diff -druNp --no-dereference linux-libre-3.18.113-gnu/arch/arm/boot/compressed/head.S linux-libre-3.18.114-gnu/arch/arm/boot/compressed/head.S
--- linux-libre-3.18.113-gnu/arch/arm/boot/compressed/head.S	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/arch/arm/boot/compressed/head.S	2018-07-03 05:18:49.000000000 -0400
@@ -24,19 +24,19 @@
 #if defined(CONFIG_DEBUG_ICEDCC)
 
 #if defined(CONFIG_CPU_V6) || defined(CONFIG_CPU_V6K) || defined(CONFIG_CPU_V7)
-		.macro	loadsp, rb, tmp
+		.macro	loadsp, rb, tmp1, tmp2
 		.endm
 		.macro	writeb, ch, rb
 		mcr	p14, 0, \ch, c0, c5, 0
 		.endm
 #elif defined(CONFIG_CPU_XSCALE)
-		.macro	loadsp, rb, tmp
+		.macro	loadsp, rb, tmp1, tmp2
 		.endm
 		.macro	writeb, ch, rb
 		mcr	p14, 0, \ch, c8, c0, 0
 		.endm
 #else
-		.macro	loadsp, rb, tmp
+		.macro	loadsp, rb, tmp1, tmp2
 		.endm
 		.macro	writeb, ch, rb
 		mcr	p14, 0, \ch, c1, c0, 0
@@ -52,7 +52,7 @@
 		.endm
 
 #if defined(CONFIG_ARCH_SA1100)
-		.macro	loadsp, rb, tmp
+		.macro	loadsp, rb, tmp1, tmp2
 		mov	\rb, #0x80000000	@ physical base address
 #ifdef CONFIG_DEBUG_LL_SER3
 		add	\rb, \rb, #0x00050000	@ Ser3
@@ -61,8 +61,8 @@
 #endif
 		.endm
 #else
-		.macro	loadsp,	rb, tmp
-		addruart \rb, \tmp
+		.macro	loadsp,	rb, tmp1, tmp2
+		addruart \rb, \tmp1, \tmp2
 		.endm
 #endif
 #endif
@@ -1221,7 +1221,7 @@ phex:		adr	r3, phexbuf
 		b	1b
 
 @ puts corrupts {r0, r1, r2, r3}
-puts:		loadsp	r3, r1
+puts:		loadsp	r3, r2, r1
 1:		ldrb	r2, [r0], #1
 		teq	r2, #0
 		moveq	pc, lr
@@ -1238,8 +1238,8 @@ puts:		loadsp	r3, r1
 @ putc corrupts {r0, r1, r2, r3}
 putc:
 		mov	r2, r0
+		loadsp	r3, r1, r0
 		mov	r0, #0
-		loadsp	r3, r1
 		b	2b
 
 @ memdump corrupts {r0, r1, r2, r3, r10, r11, r12, lr}
diff -druNp --no-dereference linux-libre-3.18.113-gnu/arch/arm/include/asm/kgdb.h linux-libre-3.18.114-gnu/arch/arm/include/asm/kgdb.h
--- linux-libre-3.18.113-gnu/arch/arm/include/asm/kgdb.h	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/arch/arm/include/asm/kgdb.h	2018-07-03 05:18:49.000000000 -0400
@@ -76,7 +76,7 @@ extern int kgdb_fault_expected;
 
 #define KGDB_MAX_NO_CPUS	1
 #define BUFMAX			400
-#define NUMREGBYTES		(DBG_MAX_REG_NUM << 2)
+#define NUMREGBYTES		(GDB_MAX_REGS << 2)
 #define NUMCRITREGBYTES		(32 << 2)
 
 #define _R0			0
diff -druNp --no-dereference linux-libre-3.18.113-gnu/arch/arm/mach-davinci/board-dm355-evm.c linux-libre-3.18.114-gnu/arch/arm/mach-davinci/board-dm355-evm.c
--- linux-libre-3.18.113-gnu/arch/arm/mach-davinci/board-dm355-evm.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/arch/arm/mach-davinci/board-dm355-evm.c	2018-07-03 05:18:49.000000000 -0400
@@ -18,6 +18,7 @@
 #include <linux/i2c.h>
 #include <linux/gpio.h>
 #include <linux/clk.h>
+#include <linux/dm9000.h>
 #include <linux/videodev2.h>
 #include <media/tvp514x.h>
 #include <linux/spi/spi.h>
@@ -170,11 +171,16 @@ static struct resource dm355evm_dm9000_r
 	},
 };
 
+static struct dm9000_plat_data dm335evm_dm9000_platdata;
+
 static struct platform_device dm355evm_dm9000 = {
 	.name		= "dm9000",
 	.id		= -1,
 	.resource	= dm355evm_dm9000_rsrc,
 	.num_resources	= ARRAY_SIZE(dm355evm_dm9000_rsrc),
+	.dev		= {
+		.platform_data = &dm335evm_dm9000_platdata,
+	},
 };
 
 static struct tvp514x_platform_data tvp5146_pdata = {
diff -druNp --no-dereference linux-libre-3.18.113-gnu/arch/arm/mach-davinci/board-dm646x-evm.c linux-libre-3.18.114-gnu/arch/arm/mach-davinci/board-dm646x-evm.c
--- linux-libre-3.18.113-gnu/arch/arm/mach-davinci/board-dm646x-evm.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/arch/arm/mach-davinci/board-dm646x-evm.c	2018-07-03 05:18:49.000000000 -0400
@@ -538,7 +538,7 @@ static struct vpif_display_config dm646x
 		.outputs = dm6467_ch0_outputs,
 		.output_count = ARRAY_SIZE(dm6467_ch0_outputs),
 	},
-	.card_name	= "DM646x EVM",
+	.card_name	= "DM646x EVM Video Display",
 };
 
 /**
@@ -696,6 +696,7 @@ static struct vpif_capture_config dm646x
 			.fid_pol = 0,
 		},
 	},
+	.card_name = "DM646x EVM Video Capture",
 };
 
 static void __init evm_init_video(void)
diff -druNp --no-dereference linux-libre-3.18.113-gnu/arch/arm/mach-keystone/pm_domain.c linux-libre-3.18.114-gnu/arch/arm/mach-keystone/pm_domain.c
--- linux-libre-3.18.113-gnu/arch/arm/mach-keystone/pm_domain.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/arch/arm/mach-keystone/pm_domain.c	2018-07-03 05:18:49.000000000 -0400
@@ -59,6 +59,7 @@ static struct dev_pm_domain keystone_pm_
 
 static struct pm_clk_notifier_block platform_domain_notifier = {
 	.pm_domain = &keystone_pm_domain,
+	.con_ids = { NULL },
 };
 
 static struct of_device_id of_keystone_table[] = {
diff -druNp --no-dereference linux-libre-3.18.113-gnu/arch/arm64/kernel/ptrace.c linux-libre-3.18.114-gnu/arch/arm64/kernel/ptrace.c
--- linux-libre-3.18.113-gnu/arch/arm64/kernel/ptrace.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/arch/arm64/kernel/ptrace.c	2018-07-03 05:18:49.000000000 -0400
@@ -945,9 +945,7 @@ static int compat_ptrace_gethbpregs(stru
 {
 	int ret;
 	u32 kdata;
-	mm_segment_t old_fs = get_fs();
 
-	set_fs(KERNEL_DS);
 	/* Watchpoint */
 	if (num < 0) {
 		ret = compat_ptrace_hbp_get(NT_ARM_HW_WATCH, tsk, num, &kdata);
@@ -958,7 +956,6 @@ static int compat_ptrace_gethbpregs(stru
 	} else {
 		ret = compat_ptrace_hbp_get(NT_ARM_HW_BREAK, tsk, num, &kdata);
 	}
-	set_fs(old_fs);
 
 	if (!ret)
 		ret = put_user(kdata, data);
@@ -971,7 +968,6 @@ static int compat_ptrace_sethbpregs(stru
 {
 	int ret;
 	u32 kdata = 0;
-	mm_segment_t old_fs = get_fs();
 
 	if (num == 0)
 		return 0;
@@ -980,12 +976,10 @@ static int compat_ptrace_sethbpregs(stru
 	if (ret)
 		return ret;
 
-	set_fs(KERNEL_DS);
 	if (num < 0)
 		ret = compat_ptrace_hbp_set(NT_ARM_HW_WATCH, tsk, num, &kdata);
 	else
 		ret = compat_ptrace_hbp_set(NT_ARM_HW_BREAK, tsk, num, &kdata);
-	set_fs(old_fs);
 
 	return ret;
 }
diff -druNp --no-dereference linux-libre-3.18.113-gnu/arch/hexagon/include/asm/io.h linux-libre-3.18.114-gnu/arch/hexagon/include/asm/io.h
--- linux-libre-3.18.113-gnu/arch/hexagon/include/asm/io.h	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/arch/hexagon/include/asm/io.h	2018-07-03 05:18:49.000000000 -0400
@@ -216,6 +216,12 @@ static inline void memcpy_toio(volatile
 	memcpy((void *) dst, src, count);
 }
 
+static inline void memset_io(volatile void __iomem *addr, int value,
+			     size_t size)
+{
+	memset((void __force *)addr, value, size);
+}
+
 #define PCI_IO_ADDR	(volatile void __iomem *)
 
 /*
diff -druNp --no-dereference linux-libre-3.18.113-gnu/arch/hexagon/lib/checksum.c linux-libre-3.18.114-gnu/arch/hexagon/lib/checksum.c
--- linux-libre-3.18.113-gnu/arch/hexagon/lib/checksum.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/arch/hexagon/lib/checksum.c	2018-07-03 05:18:49.000000000 -0400
@@ -201,3 +201,4 @@ csum_partial_copy_nocheck(const void *sr
 	memcpy(dst, src, len);
 	return csum_partial(dst, len, sum);
 }
+EXPORT_SYMBOL(csum_partial_copy_nocheck);
diff -druNp --no-dereference linux-libre-3.18.113-gnu/arch/m68k/mm/kmap.c linux-libre-3.18.114-gnu/arch/m68k/mm/kmap.c
--- linux-libre-3.18.113-gnu/arch/m68k/mm/kmap.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/arch/m68k/mm/kmap.c	2018-07-03 05:18:49.000000000 -0400
@@ -88,7 +88,8 @@ static inline void free_io_area(void *ad
 	for (p = &iolist ; (tmp = *p) ; p = &tmp->next) {
 		if (tmp->addr == addr) {
 			*p = tmp->next;
-			__iounmap(tmp->addr, tmp->size);
+			/* remove gap added in get_io_area() */
+			__iounmap(tmp->addr, tmp->size - IO_SIZE);
 			kfree(tmp);
 			return;
 		}
diff -druNp --no-dereference linux-libre-3.18.113-gnu/arch/mips/bcm47xx/setup.c linux-libre-3.18.114-gnu/arch/mips/bcm47xx/setup.c
--- linux-libre-3.18.113-gnu/arch/mips/bcm47xx/setup.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/arch/mips/bcm47xx/setup.c	2018-07-03 05:18:49.000000000 -0400
@@ -269,6 +269,12 @@ static int __init bcm47xx_cpu_fixes(void
 		 */
 		if (bcm47xx_bus.bcma.bus.chipinfo.id == BCMA_CHIP_ID_BCM4706)
 			cpu_wait = NULL;
+
+		/*
+		 * BCM47XX Erratum "R10: PCIe Transactions Periodically Fail"
+		 * Enable ExternalSync for sync instruction to take effect
+		 */
+		set_c0_config7(MIPS_CONF7_ES);
 		break;
 #endif
 	}
diff -druNp --no-dereference linux-libre-3.18.113-gnu/arch/mips/include/asm/io.h linux-libre-3.18.114-gnu/arch/mips/include/asm/io.h
--- linux-libre-3.18.113-gnu/arch/mips/include/asm/io.h	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/arch/mips/include/asm/io.h	2018-07-03 05:18:49.000000000 -0400
@@ -375,6 +375,8 @@ static inline type pfx##read##bwlq(const
 		BUG();							\
 	}								\
 									\
+	/* prevent prefetching of coherent DMA data prematurely */	\
+	rmb();								\
 	return pfx##ioswab##bwlq(__mem, __val);				\
 }
 
@@ -410,6 +412,8 @@ static inline type pfx##in##bwlq##p(unsi
 	__val = *__addr;						\
 	slow;								\
 									\
+	/* prevent prefetching of coherent DMA data prematurely */	\
+	rmb();								\
 	return pfx##ioswab##bwlq(__addr, __val);			\
 }
 
diff -druNp --no-dereference linux-libre-3.18.113-gnu/arch/mips/include/asm/mipsregs.h linux-libre-3.18.114-gnu/arch/mips/include/asm/mipsregs.h
--- linux-libre-3.18.113-gnu/arch/mips/include/asm/mipsregs.h	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/arch/mips/include/asm/mipsregs.h	2018-07-03 05:18:49.000000000 -0400
@@ -667,6 +667,8 @@
 #define MIPS_CONF7_WII		(_ULCAST_(1) << 31)
 
