diff -druNp --no-dereference linux-libre-3.18.119-gnu/arch/arm/boot/dts/am3517.dtsi linux-libre-3.18.120-gnu/arch/arm/boot/dts/am3517.dtsi
--- linux-libre-3.18.119-gnu/arch/arm/boot/dts/am3517.dtsi	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/arch/arm/boot/dts/am3517.dtsi	2018-08-28 01:21:37.000000000 -0400
@@ -62,6 +62,11 @@
 	};
 };
 
+/* Table Table 5-79 of the TRM shows 480ab000 is reserved */
+&usb_otg_hs {
+	status = "disabled";
+};
+
 &iva {
 	status = "disabled";
 };
diff -druNp --no-dereference linux-libre-3.18.119-gnu/arch/arm/boot/dts/am437x-sk-evm.dts linux-libre-3.18.120-gnu/arch/arm/boot/dts/am437x-sk-evm.dts
--- linux-libre-3.18.119-gnu/arch/arm/boot/dts/am437x-sk-evm.dts	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/arch/arm/boot/dts/am437x-sk-evm.dts	2018-08-28 01:21:37.000000000 -0400
@@ -415,6 +415,8 @@
 
 		touchscreen-size-x = <480>;
 		touchscreen-size-y = <272>;
+
+		wakeup-source;
 	};
 
 	tlv320aic3106: tlv320aic3106@1b {
diff -druNp --no-dereference linux-libre-3.18.119-gnu/arch/arm/boot/dts/da850.dtsi linux-libre-3.18.120-gnu/arch/arm/boot/dts/da850.dtsi
--- linux-libre-3.18.119-gnu/arch/arm/boot/dts/da850.dtsi	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/arch/arm/boot/dts/da850.dtsi	2018-08-28 01:21:37.000000000 -0400
@@ -267,11 +267,7 @@
 			compatible = "ti,dm6441-gpio";
 			gpio-controller;
 			reg = <0x226000 0x1000>;
-			interrupts = <42 IRQ_TYPE_EDGE_BOTH
-				43 IRQ_TYPE_EDGE_BOTH 44 IRQ_TYPE_EDGE_BOTH
-				45 IRQ_TYPE_EDGE_BOTH 46 IRQ_TYPE_EDGE_BOTH
-				47 IRQ_TYPE_EDGE_BOTH 48 IRQ_TYPE_EDGE_BOTH
-				49 IRQ_TYPE_EDGE_BOTH 50 IRQ_TYPE_EDGE_BOTH>;
+			interrupts = <42 43 44 45 46 47 48 49 50>;
 			ti,ngpio = <144>;
 			ti,davinci-gpio-unbanked = <0>;
 			status = "disabled";
diff -druNp --no-dereference linux-libre-3.18.119-gnu/arch/arm/configs/imx_v4_v5_defconfig linux-libre-3.18.120-gnu/arch/arm/configs/imx_v4_v5_defconfig
--- linux-libre-3.18.119-gnu/arch/arm/configs/imx_v4_v5_defconfig	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/arch/arm/configs/imx_v4_v5_defconfig	2018-08-28 01:21:37.000000000 -0400
@@ -146,9 +146,11 @@ CONFIG_USB_STORAGE=y
 CONFIG_USB_CHIPIDEA=y
 CONFIG_USB_CHIPIDEA_UDC=y
 CONFIG_USB_CHIPIDEA_HOST=y
+CONFIG_USB_CHIPIDEA_ULPI=y
 CONFIG_NOP_USB_XCEIV=y
 CONFIG_USB_GADGET=y
 CONFIG_USB_ETH=m
+CONFIG_USB_ULPI_BUS=y
 CONFIG_MMC=y
 CONFIG_MMC_SDHCI=y
 CONFIG_MMC_SDHCI_PLTFM=y
diff -druNp --no-dereference linux-libre-3.18.119-gnu/arch/arm/mach-pxa/irq.c linux-libre-3.18.120-gnu/arch/arm/mach-pxa/irq.c
--- linux-libre-3.18.119-gnu/arch/arm/mach-pxa/irq.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/arch/arm/mach-pxa/irq.c	2018-08-28 01:21:37.000000000 -0400
@@ -160,7 +160,7 @@ static int pxa_irq_suspend(void)
 {
 	int i;
 
-	for (i = 0; i < pxa_internal_irq_nr / 32; i++) {
+	for (i = 0; i < DIV_ROUND_UP(pxa_internal_irq_nr, 32); i++) {
 		void __iomem *base = irq_base(i);
 
 		saved_icmr[i] = __raw_readl(base + ICMR);
@@ -179,7 +179,7 @@ static void pxa_irq_resume(void)
 {
 	int i;
 
-	for (i = 0; i < pxa_internal_irq_nr / 32; i++) {
+	for (i = 0; i < DIV_ROUND_UP(pxa_internal_irq_nr, 32); i++) {
 		void __iomem *base = irq_base(i);
 
 		__raw_writel(saved_icmr[i], base + ICMR);
diff -druNp --no-dereference linux-libre-3.18.119-gnu/arch/arm64/kernel/smp.c linux-libre-3.18.120-gnu/arch/arm64/kernel/smp.c
--- linux-libre-3.18.119-gnu/arch/arm64/kernel/smp.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/arch/arm64/kernel/smp.c	2018-08-28 01:21:37.000000000 -0400
@@ -130,7 +130,7 @@ static void smp_store_cpu_info(unsigned
  * This is the secondary CPU boot entry.  We're using this CPUs
  * idle thread stack, but a set of temporary page tables.
  */
-asmlinkage void secondary_start_kernel(void)
+asmlinkage notrace void secondary_start_kernel(void)
 {
 	struct mm_struct *mm = &init_mm;
 	unsigned int cpu = smp_processor_id();
diff -druNp --no-dereference linux-libre-3.18.119-gnu/arch/m68k/include/asm/mcf_pgalloc.h linux-libre-3.18.120-gnu/arch/m68k/include/asm/mcf_pgalloc.h
--- linux-libre-3.18.119-gnu/arch/m68k/include/asm/mcf_pgalloc.h	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/arch/m68k/include/asm/mcf_pgalloc.h	2018-08-28 01:21:37.000000000 -0400
@@ -43,6 +43,7 @@ extern inline pmd_t *pmd_alloc_kernel(pg
 static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t page,
 				  unsigned long address)
 {
+	pgtable_page_dtor(page);
 	__free_page(page);
 }
 
@@ -73,8 +74,9 @@ static inline struct page *pte_alloc_one
 	return page;
 }
 
-extern inline void pte_free(struct mm_struct *mm, struct page *page)
+static inline void pte_free(struct mm_struct *mm, struct page *page)
 {
+	pgtable_page_dtor(page);
 	__free_page(page);
 }
 
diff -druNp --no-dereference linux-libre-3.18.119-gnu/drivers/dma/k3dma.c linux-libre-3.18.120-gnu/drivers/dma/k3dma.c
--- linux-libre-3.18.119-gnu/drivers/dma/k3dma.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/drivers/dma/k3dma.c	2018-08-28 01:21:37.000000000 -0400
@@ -652,7 +652,7 @@ static struct dma_chan *k3_of_dma_simple
 	struct k3_dma_dev *d = ofdma->of_dma_data;
 	unsigned int request = dma_spec->args[0];
 
-	if (request > d->dma_requests)
+	if (request >= d->dma_requests)
 		return NULL;
 
 	return dma_get_slave_channel(&(d->chans[request].vc.chan));
diff -druNp --no-dereference linux-libre-3.18.119-gnu/drivers/gpu/drm/armada/armada_hw.h linux-libre-3.18.120-gnu/drivers/gpu/drm/armada/armada_hw.h
--- linux-libre-3.18.119-gnu/drivers/gpu/drm/armada/armada_hw.h	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/drivers/gpu/drm/armada/armada_hw.h	2018-08-28 01:21:37.000000000 -0400
@@ -160,6 +160,7 @@ enum {
 	CFG_ALPHAM_GRA		= 0x1 << 16,
 	CFG_ALPHAM_CFG		= 0x2 << 16,
 	CFG_ALPHA_MASK		= 0xff << 8,
+#define CFG_ALPHA(x)		((x) << 8)
 	CFG_PIXCMD_MASK		= 0xff,
 };
 
diff -druNp --no-dereference linux-libre-3.18.119-gnu/drivers/gpu/drm/armada/armada_overlay.c linux-libre-3.18.120-gnu/drivers/gpu/drm/armada/armada_overlay.c
--- linux-libre-3.18.119-gnu/drivers/gpu/drm/armada/armada_overlay.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/drivers/gpu/drm/armada/armada_overlay.c	2018-08-28 01:21:37.000000000 -0400
@@ -26,6 +26,7 @@ struct armada_plane_properties {
 	uint16_t contrast;
 	uint16_t saturation;
 	uint32_t colorkey_mode;
+	uint32_t colorkey_enable;
 };
 
 struct armada_plane {
@@ -62,11 +63,13 @@ armada_ovl_update_attr(struct armada_pla
 	writel_relaxed(0x00002000, dcrtc->base + LCD_SPU_CBSH_HUE);
 
 	spin_lock_irq(&dcrtc->irq_lock);
-	armada_updatel(prop->colorkey_mode | CFG_ALPHAM_GRA,
-		     CFG_CKMODE_MASK | CFG_ALPHAM_MASK | CFG_ALPHA_MASK,
-		     dcrtc->base + LCD_SPU_DMA_CTRL1);
-
-	armada_updatel(ADV_GRACOLORKEY, 0, dcrtc->base + LCD_SPU_ADV_REG);
+	armada_updatel(prop->colorkey_mode,
+		       CFG_CKMODE_MASK | CFG_ALPHAM_MASK | CFG_ALPHA_MASK,
+		       dcrtc->base + LCD_SPU_DMA_CTRL1);
+	if (dcrtc->variant->has_spu_adv_reg)
+		armada_updatel(prop->colorkey_enable,
+			       ADV_GRACOLORKEY | ADV_VIDCOLORKEY,
+			       dcrtc->base + LCD_SPU_ADV_REG);
 	spin_unlock_irq(&dcrtc->irq_lock);
 }
 
