff --git linux-libre-4.14.325-gnu1/lib/mpi/mpi-cmp.c linux-libre-4.14.326-gnu1/lib/mpi/mpi-cmp.c
index d25e9e96c310..ceaebe181cd7 100644
--- linux-libre-4.14.325-gnu1/lib/mpi/mpi-cmp.c
+++ linux-libre-4.14.326-gnu1/lib/mpi/mpi-cmp.c
@@ -25,8 +25,12 @@ int mpi_cmp_ui(MPI u, unsigned long v)
 	mpi_limb_t limb = v;
 
 	mpi_normalize(u);
-	if (!u->nlimbs && !limb)
-		return 0;
+	if (u->nlimbs == 0) {
+		if (v == 0)
+			return 0;
+		else
+			return -1;
+	}
 	if (u->sign)
 		return -1;
 	if (u->nlimbs > 1)
diff --git linux-libre-4.14.325-gnu1/lib/ubsan.c linux-libre-4.14.326-gnu1/lib/ubsan.c
index c652b4a820cc..1e9e2ab25539 100644
--- linux-libre-4.14.325-gnu1/lib/ubsan.c
+++ linux-libre-4.14.326-gnu1/lib/ubsan.c
@@ -143,11 +143,6 @@ static void val_to_string(char *str, size_t size, struct type_descriptor *type,
 	}
 }
 
-static bool location_is_valid(struct source_location *loc)
-{
-	return loc->file_name != NULL;
-}
-
 static DEFINE_SPINLOCK(report_lock);
 
 static void ubsan_prologue(struct source_location *location,
@@ -354,25 +349,6 @@ void __ubsan_handle_type_mismatch_v1(struct type_mismatch_data_v1 *data,
 }
 EXPORT_SYMBOL(__ubsan_handle_type_mismatch_v1);
 
-void __ubsan_handle_nonnull_return(struct nonnull_return_data *data)
-{
-	unsigned long flags;
-
-	if (suppress_report(&data->location))
-		return;
-
-	ubsan_prologue(&data->location, &flags);
-
-	pr_err("null pointer returned from function declared to never return null\n");
-
-	if (location_is_valid(&data->attr_location))
-		print_source_location("returns_nonnull attribute specified in",
-				&data->attr_location);
-
-	ubsan_epilogue(&flags);
-}
-EXPORT_SYMBOL(__ubsan_handle_nonnull_return);
-
 void __ubsan_handle_vla_bound_not_positive(struct vla_bound_data *data,
 					void *bound)
 {
diff --git linux-libre-4.14.325-gnu1/lib/ubsan.h linux-libre-4.14.326-gnu1/lib/ubsan.h
index 7e30b26497e0..f4d8d0bd4016 100644
--- linux-libre-4.14.325-gnu1/lib/ubsan.h
+++ linux-libre-4.14.326-gnu1/lib/ubsan.h
@@ -57,11 +57,6 @@ struct nonnull_arg_data {
 	int arg_index;
 };
 
-struct nonnull_return_data {
-	struct source_location location;
-	struct source_location attr_location;
-};
-
 struct vla_bound_data {
 	struct source_location location;
 	struct type_descriptor *type;
diff --git linux-libre-4.14.325-gnu1/net/9p/trans_virtio.c linux-libre-4.14.326-gnu1/net/9p/trans_virtio.c
index c6a46e8e9eda..25f5caa57289 100644
--- linux-libre-4.14.325-gnu1/net/9p/trans_virtio.c
+++ linux-libre-4.14.326-gnu1/net/9p/trans_virtio.c
@@ -401,7 +401,7 @@ p9_virtio_zc_request(struct p9_client *client, struct p9_req_t *req,
 	struct page **in_pages = NULL, **out_pages = NULL;
 	struct virtio_chan *chan = client->trans;
 	struct scatterlist *sgs[4];
-	size_t offs;
+	size_t offs = 0;
 	int need_drop = 0;
 
 	p9_debug(P9_DEBUG_TRANS, "virtio request\n");
diff --git linux-libre-4.14.325-gnu1/net/core/sock.c linux-libre-4.14.326-gnu1/net/core/sock.c
index a7a0bc9c2a9f..5b9f51a27dc0 100644
--- linux-libre-4.14.325-gnu1/net/core/sock.c
+++ linux-libre-4.14.326-gnu1/net/core/sock.c
@@ -670,7 +670,8 @@ bool sk_mc_loop(struct sock *sk)
 		return false;
 	if (!sk)
 		return true;
-	switch (sk->sk_family) {
+	/* IPV6_ADDRFORM can change sk->sk_family under us. */
+	switch (READ_ONCE(sk->sk_family)) {
 	case AF_INET:
 		return inet_sk(sk)->mc_loop;
 #if IS_ENABLED(CONFIG_IPV6)
@@ -2064,9 +2065,9 @@ static long sock_wait_for_wmem(struct sock *sk, long timeo)
 		prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
 		if (refcount_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf)
 			break;
-		if (sk->sk_shutdown & SEND_SHUTDOWN)
+		if (READ_ONCE(sk->sk_shutdown) & SEND_SHUTDOWN)
 			break;
-		if (sk->sk_err)
+		if (READ_ONCE(sk->sk_err))
 			break;
 		timeo = schedule_timeout(timeo);
 	}
@@ -2094,7 +2095,7 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
 			goto failure;
 
 		err = -EPIPE;
-		if (sk->sk_shutdown & SEND_SHUTDOWN)
+		if (READ_ONCE(sk->sk_shutdown) & SEND_SHUTDOWN)
 			goto failure;
 
 		if (sk_wmem_alloc_get(sk) < sk->sk_sndbuf)
diff --git linux-libre-4.14.325-gnu1/net/dccp/ipv4.c linux-libre-4.14.326-gnu1/net/dccp/ipv4.c
index c021d5dde8f7..b2fc9ef7708f 100644
--- linux-libre-4.14.325-gnu1/net/dccp/ipv4.c
+++ linux-libre-4.14.326-gnu1/net/dccp/ipv4.c
@@ -247,12 +247,17 @@ static void dccp_v4_err(struct sk_buff *skb, u32 info)
 	int err;
 	struct net *net = dev_net(skb->dev);
 
-	/* Only need dccph_dport & dccph_sport which are the first
-	 * 4 bytes in dccp header.
+	/* For the first __dccp_basic_hdr_len() check, we only need dh->dccph_x,
+	 * which is in byte 7 of the dccp header.
 	 * Our caller (icmp_socket_deliver()) already pulled 8 bytes for us.
+	 *
+	 * Later on, we want to access the sequence number fields, which are
+	 * beyond 8 bytes, so we have to pskb_may_pull() ourselves.
 	 */
-	BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_sport) > 8);
-	BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_dport) > 8);
+	dh = (struct dccp_hdr *)(skb->data + offset);
+	if (!pskb_may_pull(skb, offset + __dccp_basic_hdr_len(dh)))
+		return;
+	iph = (struct iphdr *)skb->data;
 	dh = (struct dccp_hdr *)(skb->data + offset);
 
 	sk = __inet_lookup_established(net, &dccp_hashinfo,
diff --git linux-libre-4.14.325-gnu1/net/dccp/ipv6.c linux-libre-4.14.326-gnu1/net/dccp/ipv6.c
index 88732ab4887c..f8d8caa967b1 100644
--- linux-libre-4.14.325-gnu1/net/dccp/ipv6.c
+++ linux-libre-4.14.326-gnu1/net/dccp/ipv6.c
@@ -71,7 +71,7 @@ static inline __u64 dccp_v6_init_sequence(struct sk_buff *skb)
 static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 			u8 type, u8 code, int offset, __be32 info)
 {
-	const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
+	const struct ipv6hdr *hdr;
 	const struct dccp_hdr *dh;
 	struct dccp_sock *dp;
 	struct ipv6_pinfo *np;
@@ -80,12 +80,17 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 	__u64 seq;
 	struct net *net = dev_net(skb->dev);
 
-	/* Only need dccph_dport & dccph_sport which are the first
-	 * 4 bytes in dccp header.
+	/* For the first __dccp_basic_hdr_len() check, we only need dh->dccph_x,
+	 * which is in byte 7 of the dccp header.
 	 * Our caller (icmpv6_notify()) already pulled 8 bytes for us.
+	 *
+	 * Later on, we want to access the sequence number fields, which are
+	 * beyond 8 bytes, so we have to pskb_may_pull() ourselves.
 	 */
-	BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_sport) > 8);
-	BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_dport) > 8);
+	dh = (struct dccp_hdr *)(skb->data + offset);
+	if (!pskb_may_pull(skb, offset + __dccp_basic_hdr_len(dh)))
+		return;
+	hdr = (const struct ipv6hdr *)skb->data;
 	dh = (struct dccp_hdr *)(skb->data + offset);
 
 	sk = __inet6_lookup_established(net, &dccp_hashinfo,
diff --git linux-libre-4.14.325-gnu1/net/ipv4/igmp.c linux-libre-4.14.326-gnu1/net/ipv4/igmp.c
index fd2c634eeee4..bdc232f6f27c 100644
--- linux-libre-4.14.325-gnu1/net/ipv4/igmp.c
+++ linux-libre-4.14.326-gnu1/net/ipv4/igmp.c
@@ -360,8 +360,9 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, unsigned int mtu)
 	struct flowi4 fl4;
 	int hlen = LL_RESERVED_SPACE(dev);
 	int tlen = dev->needed_tailroom;
-	unsigned int size = mtu;
+	unsigned int size;
 