 #define MIPS_CONF7_RPS		(_ULCAST_(1) << 2)
+/* ExternalSync */
+#define MIPS_CONF7_ES		(_ULCAST_(1) << 8)
 
 #define MIPS_CONF7_IAR		(_ULCAST_(1) << 10)
 #define MIPS_CONF7_AR		(_ULCAST_(1) << 16)
@@ -1863,6 +1865,7 @@ __BUILD_SET_C0(status)
 __BUILD_SET_C0(cause)
 __BUILD_SET_C0(config)
 __BUILD_SET_C0(config5)
+__BUILD_SET_C0(config7)
 __BUILD_SET_C0(intcontrol)
 __BUILD_SET_C0(intctl)
 __BUILD_SET_C0(srsmap)
diff -druNp --no-dereference linux-libre-3.18.113-gnu/arch/mips/kernel/mcount.S linux-libre-3.18.114-gnu/arch/mips/kernel/mcount.S
--- linux-libre-3.18.113-gnu/arch/mips/kernel/mcount.S	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/arch/mips/kernel/mcount.S	2018-07-03 05:18:49.000000000 -0400
@@ -116,10 +116,20 @@ ftrace_stub:
 NESTED(_mcount, PT_SIZE, ra)
 	PTR_LA	t1, ftrace_stub
 	PTR_L	t2, ftrace_trace_function /* Prepare t2 for (1) */
-	bne	t1, t2, static_trace
+	beq	t1, t2, fgraph_trace
 	 nop
 
+	MCOUNT_SAVE_REGS
+
+	move	a0, ra		/* arg1: self return address */
+	jalr	t2		/* (1) call *ftrace_trace_function */
+	 move	a1, AT		/* arg2: parent's return address */
+
+	MCOUNT_RESTORE_REGS
+
+fgraph_trace:
 #ifdef	CONFIG_FUNCTION_GRAPH_TRACER
+	PTR_LA	t1, ftrace_stub
 	PTR_L	t3, ftrace_graph_return
 	bne	t1, t3, ftrace_graph_caller
 	 nop
@@ -128,24 +138,11 @@ NESTED(_mcount, PT_SIZE, ra)
 	bne	t1, t3, ftrace_graph_caller
 	 nop
 #endif
-	b	ftrace_stub
-#ifdef CONFIG_32BIT
-	 addiu sp, sp, 8
-#else
-	 nop
-#endif
-
-static_trace:
-	MCOUNT_SAVE_REGS
 
-	move	a0, ra		/* arg1: self return address */
-	jalr	t2		/* (1) call *ftrace_trace_function */
-	 move	a1, AT		/* arg2: parent's return address */
-
-	MCOUNT_RESTORE_REGS
 #ifdef CONFIG_32BIT
 	addiu sp, sp, 8
 #endif
+
 	.globl ftrace_stub
 ftrace_stub:
 	RETURN_BACK
diff -druNp --no-dereference linux-libre-3.18.113-gnu/arch/parisc/kernel/time.c linux-libre-3.18.114-gnu/arch/parisc/kernel/time.c
--- linux-libre-3.18.113-gnu/arch/parisc/kernel/time.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/arch/parisc/kernel/time.c	2018-07-03 05:18:49.000000000 -0400
@@ -246,7 +246,7 @@ static int __init rtc_init(void)
 }
 module_init(rtc_init);
 
-void read_persistent_clock(struct timespec *ts)
+void read_persistent_clock64(struct timespec64 *ts)
 {
 	static struct pdc_tod tod_data;
 	if (pdc_tod_read(&tod_data) == 0) {
diff -druNp --no-dereference linux-libre-3.18.113-gnu/arch/powerpc/kernel/entry_64.S linux-libre-3.18.114-gnu/arch/powerpc/kernel/entry_64.S
--- linux-libre-3.18.113-gnu/arch/powerpc/kernel/entry_64.S	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/arch/powerpc/kernel/entry_64.S	2018-07-03 05:18:49.000000000 -0400
@@ -521,6 +521,7 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_1T_SEG
 	 * actually hit this code path.
 	 */
 
+	isync
 	slbie	r6
 	slbie	r6		/* Workaround POWER5 < DD2.1 issue */
 	slbmte	r7,r0
diff -druNp --no-dereference linux-libre-3.18.113-gnu/arch/powerpc/kernel/fadump.c linux-libre-3.18.114-gnu/arch/powerpc/kernel/fadump.c
--- linux-libre-3.18.113-gnu/arch/powerpc/kernel/fadump.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/arch/powerpc/kernel/fadump.c	2018-07-03 05:18:49.000000000 -0400
@@ -1025,6 +1025,9 @@ void fadump_cleanup(void)
 		init_fadump_mem_struct(&fdm,
 			be64_to_cpu(fdm_active->cpu_state_data.destination_address));
 		fadump_invalidate_dump(&fdm);
+	} else if (fw_dump.dump_registered) {
+		/* Un-register Firmware-assisted dump if it was registered. */
+		fadump_unregister_dump(&fdm);
 	}
 }
 
diff -druNp --no-dereference linux-libre-3.18.113-gnu/arch/powerpc/kernel/hw_breakpoint.c linux-libre-3.18.114-gnu/arch/powerpc/kernel/hw_breakpoint.c
--- linux-libre-3.18.113-gnu/arch/powerpc/kernel/hw_breakpoint.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/arch/powerpc/kernel/hw_breakpoint.c	2018-07-03 05:18:49.000000000 -0400
@@ -174,8 +174,8 @@ int arch_validate_hwbkpt_settings(struct
 	if (cpu_has_feature(CPU_FTR_DAWR)) {
 		length_max = 512 ; /* 64 doublewords */
 		/* DAWR region can't cross 512 boundary */
-		if ((bp->attr.bp_addr >> 10) != 
-		    ((bp->attr.bp_addr + bp->attr.bp_len - 1) >> 10))
+		if ((bp->attr.bp_addr >> 9) !=
+		    ((bp->attr.bp_addr + bp->attr.bp_len - 1) >> 9))
 			return -EINVAL;
 	}
 	if (info->len >
diff -druNp --no-dereference linux-libre-3.18.113-gnu/arch/powerpc/kernel/ptrace.c linux-libre-3.18.114-gnu/arch/powerpc/kernel/ptrace.c
--- linux-libre-3.18.113-gnu/arch/powerpc/kernel/ptrace.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/arch/powerpc/kernel/ptrace.c	2018-07-03 05:18:49.000000000 -0400
@@ -1004,6 +1004,7 @@ static int ptrace_set_debugreg(struct ta
 	/* Create a new breakpoint request if one doesn't exist already */
 	hw_breakpoint_init(&attr);
 	attr.bp_addr = hw_brk.address;
+	attr.bp_len = 8;
 	arch_bp_generic_fields(hw_brk.type,
 			       &attr.bp_type);
 
diff -druNp --no-dereference linux-libre-3.18.113-gnu/arch/x86/kernel/cpu/intel.c linux-libre-3.18.114-gnu/arch/x86/kernel/cpu/intel.c
--- linux-libre-3.18.113-gnu/arch/x86/kernel/cpu/intel.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/arch/x86/kernel/cpu/intel.c	2018-07-03 05:18:49.000000000 -0400
@@ -561,6 +561,9 @@ static const struct _tlb_table intel_tlb
 	{ 0x5d, TLB_DATA_4K_4M,		256,	" TLB_DATA 4 KByte and 4 MByte pages" },
 	{ 0x61, TLB_INST_4K,		48,	" TLB_INST 4 KByte pages, full associative" },
 	{ 0x63, TLB_DATA_1G,		4,	" TLB_DATA 1 GByte pages, 4-way set associative" },
+	{ 0x6b, TLB_DATA_4K,		256,	" TLB_DATA 4 KByte pages, 8-way associative" },
+	{ 0x6c, TLB_DATA_2M_4M,		128,	" TLB_DATA 2 MByte or 4 MByte pages, 8-way associative" },
+	{ 0x6d, TLB_DATA_1G,		16,	" TLB_DATA 1 GByte pages, fully associative" },
 	{ 0x76, TLB_INST_2M_4M,		8,	" TLB_INST 2-MByte or 4-MByte pages, fully associative" },
 	{ 0xb0, TLB_INST_4K,		128,	" TLB_INST 4 KByte pages, 4-way set associative" },
 	{ 0xb1, TLB_INST_2M_4M,		4,	" TLB_INST 2M pages, 4-way, 8 entries or 4M pages, 4-way entries" },
diff -druNp --no-dereference linux-libre-3.18.113-gnu/arch/xtensa/kernel/traps.c linux-libre-3.18.114-gnu/arch/xtensa/kernel/traps.c
--- linux-libre-3.18.113-gnu/arch/xtensa/kernel/traps.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/arch/xtensa/kernel/traps.c	2018-07-03 05:18:49.000000000 -0400
@@ -280,7 +280,7 @@ do_unaligned_user (struct pt_regs *regs)
 	info.si_errno = 0;
 	info.si_code = BUS_ADRALN;
 	info.si_addr = (void *) regs->excvaddr;
-	force_sig_info(SIGSEGV, &info, current);
+	force_sig_info(SIGBUS, &info, current);
 
 }
 #endif
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/ata/libata-core.c linux-libre-3.18.114-gnu/drivers/ata/libata-core.c
--- linux-libre-3.18.113-gnu/drivers/ata/libata-core.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/ata/libata-core.c	2018-07-03 05:18:49.000000000 -0400
@@ -4248,9 +4248,6 @@ static const struct ata_blacklist_entry
 						ATA_HORKAGE_ZERO_AFTER_TRIM |
 						ATA_HORKAGE_NOLPM, },
 
-	/* Sandisk devices which are known to not handle LPM well */
-	{ "SanDisk SD7UB3Q*G1001",	NULL,	ATA_HORKAGE_NOLPM, },
-
 	/* devices that don't properly handle queued TRIM commands */
 	{ "Micron_M500_*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
 						ATA_HORKAGE_ZERO_AFTER_TRIM, },
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/ata/libata-eh.c linux-libre-3.18.114-gnu/drivers/ata/libata-eh.c
--- linux-libre-3.18.113-gnu/drivers/ata/libata-eh.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/ata/libata-eh.c	2018-07-03 05:18:49.000000000 -0400
@@ -174,8 +174,8 @@ static void ata_eh_handle_port_resume(st
 { }
 #endif /* CONFIG_PM */
 
-static void __ata_ehi_pushv_desc(struct ata_eh_info *ehi, const char *fmt,
-				 va_list args)
+static __printf(2, 0) void __ata_ehi_pushv_desc(struct ata_eh_info *ehi,
+				 const char *fmt, va_list args)
 {
 	ehi->desc_len += vscnprintf(ehi->desc + ehi->desc_len,
 				     ATA_EH_DESC_LEN - ehi->desc_len,
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/ata/libata-zpodd.c linux-libre-3.18.114-gnu/drivers/ata/libata-zpodd.c
--- linux-libre-3.18.113-gnu/drivers/ata/libata-zpodd.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/ata/libata-zpodd.c	2018-07-03 05:18:49.000000000 -0400
@@ -34,7 +34,7 @@ struct zpodd {
 static int eject_tray(struct ata_device *dev)
 {
 	struct ata_taskfile tf;
-	const char cdb[] = {  GPCMD_START_STOP_UNIT,
+	static const char cdb[ATAPI_CDB_LEN] = {  GPCMD_START_STOP_UNIT,
 		0, 0, 0,
 		0x02,     /* LoEj */
 		0, 0, 0, 0, 0, 0, 0,
@@ -55,7 +55,7 @@ static enum odd_mech_type zpodd_get_mech
 	unsigned int ret;
 	struct rm_feature_desc *desc = (void *)(buf + 8);
 	struct ata_taskfile tf;
-	char cdb[] = {  GPCMD_GET_CONFIGURATION,
+	static const char cdb[] = {  GPCMD_GET_CONFIGURATION,
 			2,      /* only 1 feature descriptor requested */
 			0, 3,   /* 3, removable medium feature */
 			0, 0, 0,/* reserved */
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/char/agp/uninorth-agp.c linux-libre-3.18.114-gnu/drivers/char/agp/uninorth-agp.c
--- linux-libre-3.18.113-gnu/drivers/char/agp/uninorth-agp.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/char/agp/uninorth-agp.c	2018-07-03 05:18:49.000000000 -0400
@@ -196,7 +196,7 @@ static int uninorth_insert_memory(struct
 	return 0;
 }
 
-int uninorth_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
+static int uninorth_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
 {
 	size_t i;
 	u32 *gp;
@@ -467,7 +467,7 @@ static int uninorth_free_gatt_table(stru
 	return 0;
 }
 
-void null_cache_flush(void)
+static void null_cache_flush(void)
 {
 	mb();
 }
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/char/ipmi/ipmi_bt_sm.c linux-libre-3.18.114-gnu/drivers/char/ipmi/ipmi_bt_sm.c
--- linux-libre-3.18.113-gnu/drivers/char/ipmi/ipmi_bt_sm.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/char/ipmi/ipmi_bt_sm.c	2018-07-03 05:18:49.000000000 -0400
@@ -522,11 +522,12 @@ static enum si_sm_result bt_event(struct
 		if (status & BT_H_BUSY)		/* clear a leftover H_BUSY */
 			BT_CONTROL(BT_H_BUSY);
 