@@ -329,8 +332,17 @@ static int armada_plane_set_property(str
 		dplane->prop.colorkey_vb |= K2B(val);
 		update_attr = true;
 	} else if (property == priv->colorkey_mode_prop) {
-		dplane->prop.colorkey_mode &= ~CFG_CKMODE_MASK;
-		dplane->prop.colorkey_mode |= CFG_CKMODE(val);
+		if (val == CKMODE_DISABLE) {
+			dplane->prop.colorkey_mode =
+				CFG_CKMODE(CKMODE_DISABLE) |
+				CFG_ALPHAM_CFG | CFG_ALPHA(255);
+			dplane->prop.colorkey_enable = 0;
+		} else {
+			dplane->prop.colorkey_mode =
+				CFG_CKMODE(val) |
+				CFG_ALPHAM_GRA | CFG_ALPHA(0);
+			dplane->prop.colorkey_enable = ADV_GRACOLORKEY;
+		}
 		update_attr = true;
 	} else if (property == priv->brightness_prop) {
 		dplane->prop.brightness = val - 256;
@@ -449,7 +461,9 @@ int armada_overlay_plane_create(struct d
 	dplane->prop.colorkey_yr = 0xfefefe00;
 	dplane->prop.colorkey_ug = 0x01010100;
 	dplane->prop.colorkey_vb = 0x01010100;
-	dplane->prop.colorkey_mode = CFG_CKMODE(CKMODE_RGB);
+	dplane->prop.colorkey_mode = CFG_CKMODE(CKMODE_RGB) |
+				     CFG_ALPHAM_GRA | CFG_ALPHA(0);
+	dplane->prop.colorkey_enable = ADV_GRACOLORKEY;
 	dplane->prop.brightness = 0;
 	dplane->prop.contrast = 0x4000;
 	dplane->prop.saturation = 0x4000;
diff -druNp --no-dereference linux-libre-3.18.119-gnu/drivers/gpu/drm/exynos/exynos_drm_gsc.c linux-libre-3.18.120-gnu/drivers/gpu/drm/exynos/exynos_drm_gsc.c
--- linux-libre-3.18.119-gnu/drivers/gpu/drm/exynos/exynos_drm_gsc.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/drivers/gpu/drm/exynos/exynos_drm_gsc.c	2018-08-28 01:21:37.000000000 -0400
@@ -526,21 +526,25 @@ static int gsc_src_set_fmt(struct device
 			GSC_IN_CHROMA_ORDER_CRCB);
 		break;
 	case DRM_FORMAT_NV21:
+		cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV420_2P);
+		break;
 	case DRM_FORMAT_NV61:
-		cfg |= (GSC_IN_CHROMA_ORDER_CRCB |
-			GSC_IN_YUV420_2P);
+		cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV422_2P);
 		break;
 	case DRM_FORMAT_YUV422:
 		cfg |= GSC_IN_YUV422_3P;
 		break;
 	case DRM_FORMAT_YUV420:
+		cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV420_3P);
+		break;
 	case DRM_FORMAT_YVU420:
-		cfg |= GSC_IN_YUV420_3P;
+		cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV420_3P);
 		break;
 	case DRM_FORMAT_NV12:
+		cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV420_2P);
+		break;
 	case DRM_FORMAT_NV16:
-		cfg |= (GSC_IN_CHROMA_ORDER_CBCR |
-			GSC_IN_YUV420_2P);
+		cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV422_2P);
 		break;
 	case DRM_FORMAT_NV12MT:
 		cfg |= (GSC_IN_TILE_C_16x8 | GSC_IN_TILE_MODE);
@@ -796,18 +800,25 @@ static int gsc_dst_set_fmt(struct device
 			GSC_OUT_CHROMA_ORDER_CRCB);
 		break;
 	case DRM_FORMAT_NV21:
-	case DRM_FORMAT_NV61:
 		cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV420_2P);
 		break;
+	case DRM_FORMAT_NV61:
+		cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV422_2P);
+		break;
 	case DRM_FORMAT_YUV422:
+		cfg |= GSC_OUT_YUV422_3P;
+		break;
 	case DRM_FORMAT_YUV420:
+		cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV420_3P);
+		break;
 	case DRM_FORMAT_YVU420:
-		cfg |= GSC_OUT_YUV420_3P;
+		cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV420_3P);
 		break;
 	case DRM_FORMAT_NV12:
+		cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV420_2P);
+		break;
 	case DRM_FORMAT_NV16:
-		cfg |= (GSC_OUT_CHROMA_ORDER_CBCR |
-			GSC_OUT_YUV420_2P);
+		cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV422_2P);
 		break;
 	case DRM_FORMAT_NV12MT:
 		cfg |= (GSC_OUT_TILE_C_16x8 | GSC_OUT_TILE_MODE);
diff -druNp --no-dereference linux-libre-3.18.119-gnu/drivers/gpu/drm/exynos/regs-gsc.h linux-libre-3.18.120-gnu/drivers/gpu/drm/exynos/regs-gsc.h
--- linux-libre-3.18.119-gnu/drivers/gpu/drm/exynos/regs-gsc.h	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/drivers/gpu/drm/exynos/regs-gsc.h	2018-08-28 01:21:37.000000000 -0400
@@ -138,6 +138,7 @@
 #define GSC_OUT_YUV420_3P		(3 << 4)
 #define GSC_OUT_YUV422_1P		(4 << 4)
 #define GSC_OUT_YUV422_2P		(5 << 4)
+#define GSC_OUT_YUV422_3P		(6 << 4)
 #define GSC_OUT_YUV444			(7 << 4)
 #define GSC_OUT_TILE_TYPE_MASK		(1 << 2)
 #define GSC_OUT_TILE_C_16x8		(0 << 2)
diff -druNp --no-dereference linux-libre-3.18.119-gnu/drivers/isdn/i4l/isdn_common.c linux-libre-3.18.120-gnu/drivers/isdn/i4l/isdn_common.c
--- linux-libre-3.18.119-gnu/drivers/isdn/i4l/isdn_common.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/drivers/isdn/i4l/isdn_common.c	2018-08-28 01:21:37.000000000 -0400
@@ -1655,13 +1655,7 @@ isdn_ioctl(struct file *file, uint cmd,
 			} else
 				return -EINVAL;
 		case IIOCDBGVAR:
-			if (arg) {
-				if (copy_to_user(argp, &dev, sizeof(ulong)))
-					return -EFAULT;
-				return 0;
-			} else
-				return -EINVAL;
-			break;
+			return -EINVAL;
 		default:
 			if ((cmd & IIOCDRVCTL) == IIOCDRVCTL)
 				cmd = ((cmd >> _IOC_NRSHIFT) & _IOC_NRMASK) & ISDN_DRVIOCTL_MASK;
diff -druNp --no-dereference linux-libre-3.18.119-gnu/drivers/md/raid10.c linux-libre-3.18.120-gnu/drivers/md/raid10.c
--- linux-libre-3.18.119-gnu/drivers/md/raid10.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/drivers/md/raid10.c	2018-08-28 01:21:37.000000000 -0400
@@ -3770,6 +3770,13 @@ static int run(struct mddev *mddev)
 			    disk->rdev->saved_raid_disk < 0)
 				conf->fullsync = 1;
 		}
+
+		if (disk->replacement &&
+		    !test_bit(In_sync, &disk->replacement->flags) &&
+		    disk->replacement->saved_raid_disk < 0) {
+			conf->fullsync = 1;
+		}
+
 		disk->recovery_disabled = mddev->recovery_disabled - 1;
 	}
 
diff -druNp --no-dereference linux-libre-3.18.119-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c linux-libre-3.18.120-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
--- linux-libre-3.18.119-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c	2018-08-17 18:28:46.000000000 -0400
+++ linux-libre-3.18.120-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c	2018-08-29 04:02:19.000000000 -0400
@@ -1257,6 +1257,11 @@ void __bnx2x_link_report(struct bnx2x *b
 {
 	struct bnx2x_link_report_data cur_data;
 
+	if (bp->force_link_down) {
+		bp->link_vars.link_up = 0;
+		return;
+	}
+
 	/* reread mf_cfg */
 	if (IS_PF(bp) && !CHIP_IS_E1(bp))
 		bnx2x_read_mf_cfg(bp);
@@ -2798,6 +2803,7 @@ int bnx2x_nic_load(struct bnx2x *bp, int
 		bp->pending_max = 0;
 	}
 
+	bp->force_link_down = false;
 	if (bp->port.pmf) {
 		rc = bnx2x_initial_phy_init(bp, load_mode);
 		if (rc)
diff -druNp --no-dereference linux-libre-3.18.119-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h linux-libre-3.18.120-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
--- linux-libre-3.18.119-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h	2018-08-28 01:21:37.000000000 -0400
@@ -1613,6 +1613,7 @@ struct bnx2x {
 	struct link_vars	link_vars;
 	u32			link_cnt;
 	struct bnx2x_link_report_data last_reported_link;
+	bool			force_link_down;
 
 	struct mdio_if_info	mdio;
 
diff -druNp --no-dereference linux-libre-3.18.119-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c linux-libre-3.18.120-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
--- linux-libre-3.18.119-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c	2018-08-17 18:28:45.000000000 -0400
+++ linux-libre-3.18.120-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c	2018-08-29 04:02:19.000000000 -0400
@@ -10030,6 +10030,12 @@ static void bnx2x_sp_rtnl_task(struct wo
 		bp->sp_rtnl_state = 0;
 		smp_mb();
 