+	size = min(mtu, IP_MAX_MTU);
 	while (1) {
 		skb = alloc_skb(size + hlen + tlen,
 				GFP_ATOMIC | __GFP_NOWARN);
diff --git linux-libre-4.14.325-gnu1/net/ipv4/ip_output.c linux-libre-4.14.326-gnu1/net/ipv4/ip_output.c
index c5c9dc0f41cb..c242c412dabc 100644
--- linux-libre-4.14.325-gnu1/net/ipv4/ip_output.c
+++ linux-libre-4.14.326-gnu1/net/ipv4/ip_output.c
@@ -221,7 +221,7 @@ static int ip_finish_output2(struct net *net, struct sock *sk, struct sk_buff *s
 	if (lwtunnel_xmit_redirect(dst->lwtstate)) {
 		int res = lwtunnel_xmit(skb);
 
-		if (res < 0 || res == LWTUNNEL_XMIT_DONE)
+		if (res != LWTUNNEL_XMIT_CONTINUE)
 			return res;
 	}
 
diff --git linux-libre-4.14.325-gnu1/net/ipv4/tcp_timer.c linux-libre-4.14.326-gnu1/net/ipv4/tcp_timer.c
index d70809495205..3d51a7edb311 100644
--- linux-libre-4.14.325-gnu1/net/ipv4/tcp_timer.c
+++ linux-libre-4.14.326-gnu1/net/ipv4/tcp_timer.c
@@ -396,6 +396,22 @@ static void tcp_fastopen_synack_timer(struct sock *sk)
 			  TCP_TIMEOUT_INIT << req->num_timeout, TCP_RTO_MAX);
 }
 
+static bool tcp_rtx_probe0_timed_out(const struct sock *sk,
+				     const struct sk_buff *skb)
+{
+	const struct tcp_sock *tp = tcp_sk(sk);
+	const int timeout = TCP_RTO_MAX * 2;
+	u32 rcv_delta, rtx_delta;
+
+	rcv_delta = inet_csk(sk)->icsk_timeout - tp->rcv_tstamp;
+	if (rcv_delta <= timeout)
+		return false;
+
+	rtx_delta = (u32)msecs_to_jiffies(tcp_time_stamp(tp) -
+			(tp->retrans_stamp ?: tcp_skb_timestamp(skb)));
+
+	return rtx_delta > timeout;
+}
 
 /**
  *  tcp_retransmit_timer() - The TCP retransmit timeout handler
@@ -458,7 +474,7 @@ void tcp_retransmit_timer(struct sock *sk)
 					    tp->snd_una, tp->snd_nxt);
 		}
 #endif
-		if (tcp_jiffies32 - tp->rcv_tstamp > TCP_RTO_MAX) {
+		if (tcp_rtx_probe0_timed_out(sk, skb)) {
 			tcp_write_err(sk);
 			goto out;
 		}
diff --git linux-libre-4.14.325-gnu1/net/ipv6/addrconf.c linux-libre-4.14.326-gnu1/net/ipv6/addrconf.c
index 893b93cc5221..288e270bd017 100644
--- linux-libre-4.14.325-gnu1/net/ipv6/addrconf.c
+++ linux-libre-4.14.326-gnu1/net/ipv6/addrconf.c
@@ -1283,7 +1283,7 @@ retry:
 	 * idev->desync_factor if it's larger
 	 */
 	cnf_temp_preferred_lft = READ_ONCE(idev->cnf.temp_prefered_lft);
-	max_desync_factor = min_t(__u32,
+	max_desync_factor = min_t(long,
 				  idev->cnf.max_desync_factor,
 				  cnf_temp_preferred_lft - regen_advance);
 
diff --git linux-libre-4.14.325-gnu1/net/ipv6/ip6_output.c linux-libre-4.14.326-gnu1/net/ipv6/ip6_output.c
index 36647d321107..c9322e6a1c0c 100644
--- linux-libre-4.14.325-gnu1/net/ipv6/ip6_output.c
+++ linux-libre-4.14.326-gnu1/net/ipv6/ip6_output.c
@@ -106,7 +106,7 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff *
 	if (lwtunnel_xmit_redirect(dst->lwtstate)) {
 		int res = lwtunnel_xmit(skb);
 
-		if (res < 0 || res == LWTUNNEL_XMIT_DONE)
+		if (res != LWTUNNEL_XMIT_CONTINUE)
 			return res;
 	}
 
diff --git linux-libre-4.14.325-gnu1/net/kcm/kcmsock.c linux-libre-4.14.326-gnu1/net/kcm/kcmsock.c
index fdce053f1099..e0fe70b55629 100644
--- linux-libre-4.14.325-gnu1/net/kcm/kcmsock.c
+++ linux-libre-4.14.326-gnu1/net/kcm/kcmsock.c
@@ -1065,15 +1065,18 @@ partial_message:
 out_error:
 	kcm_push(kcm);
 
-	if (copied && sock->type == SOCK_SEQPACKET) {
+	if (sock->type == SOCK_SEQPACKET) {
 		/* Wrote some bytes before encountering an
 		 * error, return partial success.
 		 */
-		goto partial_message;
-	}
-
-	if (head != kcm->seq_skb)
+		if (copied)
+			goto partial_message;
+		if (head != kcm->seq_skb)
+			kfree_skb(head);
+	} else {
 		kfree_skb(head);
+		kcm->seq_skb = NULL;
+	}
 
 	err = sk_stream_error(sk, msg->msg_flags, err);
 
@@ -1988,6 +1991,8 @@ static __net_exit void kcm_exit_net(struct net *net)
 	 * that all multiplexors and psocks have been destroyed.
 	 */
 	WARN_ON(!list_empty(&knet->mux_list));
+
+	mutex_destroy(&knet->mutex);
 }
 
 static struct pernet_operations kcm_net_ops = {
diff --git linux-libre-4.14.325-gnu1/net/netfilter/ipset/ip_set_hash_netportnet.c linux-libre-4.14.326-gnu1/net/netfilter/ipset/ip_set_hash_netportnet.c
index 613e18e720a4..9290a4d7b862 100644
--- linux-libre-4.14.325-gnu1/net/netfilter/ipset/ip_set_hash_netportnet.c
+++ linux-libre-4.14.326-gnu1/net/netfilter/ipset/ip_set_hash_netportnet.c
@@ -39,6 +39,7 @@ MODULE_ALIAS("ip_set_hash:net,port,net");
 #define IP_SET_HASH_WITH_PROTO
 #define IP_SET_HASH_WITH_NETS
 #define IPSET_NET_COUNT 2
+#define IP_SET_HASH_WITH_NET0
 
 /* IPv4 variant */
 
diff --git linux-libre-4.14.325-gnu1/net/netfilter/xt_sctp.c linux-libre-4.14.326-gnu1/net/netfilter/xt_sctp.c
index 2d2fa1d53ea6..05495d3f47b8 100644
--- linux-libre-4.14.325-gnu1/net/netfilter/xt_sctp.c
+++ linux-libre-4.14.326-gnu1/net/netfilter/xt_sctp.c
@@ -149,6 +149,8 @@ static int sctp_mt_check(const struct xt_mtchk_param *par)
 {
 	const struct xt_sctp_info *info = par->matchinfo;
 
+	if (info->flag_count > ARRAY_SIZE(info->flag_info))
+		return -EINVAL;
 	if (info->flags & ~XT_SCTP_VALID_FLAGS)
 		return -EINVAL;
 	if (info->invflags & ~XT_SCTP_VALID_FLAGS)
diff --git linux-libre-4.14.325-gnu1/net/netfilter/xt_u32.c linux-libre-4.14.326-gnu1/net/netfilter/xt_u32.c
index a95b50342dbb..58ba402bc0b0 100644
--- linux-libre-4.14.325-gnu1/net/netfilter/xt_u32.c
+++ linux-libre-4.14.326-gnu1/net/netfilter/xt_u32.c
@@ -95,11 +95,32 @@ static bool u32_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	return ret ^ data->invert;
 }
 