+		bt->timeout = bt->BT_CAP_req2rsp;
+
 		/* Read BT capabilities if it hasn't been done yet */
 		if (!bt->BT_CAP_outreqs)
 			BT_STATE_CHANGE(BT_STATE_CAPABILITIES_BEGIN,
 					SI_SM_CALL_WITHOUT_DELAY);
-		bt->timeout = bt->BT_CAP_req2rsp;
 		BT_SI_SM_RETURN(SI_SM_IDLE);
 
 	case BT_STATE_XACTION_START:
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/gpu/drm/msm/msm_gem.c linux-libre-3.18.114-gnu/drivers/gpu/drm/msm/msm_gem.c
--- linux-libre-3.18.113-gnu/drivers/gpu/drm/msm/msm_gem.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/gpu/drm/msm/msm_gem.c	2018-07-03 05:18:49.000000000 -0400
@@ -110,17 +110,19 @@ static void put_pages(struct drm_gem_obj
 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
 
 	if (msm_obj->pages) {
-		/* For non-cached buffers, ensure the new pages are clean
-		 * because display controller, GPU, etc. are not coherent:
-		 */
-		if (msm_obj->flags & (MSM_BO_WC|MSM_BO_UNCACHED))
-			dma_unmap_sg(obj->dev->dev, msm_obj->sgt->sgl,
-					msm_obj->sgt->nents, DMA_BIDIRECTIONAL);
+		if (msm_obj->sgt) {
+			/* For non-cached buffers, ensure the new
+			 * pages are clean because display controller,
+			 * GPU, etc. are not coherent:
+			 */
+			if (msm_obj->flags & (MSM_BO_WC|MSM_BO_UNCACHED))
+				dma_unmap_sg(obj->dev->dev, msm_obj->sgt->sgl,
+					     msm_obj->sgt->nents,
+					     DMA_BIDIRECTIONAL);
 
-		if (msm_obj->sgt)
 			sg_free_table(msm_obj->sgt);
-
-		kfree(msm_obj->sgt);
+			kfree(msm_obj->sgt);
+		}
 
 		if (iommu_present(&platform_bus_type))
 			drm_gem_put_pages(obj, msm_obj->pages, true, false);
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c linux-libre-3.18.114-gnu/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
--- linux-libre-3.18.113-gnu/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c	2018-07-03 05:18:49.000000000 -0400
@@ -356,11 +356,15 @@ int tiler_unpin(struct tiler_block *bloc
 struct tiler_block *tiler_reserve_2d(enum tiler_fmt fmt, uint16_t w,
 		uint16_t h, uint16_t align)
 {
-	struct tiler_block *block = kzalloc(sizeof(*block), GFP_KERNEL);
+	struct tiler_block *block;
 	u32 min_align = 128;
 	int ret;
 	unsigned long flags;
 
+	block = kzalloc(sizeof(*block), GFP_KERNEL);
+	if (!block)
+		return ERR_PTR(-ENOMEM);
+
 	BUG_ON(!validfmt(fmt));
 
 	/* convert width/height to slots */
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/i2c/busses/i2c-pmcmsp.c linux-libre-3.18.114-gnu/drivers/i2c/busses/i2c-pmcmsp.c
--- linux-libre-3.18.113-gnu/drivers/i2c/busses/i2c-pmcmsp.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/i2c/busses/i2c-pmcmsp.c	2018-07-03 05:18:49.000000000 -0400
@@ -592,10 +592,10 @@ static int pmcmsptwi_master_xfer(struct
 		 * TODO: We could potentially loop and retry in the case
 		 * of MSP_TWI_XFER_TIMEOUT.
 		 */
-		return -1;
+		return -EIO;
 	}
 
-	return 0;
+	return num;
 }
 
 static u32 pmcmsptwi_i2c_func(struct i2c_adapter *adapter)
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/i2c/busses/i2c-viperboard.c linux-libre-3.18.114-gnu/drivers/i2c/busses/i2c-viperboard.c
--- linux-libre-3.18.113-gnu/drivers/i2c/busses/i2c-viperboard.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/i2c/busses/i2c-viperboard.c	2018-07-03 05:18:49.000000000 -0400
@@ -341,7 +341,7 @@ static int vprbrd_i2c_xfer(struct i2c_ad
 		}
 		mutex_unlock(&vb->lock);
 	}
-	return 0;
+	return num;
 error:
 	mutex_unlock(&vb->lock);
 	return error;
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/md/dm-thin.c linux-libre-3.18.114-gnu/drivers/md/dm-thin.c
--- linux-libre-3.18.113-gnu/drivers/md/dm-thin.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/md/dm-thin.c	2018-07-03 05:18:49.000000000 -0400
@@ -992,6 +992,8 @@ static void schedule_external_copy(struc
 
 static void set_pool_mode(struct pool *pool, enum pool_mode new_mode);
 
+static void requeue_bios(struct pool *pool);
+
 static void check_for_space(struct pool *pool)
 {
 	int r;
@@ -1004,8 +1006,10 @@ static void check_for_space(struct pool
 	if (r)
 		return;
 
-	if (nr_free)
+	if (nr_free) {
 		set_pool_mode(pool, PM_WRITE);
+		requeue_bios(pool);
+	}
 }
 
 /*
@@ -1082,7 +1086,10 @@ static int alloc_data_block(struct thin_
 
 	r = dm_pool_alloc_data_block(pool->pmd, result);
 	if (r) {
-		metadata_operation_failed(pool, "dm_pool_alloc_data_block", r);
+		if (r == -ENOSPC)
+			set_pool_mode(pool, PM_OUT_OF_DATA_SPACE);
+		else
+			metadata_operation_failed(pool, "dm_pool_alloc_data_block", r);
 		return r;
 	}
 
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/media/dvb-core/dvb_frontend.c linux-libre-3.18.114-gnu/drivers/media/dvb-core/dvb_frontend.c
--- linux-libre-3.18.113-gnu/drivers/media/dvb-core/dvb_frontend.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/media/dvb-core/dvb_frontend.c	2018-07-03 05:18:49.000000000 -0400
@@ -224,8 +224,20 @@ static void dvb_frontend_add_event(struc
 	wake_up_interruptible (&events->wait_queue);
 }
 
+static int dvb_frontend_test_event(struct dvb_frontend_private *fepriv,
+				   struct dvb_fe_events *events)
+{
+	int ret;
+
+	up(&fepriv->sem);
+	ret = events->eventw != events->eventr;
+	down(&fepriv->sem);
+
+	return ret;
+}
+
 static int dvb_frontend_get_event(struct dvb_frontend *fe,
-			    struct dvb_frontend_event *event, int flags)
+			          struct dvb_frontend_event *event, int flags)
 {
 	struct dvb_frontend_private *fepriv = fe->frontend_priv;
 	struct dvb_fe_events *events = &fepriv->events;
@@ -243,13 +255,8 @@ static int dvb_frontend_get_event(struct
 		if (flags & O_NONBLOCK)
 			return -EWOULDBLOCK;
 
-		up(&fepriv->sem);
-
-		ret = wait_event_interruptible (events->wait_queue,
-						events->eventw != events->eventr);
-
-		if (down_interruptible (&fepriv->sem))
-			return -ERESTARTSYS;
+		ret = wait_event_interruptible(events->wait_queue,
+					       dvb_frontend_test_event(fepriv, events));
 
 		if (ret < 0)
 			return ret;
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/media/usb/cx231xx/cx231xx-cards.c linux-libre-3.18.114-gnu/drivers/media/usb/cx231xx/cx231xx-cards.c
--- linux-libre-3.18.113-gnu/drivers/media/usb/cx231xx/cx231xx-cards.c	2018-06-13 14:59:04.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/media/usb/cx231xx/cx231xx-cards.c	2018-07-03 14:15:19.000000000 -0400
@@ -805,6 +805,9 @@ struct usb_device_id cx231xx_id_table[]
 	 .driver_info = CX231XX_BOARD_CNXT_RDE_250},
 	{USB_DEVICE(0x0572, 0x58A0),
 	 .driver_info = CX231XX_BOARD_CNXT_RDU_250},
+	/* AverMedia DVD EZMaker 7 */
+	{USB_DEVICE(0x07ca, 0xc039),
+	 .driver_info = CX231XX_BOARD_CNXT_VIDEO_GRABBER},
 	{USB_DEVICE(0x2040, 0xb110),
 	 .driver_info = CX231XX_BOARD_HAUPPAUGE_USB2_FM_PAL},
 	{USB_DEVICE(0x2040, 0xb111),
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/media/v4l2-core/v4l2-compat-ioctl32.c linux-libre-3.18.114-gnu/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
--- linux-libre-3.18.113-gnu/drivers/media/v4l2-core/v4l2-compat-ioctl32.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/media/v4l2-core/v4l2-compat-ioctl32.c	2018-07-03 05:18:49.000000000 -0400
@@ -856,7 +856,7 @@ static int put_v4l2_ext_controls32(struc
 	    get_user(kcontrols, &kp->controls))
 		return -EFAULT;
 
-	if (!count)
+	if (!count || count > (U32_MAX/sizeof(*ucontrols)))
 		return 0;
 	if (get_user(p, &up->controls))
 		return -EFAULT;
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/mtd/chips/cfi_cmdset_0002.c linux-libre-3.18.114-gnu/drivers/mtd/chips/cfi_cmdset_0002.c
--- linux-libre-3.18.113-gnu/drivers/mtd/chips/cfi_cmdset_0002.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/mtd/chips/cfi_cmdset_0002.c	2018-07-03 05:18:49.000000000 -0400
@@ -1878,7 +1878,7 @@ static int __xipram do_write_buffer(stru
 		if (time_after(jiffies, timeo) && !chip_ready(map, adr))
 			break;
 
-		if (chip_ready(map, adr)) {
+		if (chip_good(map, adr, datum)) {
 			xip_enable(map, chip, adr);
 			goto op_done;
 		}
@@ -2533,7 +2533,7 @@ static int cfi_atmel_unlock(struct mtd_i
 
 struct ppb_lock {
 	struct flchip *chip;
-	loff_t offset;
+	unsigned long adr;
 	int locked;
 };
 
@@ -2551,8 +2551,9 @@ static int __maybe_unused do_ppb_xxlock(
 	unsigned long timeo;
 	int ret;
 
+	adr += chip->start;
 	mutex_lock(&chip->mutex);
-	ret = get_chip(map, chip, adr + chip->start, FL_LOCKING);
+	ret = get_chip(map, chip, adr, FL_LOCKING);
 	if (ret) {
 		mutex_unlock(&chip->mutex);
 		return ret;
@@ -2570,8 +2571,8 @@ static int __maybe_unused do_ppb_xxlock(
 
 	if (thunk == DO_XXLOCK_ONEBLOCK_LOCK) {
 		chip->state = FL_LOCKING;
-		map_write(map, CMD(0xA0), chip->start + adr);
-		map_write(map, CMD(0x00), chip->start + adr);
+		map_write(map, CMD(0xA0), adr);
+		map_write(map, CMD(0x00), adr);
 	} else if (thunk == DO_XXLOCK_ONEBLOCK_UNLOCK) {
 		/*
 		 * Unlocking of one specific sector is not supported, so we
@@ -2609,7 +2610,7 @@ static int __maybe_unused do_ppb_xxlock(
 	map_write(map, CMD(0x00), chip->start);
 
 	chip->state = FL_READY;
-	put_chip(map, chip, adr + chip->start);
+	put_chip(map, chip, adr);
 	mutex_unlock(&chip->mutex);
 
 	return ret;
@@ -2666,9 +2667,9 @@ static int __maybe_unused cfi_ppb_unlock
 		 * sectors shall be unlocked, so lets keep their locking
 		 * status at "unlocked" (locked=0) for the final re-locking.
 		 */
-		if ((adr < ofs) || (adr >= (ofs + len))) {
+		if ((offset < ofs) || (offset >= (ofs + len))) {
 			sect[sectors].chip = &cfi->chips[chipnum];
-			sect[sectors].offset = offset;
+			sect[sectors].adr = adr;
 			sect[sectors].locked = do_ppb_xxlock(
 				map, &cfi->chips[chipnum], adr, 0,
 				DO_XXLOCK_ONEBLOCK_GETLOCK);
@@ -2682,6 +2683,8 @@ static int __maybe_unused cfi_ppb_unlock
 			i++;
 
 		if (adr >> cfi->chipshift) {
+			if (offset >= (ofs + len))
+				break;
 			adr = 0;
 			chipnum++;
 
@@ -2712,7 +2715,7 @@ static int __maybe_unused cfi_ppb_unlock
 	 */
 	for (i = 0; i < sectors; i++) {
 		if (sect[i].locked)
-			do_ppb_xxlock(map, sect[i].chip, sect[i].offset, 0,
+			do_ppb_xxlock(map, sect[i].chip, sect[i].adr, 0,
 				      DO_XXLOCK_ONEBLOCK_LOCK);
 	}
 