+		/* Immediately indicate link as down */
+		bp->link_vars.link_up = 0;
+		bp->force_link_down = true;
+		netif_carrier_off(bp->dev);
+		BNX2X_ERR("Indicating link is down due to Tx-timeout\n");
+
 		bnx2x_nic_unload(bp, UNLOAD_NORMAL, true);
 		bnx2x_nic_load(bp, LOAD_NORMAL);
 
diff -druNp --no-dereference linux-libre-3.18.119-gnu/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c linux-libre-3.18.120-gnu/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
--- linux-libre-3.18.119-gnu/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c	2018-08-17 18:29:22.000000000 -0400
+++ linux-libre-3.18.120-gnu/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c	2018-08-29 04:02:42.000000000 -0400
@@ -528,7 +528,7 @@ static void dcb_tx_queue_prio_enable(str
 				"Can't %s DCB Priority on port %d, TX Queue %d: err=%d\n",
 				enable ? "set" : "unset", pi->port_id, i, -err);
 		else
-			txq->dcb_prio = value;
+			txq->dcb_prio = enable ? value : 0;
 	}
 }
 #endif /* CONFIG_CHELSIO_T4_DCB */
diff -druNp --no-dereference linux-libre-3.18.119-gnu/drivers/net/ethernet/cisco/enic/enic_clsf.c linux-libre-3.18.120-gnu/drivers/net/ethernet/cisco/enic/enic_clsf.c
--- linux-libre-3.18.119-gnu/drivers/net/ethernet/cisco/enic/enic_clsf.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/drivers/net/ethernet/cisco/enic/enic_clsf.c	2018-08-28 01:21:37.000000000 -0400
@@ -78,7 +78,6 @@ void enic_rfs_flw_tbl_init(struct enic *
 	enic->rfs_h.max = enic->config.num_arfs;
 	enic->rfs_h.free = enic->rfs_h.max;
 	enic->rfs_h.toclean = 0;
-	enic_rfs_timer_start(enic);
 }
 
 void enic_rfs_flw_tbl_free(struct enic *enic)
@@ -87,7 +86,6 @@ void enic_rfs_flw_tbl_free(struct enic *
 
 	enic_rfs_timer_stop(enic);
 	spin_lock_bh(&enic->rfs_h.lock);
-	enic->rfs_h.free = 0;
 	for (i = 0; i < (1 << ENIC_RFS_FLW_BITSHIFT); i++) {
 		struct hlist_head *hhead;
 		struct hlist_node *tmp;
@@ -98,6 +96,7 @@ void enic_rfs_flw_tbl_free(struct enic *
 			enic_delfltr(enic, n->fltr_id);
 			hlist_del(&n->node);
 			kfree(n);
+			enic->rfs_h.free++;
 		}
 	}
 	spin_unlock_bh(&enic->rfs_h.lock);
diff -druNp --no-dereference linux-libre-3.18.119-gnu/drivers/net/ethernet/cisco/enic/enic_main.c linux-libre-3.18.120-gnu/drivers/net/ethernet/cisco/enic/enic_main.c
--- linux-libre-3.18.119-gnu/drivers/net/ethernet/cisco/enic/enic_main.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/drivers/net/ethernet/cisco/enic/enic_main.c	2018-08-28 01:21:37.000000000 -0400
@@ -1643,7 +1643,7 @@ static int enic_open(struct net_device *
 		vnic_intr_unmask(&enic->intr[i]);
 
 	enic_notify_timer_start(enic);
-	enic_rfs_flw_tbl_init(enic);
+	enic_rfs_timer_start(enic);
 
 	return 0;
 
@@ -2508,6 +2508,7 @@ static int enic_probe(struct pci_dev *pd
 	enic->notify_timer.function = enic_notify_timer;
 	enic->notify_timer.data = (unsigned long)enic;
 
+	enic_rfs_flw_tbl_init(enic);
 	enic_set_rx_coal_setting(enic);
 	INIT_WORK(&enic->reset, enic_reset);
 	INIT_WORK(&enic->change_mtu_work, enic_change_mtu_work);
diff -druNp --no-dereference linux-libre-3.18.119-gnu/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c linux-libre-3.18.120-gnu/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
--- linux-libre-3.18.119-gnu/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c	2018-08-28 01:21:37.000000000 -0400
@@ -1781,7 +1781,12 @@ s32 ixgbe_set_rar_generic(struct ixgbe_h
 	if (enable_addr != 0)
 		rar_high |= IXGBE_RAH_AV;
 
+	/* Record lower 32 bits of MAC address and then make
+	 * sure that write is flushed to hardware before writing
+	 * the upper 16 bits and setting the valid bit.
+	 */
 	IXGBE_WRITE_REG(hw, IXGBE_RAL(index), rar_low);
+	IXGBE_WRITE_FLUSH(hw);
 	IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high);
 
 	return 0;
@@ -1813,8 +1818,13 @@ s32 ixgbe_clear_rar_generic(struct ixgbe
 	rar_high = IXGBE_READ_REG(hw, IXGBE_RAH(index));
 	rar_high &= ~(0x0000FFFF | IXGBE_RAH_AV);
 
-	IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0);
+	/* Clear the address valid bit and upper 16 bits of the address
+	 * before clearing the lower bits. This way we aren't updating
+	 * a live filter.
+	 */
 	IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high);
+	IXGBE_WRITE_FLUSH(hw);
+	IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0);
 
 	/* clear VMDq pool/queue selection for this RAR */
 	hw->mac.ops.clear_vmdq(hw, index, IXGBE_CLEAR_VMDQ_ALL);
diff -druNp --no-dereference linux-libre-3.18.119-gnu/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c linux-libre-3.18.120-gnu/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
--- linux-libre-3.18.119-gnu/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c	2018-08-28 01:21:37.000000000 -0400
@@ -1136,6 +1136,8 @@ static ssize_t qlcnic_83xx_sysfs_flash_w
 		return QL_STATUS_INVALID_PARAM;
 
 	ret = kstrtoul(buf, 16, &data);
+	if (ret)
+		return ret;
 
 	switch (data) {
 	case QLC_83XX_FLASH_SECTOR_ERASE_CMD:
diff -druNp --no-dereference linux-libre-3.18.119-gnu/drivers/net/ethernet/qualcomm/qca_spi.c linux-libre-3.18.120-gnu/drivers/net/ethernet/qualcomm/qca_spi.c
--- linux-libre-3.18.119-gnu/drivers/net/ethernet/qualcomm/qca_spi.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/drivers/net/ethernet/qualcomm/qca_spi.c	2018-08-28 01:21:37.000000000 -0400
@@ -636,7 +636,7 @@ qcaspi_netdev_open(struct net_device *de
 		return ret;
 	}
 
-	netif_start_queue(qca->net_dev);
+	/* SPI thread takes care of TX queue */
 
 	return 0;
 }
@@ -740,6 +740,9 @@ qcaspi_netdev_tx_timeout(struct net_devi
 	qca->net_dev->stats.tx_errors++;
 	/* Trigger tx queue flush and QCA7000 reset */
 	qca->sync = QCASPI_SYNC_UNKNOWN;
+
+	if (qca->spi_thread)
+		wake_up_process(qca->spi_thread);
 }
 
 static int
diff -druNp --no-dereference linux-libre-3.18.119-gnu/drivers/net/ethernet/ti/davinci_emac.c linux-libre-3.18.120-gnu/drivers/net/ethernet/ti/davinci_emac.c
--- linux-libre-3.18.119-gnu/drivers/net/ethernet/ti/davinci_emac.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/drivers/net/ethernet/ti/davinci_emac.c	2018-08-28 01:21:37.000000000 -0400
@@ -1514,6 +1514,10 @@ static int emac_devioctl(struct net_devi
 
 static int match_first_device(struct device *dev, void *data)
 {
+	if (dev->parent && dev->parent->of_node)
+		return of_device_is_compatible(dev->parent->of_node,
+					       "ti,davinci_mdio");
+
 	return !strncmp(dev_name(dev), "davinci_mdio", 12);
 }
 
diff -druNp --no-dereference linux-libre-3.18.119-gnu/drivers/net/hamradio/bpqether.c linux-libre-3.18.120-gnu/drivers/net/hamradio/bpqether.c
--- linux-libre-3.18.119-gnu/drivers/net/hamradio/bpqether.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/drivers/net/hamradio/bpqether.c	2018-08-28 01:21:37.000000000 -0400
@@ -90,10 +90,6 @@
 static const char banner[] __initconst = KERN_INFO \
 	"AX.25: bpqether driver version 004\n";
 
-static char bcast_addr[6]={0xFF,0xFF,0xFF,0xFF,0xFF,0xFF};
-
-static char bpq_eth_addr[6];
-
 static int bpq_rcv(struct sk_buff *, struct net_device *, struct packet_type *, struct net_device *);
 static int bpq_device_event(struct notifier_block *, unsigned long, void *);
 
@@ -512,8 +508,8 @@ static int bpq_new_device(struct net_dev
 	bpq->ethdev = edev;
 	bpq->axdev = ndev;
 