+static int u32_mt_checkentry(const struct xt_mtchk_param *par)
+{
+	const struct xt_u32 *data = par->matchinfo;
+	const struct xt_u32_test *ct;
+	unsigned int i;
+
+	if (data->ntests > ARRAY_SIZE(data->tests))
+		return -EINVAL;
+
+	for (i = 0; i < data->ntests; ++i) {
+		ct = &data->tests[i];
+
+		if (ct->nnums > ARRAY_SIZE(ct->location) ||
+		    ct->nvalues > ARRAY_SIZE(ct->value))
+			return -EINVAL;
+	}
+
+	return 0;
+}
+
 static struct xt_match xt_u32_mt_reg __read_mostly = {
 	.name       = "u32",
 	.revision   = 0,
 	.family     = NFPROTO_UNSPEC,
 	.match      = u32_mt,
+	.checkentry = u32_mt_checkentry,
 	.matchsize  = sizeof(struct xt_u32),
 	.me         = THIS_MODULE,
 };
diff --git linux-libre-4.14.325-gnu1/net/netlabel/netlabel_kapi.c linux-libre-4.14.326-gnu1/net/netlabel/netlabel_kapi.c
index 15fe2120b310..14c3d640f94b 100644
--- linux-libre-4.14.325-gnu1/net/netlabel/netlabel_kapi.c
+++ linux-libre-4.14.326-gnu1/net/netlabel/netlabel_kapi.c
@@ -871,7 +871,8 @@ int netlbl_catmap_setlong(struct netlbl_lsm_catmap **catmap,
 
 	offset -= iter->startbit;
 	idx = offset / NETLBL_CATMAP_MAPSIZE;
-	iter->bitmap[idx] |= bitmap << (offset % NETLBL_CATMAP_MAPSIZE);
+	iter->bitmap[idx] |= (NETLBL_CATMAP_MAPTYPE)bitmap
+			     << (offset % NETLBL_CATMAP_MAPSIZE);
 
 	return 0;
 }
diff --git linux-libre-4.14.325-gnu1/net/netrom/af_netrom.c linux-libre-4.14.326-gnu1/net/netrom/af_netrom.c
index b5a99b517207..4480d0d8394b 100644
--- linux-libre-4.14.325-gnu1/net/netrom/af_netrom.c
+++ linux-libre-4.14.326-gnu1/net/netrom/af_netrom.c
@@ -663,6 +663,11 @@ static int nr_connect(struct socket *sock, struct sockaddr *uaddr,
 		goto out_release;
 	}
 
+	if (sock->state == SS_CONNECTING) {
+		err = -EALREADY;
+		goto out_release;
+	}
+
 	sk->sk_state   = TCP_CLOSE;
 	sock->state = SS_UNCONNECTED;
 
diff --git linux-libre-4.14.325-gnu1/net/sched/Kconfig linux-libre-4.14.326-gnu1/net/sched/Kconfig
index 704018c496d4..782114a230ae 100644
--- linux-libre-4.14.325-gnu1/net/sched/Kconfig
+++ linux-libre-4.14.326-gnu1/net/sched/Kconfig
@@ -457,34 +457,6 @@ config CLS_U32_MARK
 	---help---
 	  Say Y here to be able to use netfilter marks as u32 key.
 
-config NET_CLS_RSVP
-	tristate "IPv4 Resource Reservation Protocol (RSVP)"
-	select NET_CLS
-	---help---
-	  The Resource Reservation Protocol (RSVP) permits end systems to
-	  request a minimum and maximum data flow rate for a connection; this
-	  is important for real time data such as streaming sound or video.
-
-	  Say Y here if you want to be able to classify outgoing packets based
-	  on their RSVP requests.
-
-	  To compile this code as a module, choose M here: the
-	  module will be called cls_rsvp.
-
-config NET_CLS_RSVP6
-	tristate "IPv6 Resource Reservation Protocol (RSVP6)"
-	select NET_CLS
-	---help---
-	  The Resource Reservation Protocol (RSVP) permits end systems to
-	  request a minimum and maximum data flow rate for a connection; this
-	  is important for real time data such as streaming sound or video.
-
-	  Say Y here if you want to be able to classify outgoing packets based
-	  on their RSVP requests and you are using the IPv6 protocol.
-
-	  To compile this code as a module, choose M here: the
-	  module will be called cls_rsvp6.
-
 config NET_CLS_FLOW
 	tristate "Flow classifier"
 	select NET_CLS
diff --git linux-libre-4.14.325-gnu1/net/sched/Makefile linux-libre-4.14.326-gnu1/net/sched/Makefile
index 3f3206e25156..c156c182f546 100644
--- linux-libre-4.14.325-gnu1/net/sched/Makefile
+++ linux-libre-4.14.326-gnu1/net/sched/Makefile
@@ -57,8 +57,6 @@ obj-$(CONFIG_NET_SCH_PIE)	+= sch_pie.o
 obj-$(CONFIG_NET_CLS_U32)	+= cls_u32.o
 obj-$(CONFIG_NET_CLS_ROUTE4)	+= cls_route.o
 obj-$(CONFIG_NET_CLS_FW)	+= cls_fw.o
-obj-$(CONFIG_NET_CLS_RSVP)	+= cls_rsvp.o
-obj-$(CONFIG_NET_CLS_RSVP6)	+= cls_rsvp6.o
 obj-$(CONFIG_NET_CLS_BASIC)	+= cls_basic.o
 obj-$(CONFIG_NET_CLS_FLOW)	+= cls_flow.o
 obj-$(CONFIG_NET_CLS_CGROUP)	+= cls_cgroup.o
diff --git linux-libre-4.14.325-gnu1/net/sched/cls_fw.c linux-libre-4.14.326-gnu1/net/sched/cls_fw.c
index e63f9c2e37e5..7b04b315b2bd 100644
--- linux-libre-4.14.325-gnu1/net/sched/cls_fw.c
+++ linux-libre-4.14.326-gnu1/net/sched/cls_fw.c
@@ -281,7 +281,6 @@ static int fw_change(struct net *net, struct sk_buff *in_skb,
 			return -ENOBUFS;
 