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/net/can/dev.c linux-libre-3.18.114-gnu/drivers/net/can/dev.c
--- linux-libre-3.18.113-gnu/drivers/net/can/dev.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/net/can/dev.c	2018-07-03 05:18:49.000000000 -0400
@@ -471,7 +471,7 @@ void can_bus_off(struct net_device *dev)
 {
 	struct can_priv *priv = netdev_priv(dev);
 
-	netdev_dbg(dev, "bus-off\n");
+	netdev_info(dev, "bus-off\n");
 
 	netif_carrier_off(dev);
 	priv->can_stats.bus_off++;
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/net/phy/marvell.c linux-libre-3.18.114-gnu/drivers/net/phy/marvell.c
--- linux-libre-3.18.113-gnu/drivers/net/phy/marvell.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/net/phy/marvell.c	2018-07-03 05:18:49.000000000 -0400
@@ -828,6 +828,15 @@ static int m88e1318_set_wol(struct phy_d
 		if (err < 0)
 			return err;
 
+		/* If WOL event happened once, the LED[2] interrupt pin
+		 * will not be cleared unless we reading the interrupt status
+		 * register. If interrupts are in use, the normal interrupt
+		 * handling will clear the WOL event. Clear the WOL event
+		 * before enabling it if !phy_interrupt_is_valid()
+		 */
+		if (!phy_interrupt_is_valid(phydev))
+			phy_read(phydev, MII_M1011_IEVENT);
+
 		/* Enable the WOL interrupt */
 		temp = phy_read(phydev, MII_88E1318S_PHY_CSIER);
 		temp |= MII_88E1318S_PHY_CSIER_WOL_EIE;
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/pci/hotplug/pciehp_core.c linux-libre-3.18.114-gnu/drivers/pci/hotplug/pciehp_core.c
--- linux-libre-3.18.113-gnu/drivers/pci/hotplug/pciehp_core.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/pci/hotplug/pciehp_core.c	2018-07-03 05:18:49.000000000 -0400
@@ -332,7 +332,7 @@ static int pciehp_resume(struct pcie_dev
 	ctrl = get_service_data(dev);
 
 	/* reinitialize the chipset's event detection logic */
-	pcie_enable_notification(ctrl);
+	pcie_reenable_notification(ctrl);
 
 	slot = ctrl->slot;
 
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/pci/hotplug/pciehp.h linux-libre-3.18.114-gnu/drivers/pci/hotplug/pciehp.h
--- linux-libre-3.18.113-gnu/drivers/pci/hotplug/pciehp.h	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/pci/hotplug/pciehp.h	2018-07-03 05:18:49.000000000 -0400
@@ -144,7 +144,7 @@ struct controller *pcie_init(struct pcie
 int pcie_init_notification(struct controller *ctrl);
 int pciehp_enable_slot(struct slot *p_slot);
 int pciehp_disable_slot(struct slot *p_slot);
-void pcie_enable_notification(struct controller *ctrl);
+void pcie_reenable_notification(struct controller *ctrl);
 int pciehp_power_on_slot(struct slot *slot);
 void pciehp_power_off_slot(struct slot *slot);
 void pciehp_get_power_status(struct slot *slot, u8 *status);
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/pci/hotplug/pciehp_hpc.c linux-libre-3.18.114-gnu/drivers/pci/hotplug/pciehp_hpc.c
--- linux-libre-3.18.113-gnu/drivers/pci/hotplug/pciehp_hpc.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/pci/hotplug/pciehp_hpc.c	2018-07-03 05:18:49.000000000 -0400
@@ -602,7 +602,7 @@ static irqreturn_t pcie_isr(int irq, voi
 	return IRQ_HANDLED;
 }
 
-void pcie_enable_notification(struct controller *ctrl)
+static void pcie_enable_notification(struct controller *ctrl)
 {
 	u16 cmd, mask;
 
@@ -642,6 +642,17 @@ void pcie_enable_notification(struct con
 		 pci_pcie_cap(ctrl->pcie->port) + PCI_EXP_SLTCTL, cmd);
 }
 
+void pcie_reenable_notification(struct controller *ctrl)
+{
+	/*
+	 * Clear both Presence and Data Link Layer Changed to make sure
+	 * those events still fire after we have re-enabled them.
+	 */
+	pcie_capability_write_word(ctrl->pcie->port, PCI_EXP_SLTSTA,
+				   PCI_EXP_SLTSTA_PDC | PCI_EXP_SLTSTA_DLLSC);
+	pcie_enable_notification(ctrl);
+}
+
 static void pcie_disable_notification(struct controller *ctrl)
 {
 	u16 mask;
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/s390/net/smsgiucv.c linux-libre-3.18.114-gnu/drivers/s390/net/smsgiucv.c
--- linux-libre-3.18.113-gnu/drivers/s390/net/smsgiucv.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/s390/net/smsgiucv.c	2018-07-03 05:18:49.000000000 -0400
@@ -190,7 +190,7 @@ static struct device_driver smsg_driver
 
 static void __exit smsg_exit(void)
 {
-	cpcmd("SET SMSG IUCV", NULL, 0, NULL);
+	cpcmd("SET SMSG OFF", NULL, 0, NULL);
 	device_unregister(smsg_dev);
 	iucv_unregister(&smsg_handler, 1);
 	driver_unregister(&smsg_driver);
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/scsi/isci/port_config.c linux-libre-3.18.114-gnu/drivers/scsi/isci/port_config.c
--- linux-libre-3.18.113-gnu/drivers/scsi/isci/port_config.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/scsi/isci/port_config.c	2018-07-03 05:18:49.000000000 -0400
@@ -291,7 +291,7 @@ sci_mpc_agent_validate_phy_configuration
 		 * Note: We have not moved the current phy_index so we will actually
 		 *       compare the startting phy with itself.
 		 *       This is expected and required to add the phy to the port. */
-		while (phy_index < SCI_MAX_PHYS) {
+		for (; phy_index < SCI_MAX_PHYS; phy_index++) {
 			if ((phy_mask & (1 << phy_index)) == 0)
 				continue;
 			sci_phy_get_sas_address(&ihost->phys[phy_index],
@@ -311,7 +311,6 @@ sci_mpc_agent_validate_phy_configuration
 					      &ihost->phys[phy_index]);
 
 			assigned_phy_mask |= (1 << phy_index);
-			phy_index++;
 		}
 
 	}
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/scsi/qla2xxx/qla_init.c linux-libre-3.18.114-gnu/drivers/scsi/qla2xxx/qla_init.c
--- linux-libre-3.18.113-gnu/drivers/scsi/qla2xxx/qla_init.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/scsi/qla2xxx/qla_init.c	2018-07-03 05:18:49.000000000 -0400
@@ -3212,7 +3212,8 @@ qla2x00_iidma_fcport(scsi_qla_host_t *vh
 		return;
 
 	if (fcport->fp_speed == PORT_SPEED_UNKNOWN ||
-	    fcport->fp_speed > ha->link_data_rate)
+	    fcport->fp_speed > ha->link_data_rate ||
+	    !ha->flags.gpsc_supported)
 		return;
 
 	rval = qla2x00_set_idma_speed(vha, fcport->loop_id, fcport->fp_speed,
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/scsi/scsi_transport_iscsi.c linux-libre-3.18.114-gnu/drivers/scsi/scsi_transport_iscsi.c
--- linux-libre-3.18.113-gnu/drivers/scsi/scsi_transport_iscsi.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/scsi/scsi_transport_iscsi.c	2018-07-03 05:18:49.000000000 -0400
@@ -2343,6 +2343,12 @@ iscsi_multicast_skb(struct sk_buff *skb,
 	return nlmsg_multicast(nls, skb, 0, group, gfp);
 }
 
+static int
+iscsi_unicast_skb(struct sk_buff *skb, u32 portid)
+{
+	return nlmsg_unicast(nls, skb, portid);
+}
+
 int iscsi_recv_pdu(struct iscsi_cls_conn *conn, struct iscsi_hdr *hdr,
 		   char *data, uint32_t data_size)
 {
@@ -2545,14 +2551,11 @@ void iscsi_ping_comp_event(uint32_t host
 EXPORT_SYMBOL_GPL(iscsi_ping_comp_event);
 
 static int
-iscsi_if_send_reply(uint32_t group, int seq, int type, int done, int multi,
-		    void *payload, int size)
+iscsi_if_send_reply(u32 portid, int type, void *payload, int size)
 {
 	struct sk_buff	*skb;
 	struct nlmsghdr	*nlh;
 	int len = nlmsg_total_size(size);
-	int flags = multi ? NLM_F_MULTI : 0;
-	int t = done ? NLMSG_DONE : type;
 
 	skb = alloc_skb(len, GFP_ATOMIC);
 	if (!skb) {
@@ -2560,10 +2563,9 @@ iscsi_if_send_reply(uint32_t group, int
 		return -ENOMEM;
 	}
 
-	nlh = __nlmsg_put(skb, 0, 0, t, (len - sizeof(*nlh)), 0);
-	nlh->nlmsg_flags = flags;
+	nlh = __nlmsg_put(skb, 0, 0, type, (len - sizeof(*nlh)), 0);
 	memcpy(nlmsg_data(nlh), payload, size);
-	return iscsi_multicast_skb(skb, group, GFP_ATOMIC);
+	return iscsi_unicast_skb(skb, portid);
 }
 
 static int
@@ -3490,6 +3492,7 @@ static int
 iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
 {
 	int err = 0;
+	u32 portid;
 	struct iscsi_uevent *ev = nlmsg_data(nlh);
 	struct iscsi_transport *transport = NULL;
 	struct iscsi_internal *priv;
@@ -3510,10 +3513,12 @@ iscsi_if_recv_msg(struct sk_buff *skb, s
 	if (!try_module_get(transport->owner))
 		return -EINVAL;
 
+	portid = NETLINK_CB(skb).portid;
+
 	switch (nlh->nlmsg_type) {
 	case ISCSI_UEVENT_CREATE_SESSION:
 		err = iscsi_if_create_session(priv, ep, ev,
-					      NETLINK_CB(skb).portid,
+					      portid,
 					      ev->u.c_session.initial_cmdsn,
 					      ev->u.c_session.cmds_max,
 					      ev->u.c_session.queue_depth);
@@ -3526,7 +3531,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, s
 		}
 
 		err = iscsi_if_create_session(priv, ep, ev,
-					NETLINK_CB(skb).portid,
+					portid,
 					ev->u.c_bound_session.initial_cmdsn,
 					ev->u.c_bound_session.cmds_max,
 					ev->u.c_bound_session.queue_depth);
@@ -3684,6 +3689,8 @@ iscsi_if_recv_msg(struct sk_buff *skb, s
 static void
 iscsi_if_rx(struct sk_buff *skb)
 {
+	u32 portid = NETLINK_CB(skb).portid;
+
 	mutex_lock(&rx_queue_mutex);
 	while (skb->len >= NLMSG_HDRLEN) {
 		int err;
@@ -3719,8 +3726,8 @@ iscsi_if_rx(struct sk_buff *skb)
 				break;
 			if (ev->type == ISCSI_UEVENT_GET_CHAP && !err)
 				break;
-			err = iscsi_if_send_reply(group, nlh->nlmsg_seq,
-				nlh->nlmsg_type, 0, 0, ev, sizeof(*ev));
+			err = iscsi_if_send_reply(portid, nlh->nlmsg_type,
+						  ev, sizeof(*ev));
 		} while (err < 0 && err != -ECONNREFUSED && err != -ESRCH);
 		skb_pull(skb, rlen);
 	}
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/scsi/vmw_pvscsi.c linux-libre-3.18.114-gnu/drivers/scsi/vmw_pvscsi.c
--- linux-libre-3.18.113-gnu/drivers/scsi/vmw_pvscsi.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/scsi/vmw_pvscsi.c	2018-07-03 05:18:49.000000000 -0400
@@ -615,7 +615,7 @@ static void pvscsi_complete_request(stru
 			break;
 
 		case BTSTAT_ABORTQUEUE:
-			cmd->result = (DID_ABORT << 16);
+			cmd->result = (DID_BUS_BUSY << 16);
 			break;
 
 		case BTSTAT_SCSIPARITY:
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/usb/core/hub.c linux-libre-3.18.114-gnu/drivers/usb/core/hub.c
--- linux-libre-3.18.113-gnu/drivers/usb/core/hub.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/usb/core/hub.c	2018-07-03 05:18:49.000000000 -0400
@@ -4405,7 +4405,9 @@ hub_port_init (struct usb_hub *hub, stru
 				 * reset. But only on the first attempt,
 				 * lest we get into a time out/reset loop
 				 */
-				if (r == 0  || (r == -ETIMEDOUT && retries == 0))
+				if (r == 0 || (r == -ETIMEDOUT &&
+						retries == 0 &&
+						udev->speed > USB_SPEED_FULL))
 					break;
 			}
 			udev->descriptor.bMaxPacketSize0 =
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/usb/musb/musb_host.c linux-libre-3.18.114-gnu/drivers/usb/musb/musb_host.c
--- linux-libre-3.18.113-gnu/drivers/usb/musb/musb_host.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/usb/musb/musb_host.c	2018-07-03 05:18:49.000000000 -0400
@@ -2464,8 +2464,11 @@ static int musb_bus_suspend(struct usb_h
 {
 	struct musb	*musb = hcd_to_musb(hcd);
 	u8		devctl;
+	int		ret;
 