-	memcpy(bpq->dest_addr, bcast_addr, sizeof(bpq_eth_addr));
-	memcpy(bpq->acpt_addr, bcast_addr, sizeof(bpq_eth_addr));
+	eth_broadcast_addr(bpq->dest_addr);
+	eth_broadcast_addr(bpq->acpt_addr);
 
 	err = register_netdevice(ndev);
 	if (err)
diff -druNp --no-dereference linux-libre-3.18.119-gnu/drivers/net/usb/rtl8150.c linux-libre-3.18.120-gnu/drivers/net/usb/rtl8150.c
--- linux-libre-3.18.119-gnu/drivers/net/usb/rtl8150.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/drivers/net/usb/rtl8150.c	2018-08-28 01:21:37.000000000 -0400
@@ -681,7 +681,7 @@ static void rtl8150_set_multicast(struct
 		   (netdev->flags & IFF_ALLMULTI)) {
 		rx_creg &= 0xfffe;
 		rx_creg |= 0x0002;
-		dev_info(&netdev->dev, "%s: allmulti set\n", netdev->name);
+		dev_dbg(&netdev->dev, "%s: allmulti set\n", netdev->name);
 	} else {
 		/* ~RX_MULTICAST, ~RX_PROMISCUOUS */
 		rx_creg &= 0x00fc;
diff -druNp --no-dereference linux-libre-3.18.119-gnu/drivers/net/usb/smsc75xx.c linux-libre-3.18.120-gnu/drivers/net/usb/smsc75xx.c
--- linux-libre-3.18.119-gnu/drivers/net/usb/smsc75xx.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/drivers/net/usb/smsc75xx.c	2018-08-28 01:21:37.000000000 -0400
@@ -81,6 +81,9 @@ static bool turbo_mode = true;
 module_param(turbo_mode, bool, 0644);
 MODULE_PARM_DESC(turbo_mode, "Enable multiple frames per Rx transaction");
 
+static int smsc75xx_link_ok_nopm(struct usbnet *dev);
+static int smsc75xx_phy_gig_workaround(struct usbnet *dev);
+
 static int __must_check __smsc75xx_read_reg(struct usbnet *dev, u32 index,
 					    u32 *data, int in_pm)
 {
@@ -840,6 +843,9 @@ static int smsc75xx_phy_initialize(struc
 		return -EIO;
 	}
 
+	/* phy workaround for gig link */
+	smsc75xx_phy_gig_workaround(dev);
+
 	smsc75xx_mdio_write(dev->net, dev->mii.phy_id, MII_ADVERTISE,
 		ADVERTISE_ALL | ADVERTISE_CSMA | ADVERTISE_PAUSE_CAP |
 		ADVERTISE_PAUSE_ASYM);
@@ -978,6 +984,62 @@ static int smsc75xx_wait_ready(struct us
 	return -EIO;
 }
 
+static int smsc75xx_phy_gig_workaround(struct usbnet *dev)
+{
+	struct mii_if_info *mii = &dev->mii;
+	int ret = 0, timeout = 0;
+	u32 buf, link_up = 0;
+
+	/* Set the phy in Gig loopback */
+	smsc75xx_mdio_write(dev->net, mii->phy_id, MII_BMCR, 0x4040);
+
+	/* Wait for the link up */
+	do {
+		link_up = smsc75xx_link_ok_nopm(dev);
+		usleep_range(10000, 20000);
+		timeout++;
+	} while ((!link_up) && (timeout < 1000));
+
+	if (timeout >= 1000) {
+		netdev_warn(dev->net, "Timeout waiting for PHY link up\n");
+		return -EIO;
+	}
+
+	/* phy reset */
+	ret = smsc75xx_read_reg(dev, PMT_CTL, &buf);
+	if (ret < 0) {
+		netdev_warn(dev->net, "Failed to read PMT_CTL: %d\n", ret);
+		return ret;
+	}
+
+	buf |= PMT_CTL_PHY_RST;
+
+	ret = smsc75xx_write_reg(dev, PMT_CTL, buf);
+	if (ret < 0) {
+		netdev_warn(dev->net, "Failed to write PMT_CTL: %d\n", ret);
+		return ret;
+	}
+
+	timeout = 0;
+	do {
+		usleep_range(10000, 20000);
+		ret = smsc75xx_read_reg(dev, PMT_CTL, &buf);
+		if (ret < 0) {
+			netdev_warn(dev->net, "Failed to read PMT_CTL: %d\n",
+				    ret);
+			return ret;
+		}
+		timeout++;
+	} while ((buf & PMT_CTL_PHY_RST) && (timeout < 100));
+
+	if (timeout >= 100) {
+		netdev_warn(dev->net, "timeout waiting for PHY Reset\n");
+		return -EIO;
+	}
+
+	return 0;
+}
+
 static int smsc75xx_reset(struct usbnet *dev)
 {
 	struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0]);
diff -druNp --no-dereference linux-libre-3.18.119-gnu/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c linux-libre-3.18.120-gnu/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
--- linux-libre-3.18.119-gnu/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c	2018-08-17 18:32:20.000000000 -0400
+++ linux-libre-3.18.120-gnu/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c	2018-08-29 04:04:30.000000000 -0400
@@ -4182,6 +4182,13 @@ void brcmf_sdio_remove(struct brcmf_sdio
 	brcmf_dbg(TRACE, "Enter\n");
 
 	if (bus) {
+		/* Stop watchdog task */
+		if (bus->watchdog_tsk) {
+			send_sig(SIGTERM, bus->watchdog_tsk, 1);
+			kthread_stop(bus->watchdog_tsk);
+			bus->watchdog_tsk = NULL;
+		}
+
 		/* De-register interrupt handler */
 		brcmf_sdiod_intr_unregister(bus->sdiodev);
 
diff -druNp --no-dereference linux-libre-3.18.119-gnu/drivers/pci/hotplug/pci_hotplug_core.c linux-libre-3.18.120-gnu/drivers/pci/hotplug/pci_hotplug_core.c
--- linux-libre-3.18.119-gnu/drivers/pci/hotplug/pci_hotplug_core.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/drivers/pci/hotplug/pci_hotplug_core.c	2018-08-28 01:21:37.000000000 -0400
@@ -457,8 +457,17 @@ int __pci_hp_register(struct hotplug_slo
 	list_add(&slot->slot_list, &pci_hotplug_slot_list);
 
 	result = fs_add_slot(pci_slot);
+	if (result)
+		goto err_list_del;
+
 	kobject_uevent(&pci_slot->kobj, KOBJ_ADD);
 	dbg("Added slot %s to the list\n", name);
+	goto out;
+
+err_list_del:
+	list_del(&slot->slot_list);
+	pci_slot->hotplug = NULL;
+	pci_destroy_slot(pci_slot);
 out:
 	mutex_unlock(&pci_hp_mutex);
 	return result;
diff -druNp --no-dereference linux-libre-3.18.119-gnu/drivers/staging/android/ion/ion.c linux-libre-3.18.120-gnu/drivers/staging/android/ion/ion.c
--- linux-libre-3.18.119-gnu/drivers/staging/android/ion/ion.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/drivers/staging/android/ion/ion.c	2018-08-28 01:21:37.000000000 -0400
@@ -15,6 +15,7 @@
  *
  */
 
+#include <linux/atomic.h>
 #include <linux/device.h>
 #include <linux/err.h>
 #include <linux/file.h>
@@ -389,6 +390,16 @@ static void ion_handle_get(struct ion_ha
 	kref_get(&handle->ref);
 }
 
+/* Must hold the client lock */
+static struct ion_handle *ion_handle_get_check_overflow(
+					struct ion_handle *handle)
+{
+	if (atomic_read(&handle->ref.refcount) + 1 == 0)
+		return ERR_PTR(-EOVERFLOW);
+	ion_handle_get(handle);
+	return handle;
+}
+
 static int ion_handle_put_nolock(struct ion_handle *handle)
 {
 	int ret;
@@ -435,9 +446,9 @@ static struct ion_handle *ion_handle_get
 
 	handle = idr_find(&client->idr, id);
 	if (handle)
-		ion_handle_get(handle);
+		return ion_handle_get_check_overflow(handle);
 
-	return handle ? handle : ERR_PTR(-EINVAL);
+	return ERR_PTR(-EINVAL);
 }
 
 struct ion_handle *ion_handle_get_by_id(struct ion_client *client,
@@ -1197,7 +1208,7 @@ struct ion_handle *ion_import_dma_buf(st
 	/* if a handle exists for this buffer just take a reference to it */
 	handle = ion_handle_lookup(client, buffer);
 	if (!IS_ERR(handle)) {
-		ion_handle_get(handle);
+		handle = ion_handle_get_check_overflow(handle);
 		mutex_unlock(&client->lock);
 		goto end;
 	}
diff -druNp --no-dereference linux-libre-3.18.119-gnu/drivers/tty/serial/8250/8250_dw.c linux-libre-3.18.120-gnu/drivers/tty/serial/8250/8250_dw.c
--- linux-libre-3.18.119-gnu/drivers/tty/serial/8250/8250_dw.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/drivers/tty/serial/8250/8250_dw.c	2018-08-28 01:21:37.000000000 -0400
@@ -202,7 +202,7 @@ static void dw8250_set_termios(struct ua
 	unsigned int rate;
 	int ret;
 
-	if (IS_ERR(d->clk) || !old)
+	if (IS_ERR(d->clk))
 		goto out;
 