 		fnew->id = f->id;
-		fnew->res = f->res;
 #ifdef CONFIG_NET_CLS_IND
 		fnew->ifindex = f->ifindex;
 #endif /* CONFIG_NET_CLS_IND */
diff --git linux-libre-4.14.325-gnu1/net/sched/cls_rsvp.c linux-libre-4.14.326-gnu1/net/sched/cls_rsvp.c
deleted file mode 100644
index cbb5e0d600f3..000000000000
--- linux-libre-4.14.325-gnu1/net/sched/cls_rsvp.c
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * net/sched/cls_rsvp.c	Special RSVP packet classifier for IPv4.
- *
- *		This program is free software; you can redistribute it and/or
- *		modify it under the terms of the GNU General Public License
- *		as published by the Free Software Foundation; either version
- *		2 of the License, or (at your option) any later version.
- *
- * Authors:	Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
- */
-
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/string.h>
-#include <linux/errno.h>
-#include <linux/skbuff.h>
-#include <net/ip.h>
-#include <net/netlink.h>
-#include <net/act_api.h>
-#include <net/pkt_cls.h>
-
-#define RSVP_DST_LEN	1
-#define RSVP_ID		"rsvp"
-#define RSVP_OPS	cls_rsvp_ops
-
-#include "cls_rsvp.h"
-MODULE_LICENSE("GPL");
diff --git linux-libre-4.14.325-gnu1/net/sched/cls_rsvp.h linux-libre-4.14.326-gnu1/net/sched/cls_rsvp.h
deleted file mode 100644
index 89259819e9ed..000000000000
--- linux-libre-4.14.325-gnu1/net/sched/cls_rsvp.h
+++ /dev/null
@@ -1,779 +0,0 @@
-/*
- * net/sched/cls_rsvp.h	Template file for RSVPv[46] classifiers.
- *
- *		This program is free software; you can redistribute it and/or
- *		modify it under the terms of the GNU General Public License
- *		as published by the Free Software Foundation; either version
- *		2 of the License, or (at your option) any later version.
- *
- * Authors:	Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
- */
-
-/*
-   Comparing to general packet classification problem,
-   RSVP needs only sevaral relatively simple rules:
-
-   * (dst, protocol) are always specified,
-     so that we are able to hash them.
-   * src may be exact, or may be wildcard, so that
-     we can keep a hash table plus one wildcard entry.
-   * source port (or flow label) is important only if src is given.
-
-   IMPLEMENTATION.
-
-   We use a two level hash table: The top level is keyed by
-   destination address and protocol ID, every bucket contains a list
-   of "rsvp sessions", identified by destination address, protocol and
-   DPI(="Destination Port ID"): triple (key, mask, offset).
-
-   Every bucket has a smaller hash table keyed by source address
-   (cf. RSVP flowspec) and one wildcard entry for wildcard reservations.
-   Every bucket is again a list of "RSVP flows", selected by
-   source address and SPI(="Source Port ID" here rather than
-   "security parameter index"): triple (key, mask, offset).
-
-
-   NOTE 1. All the packets with IPv6 extension headers (but AH and ESP)
-   and all fragmented packets go to the best-effort traffic class.
-
-
-   NOTE 2. Two "port id"'s seems to be redundant, rfc2207 requires
-   only one "Generalized Port Identifier". So that for classic
-   ah, esp (and udp,tcp) both *pi should coincide or one of them
-   should be wildcard.
-
-   At first sight, this redundancy is just a waste of CPU
-   resources. But DPI and SPI add the possibility to assign different
-   priorities to GPIs. Look also at note 4 about tunnels below.
-
-
-   NOTE 3. One complication is the case of tunneled packets.
-   We implement it as following: if the first lookup
-   matches a special session with "tunnelhdr" value not zero,
-   flowid doesn't contain the true flow ID, but the tunnel ID (1...255).
-   In this case, we pull tunnelhdr bytes and restart lookup
-   with tunnel ID added to the list of keys. Simple and stupid 8)8)
-   It's enough for PIMREG and IPIP.
-
-
-   NOTE 4. Two GPIs make it possible to parse even GRE packets.
-   F.e. DPI can select ETH_P_IP (and necessary flags to make
-   tunnelhdr correct) in GRE protocol field and SPI matches
-   GRE key. Is it not nice? 8)8)
-
-
-   Well, as result, despite its simplicity, we get a pretty
-   powerful classification engine.  */
-
-
-struct rsvp_head {
-	u32			tmap[256/32];
-	u32			hgenerator;
-	u8			tgenerator;
-	struct rsvp_session __rcu *ht[256];
-	struct rcu_head		rcu;
-};
-
-struct rsvp_session {
-	struct rsvp_session __rcu	*next;
-	__be32				dst[RSVP_DST_LEN];
-	struct tc_rsvp_gpi		dpi;
-	u8				protocol;
-	u8				tunnelid;
-	/* 16 (src,sport) hash slots, and one wildcard source slot */
-	struct rsvp_filter __rcu	*ht[16 + 1];
-	struct rcu_head			rcu;
-};
-
-
-struct rsvp_filter {
-	struct rsvp_filter __rcu	*next;
-	__be32				src[RSVP_DST_LEN];
-	struct tc_rsvp_gpi		spi;
-	u8				tunnelhdr;
-
-	struct tcf_result		res;
-	struct tcf_exts			exts;
-
-	u32				handle;
-	struct rsvp_session		*sess;
-	union {
-		struct work_struct		work;
-		struct rcu_head			rcu;
-	};
-};
-
-static inline unsigned int hash_dst(__be32 *dst, u8 protocol, u8 tunnelid)
-{
-	unsigned int h = (__force __u32)dst[RSVP_DST_LEN - 1];
-
-	h ^= h>>16;
-	h ^= h>>8;
-	return (h ^ protocol ^ tunnelid) & 0xFF;
-}
-
-static inline unsigned int hash_src(__be32 *src)
-{
-	unsigned int h = (__force __u32)src[RSVP_DST_LEN-1];
-
-	h ^= h>>16;
-	h ^= h>>8;
-	h ^= h>>4;
-	return h & 0xF;
-}
-
-#define RSVP_APPLY_RESULT()				\
-{							\
-	int r = tcf_exts_exec(skb, &f->exts, res);	\
-	if (r < 0)					\
-		continue;				\
-	else if (r > 0)					\
-		return r;				\
-}
-
-static int rsvp_classify(struct sk_buff *skb, const struct tcf_proto *tp,
-			 struct tcf_result *res)
-{
-	struct rsvp_head *head = rcu_dereference_bh(tp->root);
-	struct rsvp_session *s;
-	struct rsvp_filter *f;
-	unsigned int h1, h2;
-	__be32 *dst, *src;
-	u8 protocol;
-	u8 tunnelid = 0;
-	u8 *xprt;
-#if RSVP_DST_LEN == 4
-	struct ipv6hdr *nhptr;
-
-	if (!pskb_network_may_pull(skb, sizeof(*nhptr)))
-		return -1;
-	nhptr = ipv6_hdr(skb);
-#else
-	struct iphdr *nhptr;
-
-	if (!pskb_network_may_pull(skb, sizeof(*nhptr)))
-		return -1;
-	nhptr = ip_hdr(skb);
-#endif
-restart:
-
-#if RSVP_DST_LEN == 4
-	src = &nhptr->saddr.s6_addr32[0];
-	dst = &nhptr->daddr.s6_addr32[0];
-	protocol = nhptr->nexthdr;
-	xprt = ((u8 *)nhptr) + sizeof(struct ipv6hdr);
-#else
-	src = &nhptr->saddr;
-	dst = &nhptr->daddr;
-	protocol = nhptr->protocol;
-	xprt = ((u8 *)nhptr) + (nhptr->ihl<<2);
-	if (ip_is_fragment(nhptr))
-		return -1;
-#endif
-
-	h1 = hash_dst(dst, protocol, tunnelid);
-	h2 = hash_src(src);
-
-	for (s = rcu_dereference_bh(head->ht[h1]); s;
-	     s = rcu_dereference_bh(s->next)) {
-		if (dst[RSVP_DST_LEN-1] == s->dst[RSVP_DST_LEN - 1] &&
-		    protocol == s->protocol &&
-		    !(s->dpi.mask &
-		      (*(u32 *)(xprt + s->dpi.offset) ^ s->dpi.key)) &&
-#if RSVP_DST_LEN == 4
-		    dst[0] == s->dst[0] &&
-		    dst[1] == s->dst[1] &&
-		    dst[2] == s->dst[2] &&
-#endif
-		    tunnelid == s->tunnelid) {
-
-			for (f = rcu_dereference_bh(s->ht[h2]); f;
-			     f = rcu_dereference_bh(f->next)) {
-				if (src[RSVP_DST_LEN-1] == f->src[RSVP_DST_LEN - 1] &&
-				    !(f->spi.mask & (*(u32 *)(xprt + f->spi.offset) ^ f->spi.key))
-#if RSVP_DST_LEN == 4
-				    &&
-				    src[0] == f->src[0] &&
-				    src[1] == f->src[1] &&
-				    src[2] == f->src[2]
-#endif
-				    ) {
-					*res = f->res;
-					RSVP_APPLY_RESULT();
-
-matched:
-					if (f->tunnelhdr == 0)
-						return 0;
-
-					tunnelid = f->res.classid;
-					nhptr = (void *)(xprt + f->tunnelhdr - sizeof(*nhptr));
-					goto restart;
-				}
-			}
-
-			/* And wildcard bucket... */