-	musb_port_suspend(musb, true);
+	ret = musb_port_suspend(musb, true);
+	if (ret)
+		return ret;
 
 	if (!is_host_active(musb))
 		return 0;
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/usb/musb/musb_host.h linux-libre-3.18.114-gnu/drivers/usb/musb/musb_host.h
--- linux-libre-3.18.113-gnu/drivers/usb/musb/musb_host.h	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/usb/musb/musb_host.h	2018-07-03 05:18:49.000000000 -0400
@@ -92,7 +92,7 @@ extern void musb_host_rx(struct musb *,
 extern void musb_root_disconnect(struct musb *musb);
 extern void musb_host_resume_root_hub(struct musb *musb);
 extern void musb_host_poke_root_hub(struct musb *musb);
-extern void musb_port_suspend(struct musb *musb, bool do_suspend);
+extern int musb_port_suspend(struct musb *musb, bool do_suspend);
 extern void musb_port_reset(struct musb *musb, bool do_reset);
 extern void musb_host_finish_resume(struct work_struct *work);
 #else
@@ -124,7 +124,10 @@ static inline void musb_root_disconnect(
 static inline void musb_host_resume_root_hub(struct musb *musb)	{}
 static inline void musb_host_poll_rh_status(struct musb *musb)	{}
 static inline void musb_host_poke_root_hub(struct musb *musb)	{}
-static inline void musb_port_suspend(struct musb *musb, bool do_suspend) {}
+static inline int musb_port_suspend(struct musb *musb, bool do_suspend)
+{
+	return 0;
+}
 static inline void musb_port_reset(struct musb *musb, bool do_reset) {}
 static inline void musb_host_finish_resume(struct work_struct *work) {}
 #endif
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/usb/musb/musb_virthub.c linux-libre-3.18.114-gnu/drivers/usb/musb/musb_virthub.c
--- linux-libre-3.18.113-gnu/drivers/usb/musb/musb_virthub.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/usb/musb/musb_virthub.c	2018-07-03 05:18:49.000000000 -0400
@@ -74,14 +74,14 @@ void musb_host_finish_resume(struct work
 	spin_unlock_irqrestore(&musb->lock, flags);
 }
 
-void musb_port_suspend(struct musb *musb, bool do_suspend)
+int musb_port_suspend(struct musb *musb, bool do_suspend)
 {
 	struct usb_otg	*otg = musb->xceiv->otg;
 	u8		power;
 	void __iomem	*mbase = musb->mregs;
 
 	if (!is_host_active(musb))
-		return;
+		return 0;
 
 	/* NOTE:  this doesn't necessarily put PHY into low power mode,
 	 * turning off its clock; that's a function of PHY integration and
@@ -92,16 +92,20 @@ void musb_port_suspend(struct musb *musb
 	if (do_suspend) {
 		int retries = 10000;
 
-		power &= ~MUSB_POWER_RESUME;
-		power |= MUSB_POWER_SUSPENDM;
-		musb_writeb(mbase, MUSB_POWER, power);
+		if (power & MUSB_POWER_RESUME)
+			return -EBUSY;
 
-		/* Needed for OPT A tests */
-		power = musb_readb(mbase, MUSB_POWER);
-		while (power & MUSB_POWER_SUSPENDM) {
+		if (!(power & MUSB_POWER_SUSPENDM)) {
+			power |= MUSB_POWER_SUSPENDM;
+			musb_writeb(mbase, MUSB_POWER, power);
+
+			/* Needed for OPT A tests */
 			power = musb_readb(mbase, MUSB_POWER);
-			if (retries-- < 1)
-				break;
+			while (power & MUSB_POWER_SUSPENDM) {
+				power = musb_readb(mbase, MUSB_POWER);
+				if (retries-- < 1)
+					break;
+			}
 		}
 
 		dev_dbg(musb->controller, "Root port suspended, power %02x\n", power);
@@ -138,6 +142,7 @@ void musb_port_suspend(struct musb *musb
 		schedule_delayed_work(&musb->finish_resume_work,
 				      msecs_to_jiffies(USB_RESUME_TIMEOUT));
 	}
+	return 0;
 }
 
 void musb_port_reset(struct musb *musb, bool do_reset)
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/video/backlight/as3711_bl.c linux-libre-3.18.114-gnu/drivers/video/backlight/as3711_bl.c
--- linux-libre-3.18.113-gnu/drivers/video/backlight/as3711_bl.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/video/backlight/as3711_bl.c	2018-07-03 05:18:49.000000000 -0400
@@ -262,10 +262,10 @@ static int as3711_bl_register(struct pla
 static int as3711_backlight_parse_dt(struct device *dev)
 {
 	struct as3711_bl_pdata *pdata = dev_get_platdata(dev);
-	struct device_node *bl =
-		of_find_node_by_name(dev->parent->of_node, "backlight"), *fb;
+	struct device_node *bl, *fb;
 	int ret;
 
+	bl = of_get_child_by_name(dev->parent->of_node, "backlight");
 	if (!bl) {
 		dev_dbg(dev, "backlight node not found\n");
 		return -ENODEV;
@@ -279,7 +279,7 @@ static int as3711_backlight_parse_dt(str
 		if (pdata->su1_max_uA <= 0)
 			ret = -EINVAL;
 		if (ret < 0)
-			return ret;
+			goto err_put_bl;
 	}
 
 	fb = of_parse_phandle(bl, "su2-dev", 0);
@@ -292,7 +292,7 @@ static int as3711_backlight_parse_dt(str
 		if (pdata->su2_max_uA <= 0)
 			ret = -EINVAL;
 		if (ret < 0)
-			return ret;
+			goto err_put_bl;
 
 		if (of_find_property(bl, "su2-feedback-voltage", NULL)) {
 			pdata->su2_feedback = AS3711_SU2_VOLTAGE;
@@ -314,8 +314,10 @@ static int as3711_backlight_parse_dt(str
 			pdata->su2_feedback = AS3711_SU2_CURR_AUTO;
 			count++;
 		}
-		if (count != 1)
-			return -EINVAL;
+		if (count != 1) {
+			ret = -EINVAL;
+			goto err_put_bl;
+		}
 
 		count = 0;
 		if (of_find_property(bl, "su2-fbprot-lx-sd4", NULL)) {
@@ -334,8 +336,10 @@ static int as3711_backlight_parse_dt(str
 			pdata->su2_fbprot = AS3711_SU2_GPIO4;
 			count++;
 		}
-		if (count != 1)
-			return -EINVAL;
+		if (count != 1) {
+			ret = -EINVAL;
+			goto err_put_bl;
+		}
 
 		count = 0;
 		if (of_find_property(bl, "su2-auto-curr1", NULL)) {
@@ -355,11 +359,20 @@ static int as3711_backlight_parse_dt(str
 		 * At least one su2-auto-curr* must be specified iff
 		 * AS3711_SU2_CURR_AUTO is used
 		 */
-		if (!count ^ (pdata->su2_feedback != AS3711_SU2_CURR_AUTO))
-			return -EINVAL;
+		if (!count ^ (pdata->su2_feedback != AS3711_SU2_CURR_AUTO)) {
+			ret = -EINVAL;
+			goto err_put_bl;
+		}
 	}
 
+	of_node_put(bl);
+
 	return 0;
+
+err_put_bl:
+	of_node_put(bl);
+
+	return ret;
 }
 
 static int as3711_backlight_probe(struct platform_device *pdev)
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/video/backlight/max8925_bl.c linux-libre-3.18.114-gnu/drivers/video/backlight/max8925_bl.c
--- linux-libre-3.18.113-gnu/drivers/video/backlight/max8925_bl.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/video/backlight/max8925_bl.c	2018-07-03 05:18:49.000000000 -0400
@@ -116,7 +116,7 @@ static void max8925_backlight_dt_init(st
 	if (!pdata)
 		return;
 
-	np = of_find_node_by_name(nproot, "backlight");
+	np = of_get_child_by_name(nproot, "backlight");
 	if (!np) {
 		dev_err(&pdev->dev, "failed to find backlight node\n");
 		return;
@@ -125,6 +125,8 @@ static void max8925_backlight_dt_init(st
 	if (!of_property_read_u32(np, "maxim,max8925-dual-string", &val))
 		pdata->dual_string = val;
 
+	of_node_put(np);
+
 	pdev->dev.platform_data = pdata;
 }
 
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/video/backlight/tps65217_bl.c linux-libre-3.18.114-gnu/drivers/video/backlight/tps65217_bl.c
--- linux-libre-3.18.113-gnu/drivers/video/backlight/tps65217_bl.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/video/backlight/tps65217_bl.c	2018-07-03 05:18:49.000000000 -0400
@@ -184,11 +184,11 @@ static struct tps65217_bl_pdata *
 tps65217_bl_parse_dt(struct platform_device *pdev)
 {
 	struct tps65217 *tps = dev_get_drvdata(pdev->dev.parent);
-	struct device_node *node = of_node_get(tps->dev->of_node);
+	struct device_node *node;
 	struct tps65217_bl_pdata *pdata, *err;
 	u32 val;
 
-	node = of_find_node_by_name(node, "backlight");
+	node = of_get_child_by_name(tps->dev->of_node, "backlight");
 	if (!node)
 		return ERR_PTR(-ENODEV);
 
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/video/fbdev/uvesafb.c linux-libre-3.18.114-gnu/drivers/video/fbdev/uvesafb.c
--- linux-libre-3.18.113-gnu/drivers/video/fbdev/uvesafb.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/video/fbdev/uvesafb.c	2018-07-03 05:18:49.000000000 -0400
@@ -1059,7 +1059,8 @@ static int uvesafb_setcmap(struct fb_cma
 		    info->cmap.len || cmap->start < info->cmap.start)
 			return -EINVAL;
 
-		entries = kmalloc(sizeof(*entries) * cmap->len, GFP_KERNEL);
+		entries = kmalloc_array(cmap->len, sizeof(*entries),
+					GFP_KERNEL);
 		if (!entries)
 			return -ENOMEM;
 
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/w1/masters/mxc_w1.c linux-libre-3.18.114-gnu/drivers/w1/masters/mxc_w1.c
--- linux-libre-3.18.113-gnu/drivers/w1/masters/mxc_w1.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/w1/masters/mxc_w1.c	2018-07-03 05:18:49.000000000 -0400
@@ -113,6 +113,10 @@ static int mxc_w1_probe(struct platform_
 	if (IS_ERR(mdev->clk))
 		return PTR_ERR(mdev->clk);
 
+	err = clk_prepare_enable(mdev->clk);
+	if (err)
+		return err;
+
 	clkrate = clk_get_rate(mdev->clk);
 	if (clkrate < 10000000)
 		dev_warn(&pdev->dev,
@@ -126,12 +130,10 @@ static int mxc_w1_probe(struct platform_
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	mdev->regs = devm_ioremap_resource(&pdev->dev, res);
-	if (IS_ERR(mdev->regs))
-		return PTR_ERR(mdev->regs);
-
-	err = clk_prepare_enable(mdev->clk);
-	if (err)
-		return err;
+	if (IS_ERR(mdev->regs)) {
+		err = PTR_ERR(mdev->regs);
+		goto out_disable_clk;
+	}
 
 	/* Software reset 1-Wire module */
 	writeb(MXC_W1_RESET_RST, mdev->regs + MXC_W1_RESET);
@@ -147,8 +149,12 @@ static int mxc_w1_probe(struct platform_
 
 	err = w1_add_master_device(&mdev->bus_master);
 	if (err)
-		clk_disable_unprepare(mdev->clk);
+		goto out_disable_clk;
+
+	return 0;
 
+out_disable_clk:
+	clk_disable_unprepare(mdev->clk);
 	return err;
 }
 
diff -druNp --no-dereference linux-libre-3.18.113-gnu/drivers/xen/events/events_base.c linux-libre-3.18.114-gnu/drivers/xen/events/events_base.c
--- linux-libre-3.18.113-gnu/drivers/xen/events/events_base.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/drivers/xen/events/events_base.c	2018-07-03 05:18:49.000000000 -0400
@@ -636,8 +636,6 @@ static void __unbind_from_irq(unsigned i
 		xen_irq_info_cleanup(info);
 	}
 