 	/* Not requesting clock rates below 1.8432Mhz */
diff -druNp --no-dereference linux-libre-3.18.119-gnu/drivers/usb/dwc2/hcd_intr.c linux-libre-3.18.120-gnu/drivers/usb/dwc2/hcd_intr.c
--- linux-libre-3.18.119-gnu/drivers/usb/dwc2/hcd_intr.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/drivers/usb/dwc2/hcd_intr.c	2018-08-28 01:21:37.000000000 -0400
@@ -913,9 +913,8 @@ static int dwc2_xfercomp_isoc_split_in(s
 	frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
 	len = dwc2_get_actual_xfer_length(hsotg, chan, chnum, qtd,
 					  DWC2_HC_XFER_COMPLETE, NULL);
-	if (!len) {
+	if (!len && !qtd->isoc_split_offset) {
 		qtd->complete_split = 0;
-		qtd->isoc_split_offset = 0;
 		return 0;
 	}
 
diff -druNp --no-dereference linux-libre-3.18.119-gnu/drivers/usb/gadget/composite.c linux-libre-3.18.120-gnu/drivers/usb/gadget/composite.c
--- linux-libre-3.18.119-gnu/drivers/usb/gadget/composite.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/drivers/usb/gadget/composite.c	2018-08-28 01:21:37.000000000 -0400
@@ -1530,6 +1530,8 @@ composite_setup(struct usb_gadget *gadge
 			break;
 		if (w_value && !f->set_alt)
 			break;
+
+		spin_lock(&cdev->lock);
 		value = f->set_alt(f, w_index, w_value);
 		if (value == USB_GADGET_DELAYED_STATUS) {
 			DBG(cdev,
@@ -1539,6 +1541,7 @@ composite_setup(struct usb_gadget *gadge
 			DBG(cdev, "delayed_status count %d\n",
 					cdev->delayed_status);
 		}
+		spin_unlock(&cdev->lock);
 		break;
 	case USB_REQ_GET_INTERFACE:
 		if (ctrl->bRequestType != (USB_DIR_IN|USB_RECIP_INTERFACE))
diff -druNp --no-dereference linux-libre-3.18.119-gnu/drivers/usb/serial/sierra.c linux-libre-3.18.120-gnu/drivers/usb/serial/sierra.c
--- linux-libre-3.18.119-gnu/drivers/usb/serial/sierra.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/drivers/usb/serial/sierra.c	2018-08-28 01:21:37.000000000 -0400
@@ -790,9 +790,9 @@ static void sierra_close(struct usb_seri
 		kfree(urb->transfer_buffer);
 		usb_free_urb(urb);
 		usb_autopm_put_interface_async(serial->interface);
-		spin_lock(&portdata->lock);
+		spin_lock_irq(&portdata->lock);
 		portdata->outstanding_urbs--;
-		spin_unlock(&portdata->lock);
+		spin_unlock_irq(&portdata->lock);
 	}
 
 	sierra_stop_rx_urbs(port);
diff -druNp --no-dereference linux-libre-3.18.119-gnu/fs/reiserfs/xattr.c linux-libre-3.18.120-gnu/fs/reiserfs/xattr.c
--- linux-libre-3.18.119-gnu/fs/reiserfs/xattr.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/fs/reiserfs/xattr.c	2018-08-28 01:21:37.000000000 -0400
@@ -842,8 +842,10 @@ static int listxattr_filler(void *buf, c
 			size = handler->list(b->dentry, b->buf + b->pos,
 					 b->size, name, namelen,
 					 handler->flags);
-			if (size > b->size)
+			if (b->pos + size > b->size) {
+				b->pos = -ERANGE;
 				return -ERANGE;
+			}
 		} else {
 			size = handler->list(b->dentry, NULL, 0, name,
 					     namelen, handler->flags);
diff -druNp --no-dereference linux-libre-3.18.119-gnu/include/net/af_vsock.h linux-libre-3.18.120-gnu/include/net/af_vsock.h
--- linux-libre-3.18.119-gnu/include/net/af_vsock.h	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/include/net/af_vsock.h	2018-08-28 01:21:37.000000000 -0400
@@ -59,7 +59,8 @@ struct vsock_sock {
 	struct list_head pending_links;
 	struct list_head accept_queue;
 	bool rejected;
-	struct delayed_work dwork;
+	struct delayed_work connect_work;
+	struct delayed_work pending_work;
 	u32 peer_shutdown;
 	bool sent_request;
 	bool ignore_connecting_rst;
@@ -70,7 +71,6 @@ struct vsock_sock {
 
 s64 vsock_stream_has_data(struct vsock_sock *vsk);
 s64 vsock_stream_has_space(struct vsock_sock *vsk);
-void vsock_pending_work(struct work_struct *work);
 struct sock *__vsock_create(struct net *net,
 			    struct socket *sock,
 			    struct sock *parent,
diff -druNp --no-dereference linux-libre-3.18.119-gnu/include/net/llc.h linux-libre-3.18.120-gnu/include/net/llc.h
--- linux-libre-3.18.119-gnu/include/net/llc.h	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/include/net/llc.h	2018-08-28 01:21:37.000000000 -0400
@@ -116,6 +116,11 @@ static inline void llc_sap_hold(struct l
 	atomic_inc(&sap->refcnt);
 }
 
+static inline bool llc_sap_hold_safe(struct llc_sap *sap)
+{
+	return atomic_inc_not_zero(&sap->refcnt);
+}
+
 void llc_sap_close(struct llc_sap *sap);
 
 static inline void llc_sap_put(struct llc_sap *sap)
diff -druNp --no-dereference linux-libre-3.18.119-gnu/include/net/net_namespace.h linux-libre-3.18.120-gnu/include/net/net_namespace.h
--- linux-libre-3.18.119-gnu/include/net/net_namespace.h	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/include/net/net_namespace.h	2018-08-28 01:21:37.000000000 -0400
@@ -112,6 +112,7 @@ struct net {
 #endif
 #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
 	struct netns_nf_frag	nf_frag;
+	struct ctl_table_header *nf_frag_frags_hdr;
 #endif
 	struct sock		*nfnl;
 	struct sock		*nfnl_stash;
diff -druNp --no-dereference linux-libre-3.18.119-gnu/include/net/netns/ipv6.h linux-libre-3.18.120-gnu/include/net/netns/ipv6.h
--- linux-libre-3.18.119-gnu/include/net/netns/ipv6.h	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/include/net/netns/ipv6.h	2018-08-28 01:21:37.000000000 -0400
@@ -81,7 +81,6 @@ struct netns_ipv6 {
 
 #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
 struct netns_nf_frag {
-	struct netns_sysctl_ipv6 sysctl;
 	struct netns_frags	frags;
 };
 #endif
diff -druNp --no-dereference linux-libre-3.18.119-gnu/kernel/locking/lockdep.c linux-libre-3.18.120-gnu/kernel/locking/lockdep.c
--- linux-libre-3.18.119-gnu/kernel/locking/lockdep.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/kernel/locking/lockdep.c	2018-08-28 01:21:37.000000000 -0400
@@ -1253,11 +1253,11 @@ unsigned long lockdep_count_forward_deps
 	this.parent = NULL;
 	this.class = class;
 
-	local_irq_save(flags);
+	raw_local_irq_save(flags);
 	arch_spin_lock(&lockdep_lock);
 	ret = __lockdep_count_forward_deps(&this);
 	arch_spin_unlock(&lockdep_lock);
-	local_irq_restore(flags);
+	raw_local_irq_restore(flags);
 
 	return ret;
 }
@@ -1280,11 +1280,11 @@ unsigned long lockdep_count_backward_dep
 	this.parent = NULL;
 	this.class = class;
 
-	local_irq_save(flags);
+	raw_local_irq_save(flags);
 	arch_spin_lock(&lockdep_lock);
 	ret = __lockdep_count_backward_deps(&this);
 	arch_spin_unlock(&lockdep_lock);
-	local_irq_restore(flags);
+	raw_local_irq_restore(flags);
 
 	return ret;
 }
@@ -4083,7 +4083,7 @@ void debug_check_no_locks_freed(const vo
 	if (unlikely(!debug_locks))
 		return;
 
-	local_irq_save(flags);
+	raw_local_irq_save(flags);
 	for (i = 0; i < curr->lockdep_depth; i++) {
 		hlock = curr->held_locks + i;
 
@@ -4094,7 +4094,7 @@ void debug_check_no_locks_freed(const vo
 		print_freed_lock_bug(curr, mem_from, mem_from + mem_len, hlock);
 		break;
 	}
-	local_irq_restore(flags);
+	raw_local_irq_restore(flags);
 }
 EXPORT_SYMBOL_GPL(debug_check_no_locks_freed);
 
diff -druNp --no-dereference linux-libre-3.18.119-gnu/kernel/trace/trace.c linux-libre-3.18.120-gnu/kernel/trace/trace.c
--- linux-libre-3.18.119-gnu/kernel/trace/trace.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/kernel/trace/trace.c	2018-08-28 01:21:37.000000000 -0400
@@ -2137,6 +2137,7 @@ out:
 }
 EXPORT_SYMBOL_GPL(trace_vbprintk);
 
+__printf(3, 0)
 static int
 __trace_array_vprintk(struct ring_buffer *buffer,
 		      unsigned long ip, const char *fmt, va_list args)
@@ -2190,12 +2191,14 @@ __trace_array_vprintk(struct ring_buffer
 	return len;
 }
 
+__printf(3, 0)
 int trace_array_vprintk(struct trace_array *tr,
 			unsigned long ip, const char *fmt, va_list args)
 {
 	return __trace_array_vprintk(tr->trace_buffer.buffer, ip, fmt, args);
 }
 
+__printf(3, 0)
 int trace_array_printk(struct trace_array *tr,
 		       unsigned long ip, const char *fmt, ...)
 {
@@ -2211,6 +2214,7 @@ int trace_array_printk(struct trace_arra
 	return ret;
 }
 
+__printf(3, 4)
 int trace_array_printk_buf(struct ring_buffer *buffer,
 			   unsigned long ip, const char *fmt, ...)
 {
@@ -2226,6 +2230,7 @@ int trace_array_printk_buf(struct ring_b
 	return ret;
 }
 