-			for (f = rcu_dereference_bh(s->ht[16]); f;
-			     f = rcu_dereference_bh(f->next)) {
-				*res = f->res;
-				RSVP_APPLY_RESULT();
-				goto matched;
-			}
-			return -1;
-		}
-	}
-	return -1;
-}
-
-static void rsvp_replace(struct tcf_proto *tp, struct rsvp_filter *n, u32 h)
-{
-	struct rsvp_head *head = rtnl_dereference(tp->root);
-	struct rsvp_session *s;
-	struct rsvp_filter __rcu **ins;
-	struct rsvp_filter *pins;
-	unsigned int h1 = h & 0xFF;
-	unsigned int h2 = (h >> 8) & 0xFF;
-
-	for (s = rtnl_dereference(head->ht[h1]); s;
-	     s = rtnl_dereference(s->next)) {
-		for (ins = &s->ht[h2], pins = rtnl_dereference(*ins); ;
-		     ins = &pins->next, pins = rtnl_dereference(*ins)) {
-			if (pins->handle == h) {
-				RCU_INIT_POINTER(n->next, pins->next);
-				rcu_assign_pointer(*ins, n);
-				return;
-			}
-		}
-	}
-
-	/* Something went wrong if we are trying to replace a non-existant
-	 * node. Mind as well halt instead of silently failing.
-	 */
-	BUG_ON(1);
-}
-
-static void *rsvp_get(struct tcf_proto *tp, u32 handle)
-{
-	struct rsvp_head *head = rtnl_dereference(tp->root);
-	struct rsvp_session *s;
-	struct rsvp_filter *f;
-	unsigned int h1 = handle & 0xFF;
-	unsigned int h2 = (handle >> 8) & 0xFF;
-
-	if (h2 > 16)
-		return NULL;
-
-	for (s = rtnl_dereference(head->ht[h1]); s;
-	     s = rtnl_dereference(s->next)) {
-		for (f = rtnl_dereference(s->ht[h2]); f;
-		     f = rtnl_dereference(f->next)) {
-			if (f->handle == handle)
-				return f;
-		}
-	}
-	return NULL;
-}
-
-static int rsvp_init(struct tcf_proto *tp)
-{
-	struct rsvp_head *data;
-
-	data = kzalloc(sizeof(struct rsvp_head), GFP_KERNEL);
-	if (data) {
-		rcu_assign_pointer(tp->root, data);
-		return 0;
-	}
-	return -ENOBUFS;
-}
-
-static void __rsvp_delete_filter(struct rsvp_filter *f)
-{
-	tcf_exts_destroy(&f->exts);
-	tcf_exts_put_net(&f->exts);
-	kfree(f);
-}
-
-static void rsvp_delete_filter_work(struct work_struct *work)
-{
-	struct rsvp_filter *f = container_of(work, struct rsvp_filter, work);
-
-	rtnl_lock();
-	__rsvp_delete_filter(f);
-	rtnl_unlock();
-}
-
-static void rsvp_delete_filter_rcu(struct rcu_head *head)
-{
-	struct rsvp_filter *f = container_of(head, struct rsvp_filter, rcu);
-
-	INIT_WORK(&f->work, rsvp_delete_filter_work);
-	tcf_queue_work(&f->work);
-}
-
-static void rsvp_delete_filter(struct tcf_proto *tp, struct rsvp_filter *f)
-{
-	tcf_unbind_filter(tp, &f->res);
-	/* all classifiers are required to call tcf_exts_destroy() after rcu
-	 * grace period, since converted-to-rcu actions are relying on that
-	 * in cleanup() callback
-	 */
-	if (tcf_exts_get_net(&f->exts))
-		call_rcu(&f->rcu, rsvp_delete_filter_rcu);
-	else
-		__rsvp_delete_filter(f);
-}
-
-static void rsvp_destroy(struct tcf_proto *tp)
-{
-	struct rsvp_head *data = rtnl_dereference(tp->root);
-	int h1, h2;
-
-	if (data == NULL)
-		return;
-
-	for (h1 = 0; h1 < 256; h1++) {
-		struct rsvp_session *s;
-
-		while ((s = rtnl_dereference(data->ht[h1])) != NULL) {
-			RCU_INIT_POINTER(data->ht[h1], s->next);
-
-			for (h2 = 0; h2 <= 16; h2++) {
-				struct rsvp_filter *f;
-
-				while ((f = rtnl_dereference(s->ht[h2])) != NULL) {
-					rcu_assign_pointer(s->ht[h2], f->next);
-					rsvp_delete_filter(tp, f);
-				}
-			}
-			kfree_rcu(s, rcu);
-		}
-	}
-	kfree_rcu(data, rcu);
-}
-
-static int rsvp_delete(struct tcf_proto *tp, void *arg, bool *last)
-{
-	struct rsvp_head *head = rtnl_dereference(tp->root);
-	struct rsvp_filter *nfp, *f = arg;
-	struct rsvp_filter __rcu **fp;
-	unsigned int h = f->handle;
-	struct rsvp_session __rcu **sp;
-	struct rsvp_session *nsp, *s = f->sess;
-	int i, h1;
-
-	fp = &s->ht[(h >> 8) & 0xFF];
-	for (nfp = rtnl_dereference(*fp); nfp;
-	     fp = &nfp->next, nfp = rtnl_dereference(*fp)) {
-		if (nfp == f) {
-			RCU_INIT_POINTER(*fp, f->next);
-			rsvp_delete_filter(tp, f);
-
-			/* Strip tree */
-
-			for (i = 0; i <= 16; i++)
-				if (s->ht[i])
-					goto out;
-
-			/* OK, session has no flows */
-			sp = &head->ht[h & 0xFF];
-			for (nsp = rtnl_dereference(*sp); nsp;
-			     sp = &nsp->next, nsp = rtnl_dereference(*sp)) {
-				if (nsp == s) {
-					RCU_INIT_POINTER(*sp, s->next);
-					kfree_rcu(s, rcu);
-					goto out;
-				}
-			}
-
-			break;
-		}
-	}
-
-out:
-	*last = true;
-	for (h1 = 0; h1 < 256; h1++) {
-		if (rcu_access_pointer(head->ht[h1])) {
-			*last = false;
-			break;
-		}
-	}
-
-	return 0;
-}
-
-static unsigned int gen_handle(struct tcf_proto *tp, unsigned salt)
-{
-	struct rsvp_head *data = rtnl_dereference(tp->root);
-	int i = 0xFFFF;
-
-	while (i-- > 0) {
-		u32 h;
-
-		if ((data->hgenerator += 0x10000) == 0)
-			data->hgenerator = 0x10000;
-		h = data->hgenerator|salt;
-		if (!rsvp_get(tp, h))
-			return h;
-	}
-	return 0;
-}
-
-static int tunnel_bts(struct rsvp_head *data)
-{
-	int n = data->tgenerator >> 5;
-	u32 b = 1 << (data->tgenerator & 0x1F);
-
-	if (data->tmap[n] & b)
-		return 0;
-	data->tmap[n] |= b;
-	return 1;
-}
-
-static void tunnel_recycle(struct rsvp_head *data)
-{
-	struct rsvp_session __rcu **sht = data->ht;
-	u32 tmap[256/32];
-	int h1, h2;
-
-	memset(tmap, 0, sizeof(tmap));
-
-	for (h1 = 0; h1 < 256; h1++) {
-		struct rsvp_session *s;
-		for (s = rtnl_dereference(sht[h1]); s;
-		     s = rtnl_dereference(s->next)) {
-			for (h2 = 0; h2 <= 16; h2++) {
-				struct rsvp_filter *f;
-
-				for (f = rtnl_dereference(s->ht[h2]); f;
-				     f = rtnl_dereference(f->next)) {
-					if (f->tunnelhdr == 0)
-						continue;
-					data->tgenerator = f->res.classid;
-					tunnel_bts(data);
-				}
-			}
-		}
-	}
-
-	memcpy(data->tmap, tmap, sizeof(tmap));
-}
-
-static u32 gen_tunnel(struct rsvp_head *data)
-{
-	int i, k;
-
-	for (k = 0; k < 2; k++) {
-		for (i = 255; i > 0; i--) {
-			if (++data->tgenerator == 0)
-				data->tgenerator = 1;
-			if (tunnel_bts(data))
-				return data->tgenerator;
-		}
-		tunnel_recycle(data);
-	}
-	return 0;
-}
-
-static const struct nla_policy rsvp_policy[TCA_RSVP_MAX + 1] = {
-	[TCA_RSVP_CLASSID]	= { .type = NLA_U32 },
-	[TCA_RSVP_DST]		= { .len = RSVP_DST_LEN * sizeof(u32) },
-	[TCA_RSVP_SRC]		= { .len = RSVP_DST_LEN * sizeof(u32) },
-	[TCA_RSVP_PINFO]	= { .len = sizeof(struct tc_rsvp_pinfo) },
-};
-
-static int rsvp_change(struct net *net, struct sk_buff *in_skb,
-		       struct tcf_proto *tp, unsigned long base,
-		       u32 handle,
-		       struct nlattr **tca,
-		       void **arg, bool ovr)
-{
-	struct rsvp_head *data = rtnl_dereference(tp->root);
-	struct rsvp_filter *f, *nfp;
-	struct rsvp_filter __rcu **fp;
-	struct rsvp_session *nsp, *s;
-	struct rsvp_session __rcu **sp;
-	struct tc_rsvp_pinfo *pinfo = NULL;
-	struct nlattr *opt = tca[TCA_OPTIONS];
-	struct nlattr *tb[TCA_RSVP_MAX + 1];
-	struct tcf_exts e;
-	unsigned int h1, h2;
-	__be32 *dst;
-	int err;
-
-	if (opt == NULL)
-		return handle ? -EINVAL : 0;
-
-	err = nla_parse_nested(tb, TCA_RSVP_MAX, opt, rsvp_policy, NULL);
-	if (err < 0)
-		return err;
-
-	err = tcf_exts_init(&e, TCA_RSVP_ACT, TCA_RSVP_POLICE);
-	if (err < 0)
-		return err;
-	err = tcf_exts_validate(net, tp, tb, tca[TCA_RATE], &e, ovr);
-	if (err < 0)
-		goto errout2;
-
-	f = *arg;
-	if (f) {
-		/* Node exists: adjust only classid */
-		struct rsvp_filter *n;
-
-		if (f->handle != handle && handle)
-			goto errout2;
-
-		n = kmemdup(f, sizeof(*f), GFP_KERNEL);
-		if (!n) {
-			err = -ENOMEM;
-			goto errout2;
-		}
-
-		err = tcf_exts_init(&n->exts, TCA_RSVP_ACT, TCA_RSVP_POLICE);
-		if (err < 0) {
-			kfree(n);
-			goto errout2;
-		}
-
-		if (tb[TCA_RSVP_CLASSID]) {
-			n->res.classid = nla_get_u32(tb[TCA_RSVP_CLASSID]);