-	BUG_ON(info_for_irq(irq)->type == IRQT_UNBOUND);
-
 	xen_free_irq(irq);
 }
 
diff -druNp --no-dereference linux-libre-3.18.113-gnu/fs/binfmt_misc.c linux-libre-3.18.114-gnu/fs/binfmt_misc.c
--- linux-libre-3.18.113-gnu/fs/binfmt_misc.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/fs/binfmt_misc.c	2018-07-03 05:18:49.000000000 -0400
@@ -334,8 +334,13 @@ static Node *create_entry(const char __u
 		char *s = strchr(p, del);
 		if (!s)
 			goto Einval;
-		*s++ = '\0';
-		e->offset = simple_strtoul(p, &p, 10);
+		*s = '\0';
+		if (p != s) {
+			int r = kstrtoint(p, 10, &e->offset);
+			if (r != 0 || e->offset < 0)
+				goto Einval;
+		}
+		p = s;
 		if (*p++)
 			goto Einval;
 		e->magic = p;
@@ -356,7 +361,8 @@ static Node *create_entry(const char __u
 		if (e->mask &&
 		    string_unescape_inplace(e->mask, UNESCAPE_HEX) != e->size)
 			goto Einval;
-		if (e->size + e->offset > BINPRM_BUF_SIZE)
+		if (e->size > BINPRM_BUF_SIZE ||
+		    BINPRM_BUF_SIZE - e->size < e->offset)
 			goto Einval;
 	} else {
 		p = strchr(p, del);
diff -druNp --no-dereference linux-libre-3.18.113-gnu/fs/btrfs/scrub.c linux-libre-3.18.114-gnu/fs/btrfs/scrub.c
--- linux-libre-3.18.113-gnu/fs/btrfs/scrub.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/fs/btrfs/scrub.c	2018-07-03 05:18:49.000000000 -0400
@@ -2207,7 +2207,7 @@ static int scrub_extent(struct scrub_ctx
 			have_csum = scrub_find_csum(sctx, logical, l, csum);
 			if (have_csum == 0)
 				++sctx->stat.no_csum;
-			if (sctx->is_dev_replace && !have_csum) {
+			if (0 && sctx->is_dev_replace && !have_csum) {
 				ret = copy_nocow_pages(sctx, logical, l,
 						       mirror_num,
 						      physical_for_dev_replace);
diff -druNp --no-dereference linux-libre-3.18.113-gnu/fs/ext4/inode.c linux-libre-3.18.114-gnu/fs/ext4/inode.c
--- linux-libre-3.18.113-gnu/fs/ext4/inode.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/fs/ext4/inode.c	2018-07-03 05:18:49.000000000 -0400
@@ -3531,28 +3531,28 @@ int ext4_punch_hole(struct inode *inode,
 		EXT4_BLOCK_SIZE_BITS(sb);
 	stop_block = (offset + length) >> EXT4_BLOCK_SIZE_BITS(sb);
 
-	/* If there are no blocks to remove, return now */
-	if (first_block >= stop_block)
-		goto out_stop;
+	/* If there are blocks to remove, do it */
+	if (stop_block > first_block) {
 
-	down_write(&EXT4_I(inode)->i_data_sem);
-	ext4_discard_preallocations(inode);
+		down_write(&EXT4_I(inode)->i_data_sem);
+		ext4_discard_preallocations(inode);
 
-	ret = ext4_es_remove_extent(inode, first_block,
-				    stop_block - first_block);
-	if (ret) {
-		up_write(&EXT4_I(inode)->i_data_sem);
-		goto out_stop;
-	}
+		ret = ext4_es_remove_extent(inode, first_block,
+					    stop_block - first_block);
+		if (ret) {
+			up_write(&EXT4_I(inode)->i_data_sem);
+			goto out_stop;
+		}
 
-	if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))
-		ret = ext4_ext_remove_space(inode, first_block,
-					    stop_block - 1);
-	else
-		ret = ext4_ind_remove_space(handle, inode, first_block,
-					    stop_block);
+		if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))
+			ret = ext4_ext_remove_space(inode, first_block,
+						    stop_block - 1);
+		else
+			ret = ext4_ind_remove_space(handle, inode, first_block,
+						    stop_block);
 
-	up_write(&EXT4_I(inode)->i_data_sem);
+		up_write(&EXT4_I(inode)->i_data_sem);
+	}
 	if (IS_SYNC(inode))
 		ext4_handle_sync(handle);
 
diff -druNp --no-dereference linux-libre-3.18.113-gnu/fs/ext4/resize.c linux-libre-3.18.114-gnu/fs/ext4/resize.c
--- linux-libre-3.18.113-gnu/fs/ext4/resize.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/fs/ext4/resize.c	2018-07-03 05:18:49.000000000 -0400
@@ -1906,7 +1906,7 @@ retry:
 		return 0;
 
 	n_group = ext4_get_group_number(sb, n_blocks_count - 1);
-	if (n_group > (0xFFFFFFFFUL / EXT4_INODES_PER_GROUP(sb))) {
+	if (n_group >= (0xFFFFFFFFUL / EXT4_INODES_PER_GROUP(sb))) {
 		ext4_warning(sb, "resize would cause inodes_count overflow");
 		return -EINVAL;
 	}
diff -druNp --no-dereference linux-libre-3.18.113-gnu/fs/fuse/dir.c linux-libre-3.18.114-gnu/fs/fuse/dir.c
--- linux-libre-3.18.113-gnu/fs/fuse/dir.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/fs/fuse/dir.c	2018-07-03 05:18:49.000000000 -0400
@@ -1717,8 +1717,19 @@ int fuse_do_setattr(struct dentry *dentr
 		return err;
 
 	if (attr->ia_valid & ATTR_OPEN) {
-		if (fc->atomic_o_trunc)
+		/* This is coming from open(..., ... | O_TRUNC); */
+		WARN_ON(!(attr->ia_valid & ATTR_SIZE));
+		WARN_ON(attr->ia_size != 0);
+		if (fc->atomic_o_trunc) {
+			/*
+			 * No need to send request to userspace, since actual
+			 * truncation has already been done by OPEN.  But still
+			 * need to truncate page cache.
+			 */
+			i_size_write(inode, 0);
+			truncate_pagecache(inode, 0);
 			return 0;
+		}
 		file = NULL;
 	}
 
diff -druNp --no-dereference linux-libre-3.18.113-gnu/fs/fuse/inode.c linux-libre-3.18.114-gnu/fs/fuse/inode.c
--- linux-libre-3.18.113-gnu/fs/fuse/inode.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/fs/fuse/inode.c	2018-07-03 05:18:49.000000000 -0400
@@ -1125,6 +1125,7 @@ static int fuse_fill_super(struct super_
  err_put_conn:
 	fuse_bdi_destroy(fc);
 	fuse_conn_put(fc);
+	sb->s_fs_info = NULL;
  err_fput:
 	fput(file);
  err:
diff -druNp --no-dereference linux-libre-3.18.113-gnu/fs/isofs/inode.c linux-libre-3.18.114-gnu/fs/isofs/inode.c
--- linux-libre-3.18.113-gnu/fs/isofs/inode.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/fs/isofs/inode.c	2018-07-03 05:18:49.000000000 -0400
@@ -394,7 +394,10 @@ static int parse_options(char *options,
 			break;
 #ifdef CONFIG_JOLIET
 		case Opt_iocharset:
+			kfree(popt->iocharset);
 			popt->iocharset = match_strdup(&args[0]);
+			if (!popt->iocharset)
+				return 0;
 			break;
 #endif
 		case Opt_map_a:
diff -druNp --no-dereference linux-libre-3.18.113-gnu/fs/nfsd/nfs4xdr.c linux-libre-3.18.114-gnu/fs/nfsd/nfs4xdr.c
--- linux-libre-3.18.113-gnu/fs/nfsd/nfs4xdr.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/fs/nfsd/nfs4xdr.c	2018-07-03 05:18:49.000000000 -0400
@@ -3358,7 +3358,8 @@ nfsd4_encode_readdir(struct nfsd4_compou
 		nfserr = nfserr_resource;
 		goto err_no_verf;
 	}
-	maxcount = min_t(u32, readdir->rd_maxcount, INT_MAX);
+	maxcount = svc_max_payload(resp->rqstp);
+	maxcount = min_t(u32, readdir->rd_maxcount, maxcount);
 	/*
 	 * Note the rfc defines rd_maxcount as the size of the
 	 * READDIR4resok structure, which includes the verifier above
@@ -3372,7 +3373,7 @@ nfsd4_encode_readdir(struct nfsd4_compou
 
 	/* RFC 3530 14.2.24 allows us to ignore dircount when it's 0: */
 	if (!readdir->rd_dircount)
-		readdir->rd_dircount = INT_MAX;
+		readdir->rd_dircount = svc_max_payload(resp->rqstp);
 
 	readdir->xdr = xdr;
 	readdir->rd_maxcount = maxcount;
diff -druNp --no-dereference linux-libre-3.18.113-gnu/fs/notify/fsnotify.c linux-libre-3.18.114-gnu/fs/notify/fsnotify.c
--- linux-libre-3.18.113-gnu/fs/notify/fsnotify.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/fs/notify/fsnotify.c	2018-07-03 05:18:49.000000000 -0400
@@ -135,8 +135,9 @@ static int send_to_group(struct inode *t
 			 const unsigned char *file_name)
 {
 	struct fsnotify_group *group = NULL;
-	__u32 inode_test_mask = 0;
-	__u32 vfsmount_test_mask = 0;
+	__u32 test_mask = (mask & ~FS_EVENT_ON_CHILD);
+	__u32 marks_mask = 0;
+	__u32 marks_ignored_mask = 0;
 
 	if (unlikely(!inode_mark && !vfsmount_mark)) {
 		BUG();
@@ -156,29 +157,25 @@ static int send_to_group(struct inode *t
 	/* does the inode mark tell us to do something? */
 	if (inode_mark) {
 		group = inode_mark->group;
-		inode_test_mask = (mask & ~FS_EVENT_ON_CHILD);
-		inode_test_mask &= inode_mark->mask;
-		inode_test_mask &= ~inode_mark->ignored_mask;
+		marks_mask |= inode_mark->mask;
+		marks_ignored_mask |= inode_mark->ignored_mask;
 	}
 
 	/* does the vfsmount_mark tell us to do something? */
 	if (vfsmount_mark) {
-		vfsmount_test_mask = (mask & ~FS_EVENT_ON_CHILD);
 		group = vfsmount_mark->group;
-		vfsmount_test_mask &= vfsmount_mark->mask;
-		vfsmount_test_mask &= ~vfsmount_mark->ignored_mask;
-		if (inode_mark)
-			vfsmount_test_mask &= ~inode_mark->ignored_mask;
+		marks_mask |= vfsmount_mark->mask;
+		marks_ignored_mask |= vfsmount_mark->ignored_mask;
 	}
 
 	pr_debug("%s: group=%p to_tell=%p mask=%x inode_mark=%p"
-		 " inode_test_mask=%x vfsmount_mark=%p vfsmount_test_mask=%x"
+		 " vfsmount_mark=%p marks_mask=%x marks_ignored_mask=%x"
 		 " data=%p data_is=%d cookie=%d\n",
-		 __func__, group, to_tell, mask, inode_mark,
-		 inode_test_mask, vfsmount_mark, vfsmount_test_mask, data,
+		 __func__, group, to_tell, mask, inode_mark, vfsmount_mark,
+		 marks_mask, marks_ignored_mask, data,
 		 data_is, cookie);
 
-	if (!inode_test_mask && !vfsmount_test_mask)
+	if (!(test_mask & marks_mask & ~marks_ignored_mask))
 		return 0;
 
 	return group->ops->handle_event(group, to_tell, inode_mark,
diff -druNp --no-dereference linux-libre-3.18.113-gnu/fs/ubifs/journal.c linux-libre-3.18.114-gnu/fs/ubifs/journal.c
--- linux-libre-3.18.113-gnu/fs/ubifs/journal.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/fs/ubifs/journal.c	2018-07-03 05:18:49.000000000 -0400
@@ -1101,7 +1101,7 @@ static int recomp_data_node(struct ubifs
 	int err, len, compr_type, out_len;
 
 	out_len = le32_to_cpu(dn->size);
-	buf = kmalloc(out_len * WORST_COMPR_FACTOR, GFP_NOFS);
+	buf = kmalloc_array(out_len, WORST_COMPR_FACTOR, GFP_NOFS);
 	if (!buf)
 		return -ENOMEM;
 
diff -druNp --no-dereference linux-libre-3.18.113-gnu/fs/udf/directory.c linux-libre-3.18.114-gnu/fs/udf/directory.c
--- linux-libre-3.18.113-gnu/fs/udf/directory.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/fs/udf/directory.c	2018-07-03 05:18:49.000000000 -0400
@@ -151,6 +151,9 @@ struct fileIdentDesc *udf_fileident_read
 			       sizeof(struct fileIdentDesc));
 		}
 	}
+	/* Got last entry outside of dir size - fs is corrupted! */
+	if (*nf_pos > dir->i_size)
+		return NULL;
 	return fi;
 }
 
diff -druNp --no-dereference linux-libre-3.18.113-gnu/include/linux/blkdev.h linux-libre-3.18.114-gnu/include/linux/blkdev.h
--- linux-libre-3.18.113-gnu/include/linux/blkdev.h	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/include/linux/blkdev.h	2018-07-03 05:18:49.000000000 -0400
@@ -919,8 +919,8 @@ static inline unsigned int blk_max_size_
 	if (!q->limits.chunk_sectors)
 		return q->limits.max_sectors;
 