+__printf(2, 0)
 int trace_vprintk(unsigned long ip, const char *fmt, va_list args)
 {
 	return trace_array_vprintk(&global_trace, ip, fmt, args);
diff -druNp --no-dereference linux-libre-3.18.119-gnu/Makefile linux-libre-3.18.120-gnu/Makefile
--- linux-libre-3.18.119-gnu/Makefile	2018-08-17 18:17:42.000000000 -0400
+++ linux-libre-3.18.120-gnu/Makefile	2018-08-29 03:54:13.000000000 -0400
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 18
-SUBLEVEL = 119
+SUBLEVEL = 120
 EXTRAVERSION =-gnu
 NAME = Diseased Newt
 
diff -druNp --no-dereference linux-libre-3.18.119-gnu/net/bluetooth/sco.c linux-libre-3.18.120-gnu/net/bluetooth/sco.c
--- linux-libre-3.18.119-gnu/net/bluetooth/sco.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/net/bluetooth/sco.c	2018-08-28 01:21:37.000000000 -0400
@@ -390,7 +390,8 @@ static void sco_sock_cleanup_listen(stru
  */
 static void sco_sock_kill(struct sock *sk)
 {
-	if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
+	if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket ||
+	    sock_flag(sk, SOCK_DEAD))
 		return;
 
 	BT_DBG("sk %p state %d", sk, sk->sk_state);
diff -druNp --no-dereference linux-libre-3.18.119-gnu/net/core/dev.c linux-libre-3.18.120-gnu/net/core/dev.c
--- linux-libre-3.18.119-gnu/net/core/dev.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/net/core/dev.c	2018-08-28 01:21:37.000000000 -0400
@@ -6911,7 +6911,8 @@ int dev_change_net_namespace(struct net_
 		/* We get here if we can't use the current device name */
 		if (!pat)
 			goto out;
-		if (dev_get_valid_name(net, dev, pat) < 0)
+		err = dev_get_valid_name(net, dev, pat);
+		if (err < 0)
 			goto out;
 	}
 
@@ -6923,7 +6924,6 @@ int dev_change_net_namespace(struct net_
 	dev_close(dev);
 
 	/* And unlink it from device chain */
-	err = -ENODEV;
 	unlist_netdevice(dev);
 
 	synchronize_net();
diff -druNp --no-dereference linux-libre-3.18.119-gnu/net/dccp/ccids/ccid2.c linux-libre-3.18.120-gnu/net/dccp/ccids/ccid2.c
--- linux-libre-3.18.119-gnu/net/dccp/ccids/ccid2.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/net/dccp/ccids/ccid2.c	2018-08-28 01:21:37.000000000 -0400
@@ -228,14 +228,16 @@ static void ccid2_cwnd_restart(struct so
 	struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
 	u32 cwnd = hc->tx_cwnd, restart_cwnd,
 	    iwnd = rfc3390_bytes_to_packets(dccp_sk(sk)->dccps_mss_cache);
+	s32 delta = now - hc->tx_lsndtime;
 
 	hc->tx_ssthresh = max(hc->tx_ssthresh, (cwnd >> 1) + (cwnd >> 2));
 
 	/* don't reduce cwnd below the initial window (IW) */
 	restart_cwnd = min(cwnd, iwnd);
-	cwnd >>= (now - hc->tx_lsndtime) / hc->tx_rto;
-	hc->tx_cwnd = max(cwnd, restart_cwnd);
 
+	while ((delta -= hc->tx_rto) >= 0 && cwnd > restart_cwnd)
+		cwnd >>= 1;
+	hc->tx_cwnd = max(cwnd, restart_cwnd);
 	hc->tx_cwnd_stamp = now;
 	hc->tx_cwnd_used  = 0;
 
diff -druNp --no-dereference linux-libre-3.18.119-gnu/net/ipv4/netfilter/ip_tables.c linux-libre-3.18.120-gnu/net/ipv4/netfilter/ip_tables.c
--- linux-libre-3.18.119-gnu/net/ipv4/netfilter/ip_tables.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/net/ipv4/netfilter/ip_tables.c	2018-08-28 01:21:37.000000000 -0400
@@ -2069,6 +2069,7 @@ static struct xt_match ipt_builtin_mt[]
 		.checkentry = icmp_checkentry,
 		.proto      = IPPROTO_ICMP,
 		.family     = NFPROTO_IPV4,
+		.me	    = THIS_MODULE,
 	},
 };
 
diff -druNp --no-dereference linux-libre-3.18.119-gnu/net/ipv4/tcp.c linux-libre-3.18.120-gnu/net/ipv4/tcp.c
--- linux-libre-3.18.119-gnu/net/ipv4/tcp.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/net/ipv4/tcp.c	2018-08-28 01:21:37.000000000 -0400
@@ -1668,7 +1668,7 @@ int tcp_recvmsg(struct kiocb *iocb, stru
 			 * shouldn't happen.
 			 */
 			if (WARN(before(*seq, TCP_SKB_CB(skb)->seq),
-				 "recvmsg bug: copied %X seq %X rcvnxt %X fl %X\n",
+				 "TCP recvmsg seq # bug: copied %X, seq %X, rcvnxt %X, fl %X\n",
 				 *seq, TCP_SKB_CB(skb)->seq, tp->rcv_nxt,
 				 flags))
 				break;
@@ -1681,7 +1681,7 @@ int tcp_recvmsg(struct kiocb *iocb, stru
 			if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
 				goto found_fin_ok;
 			WARN(!(flags & MSG_PEEK),
-			     "recvmsg bug 2: copied %X seq %X rcvnxt %X fl %X\n",
+			     "TCP recvmsg seq # bug 2: copied %X, seq %X, rcvnxt %X, fl %X\n",
 			     *seq, TCP_SKB_CB(skb)->seq, tp->rcv_nxt, flags);
 		}
 
diff -druNp --no-dereference linux-libre-3.18.119-gnu/net/ipv6/mcast.c linux-libre-3.18.120-gnu/net/ipv6/mcast.c
--- linux-libre-3.18.119-gnu/net/ipv6/mcast.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/net/ipv6/mcast.c	2018-08-28 01:21:37.000000000 -0400
@@ -2062,7 +2062,8 @@ void ipv6_mc_dad_complete(struct inet6_d
 		mld_send_initial_cr(idev);
 		idev->mc_dad_count--;
 		if (idev->mc_dad_count)
-			mld_dad_start_timer(idev, idev->mc_maxdelay);
+			mld_dad_start_timer(idev,
+					    unsolicited_report_interval(idev));
 	}
 }
 
@@ -2074,7 +2075,8 @@ static void mld_dad_timer_expire(unsigne
 	if (idev->mc_dad_count) {
 		idev->mc_dad_count--;
 		if (idev->mc_dad_count)
-			mld_dad_start_timer(idev, idev->mc_maxdelay);
+			mld_dad_start_timer(idev,
+					    unsolicited_report_interval(idev));
 	}
 	in6_dev_put(idev);
 }
@@ -2432,7 +2434,8 @@ static void mld_ifc_timer_expire(unsigne
 	if (idev->mc_ifc_count) {
 		idev->mc_ifc_count--;
 		if (idev->mc_ifc_count)
-			mld_ifc_start_timer(idev, idev->mc_maxdelay);
+			mld_ifc_start_timer(idev,
+					    unsolicited_report_interval(idev));
 	}
 	in6_dev_put(idev);
 }
diff -druNp --no-dereference linux-libre-3.18.119-gnu/net/ipv6/netfilter/ip6_tables.c linux-libre-3.18.120-gnu/net/ipv6/netfilter/ip6_tables.c
--- linux-libre-3.18.119-gnu/net/ipv6/netfilter/ip6_tables.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/net/ipv6/netfilter/ip6_tables.c	2018-08-28 01:21:37.000000000 -0400
@@ -2071,6 +2071,7 @@ static struct xt_match ip6t_builtin_mt[]
 		.checkentry = icmp6_checkentry,
 		.proto      = IPPROTO_ICMPV6,
 		.family     = NFPROTO_IPV6,
+		.me	    = THIS_MODULE,
 	},
 };
 
diff -druNp --no-dereference linux-libre-3.18.119-gnu/net/ipv6/netfilter/nf_conntrack_reasm.c linux-libre-3.18.120-gnu/net/ipv6/netfilter/nf_conntrack_reasm.c
--- linux-libre-3.18.119-gnu/net/ipv6/netfilter/nf_conntrack_reasm.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/net/ipv6/netfilter/nf_conntrack_reasm.c	2018-08-28 01:21:37.000000000 -0400
@@ -118,7 +118,7 @@ static int nf_ct_frag6_sysctl_register(s
 	if (hdr == NULL)
 		goto err_reg;
 
-	net->nf_frag.sysctl.frags_hdr = hdr;
+	net->nf_frag_frags_hdr = hdr;
 	return 0;
 
 err_reg:
@@ -132,8 +132,8 @@ static void __net_exit nf_ct_frags6_sysc
 {
 	struct ctl_table *table;
 
-	table = net->nf_frag.sysctl.frags_hdr->ctl_table_arg;
-	unregister_net_sysctl_table(net->nf_frag.sysctl.frags_hdr);
+	table = net->nf_frag_frags_hdr->ctl_table_arg;
+	unregister_net_sysctl_table(net->nf_frag_frags_hdr);
 	if (!net_eq(net, &init_net))
 		kfree(table);
 }
diff -druNp --no-dereference linux-libre-3.18.119-gnu/net/l2tp/l2tp_core.c linux-libre-3.18.120-gnu/net/l2tp/l2tp_core.c
--- linux-libre-3.18.119-gnu/net/l2tp/l2tp_core.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/net/l2tp/l2tp_core.c	2018-08-28 01:21:37.000000000 -0400
@@ -1141,7 +1141,7 @@ int l2tp_xmit_skb(struct l2tp_session *s
 