-			tcf_bind_filter(tp, &n->res, base);
-		}
-
-		tcf_exts_change(&n->exts, &e);
-		rsvp_replace(tp, n, handle);
-		return 0;
-	}
-
-	/* Now more serious part... */
-	err = -EINVAL;
-	if (handle)
-		goto errout2;
-	if (tb[TCA_RSVP_DST] == NULL)
-		goto errout2;
-
-	err = -ENOBUFS;
-	f = kzalloc(sizeof(struct rsvp_filter), GFP_KERNEL);
-	if (f == NULL)
-		goto errout2;
-
-	err = tcf_exts_init(&f->exts, TCA_RSVP_ACT, TCA_RSVP_POLICE);
-	if (err < 0)
-		goto errout;
-	h2 = 16;
-	if (tb[TCA_RSVP_SRC]) {
-		memcpy(f->src, nla_data(tb[TCA_RSVP_SRC]), sizeof(f->src));
-		h2 = hash_src(f->src);
-	}
-	if (tb[TCA_RSVP_PINFO]) {
-		pinfo = nla_data(tb[TCA_RSVP_PINFO]);
-		f->spi = pinfo->spi;
-		f->tunnelhdr = pinfo->tunnelhdr;
-	}
-	if (tb[TCA_RSVP_CLASSID])
-		f->res.classid = nla_get_u32(tb[TCA_RSVP_CLASSID]);
-
-	dst = nla_data(tb[TCA_RSVP_DST]);
-	h1 = hash_dst(dst, pinfo ? pinfo->protocol : 0, pinfo ? pinfo->tunnelid : 0);
-
-	err = -ENOMEM;
-	if ((f->handle = gen_handle(tp, h1 | (h2<<8))) == 0)
-		goto errout;
-
-	if (f->tunnelhdr) {
-		err = -EINVAL;
-		if (f->res.classid > 255)
-			goto errout;
-
-		err = -ENOMEM;
-		if (f->res.classid == 0 &&
-		    (f->res.classid = gen_tunnel(data)) == 0)
-			goto errout;
-	}
-
-	for (sp = &data->ht[h1];
-	     (s = rtnl_dereference(*sp)) != NULL;
-	     sp = &s->next) {
-		if (dst[RSVP_DST_LEN-1] == s->dst[RSVP_DST_LEN-1] &&
-		    pinfo && pinfo->protocol == s->protocol &&
-		    memcmp(&pinfo->dpi, &s->dpi, sizeof(s->dpi)) == 0 &&
-#if RSVP_DST_LEN == 4
-		    dst[0] == s->dst[0] &&
-		    dst[1] == s->dst[1] &&
-		    dst[2] == s->dst[2] &&
-#endif
-		    pinfo->tunnelid == s->tunnelid) {
-
-insert:
-			/* OK, we found appropriate session */
-
-			fp = &s->ht[h2];
-
-			f->sess = s;
-			if (f->tunnelhdr == 0)
-				tcf_bind_filter(tp, &f->res, base);
-
-			tcf_exts_change(&f->exts, &e);
-
-			fp = &s->ht[h2];
-			for (nfp = rtnl_dereference(*fp); nfp;
-			     fp = &nfp->next, nfp = rtnl_dereference(*fp)) {
-				__u32 mask = nfp->spi.mask & f->spi.mask;
-
-				if (mask != f->spi.mask)
-					break;
-			}
-			RCU_INIT_POINTER(f->next, nfp);
-			rcu_assign_pointer(*fp, f);
-
-			*arg = f;
-			return 0;
-		}
-	}
-
-	/* No session found. Create new one. */
-
-	err = -ENOBUFS;
-	s = kzalloc(sizeof(struct rsvp_session), GFP_KERNEL);
-	if (s == NULL)
-		goto errout;
-	memcpy(s->dst, dst, sizeof(s->dst));
-
-	if (pinfo) {
-		s->dpi = pinfo->dpi;
-		s->protocol = pinfo->protocol;
-		s->tunnelid = pinfo->tunnelid;
-	}
-	sp = &data->ht[h1];
-	for (nsp = rtnl_dereference(*sp); nsp;
-	     sp = &nsp->next, nsp = rtnl_dereference(*sp)) {
-		if ((nsp->dpi.mask & s->dpi.mask) != s->dpi.mask)
-			break;
-	}
-	RCU_INIT_POINTER(s->next, nsp);
-	rcu_assign_pointer(*sp, s);
-
-	goto insert;
-
-errout:
-	tcf_exts_destroy(&f->exts);
-	kfree(f);
-errout2:
-	tcf_exts_destroy(&e);
-	return err;
-}
-
-static void rsvp_walk(struct tcf_proto *tp, struct tcf_walker *arg)
-{
-	struct rsvp_head *head = rtnl_dereference(tp->root);
-	unsigned int h, h1;
-
-	if (arg->stop)
-		return;
-
-	for (h = 0; h < 256; h++) {
-		struct rsvp_session *s;
-
-		for (s = rtnl_dereference(head->ht[h]); s;
-		     s = rtnl_dereference(s->next)) {
-			for (h1 = 0; h1 <= 16; h1++) {
-				struct rsvp_filter *f;
-
-				for (f = rtnl_dereference(s->ht[h1]); f;
-				     f = rtnl_dereference(f->next)) {
-					if (arg->count < arg->skip) {
-						arg->count++;
-						continue;
-					}
-					if (arg->fn(tp, f, arg) < 0) {
-						arg->stop = 1;
-						return;
-					}
-					arg->count++;
-				}
-			}
-		}
-	}
-}
-
-static int rsvp_dump(struct net *net, struct tcf_proto *tp, void *fh,
-		     struct sk_buff *skb, struct tcmsg *t)
-{
-	struct rsvp_filter *f = fh;
-	struct rsvp_session *s;
-	struct nlattr *nest;
-	struct tc_rsvp_pinfo pinfo;
-
-	if (f == NULL)
-		return skb->len;
-	s = f->sess;
-
-	t->tcm_handle = f->handle;
-
-	nest = nla_nest_start(skb, TCA_OPTIONS);
-	if (nest == NULL)
-		goto nla_put_failure;
-
-	if (nla_put(skb, TCA_RSVP_DST, sizeof(s->dst), &s->dst))
-		goto nla_put_failure;
-	pinfo.dpi = s->dpi;
-	pinfo.spi = f->spi;
-	pinfo.protocol = s->protocol;
-	pinfo.tunnelid = s->tunnelid;
-	pinfo.tunnelhdr = f->tunnelhdr;
-	pinfo.pad = 0;
-	if (nla_put(skb, TCA_RSVP_PINFO, sizeof(pinfo), &pinfo))
-		goto nla_put_failure;
-	if (f->res.classid &&
-	    nla_put_u32(skb, TCA_RSVP_CLASSID, f->res.classid))
-		goto nla_put_failure;
-	if (((f->handle >> 8) & 0xFF) != 16 &&
-	    nla_put(skb, TCA_RSVP_SRC, sizeof(f->src), f->src))
-		goto nla_put_failure;
-
-	if (tcf_exts_dump(skb, &f->exts) < 0)
-		goto nla_put_failure;
-
-	nla_nest_end(skb, nest);
-
-	if (tcf_exts_dump_stats(skb, &f->exts) < 0)
-		goto nla_put_failure;
-	return skb->len;
-
-nla_put_failure:
-	nla_nest_cancel(skb, nest);
-	return -1;
-}
-
-static void rsvp_bind_class(void *fh, u32 classid, unsigned long cl)
-{
-	struct rsvp_filter *f = fh;
-
-	if (f && f->res.classid == classid)
-		f->res.class = cl;
-}
-
-static struct tcf_proto_ops RSVP_OPS __read_mostly = {
-	.kind		=	RSVP_ID,
-	.classify	=	rsvp_classify,
-	.init		=	rsvp_init,
-	.destroy	=	rsvp_destroy,
-	.get		=	rsvp_get,
-	.change		=	rsvp_change,
-	.delete		=	rsvp_delete,
-	.walk		=	rsvp_walk,
-	.dump		=	rsvp_dump,
-	.bind_class	=	rsvp_bind_class,
-	.owner		=	THIS_MODULE,
-};
-
-static int __init init_rsvp(void)
-{
-	return register_tcf_proto_ops(&RSVP_OPS);
-}
-
-static void __exit exit_rsvp(void)
-{
-	unregister_tcf_proto_ops(&RSVP_OPS);
-}
-
-module_init(init_rsvp)
-module_exit(exit_rsvp)
diff --git linux-libre-4.14.325-gnu1/net/sched/cls_rsvp6.c linux-libre-4.14.326-gnu1/net/sched/cls_rsvp6.c
deleted file mode 100644
index dd08aea2aee5..000000000000
--- linux-libre-4.14.325-gnu1/net/sched/cls_rsvp6.c
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * net/sched/cls_rsvp6.c	Special RSVP packet classifier for IPv6.
- *
- *		This program is free software; you can redistribute it and/or
- *		modify it under the terms of the GNU General Public License
- *		as published by the Free Software Foundation; either version
- *		2 of the License, or (at your option) any later version.
- *
- * Authors:	Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
- */
-
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/string.h>
-#include <linux/errno.h>
-#include <linux/ipv6.h>
-#include <linux/skbuff.h>
-#include <net/act_api.h>
-#include <net/pkt_cls.h>
-#include <net/netlink.h>
-
-#define RSVP_DST_LEN	4
-#define RSVP_ID		"rsvp6"
-#define RSVP_OPS	cls_rsvp6_ops
-
-#include "cls_rsvp.h"
-MODULE_LICENSE("GPL");
diff --git linux-libre-4.14.325-gnu1/net/sched/sch_plug.c linux-libre-4.14.326-gnu1/net/sched/sch_plug.c
index 1c6cbab3e7b9..27a0c028ba33 100644
--- linux-libre-4.14.325-gnu1/net/sched/sch_plug.c
+++ linux-libre-4.14.326-gnu1/net/sched/sch_plug.c
@@ -212,7 +212,7 @@ static struct Qdisc_ops plug_qdisc_ops __read_mostly = {
 	.priv_size   =       sizeof(struct plug_sched_data),
 	.enqueue     =       plug_enqueue,
 	.dequeue     =       plug_dequeue,
-	.peek        =       qdisc_peek_head,
+	.peek        =       qdisc_peek_dequeued,
 	.init        =       plug_init,
 	.change      =       plug_change,
 	.reset       =	     qdisc_reset_queue,
diff --git linux-libre-4.14.325-gnu1/net/sched/sch_qfq.c linux-libre-4.14.326-gnu1/net/sched/sch_qfq.c
index 1a1366b037fb..594c2ac319e0 100644
--- linux-libre-4.14.325-gnu1/net/sched/sch_qfq.c
+++ linux-libre-4.14.326-gnu1/net/sched/sch_qfq.c
@@ -984,10 +984,13 @@ static void qfq_update_eligible(struct qfq_sched *q)
 }
 