-	return q->limits.chunk_sectors -
-			(offset & (q->limits.chunk_sectors - 1));
+	return min(q->limits.max_sectors, (unsigned int)(q->limits.chunk_sectors -
+			(offset & (q->limits.chunk_sectors - 1))));
 }
 
 static inline unsigned int blk_rq_get_max_sectors(struct request *rq)
diff -druNp --no-dereference linux-libre-3.18.113-gnu/include/linux/compiler.h linux-libre-3.18.114-gnu/include/linux/compiler.h
--- linux-libre-3.18.113-gnu/include/linux/compiler.h	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/include/linux/compiler.h	2018-07-03 05:18:49.000000000 -0400
@@ -105,7 +105,7 @@ void ftrace_likely_update(struct ftrace_
 #define unlikely_notrace(x)	__builtin_expect(!!(x), 0)
 
 #define __branch_check__(x, expect) ({					\
-			int ______r;					\
+			long ______r;					\
 			static struct ftrace_branch_data		\
 				__attribute__((__aligned__(4)))		\
 				__attribute__((section("_ftrace_annotated_branch"))) \
diff -druNp --no-dereference linux-libre-3.18.113-gnu/kernel/kthread.c linux-libre-3.18.114-gnu/kernel/kthread.c
--- linux-libre-3.18.113-gnu/kernel/kthread.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/kernel/kthread.c	2018-07-03 05:18:49.000000000 -0400
@@ -156,12 +156,13 @@ void *probe_kthread_data(struct task_str
 
 static void __kthread_parkme(struct kthread *self)
 {
-	__set_current_state(TASK_PARKED);
-	while (test_bit(KTHREAD_SHOULD_PARK, &self->flags)) {
+	for (;;) {
+		set_current_state(TASK_PARKED);
+		if (!test_bit(KTHREAD_SHOULD_PARK, &self->flags))
+			break;
 		if (!test_and_set_bit(KTHREAD_IS_PARKED, &self->flags))
 			complete(&self->parked);
 		schedule();
-		__set_current_state(TASK_PARKED);
 	}
 	clear_bit(KTHREAD_IS_PARKED, &self->flags);
 	__set_current_state(TASK_RUNNING);
diff -druNp --no-dereference linux-libre-3.18.113-gnu/kernel/time/time.c linux-libre-3.18.114-gnu/kernel/time/time.c
--- linux-libre-3.18.113-gnu/kernel/time/time.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/kernel/time/time.c	2018-07-03 05:18:49.000000000 -0400
@@ -28,6 +28,7 @@
  */
 
 #include <linux/export.h>
+#include <linux/kernel.h>
 #include <linux/timex.h>
 #include <linux/capability.h>
 #include <linux/timekeeper_internal.h>
@@ -254,9 +255,10 @@ unsigned int jiffies_to_msecs(const unsi
 	return (j + (HZ / MSEC_PER_SEC) - 1)/(HZ / MSEC_PER_SEC);
 #else
 # if BITS_PER_LONG == 32
-	return (HZ_TO_MSEC_MUL32 * j) >> HZ_TO_MSEC_SHR32;
+	return (HZ_TO_MSEC_MUL32 * j + (1ULL << HZ_TO_MSEC_SHR32) - 1) >>
+	       HZ_TO_MSEC_SHR32;
 # else
-	return (j * HZ_TO_MSEC_NUM) / HZ_TO_MSEC_DEN;
+	return DIV_ROUND_UP(j * HZ_TO_MSEC_NUM, HZ_TO_MSEC_DEN);
 # endif
 #endif
 }
diff -druNp --no-dereference linux-libre-3.18.113-gnu/Makefile linux-libre-3.18.114-gnu/Makefile
--- linux-libre-3.18.113-gnu/Makefile	2018-06-13 14:55:16.000000000 -0400
+++ linux-libre-3.18.114-gnu/Makefile	2018-07-03 14:10:59.000000000 -0400
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 18
-SUBLEVEL = 113
+SUBLEVEL = 114
 EXTRAVERSION =-gnu
 NAME = Diseased Newt
 
@@ -214,7 +214,6 @@ VPATH		:= $(srctree)$(if $(KBUILD_EXTMOD
 
 export srctree objtree VPATH
 
-
 # SUBARCH tells the usermode build what the underlying arch is.  That is set
 # first, and if a usermode build is happening, the "ARCH=um" on the command
 # line overrides the setting of ARCH below.  If a native build is happening,
@@ -1505,11 +1504,11 @@ image_name:
 # Clear a bunch of variables before executing the submake
 tools/: FORCE
 	$(Q)mkdir -p $(objtree)/tools
-	$(Q)$(MAKE) LDFLAGS= MAKEFLAGS="$(filter --j% -j,$(MAKEFLAGS))" O=$(objtree) subdir=tools -C $(src)/tools/
+	$(Q)$(MAKE) LDFLAGS= MAKEFLAGS="$(filter --j% -j,$(MAKEFLAGS))" O=$(O) subdir=tools -C $(src)/tools/
 
 tools/%: FORCE
 	$(Q)mkdir -p $(objtree)/tools
-	$(Q)$(MAKE) LDFLAGS= MAKEFLAGS="$(filter --j% -j,$(MAKEFLAGS))" O=$(objtree) subdir=tools -C $(src)/tools/ $*
+	$(Q)$(MAKE) LDFLAGS= MAKEFLAGS="$(filter --j% -j,$(MAKEFLAGS))" O=$(O) subdir=tools -C $(src)/tools/ $*
 
 # Single targets
 # ---------------------------------------------------------------------------
diff -druNp --no-dereference linux-libre-3.18.113-gnu/net/ipv4/tcp_input.c linux-libre-3.18.114-gnu/net/ipv4/tcp_input.c
--- linux-libre-3.18.113-gnu/net/ipv4/tcp_input.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/net/ipv4/tcp_input.c	2018-07-03 05:18:49.000000000 -0400
@@ -605,7 +605,7 @@ void tcp_rcv_space_adjust(struct sock *s
 			sk->sk_rcvbuf = rcvbuf;
 
 			/* Make the window clamp follow along.  */
-			tp->window_clamp = rcvwin;
+			tp->window_clamp = tcp_win_from_space(rcvbuf);
 		}
 	}
 	tp->rcvq_space.space = copied;
diff -druNp --no-dereference linux-libre-3.18.113-gnu/net/key/af_key.c linux-libre-3.18.114-gnu/net/key/af_key.c
--- linux-libre-3.18.113-gnu/net/key/af_key.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/net/key/af_key.c	2018-07-03 05:18:49.000000000 -0400
@@ -437,6 +437,24 @@ static int verify_address_len(const void
 	return 0;
 }
 
+static inline int sadb_key_len(const struct sadb_key *key)
+{
+	int key_bytes = DIV_ROUND_UP(key->sadb_key_bits, 8);
+
+	return DIV_ROUND_UP(sizeof(struct sadb_key) + key_bytes,
+			    sizeof(uint64_t));
+}
+
+static int verify_key_len(const void *p)
+{
+	const struct sadb_key *key = p;
+
+	if (sadb_key_len(key) > key->sadb_key_len)
+		return -EINVAL;
+
+	return 0;
+}
+
 static inline int pfkey_sec_ctx_len(const struct sadb_x_sec_ctx *sec_ctx)
 {
 	return DIV_ROUND_UP(sizeof(struct sadb_x_sec_ctx) +
@@ -533,16 +551,25 @@ static int parse_exthdrs(struct sk_buff
 				return -EINVAL;
 			if (ext_hdrs[ext_type-1] != NULL)
 				return -EINVAL;
-			if (ext_type == SADB_EXT_ADDRESS_SRC ||
-			    ext_type == SADB_EXT_ADDRESS_DST ||
-			    ext_type == SADB_EXT_ADDRESS_PROXY ||
-			    ext_type == SADB_X_EXT_NAT_T_OA) {
+			switch (ext_type) {
+			case SADB_EXT_ADDRESS_SRC:
+			case SADB_EXT_ADDRESS_DST:
+			case SADB_EXT_ADDRESS_PROXY:
+			case SADB_X_EXT_NAT_T_OA:
 				if (verify_address_len(p))
 					return -EINVAL;
-			}
-			if (ext_type == SADB_X_EXT_SEC_CTX) {
+				break;
+			case SADB_X_EXT_SEC_CTX:
 				if (verify_sec_ctx_len(p))
 					return -EINVAL;
+				break;
+			case SADB_EXT_KEY_AUTH:
+			case SADB_EXT_KEY_ENCRYPT:
+				if (verify_key_len(p))
+					return -EINVAL;
+				break;
+			default:
+				break;
 			}
 			ext_hdrs[ext_type-1] = (void *) p;
 		}
@@ -1111,14 +1138,12 @@ static struct xfrm_state * pfkey_msg2xfr
 	key = ext_hdrs[SADB_EXT_KEY_AUTH - 1];
 	if (key != NULL &&
 	    sa->sadb_sa_auth != SADB_X_AALG_NULL &&
-	    ((key->sadb_key_bits+7) / 8 == 0 ||
-	     (key->sadb_key_bits+7) / 8 > key->sadb_key_len * sizeof(uint64_t)))
+	    key->sadb_key_bits == 0)
 		return ERR_PTR(-EINVAL);
 	key = ext_hdrs[SADB_EXT_KEY_ENCRYPT-1];
 	if (key != NULL &&
 	    sa->sadb_sa_encrypt != SADB_EALG_NULL &&
-	    ((key->sadb_key_bits+7) / 8 == 0 ||
-	     (key->sadb_key_bits+7) / 8 > key->sadb_key_len * sizeof(uint64_t)))
+	    key->sadb_key_bits == 0)
 		return ERR_PTR(-EINVAL);
 
 	x = xfrm_state_alloc(net);
diff -druNp --no-dereference linux-libre-3.18.113-gnu/net/mac80211/mlme.c linux-libre-3.18.114-gnu/net/mac80211/mlme.c
--- linux-libre-3.18.113-gnu/net/mac80211/mlme.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/net/mac80211/mlme.c	2018-07-03 05:18:49.000000000 -0400
@@ -34,6 +34,7 @@
 #define IEEE80211_AUTH_TIMEOUT		(HZ / 5)
 #define IEEE80211_AUTH_TIMEOUT_LONG	(HZ / 2)
 #define IEEE80211_AUTH_TIMEOUT_SHORT	(HZ / 10)
+#define IEEE80211_AUTH_TIMEOUT_SAE	(HZ * 2)
 #define IEEE80211_AUTH_MAX_TRIES	3
 #define IEEE80211_AUTH_WAIT_ASSOC	(HZ * 5)
 #define IEEE80211_ASSOC_TIMEOUT		(HZ / 5)
@@ -3464,16 +3465,19 @@ static int ieee80211_probe_auth(struct i
 	}
 
 	if (tx_flags == 0) {
-		auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
-		auth_data->timeout_started = true;
-		run_again(sdata, auth_data->timeout);
+		if (auth_data->algorithm == WLAN_AUTH_SAE)
+			auth_data->timeout = jiffies +
+				IEEE80211_AUTH_TIMEOUT_SAE;
+		else
+			auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
 	} else {
 		auth_data->timeout =
 			round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
-		auth_data->timeout_started = true;
-		run_again(sdata, auth_data->timeout);
 	}
 
+	auth_data->timeout_started = true;
+	run_again(sdata, auth_data->timeout);
+
 	return 0;
 }
 
@@ -3545,8 +3549,15 @@ void ieee80211_sta_work(struct ieee80211
 		if (ifmgd->auth_data &&
 		    (ieee80211_is_probe_req(fc) || ieee80211_is_auth(fc))) {
 			if (status_acked) {
-				ifmgd->auth_data->timeout =
-					jiffies + IEEE80211_AUTH_TIMEOUT_SHORT;
+				if (ifmgd->auth_data->algorithm ==
+				    WLAN_AUTH_SAE)
+					ifmgd->auth_data->timeout =
+						jiffies +
+						IEEE80211_AUTH_TIMEOUT_SAE;
+				else
+					ifmgd->auth_data->timeout =
+						jiffies +
+						IEEE80211_AUTH_TIMEOUT_SHORT;
 				run_again(sdata, ifmgd->auth_data->timeout);
 			} else {
 				ifmgd->auth_data->timeout = jiffies - 1;
diff -druNp --no-dereference linux-libre-3.18.113-gnu/net/rds/ib_cm.c linux-libre-3.18.114-gnu/net/rds/ib_cm.c
--- linux-libre-3.18.113-gnu/net/rds/ib_cm.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/net/rds/ib_cm.c	2018-07-03 05:18:49.000000000 -0400
@@ -396,7 +396,7 @@ static int rds_ib_setup_qp(struct rds_co
 	rdsdebug("conn %p pd %p mr %p cq %p %p\n", conn, ic->i_pd, ic->i_mr,
 		 ic->i_send_cq, ic->i_recv_cq);
 