 	/* Get routing info from the tunnel socket */
 	skb_dst_drop(skb);
-	skb_dst_set(skb, dst_clone(__sk_dst_check(sk, 0)));
+	skb_dst_set(skb, sk_dst_check(sk, 0));
 
 	inet = inet_sk(sk);
 	fl = &inet->cork.fl;
diff -druNp --no-dereference linux-libre-3.18.119-gnu/net/llc/llc_core.c linux-libre-3.18.120-gnu/net/llc/llc_core.c
--- linux-libre-3.18.119-gnu/net/llc/llc_core.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/net/llc/llc_core.c	2018-08-28 01:21:37.000000000 -0400
@@ -73,8 +73,8 @@ struct llc_sap *llc_sap_find(unsigned ch
 
 	rcu_read_lock_bh();
 	sap = __llc_sap_find(sap_value);
-	if (sap)
-		llc_sap_hold(sap);
+	if (!sap || !llc_sap_hold_safe(sap))
+		sap = NULL;
 	rcu_read_unlock_bh();
 	return sap;
 }
diff -druNp --no-dereference linux-libre-3.18.119-gnu/net/netfilter/nf_conntrack_proto_dccp.c linux-libre-3.18.120-gnu/net/netfilter/nf_conntrack_proto_dccp.c
--- linux-libre-3.18.119-gnu/net/netfilter/nf_conntrack_proto_dccp.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/net/netfilter/nf_conntrack_proto_dccp.c	2018-08-28 01:21:37.000000000 -0400
@@ -244,14 +244,14 @@ dccp_state_table[CT_DCCP_ROLE_MAX + 1][D
 		 * We currently ignore Sync packets
 		 *
 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
-			sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
+			sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
 		},
 		[DCCP_PKT_SYNCACK] = {
 		/*
 		 * We currently ignore SyncAck packets
 		 *
 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
-			sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
+			sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
 		},
 	},
 	[CT_DCCP_ROLE_SERVER] = {
@@ -372,14 +372,14 @@ dccp_state_table[CT_DCCP_ROLE_MAX + 1][D
 		 * We currently ignore Sync packets
 		 *
 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
-			sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
+			sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
 		},
 		[DCCP_PKT_SYNCACK] = {
 		/*
 		 * We currently ignore SyncAck packets
 		 *
 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
-			sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
+			sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
 		},
 	},
 };
diff -druNp --no-dereference linux-libre-3.18.119-gnu/net/packet/af_packet.c linux-libre-3.18.120-gnu/net/packet/af_packet.c
--- linux-libre-3.18.119-gnu/net/packet/af_packet.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/net/packet/af_packet.c	2018-08-28 01:21:37.000000000 -0400
@@ -3853,6 +3853,8 @@ static int packet_set_ring(struct sock *
 	}
 
 	if (req->tp_block_nr) {
+		unsigned int min_frame_size;
+
 		/* Sanity tests and some calculations */
 		err = -EBUSY;
 		if (unlikely(rb->pg_vec))
@@ -3875,12 +3877,12 @@ static int packet_set_ring(struct sock *
 			goto out;
 		if (unlikely(req->tp_block_size & (PAGE_SIZE - 1)))
 			goto out;
+		min_frame_size = po->tp_hdrlen + po->tp_reserve;
 		if (po->tp_version >= TPACKET_V3 &&
-		    req->tp_block_size <=
-		    BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + sizeof(struct tpacket3_hdr))
+		    req->tp_block_size <
+		    BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + min_frame_size)
 			goto out;
-		if (unlikely(req->tp_frame_size < po->tp_hdrlen +
-					po->tp_reserve))
+		if (unlikely(req->tp_frame_size < min_frame_size))
 			goto out;
 		if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1)))
 			goto out;
diff -druNp --no-dereference linux-libre-3.18.119-gnu/net/sched/cls_tcindex.c linux-libre-3.18.120-gnu/net/sched/cls_tcindex.c
--- linux-libre-3.18.119-gnu/net/sched/cls_tcindex.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/net/sched/cls_tcindex.c	2018-08-28 01:21:37.000000000 -0400
@@ -368,22 +368,20 @@ tcindex_set_parms(struct net *net, struc
 		tcf_bind_filter(tp, &cr.res, base);
 	}
 
-	if (old_r)
-		tcf_exts_change(tp, &r->exts, &e);
-	else
-		tcf_exts_change(tp, &cr.exts, &e);
-
 	if (old_r && old_r != r)
 		tcindex_filter_result_init(old_r);
 
 	oldp = p;
 	r->res = cr.res;
+	tcf_exts_change(tp, &r->exts, &e);
+
 	rcu_assign_pointer(tp->root, cp);
 
 	if (r == &new_filter_result) {
 		struct tcindex_filter *nfp;
 		struct tcindex_filter __rcu **fp;
 
+		f->result.res = r->res;
 		tcf_exts_change(tp, &f->result.exts, &r->exts);
 
 		fp = cp->h + (handle % cp->hash);
diff -druNp --no-dereference linux-libre-3.18.119-gnu/net/vmw_vsock/af_vsock.c linux-libre-3.18.120-gnu/net/vmw_vsock/af_vsock.c
--- linux-libre-3.18.119-gnu/net/vmw_vsock/af_vsock.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/net/vmw_vsock/af_vsock.c	2018-08-28 01:21:37.000000000 -0400
@@ -431,14 +431,14 @@ static int vsock_send_shutdown(struct so
 	return transport->shutdown(vsock_sk(sk), mode);
 }
 
-void vsock_pending_work(struct work_struct *work)
+static void vsock_pending_work(struct work_struct *work)
 {
 	struct sock *sk;
 	struct sock *listener;
 	struct vsock_sock *vsk;
 	bool cleanup;
 
-	vsk = container_of(work, struct vsock_sock, dwork.work);
+	vsk = container_of(work, struct vsock_sock, pending_work.work);
 	sk = sk_vsock(vsk);
 	listener = vsk->listener;
 	cleanup = true;
@@ -478,7 +478,6 @@ out:
 	sock_put(sk);
 	sock_put(listener);
 }
-EXPORT_SYMBOL_GPL(vsock_pending_work);
 
 /**** SOCKET OPERATIONS ****/
 
@@ -577,6 +576,8 @@ static int __vsock_bind(struct sock *sk,
 	return retval;
 }
 
+static void vsock_connect_timeout(struct work_struct *work);
+
 struct sock *__vsock_create(struct net *net,
 			    struct socket *sock,
 			    struct sock *parent,
@@ -618,6 +619,8 @@ struct sock *__vsock_create(struct net *
 	vsk->sent_request = false;
 	vsk->ignore_connecting_rst = false;
 	vsk->peer_shutdown = 0;
+	INIT_DELAYED_WORK(&vsk->connect_work, vsock_connect_timeout);
+	INIT_DELAYED_WORK(&vsk->pending_work, vsock_pending_work);
 
 	psk = parent ? vsock_sk(parent) : NULL;
 	if (parent) {
@@ -1095,7 +1098,7 @@ static void vsock_connect_timeout(struct
 	struct sock *sk;
 	struct vsock_sock *vsk;
 
-	vsk = container_of(work, struct vsock_sock, dwork.work);
+	vsk = container_of(work, struct vsock_sock, connect_work.work);
 	sk = sk_vsock(vsk);
 
 	lock_sock(sk);
@@ -1196,9 +1199,7 @@ static int vsock_stream_connect(struct s
 			 * timeout fires.
 			 */
 			sock_hold(sk);
-			INIT_DELAYED_WORK(&vsk->dwork,
-					  vsock_connect_timeout);
-			schedule_delayed_work(&vsk->dwork, timeout);
+			schedule_delayed_work(&vsk->connect_work, timeout);
 
 			/* Skip ahead to preserve error code set above. */
 			goto out_wait;
diff -druNp --no-dereference linux-libre-3.18.119-gnu/net/vmw_vsock/vmci_transport.c linux-libre-3.18.120-gnu/net/vmw_vsock/vmci_transport.c
--- linux-libre-3.18.119-gnu/net/vmw_vsock/vmci_transport.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/net/vmw_vsock/vmci_transport.c	2018-08-28 01:21:37.000000000 -0400
@@ -1127,8 +1127,7 @@ static int vmci_transport_recv_listen(st
 	vpending->listener = sk;
 	sock_hold(sk);
 	sock_hold(pending);
-	INIT_DELAYED_WORK(&vpending->dwork, vsock_pending_work);
-	schedule_delayed_work(&vpending->dwork, HZ);
+	schedule_delayed_work(&vpending->pending_work, HZ);
 
 out:
 	return err;
diff -druNp --no-dereference linux-libre-3.18.119-gnu/net/xfrm/xfrm_user.c linux-libre-3.18.120-gnu/net/xfrm/xfrm_user.c
--- linux-libre-3.18.119-gnu/net/xfrm/xfrm_user.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/net/xfrm/xfrm_user.c	2018-08-28 01:21:37.000000000 -0400
@@ -1597,9 +1597,11 @@ static inline size_t userpolicy_type_att
 #ifdef CONFIG_XFRM_SUB_POLICY
 static int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
 {
-	struct xfrm_userpolicy_type upt = {
-		.type = type,
-	};
+	struct xfrm_userpolicy_type upt;
+
+	/* Sadly there are two holes in struct xfrm_userpolicy_type */
+	memset(&upt, 0, sizeof(upt));
+	upt.type = type;
 
 	return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt);
 }
diff -druNp --no-dereference linux-libre-3.18.119-gnu/security/smack/smack_lsm.c linux-libre-3.18.120-gnu/security/smack/smack_lsm.c
--- linux-libre-3.18.119-gnu/security/smack/smack_lsm.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/security/smack/smack_lsm.c	2018-08-28 01:21:37.000000000 -0400
@@ -2037,6 +2037,7 @@ static void smack_task_to_inode(struct t
 	struct smack_known *skp = smk_of_task_struct(p);
 
 	isp->smk_inode = skp;
+	isp->smk_flags |= SMK_INODE_INSTANT;
 }
 
 /*
diff -druNp --no-dereference linux-libre-3.18.119-gnu/sound/core/memalloc.c linux-libre-3.18.120-gnu/sound/core/memalloc.c
--- linux-libre-3.18.119-gnu/sound/core/memalloc.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/sound/core/memalloc.c	2018-08-28 01:21:37.000000000 -0400
@@ -239,16 +239,12 @@ int snd_dma_alloc_pages_fallback(int typ
 	int err;
 