 /* Dequeue head packet of the head class in the DRR queue of the aggregate. */
-static void agg_dequeue(struct qfq_aggregate *agg,
-			struct qfq_class *cl, unsigned int len)
+static struct sk_buff *agg_dequeue(struct qfq_aggregate *agg,
+				   struct qfq_class *cl, unsigned int len)
 {
-	qdisc_dequeue_peeked(cl->qdisc);
+	struct sk_buff *skb = qdisc_dequeue_peeked(cl->qdisc);
+
+	if (!skb)
+		return NULL;
 
 	cl->deficit -= (int) len;
 
@@ -997,6 +1000,8 @@ static void agg_dequeue(struct qfq_aggregate *agg,
 		cl->deficit += agg->lmax;
 		list_move_tail(&cl->alist, &agg->active);
 	}
+
+	return skb;
 }
 
 static inline struct sk_buff *qfq_peek_skb(struct qfq_aggregate *agg,
@@ -1142,11 +1147,18 @@ static struct sk_buff *qfq_dequeue(struct Qdisc *sch)
 	if (!skb)
 		return NULL;
 
-	qdisc_qstats_backlog_dec(sch, skb);
 	sch->q.qlen--;
+
+	skb = agg_dequeue(in_serv_agg, cl, len);
+
+	if (!skb) {
+		sch->q.qlen++;
+		return NULL;
+	}
+
+	qdisc_qstats_backlog_dec(sch, skb);
 	qdisc_bstats_update(sch, skb);
 
-	agg_dequeue(in_serv_agg, cl, len);
 	/* If lmax is lowered, through qfq_change_class, for a class
 	 * owning pending packets with larger size than the new value
 	 * of lmax, then the following condition may hold.
diff --git linux-libre-4.14.325-gnu1/net/sctp/sm_sideeffect.c linux-libre-4.14.326-gnu1/net/sctp/sm_sideeffect.c
index 169819263c0b..87822421b99d 100644
--- linux-libre-4.14.325-gnu1/net/sctp/sm_sideeffect.c
+++ linux-libre-4.14.326-gnu1/net/sctp/sm_sideeffect.c
@@ -1235,7 +1235,10 @@ static int sctp_side_effects(enum sctp_event event_type,
 	default:
 		pr_err("impossible disposition %d in state %d, event_type %d, event_id %d\n",
 		       status, state, event_type, subtype.chunk);
-		BUG();
+		error = status;
+		if (error >= 0)
+			error = -EINVAL;
+		WARN_ON_ONCE(1);
 		break;
 	}
 
diff --git linux-libre-4.14.325-gnu1/net/unix/af_unix.c linux-libre-4.14.326-gnu1/net/unix/af_unix.c
index 4def6e954e48..8d25d50f916e 100644
--- linux-libre-4.14.325-gnu1/net/unix/af_unix.c
+++ linux-libre-4.14.326-gnu1/net/unix/af_unix.c
@@ -589,7 +589,7 @@ static void unix_release_sock(struct sock *sk, int embrion)
 	 *	  What the above comment does talk about? --ANK(980817)
 	 */
 
-	if (unix_tot_inflight)
+	if (READ_ONCE(unix_tot_inflight))
 		unix_gc();		/* Garbage collect fds */
 }
 
diff --git linux-libre-4.14.325-gnu1/net/unix/scm.c linux-libre-4.14.326-gnu1/net/unix/scm.c
index 6c10af6037e3..c4dde276fea5 100644
--- linux-libre-4.14.325-gnu1/net/unix/scm.c
+++ linux-libre-4.14.326-gnu1/net/unix/scm.c
@@ -60,7 +60,7 @@ void unix_inflight(struct user_struct *user, struct file *fp)
 		/* Paired with READ_ONCE() in wait_for_unix_gc() */
 		WRITE_ONCE(unix_tot_inflight, unix_tot_inflight + 1);
 	}
-	user->unix_inflight++;
+	WRITE_ONCE(user->unix_inflight, user->unix_inflight + 1);
 	spin_unlock(&unix_gc_lock);
 }
 
@@ -81,7 +81,7 @@ void unix_notinflight(struct user_struct *user, struct file *fp)
 		/* Paired with READ_ONCE() in wait_for_unix_gc() */
 		WRITE_ONCE(unix_tot_inflight, unix_tot_inflight - 1);
 	}
-	user->unix_inflight--;
+	WRITE_ONCE(user->unix_inflight, user->unix_inflight - 1);
 	spin_unlock(&unix_gc_lock);
 }
 
@@ -95,7 +95,7 @@ static inline bool too_many_unix_fds(struct task_struct *p)
 {
 	struct user_struct *user = current_user();
 
-	if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE)))
+	if (unlikely(READ_ONCE(user->unix_inflight) > task_rlimit(p, RLIMIT_NOFILE)))
 		return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN);
 	return false;
 }
diff --git linux-libre-4.14.325-gnu1/scripts/Makefile.ubsan linux-libre-4.14.326-gnu1/scripts/Makefile.ubsan
index 8fd4d44fbcd1..b593b36ccff8 100644
--- linux-libre-4.14.325-gnu1/scripts/Makefile.ubsan
+++ linux-libre-4.14.326-gnu1/scripts/Makefile.ubsan
@@ -7,7 +7,6 @@ ifdef CONFIG_UBSAN
       CFLAGS_UBSAN += $(call cc-option, -fsanitize=signed-integer-overflow)
       CFLAGS_UBSAN += $(call cc-option, -fsanitize=bounds)
       CFLAGS_UBSAN += $(call cc-option, -fsanitize=object-size)
-      CFLAGS_UBSAN += $(call cc-option, -fsanitize=returns-nonnull-attribute)
       CFLAGS_UBSAN += $(call cc-option, -fsanitize=bool)
       CFLAGS_UBSAN += $(call cc-option, -fsanitize=enum)
 
diff --git linux-libre-4.14.325-gnu1/security/keys/keyctl.c linux-libre-4.14.326-gnu1/security/keys/keyctl.c
index 9394d72a77e8..9e52a3e0fc67 100644
--- linux-libre-4.14.325-gnu1/security/keys/keyctl.c
+++ linux-libre-4.14.326-gnu1/security/keys/keyctl.c
@@ -922,14 +922,19 @@ long keyctl_chown_key(key_serial_t id, uid_t user, gid_t group)
 	ret = -EACCES;
 	down_write(&key->sem);
 
-	if (!capable(CAP_SYS_ADMIN)) {
+	{
+		bool is_privileged_op = false;
+
 		/* only the sysadmin can chown a key to some other UID */
 		if (user != (uid_t) -1 && !uid_eq(key->uid, uid))
-			goto error_put;
+			is_privileged_op = true;
 
 		/* only the sysadmin can set the key's GID to a group other
 		 * than one of those that the current process subscribes to */
 		if (group != (gid_t) -1 && !gid_eq(gid, key->gid) && !in_group_p(gid))
+			is_privileged_op = true;
+
+		if (is_privileged_op && !capable(CAP_SYS_ADMIN))
 			goto error_put;
 	}
 
@@ -1029,7 +1034,7 @@ long keyctl_setperm_key(key_serial_t id, key_perm_t perm)
 	down_write(&key->sem);
 