-	return ret;
+	goto out;
 
 sends_out:
 	vfree(ic->i_sends);
@@ -421,6 +421,7 @@ send_cq_out:
 		ic->i_send_cq = NULL;
 rds_ibdev_out:
 	rds_ib_remove_conn(rds_ibdev, conn);
+out:
 	rds_ib_dev_put(rds_ibdev);
 
 	return ret;
diff -druNp --no-dereference linux-libre-3.18.113-gnu/sound/pci/hda/hda_controller.c linux-libre-3.18.114-gnu/sound/pci/hda/hda_controller.c
--- linux-libre-3.18.113-gnu/sound/pci/hda/hda_controller.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/sound/pci/hda/hda_controller.c	2018-07-03 05:18:49.000000000 -0400
@@ -915,8 +915,10 @@ static int azx_attach_pcm_stream(struct
 		return err;
 	strlcpy(pcm->name, cpcm->name, sizeof(pcm->name));
 	apcm = kzalloc(sizeof(*apcm), GFP_KERNEL);
-	if (apcm == NULL)
+	if (apcm == NULL) {
+		snd_device_free(chip->card, pcm);
 		return -ENOMEM;
+	}
 	apcm->chip = chip;
 	apcm->pcm = pcm;
 	apcm->codec = codec;
diff -druNp --no-dereference linux-libre-3.18.113-gnu/sound/soc/cirrus/edb93xx.c linux-libre-3.18.114-gnu/sound/soc/cirrus/edb93xx.c
--- linux-libre-3.18.113-gnu/sound/soc/cirrus/edb93xx.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/sound/soc/cirrus/edb93xx.c	2018-07-03 05:18:49.000000000 -0400
@@ -67,7 +67,7 @@ static struct snd_soc_dai_link edb93xx_d
 	.cpu_dai_name	= "ep93xx-i2s",
 	.codec_name	= "spi0.0",
 	.codec_dai_name	= "cs4271-hifi",
-	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_IF |
+	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
 			  SND_SOC_DAIFMT_CBS_CFS,
 	.ops		= &edb93xx_ops,
 };
diff -druNp --no-dereference linux-libre-3.18.113-gnu/sound/soc/cirrus/ep93xx-i2s.c linux-libre-3.18.114-gnu/sound/soc/cirrus/ep93xx-i2s.c
--- linux-libre-3.18.113-gnu/sound/soc/cirrus/ep93xx-i2s.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/sound/soc/cirrus/ep93xx-i2s.c	2018-07-03 05:18:49.000000000 -0400
@@ -51,7 +51,9 @@
 #define EP93XX_I2S_WRDLEN_24		(1 << 0)
 #define EP93XX_I2S_WRDLEN_32		(2 << 0)
 
-#define EP93XX_I2S_LINCTRLDATA_R_JUST	(1 << 2) /* Right justify */
+#define EP93XX_I2S_RXLINCTRLDATA_R_JUST	BIT(1) /* Right justify */
+
+#define EP93XX_I2S_TXLINCTRLDATA_R_JUST	BIT(2) /* Right justify */
 
 #define EP93XX_I2S_CLKCFG_LRS		(1 << 0) /* lrclk polarity */
 #define EP93XX_I2S_CLKCFG_CKP		(1 << 1) /* Bit clock polarity */
@@ -170,25 +172,25 @@ static int ep93xx_i2s_set_dai_fmt(struct
 				  unsigned int fmt)
 {
 	struct ep93xx_i2s_info *info = snd_soc_dai_get_drvdata(cpu_dai);
-	unsigned int clk_cfg, lin_ctrl;
+	unsigned int clk_cfg;
+	unsigned int txlin_ctrl = 0;
+	unsigned int rxlin_ctrl = 0;
 
 	clk_cfg  = ep93xx_i2s_read_reg(info, EP93XX_I2S_RXCLKCFG);
-	lin_ctrl = ep93xx_i2s_read_reg(info, EP93XX_I2S_RXLINCTRLDATA);
 
 	switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
 	case SND_SOC_DAIFMT_I2S:
 		clk_cfg |= EP93XX_I2S_CLKCFG_REL;
-		lin_ctrl &= ~EP93XX_I2S_LINCTRLDATA_R_JUST;
 		break;
 
 	case SND_SOC_DAIFMT_LEFT_J:
 		clk_cfg &= ~EP93XX_I2S_CLKCFG_REL;
-		lin_ctrl &= ~EP93XX_I2S_LINCTRLDATA_R_JUST;
 		break;
 
 	case SND_SOC_DAIFMT_RIGHT_J:
 		clk_cfg &= ~EP93XX_I2S_CLKCFG_REL;
-		lin_ctrl |= EP93XX_I2S_LINCTRLDATA_R_JUST;
+		rxlin_ctrl |= EP93XX_I2S_RXLINCTRLDATA_R_JUST;
+		txlin_ctrl |= EP93XX_I2S_TXLINCTRLDATA_R_JUST;
 		break;
 
 	default:
@@ -213,32 +215,32 @@ static int ep93xx_i2s_set_dai_fmt(struct
 	switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
 	case SND_SOC_DAIFMT_NB_NF:
 		/* Negative bit clock, lrclk low on left word */
-		clk_cfg &= ~(EP93XX_I2S_CLKCFG_CKP | EP93XX_I2S_CLKCFG_REL);
+		clk_cfg &= ~(EP93XX_I2S_CLKCFG_CKP | EP93XX_I2S_CLKCFG_LRS);
 		break;
 
 	case SND_SOC_DAIFMT_NB_IF:
 		/* Negative bit clock, lrclk low on right word */
 		clk_cfg &= ~EP93XX_I2S_CLKCFG_CKP;
-		clk_cfg |= EP93XX_I2S_CLKCFG_REL;
+		clk_cfg |= EP93XX_I2S_CLKCFG_LRS;
 		break;
 
 	case SND_SOC_DAIFMT_IB_NF:
 		/* Positive bit clock, lrclk low on left word */
 		clk_cfg |= EP93XX_I2S_CLKCFG_CKP;
-		clk_cfg &= ~EP93XX_I2S_CLKCFG_REL;
+		clk_cfg &= ~EP93XX_I2S_CLKCFG_LRS;
 		break;
 
 	case SND_SOC_DAIFMT_IB_IF:
 		/* Positive bit clock, lrclk low on right word */
-		clk_cfg |= EP93XX_I2S_CLKCFG_CKP | EP93XX_I2S_CLKCFG_REL;
+		clk_cfg |= EP93XX_I2S_CLKCFG_CKP | EP93XX_I2S_CLKCFG_LRS;
 		break;
 	}
 
 	/* Write new register values */
 	ep93xx_i2s_write_reg(info, EP93XX_I2S_RXCLKCFG, clk_cfg);
 	ep93xx_i2s_write_reg(info, EP93XX_I2S_TXCLKCFG, clk_cfg);
-	ep93xx_i2s_write_reg(info, EP93XX_I2S_RXLINCTRLDATA, lin_ctrl);
-	ep93xx_i2s_write_reg(info, EP93XX_I2S_TXLINCTRLDATA, lin_ctrl);
+	ep93xx_i2s_write_reg(info, EP93XX_I2S_RXLINCTRLDATA, rxlin_ctrl);
+	ep93xx_i2s_write_reg(info, EP93XX_I2S_TXLINCTRLDATA, txlin_ctrl);
 	return 0;
 }
 
diff -druNp --no-dereference linux-libre-3.18.113-gnu/sound/soc/cirrus/snappercl15.c linux-libre-3.18.114-gnu/sound/soc/cirrus/snappercl15.c
--- linux-libre-3.18.113-gnu/sound/soc/cirrus/snappercl15.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/sound/soc/cirrus/snappercl15.c	2018-07-03 05:18:49.000000000 -0400
@@ -72,7 +72,7 @@ static struct snd_soc_dai_link snappercl
 	.codec_dai_name	= "tlv320aic23-hifi",
 	.codec_name	= "tlv320aic23-codec.0-001a",
 	.platform_name	= "ep93xx-i2s",
-	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_IF |
+	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
 			  SND_SOC_DAIFMT_CBS_CFS,
 	.ops		= &snappercl15_ops,
 };
diff -druNp --no-dereference linux-libre-3.18.113-gnu/sound/soc/soc-dapm.c linux-libre-3.18.114-gnu/sound/soc/soc-dapm.c
--- linux-libre-3.18.113-gnu/sound/soc/soc-dapm.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/sound/soc/soc-dapm.c	2018-07-03 05:18:49.000000000 -0400
@@ -254,6 +254,8 @@ static int dapm_kcontrol_data_alloc(stru
 static void dapm_kcontrol_free(struct snd_kcontrol *kctl)
 {
 	struct dapm_kcontrol_data *data = snd_kcontrol_chip(kctl);
+
+	list_del(&data->paths);
 	kfree(data->wlist);
 	kfree(data);
 }
diff -druNp --no-dereference linux-libre-3.18.113-gnu/tools/Makefile linux-libre-3.18.114-gnu/tools/Makefile
--- linux-libre-3.18.113-gnu/tools/Makefile	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/tools/Makefile	2018-07-03 05:18:49.000000000 -0400
@@ -1,3 +1,8 @@
+# Some of the tools (perf) use same make variables
+# as in kernel build.
+export srctree=
+export objtree=
+
 include scripts/Makefile.include
 
 help:
@@ -51,11 +56,16 @@ cgroup firewire hv guest usb virtio vm n
 liblockdep: FORCE
 	$(call descend,lib/lockdep)
 
-libapikfs: FORCE
+libapi: FORCE
 	$(call descend,lib/api)
 
-perf: libapikfs FORCE
-	$(call descend,$@)
+# The perf build does not follow the descend function setup,
+# invoking it via it's own make rule.
+PERF_O   = $(if $(O),$(O)/tools/perf,)
+
+perf: FORCE
+	$(Q)mkdir -p $(PERF_O) .
+	$(Q)$(MAKE) --no-print-directory -C perf O=$(PERF_O) subdir=
 
 selftests: FORCE
 	$(call descend,testing/$@)
@@ -106,10 +116,10 @@ cgroup_clean hv_clean firewire_clean lgu
 liblockdep_clean:
 	$(call descend,lib/lockdep,clean)
 
-libapikfs_clean:
+libapi_clean:
 	$(call descend,lib/api,clean)
 
-perf_clean: libapikfs_clean
+perf_clean:
 	$(call descend,$(@:_clean=),clean)
 
 selftests_clean:
diff -druNp --no-dereference linux-libre-3.18.113-gnu/tools/net/bpf_dbg.c linux-libre-3.18.114-gnu/tools/net/bpf_dbg.c
--- linux-libre-3.18.113-gnu/tools/net/bpf_dbg.c	2018-06-13 10:12:22.000000000 -0400
+++ linux-libre-3.18.114-gnu/tools/net/bpf_dbg.c	2018-07-03 05:18:49.000000000 -0400
@@ -1063,7 +1063,7 @@ static int cmd_load_pcap(char *file)
 
 static int cmd_load(char *arg)
 {
-	char *subcmd, *cont, *tmp = strdup(arg);
+	char *subcmd, *cont = NULL, *tmp = strdup(arg);
 	int ret = CMD_OK;
 
 	subcmd = strtok_r(tmp, " ", &cont);
@@ -1073,7 +1073,10 @@ static int cmd_load(char *arg)
 		bpf_reset();
 		bpf_reset_breakpoints();
 
-		ret = cmd_load_bpf(cont);
+		if (!cont)
+			ret = CMD_ERR;
+		else
+			ret = cmd_load_bpf(cont);
 	} else if (matches(subcmd, "pcap") == 0) {
 		ret = cmd_load_pcap(cont);
 	} else {
diff -druNp --no-dereference linux-libre-3.18.113-gnu/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-multi-actions-accept.tc linux-libre-3.18.114-gnu/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-multi-actions-accept.tc
--- linux-libre-3.18.113-gnu/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-multi-actions-accept.tc	1969-12-31 19:00:00.000000000 -0500
+++ linux-libre-3.18.114-gnu/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-multi-actions-accept.tc	2018-07-03 05:18:49.000000000 -0400
@@ -0,0 +1,44 @@
+#!/bin/sh
+# description: event trigger - test multiple actions on hist trigger
+
+
+do_reset() {
+    reset_trigger
+    echo > set_event
+    clear_trace
+}
+
+fail() { #msg
+    do_reset
+    echo $1
+    exit_fail
+}
+
+if [ ! -f set_event ]; then
+    echo "event tracing is not supported"
+    exit_unsupported
+fi
+
+if [ ! -f synthetic_events ]; then
+    echo "synthetic event is not supported"
+    exit_unsupported
+fi
+
+clear_synthetic_events
+reset_tracer
+do_reset
+
+echo "Test multiple actions on hist trigger"
+echo 'wakeup_latency u64 lat; pid_t pid' >> synthetic_events
+TRIGGER1=events/sched/sched_wakeup/trigger
+TRIGGER2=events/sched/sched_switch/trigger
+
+echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm=="cyclictest"' > $TRIGGER1
+echo 'hist:keys=next_pid:wakeup_lat=common_timestamp.usecs-$ts0 if next_comm=="cyclictest"' >> $TRIGGER2
+echo 'hist:keys=next_pid:onmatch(sched.sched_wakeup).wakeup_latency(sched.sched_switch.$wakeup_lat,next_pid) if next_comm=="cyclictest"' >> $TRIGGER2
+echo 'hist:keys=next_pid:onmatch(sched.sched_wakeup).wakeup_latency(sched.sched_switch.$wakeup_lat,prev_pid) if next_comm=="cyclictest"' >> $TRIGGER2
+echo 'hist:keys=next_pid if next_comm=="cyclictest"' >> $TRIGGER2
+
+do_reset
+
+exit 0