 	while ((err = snd_dma_alloc_pages(type, device, size, dmab)) < 0) {
-		size_t aligned_size;
 		if (err != -ENOMEM)
 			return err;
 		if (size <= PAGE_SIZE)
 			return -ENOMEM;
-		aligned_size = PAGE_SIZE << get_order(size);
-		if (size != aligned_size)
-			size = aligned_size;
-		else
-			size >>= 1;
+		size >>= 1;
+		size = PAGE_SIZE << get_order(size);
 	}
 	if (! dmab->area)
 		return -ENOMEM;
diff -druNp --no-dereference linux-libre-3.18.119-gnu/sound/core/seq/seq_virmidi.c linux-libre-3.18.120-gnu/sound/core/seq/seq_virmidi.c
--- linux-libre-3.18.119-gnu/sound/core/seq/seq_virmidi.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/sound/core/seq/seq_virmidi.c	2018-08-28 01:21:37.000000000 -0400
@@ -163,6 +163,7 @@ static void snd_virmidi_output_trigger(s
 	int count, res;
 	unsigned char buf[32], *pbuf;
 	unsigned long flags;
+	bool check_resched = !in_atomic();
 
 	if (up) {
 		vmidi->trigger = 1;
@@ -200,6 +201,15 @@ static void snd_virmidi_output_trigger(s
 					vmidi->event.type = SNDRV_SEQ_EVENT_NONE;
 				}
 			}
+			if (!check_resched)
+				continue;
+			/* do temporary unlock & cond_resched() for avoiding
+			 * CPU soft lockup, which may happen via a write from
+			 * a huge rawmidi buffer
+			 */
+			spin_unlock_irqrestore(&substream->runtime->lock, flags);
+			cond_resched();
+			spin_lock_irqsave(&substream->runtime->lock, flags);
 		}
 	out:
 		spin_unlock_irqrestore(&substream->runtime->lock, flags);
diff -druNp --no-dereference linux-libre-3.18.119-gnu/sound/pci/cs5535audio/cs5535audio.h linux-libre-3.18.120-gnu/sound/pci/cs5535audio/cs5535audio.h
--- linux-libre-3.18.119-gnu/sound/pci/cs5535audio/cs5535audio.h	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/sound/pci/cs5535audio/cs5535audio.h	2018-08-28 01:21:37.000000000 -0400
@@ -66,9 +66,9 @@ struct cs5535audio_dma_ops {
 };
 
 struct cs5535audio_dma_desc {
-	u32 addr;
-	u16 size;
-	u16 ctlreserved;
+	__le32 addr;
+	__le16 size;
+	__le16 ctlreserved;
 };
 
 struct cs5535audio_dma {
diff -druNp --no-dereference linux-libre-3.18.119-gnu/sound/pci/cs5535audio/cs5535audio_pcm.c linux-libre-3.18.120-gnu/sound/pci/cs5535audio/cs5535audio_pcm.c
--- linux-libre-3.18.119-gnu/sound/pci/cs5535audio/cs5535audio_pcm.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/sound/pci/cs5535audio/cs5535audio_pcm.c	2018-08-28 01:21:37.000000000 -0400
@@ -158,8 +158,8 @@ static int cs5535audio_build_dma_packets
 	lastdesc->addr = cpu_to_le32((u32) dma->desc_buf.addr);
 	lastdesc->size = 0;
 	lastdesc->ctlreserved = cpu_to_le16(PRD_JMP);
-	jmpprd_addr = cpu_to_le32(lastdesc->addr +
-				  (sizeof(struct cs5535audio_dma_desc)*periods));
+	jmpprd_addr = (u32)dma->desc_buf.addr +
+		sizeof(struct cs5535audio_dma_desc) * periods;
 
 	dma->substream = substream;
 	dma->period_bytes = period_bytes;
diff -druNp --no-dereference linux-libre-3.18.119-gnu/sound/pci/vx222/vx222_ops.c linux-libre-3.18.120-gnu/sound/pci/vx222/vx222_ops.c
--- linux-libre-3.18.119-gnu/sound/pci/vx222/vx222_ops.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/sound/pci/vx222/vx222_ops.c	2018-08-28 01:21:37.000000000 -0400
@@ -270,7 +270,7 @@ static void vx2_dma_write(struct vx_core
 		length >>= 2; /* in 32bit words */
 		/* Transfer using pseudo-dma. */
 		for (; length > 0; length--) {
-			outl(cpu_to_le32(*addr), port);
+			outl(*addr, port);
 			addr++;
 		}
 		addr = (u32 *)runtime->dma_area;
@@ -280,7 +280,7 @@ static void vx2_dma_write(struct vx_core
 	count >>= 2; /* in 32bit words */
 	/* Transfer using pseudo-dma. */
 	for (; count > 0; count--) {
-		outl(cpu_to_le32(*addr), port);
+		outl(*addr, port);
 		addr++;
 	}
 
@@ -308,7 +308,7 @@ static void vx2_dma_read(struct vx_core
 		length >>= 2; /* in 32bit words */
 		/* Transfer using pseudo-dma. */
 		for (; length > 0; length--)
-			*addr++ = le32_to_cpu(inl(port));
+			*addr++ = inl(port);
 		addr = (u32 *)runtime->dma_area;
 		pipe->hw_ptr = 0;
 	}
@@ -316,7 +316,7 @@ static void vx2_dma_read(struct vx_core
 	count >>= 2; /* in 32bit words */
 	/* Transfer using pseudo-dma. */
 	for (; count > 0; count--)
-		*addr++ = le32_to_cpu(inl(port));
+		*addr++ = inl(port);
 
 	vx2_release_pseudo_dma(chip);
 }
diff -druNp --no-dereference linux-libre-3.18.119-gnu/sound/pcmcia/vx/vxp_ops.c linux-libre-3.18.120-gnu/sound/pcmcia/vx/vxp_ops.c
--- linux-libre-3.18.119-gnu/sound/pcmcia/vx/vxp_ops.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/sound/pcmcia/vx/vxp_ops.c	2018-08-28 01:21:37.000000000 -0400
@@ -375,7 +375,7 @@ static void vxp_dma_write(struct vx_core
 		length >>= 1; /* in 16bit words */
 		/* Transfer using pseudo-dma. */
 		for (; length > 0; length--) {
-			outw(cpu_to_le16(*addr), port);
+			outw(*addr, port);
 			addr++;
 		}
 		addr = (unsigned short *)runtime->dma_area;
@@ -385,7 +385,7 @@ static void vxp_dma_write(struct vx_core
 	count >>= 1; /* in 16bit words */
 	/* Transfer using pseudo-dma. */
 	for (; count > 0; count--) {
-		outw(cpu_to_le16(*addr), port);
+		outw(*addr, port);
 		addr++;
 	}
 	vx_release_pseudo_dma(chip);
@@ -417,7 +417,7 @@ static void vxp_dma_read(struct vx_core
 		length >>= 1; /* in 16bit words */
 		/* Transfer using pseudo-dma. */
 		for (; length > 0; length--)
-			*addr++ = le16_to_cpu(inw(port));
+			*addr++ = inw(port);
 		addr = (unsigned short *)runtime->dma_area;
 		pipe->hw_ptr = 0;
 	}
@@ -425,12 +425,12 @@ static void vxp_dma_read(struct vx_core
 	count >>= 1; /* in 16bit words */
 	/* Transfer using pseudo-dma. */
 	for (; count > 1; count--)
-		*addr++ = le16_to_cpu(inw(port));
+		*addr++ = inw(port);
 	/* Disable DMA */
 	pchip->regDIALOG &= ~VXP_DLG_DMAREAD_SEL_MASK;
 	vx_outb(chip, DIALOG, pchip->regDIALOG);
 	/* Read the last word (16 bits) */
-	*addr = le16_to_cpu(inw(port));
+	*addr = inw(port);
 	/* Disable 16-bit accesses */
 	pchip->regDIALOG &= ~VXP_DLG_DMA16_SEL_MASK;
 	vx_outb(chip, DIALOG, pchip->regDIALOG);
diff -druNp --no-dereference linux-libre-3.18.119-gnu/tools/perf/arch/powerpc/util/skip-callchain-idx.c linux-libre-3.18.120-gnu/tools/perf/arch/powerpc/util/skip-callchain-idx.c
--- linux-libre-3.18.119-gnu/tools/perf/arch/powerpc/util/skip-callchain-idx.c	2018-08-17 14:54:56.000000000 -0400
+++ linux-libre-3.18.120-gnu/tools/perf/arch/powerpc/util/skip-callchain-idx.c	2018-08-28 01:21:37.000000000 -0400
@@ -230,7 +230,7 @@ int arch_skip_callchain_idx(struct machi
 	u64 ip;
 	u64 skip_slot = -1;
 
-	if (chain->nr < 3)
+	if (!chain || chain->nr < 3)
 		return skip_slot;
 
 	ip = chain->ips[2];
diff -druNp --no-dereference linux-libre-3.18.119-gnu/tools/testing/selftests/sync/config linux-libre-3.18.120-gnu/tools/testing/selftests/sync/config
--- linux-libre-3.18.119-gnu/tools/testing/selftests/sync/config	1969-12-31 19:00:00.000000000 -0500
+++ linux-libre-3.18.120-gnu/tools/testing/selftests/sync/config	2018-08-28 01:21:37.000000000 -0400
@@ -0,0 +1,4 @@
+CONFIG_STAGING=y
+CONFIG_ANDROID=y
+CONFIG_SYNC=y
+CONFIG_SW_SYNC=y