 	/* if we're not the sysadmin, we can only change a key that we own */
-	if (capable(CAP_SYS_ADMIN) || uid_eq(key->uid, current_fsuid())) {
+	if (uid_eq(key->uid, current_fsuid()) || capable(CAP_SYS_ADMIN)) {
 		key->perm = perm;
 		ret = 0;
 	}
diff --git linux-libre-4.14.325-gnu1/security/smack/smackfs.c linux-libre-4.14.326-gnu1/security/smack/smackfs.c
index a9c516362170..61e734baa332 100644
--- linux-libre-4.14.325-gnu1/security/smack/smackfs.c
+++ linux-libre-4.14.326-gnu1/security/smack/smackfs.c
@@ -923,7 +923,7 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
 	}
 
 	ret = sscanf(rule, "%d", &catlen);
-	if (ret != 1 || catlen > SMACK_CIPSO_MAXCATNUM)
+	if (ret != 1 || catlen < 0 || catlen > SMACK_CIPSO_MAXCATNUM)
 		goto out;
 
 	if (format == SMK_FIXED24_FMT &&
diff --git linux-libre-4.14.325-gnu1/sound/core/pcm_compat.c linux-libre-4.14.326-gnu1/sound/core/pcm_compat.c
index 6491afbb5fd5..6b8e64d053c1 100644
--- linux-libre-4.14.325-gnu1/sound/core/pcm_compat.c
+++ linux-libre-4.14.326-gnu1/sound/core/pcm_compat.c
@@ -335,10 +335,14 @@ static int snd_pcm_ioctl_hw_params_compat(struct snd_pcm_substream *substream,
 		goto error;
 	}
 
-	if (refine)
+	if (refine) {
 		err = snd_pcm_hw_refine(substream, data);
-	else
+		if (err < 0)
+			goto error;
+		err = fixup_unreferenced_params(substream, data);
+	} else {
 		err = snd_pcm_hw_params(substream, data);
+	}
 	if (err < 0)
 		goto error;
 	if (copy_to_user(data32, data, sizeof(*data32)) ||
diff --git linux-libre-4.14.325-gnu1/sound/core/seq/oss/seq_oss_midi.c linux-libre-4.14.326-gnu1/sound/core/seq/oss/seq_oss_midi.c
index cc8f06638edc..7226c03f1593 100644
--- linux-libre-4.14.325-gnu1/sound/core/seq/oss/seq_oss_midi.c
+++ linux-libre-4.14.326-gnu1/sound/core/seq/oss/seq_oss_midi.c
@@ -50,6 +50,7 @@ struct seq_oss_midi {
 	struct snd_midi_event *coder;	/* MIDI event coder */
 	struct seq_oss_devinfo *devinfo;	/* assigned OSSseq device */
 	snd_use_lock_t use_lock;
+	struct mutex open_mutex;
 };
 
 
@@ -184,6 +185,7 @@ snd_seq_oss_midi_check_new_port(struct snd_seq_port_info *pinfo)
 	mdev->flags = pinfo->capability;
 	mdev->opened = 0;
 	snd_use_lock_init(&mdev->use_lock);
+	mutex_init(&mdev->open_mutex);
 
 	/* copy and truncate the name of synth device */
 	strlcpy(mdev->name, pinfo->name, sizeof(mdev->name));
@@ -332,14 +334,16 @@ snd_seq_oss_midi_open(struct seq_oss_devinfo *dp, int dev, int fmode)
 	int perm;
 	struct seq_oss_midi *mdev;
 	struct snd_seq_port_subscribe subs;
+	int err;
 
 	if ((mdev = get_mididev(dp, dev)) == NULL)
 		return -ENODEV;
 
+	mutex_lock(&mdev->open_mutex);
 	/* already used? */
 	if (mdev->opened && mdev->devinfo != dp) {
-		snd_use_lock_free(&mdev->use_lock);
-		return -EBUSY;
+		err = -EBUSY;
+		goto unlock;
 	}
 
 	perm = 0;
@@ -349,14 +353,14 @@ snd_seq_oss_midi_open(struct seq_oss_devinfo *dp, int dev, int fmode)
 		perm |= PERM_READ;
 	perm &= mdev->flags;
 	if (perm == 0) {
-		snd_use_lock_free(&mdev->use_lock);
-		return -ENXIO;
+		err = -ENXIO;
+		goto unlock;
 	}
 
 	/* already opened? */
 	if ((mdev->opened & perm) == perm) {
-		snd_use_lock_free(&mdev->use_lock);
-		return 0;
+		err = 0;
+		goto unlock;
 	}
 
 	perm &= ~mdev->opened;
@@ -381,13 +385,17 @@ snd_seq_oss_midi_open(struct seq_oss_devinfo *dp, int dev, int fmode)
 	}
 
 	if (! mdev->opened) {
-		snd_use_lock_free(&mdev->use_lock);
-		return -ENXIO;
+		err = -ENXIO;
+		goto unlock;
 	}
 
 	mdev->devinfo = dp;
+	err = 0;
+
+ unlock:
+	mutex_unlock(&mdev->open_mutex);
 	snd_use_lock_free(&mdev->use_lock);
-	return 0;
+	return err;
 }
 
 /*
@@ -401,10 +409,9 @@ snd_seq_oss_midi_close(struct seq_oss_devinfo *dp, int dev)
 
 	if ((mdev = get_mididev(dp, dev)) == NULL)
 		return -ENODEV;
-	if (! mdev->opened || mdev->devinfo != dp) {
-		snd_use_lock_free(&mdev->use_lock);
-		return 0;
-	}
+	mutex_lock(&mdev->open_mutex);
+	if (!mdev->opened || mdev->devinfo != dp)
+		goto unlock;
 
 	memset(&subs, 0, sizeof(subs));
 	if (mdev->opened & PERM_WRITE) {
@@ -423,6 +430,8 @@ snd_seq_oss_midi_close(struct seq_oss_devinfo *dp, int dev)
 	mdev->opened = 0;
 	mdev->devinfo = NULL;
 
+ unlock:
+	mutex_unlock(&mdev->open_mutex);
 	snd_use_lock_free(&mdev->use_lock);
 	return 0;
 }
diff --git linux-libre-4.14.325-gnu1/sound/pci/ac97/ac97_codec.c linux-libre-4.14.326-gnu1/sound/pci/ac97/ac97_codec.c
index e37eab3ddc73..5095048d5cea 100644
--- linux-libre-4.14.325-gnu1/sound/pci/ac97/ac97_codec.c
+++ linux-libre-4.14.326-gnu1/sound/pci/ac97/ac97_codec.c
@@ -2026,10 +2026,9 @@ int snd_ac97_mixer(struct snd_ac97_bus *bus, struct snd_ac97_template *template,
 		.dev_disconnect =	snd_ac97_dev_disconnect,
 	};
 
-	if (!rac97)
-		return -EINVAL;
-	if (snd_BUG_ON(!bus || !template))
+	if (snd_BUG_ON(!bus || !template || !rac97))
 		return -EINVAL;
+	*rac97 = NULL;
 	if (snd_BUG_ON(template->num >= 4))
 		return -EINVAL;
 	if (bus->codec[template->num])
diff --git linux-libre-4.14.325-gnu1/sound/soc/codecs/da7219-aad.c linux-libre-4.14.326-gnu1/sound/soc/codecs/da7219-aad.c
index 1d1d10dd92ae..793c8768f7c4 100644
--- linux-libre-4.14.325-gnu1/sound/soc/codecs/da7219-aad.c
+++ linux-libre-4.14.326-gnu1/sound/soc/codecs/da7219-aad.c
@@ -854,6 +854,8 @@ void da7219_aad_suspend(struct snd_soc_codec *codec)
 			}
 		}
 	}
+
+	synchronize_irq(da7219_aad->irq);
 }
 
 void da7219_aad_resume(struct snd_soc_codec *codec)
diff --git linux-libre-4.14.325-gnu1/sound/soc/codecs/es8316.c linux-libre-4.14.326-gnu1/sound/soc/codecs/es8316.c
index fad918c44ec9..75a6b8b4e9c0 100644
--- linux-libre-4.14.325-gnu1/sound/soc/codecs/es8316.c
+++ linux-libre-4.14.326-gnu1/sound/soc/codecs/es8316.c
@@ -145,7 +145,7 @@ static const char * const es8316_dmic_txt[] = {
 		"dmic data at high level",
 		"dmic data at low level",
 };
-static const unsigned int es8316_dmic_values[] = { 0, 1, 2 };
+static const unsigned int es8316_dmic_values[] = { 0, 2, 3 };
 static const struct soc_enum es8316_dmic_src_enum =
 	SOC_VALUE_ENUM_SINGLE(ES8316_ADC_DMIC, 0, 3,
 			      ARRAY_SIZE(es8316_dmic_txt),
