diff -druNp --no-dereference linux-libre-3.18.122-gnu/arch/arm/mach-hisi/hotplug.c linux-libre-3.18.123-gnu/arch/arm/mach-hisi/hotplug.c
--- linux-libre-3.18.122-gnu/arch/arm/mach-hisi/hotplug.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/arch/arm/mach-hisi/hotplug.c	2018-09-26 02:33:59.000000000 -0400
@@ -145,13 +145,20 @@ static int hi3xxx_hotplug_init(void)
 	struct device_node *node;
 
 	node = of_find_compatible_node(NULL, NULL, "hisilicon,sysctrl");
-	if (node) {
-		ctrl_base = of_iomap(node, 0);
-		id = HI3620_CTRL;
-		return 0;
+	if (!node) {
+		id = ERROR_CTRL;
+		return -ENOENT;
 	}
-	id = ERROR_CTRL;
-	return -ENOENT;
+
+	ctrl_base = of_iomap(node, 0);
+	of_node_put(node);
+	if (!ctrl_base) {
+		id = ERROR_CTRL;
+		return -ENOMEM;
+	}
+
+	id = HI3620_CTRL;
+	return 0;
 }
 
 void hi3xxx_set_cpu(int cpu, bool enable)
@@ -170,11 +177,15 @@ static bool hix5hd2_hotplug_init(void)
 	struct device_node *np;
 
 	np = of_find_compatible_node(NULL, NULL, "hisilicon,cpuctrl");
-	if (np) {
-		ctrl_base = of_iomap(np, 0);
-		return true;
-	}
-	return false;
+	if (!np)
+		return false;
+
+	ctrl_base = of_iomap(np, 0);
+	of_node_put(np);
+	if (!ctrl_base)
+		return false;
+
+	return true;
 }
 
 void hix5hd2_set_cpu(int cpu, bool enable)
diff -druNp --no-dereference linux-libre-3.18.122-gnu/arch/mips/ath79/setup.c linux-libre-3.18.123-gnu/arch/mips/ath79/setup.c
--- linux-libre-3.18.122-gnu/arch/mips/ath79/setup.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/arch/mips/ath79/setup.c	2018-09-26 02:33:59.000000000 -0400
@@ -40,6 +40,7 @@ static char ath79_sys_type[ATH79_SYS_TYP
 
 static void ath79_restart(char *command)
 {
+	local_irq_disable();
 	ath79_device_reset_set(AR71XX_RESET_FULL_CHIP);
 	for (;;)
 		if (cpu_wait)
diff -druNp --no-dereference linux-libre-3.18.122-gnu/arch/mips/include/asm/io.h linux-libre-3.18.123-gnu/arch/mips/include/asm/io.h
--- linux-libre-3.18.122-gnu/arch/mips/include/asm/io.h	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/arch/mips/include/asm/io.h	2018-09-26 02:33:59.000000000 -0400
@@ -141,14 +141,14 @@ static inline void * phys_to_virt(unsign
 /*
  * ISA I/O bus memory addresses are 1:1 with the physical address.
  */
-static inline unsigned long isa_virt_to_bus(volatile void * address)
+static inline unsigned long isa_virt_to_bus(volatile void *address)
 {
-	return (unsigned long)address - PAGE_OFFSET;
+	return virt_to_phys(address);
 }
 
-static inline void * isa_bus_to_virt(unsigned long address)
+static inline void *isa_bus_to_virt(unsigned long address)
 {
-	return (void *)(address + PAGE_OFFSET);
+	return phys_to_virt(address);
 }
 
 #define isa_page_to_bus page_to_phys
diff -druNp --no-dereference linux-libre-3.18.122-gnu/arch/mips/include/asm/mach-ath79/ath79.h linux-libre-3.18.123-gnu/arch/mips/include/asm/mach-ath79/ath79.h
--- linux-libre-3.18.122-gnu/arch/mips/include/asm/mach-ath79/ath79.h	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/arch/mips/include/asm/mach-ath79/ath79.h	2018-09-26 02:33:59.000000000 -0400
@@ -132,6 +132,7 @@ static inline u32 ath79_pll_rr(unsigned
 static inline void ath79_reset_wr(unsigned reg, u32 val)
 {
 	__raw_writel(val, ath79_reset_base + reg);
+	(void) __raw_readl(ath79_reset_base + reg); /* flush */
 }
 
 static inline u32 ath79_reset_rr(unsigned reg)
diff -druNp --no-dereference linux-libre-3.18.122-gnu/arch/mips/kernel/process.c linux-libre-3.18.123-gnu/arch/mips/kernel/process.c
--- linux-libre-3.18.122-gnu/arch/mips/kernel/process.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/arch/mips/kernel/process.c	2018-09-26 02:33:59.000000000 -0400
@@ -87,7 +87,6 @@ int copy_thread(unsigned long clone_flag
 	struct thread_info *ti = task_thread_info(p);
 	struct pt_regs *childregs, *regs = current_pt_regs();
 	unsigned long childksp;
-	p->set_child_tid = p->clear_child_tid = NULL;
 
 	childksp = (unsigned long)task_stack_page(p) + THREAD_SIZE - 32;
 
diff -druNp --no-dereference linux-libre-3.18.122-gnu/arch/mips/loongson/common/cs5536/cs5536_ohci.c linux-libre-3.18.123-gnu/arch/mips/loongson/common/cs5536/cs5536_ohci.c
--- linux-libre-3.18.122-gnu/arch/mips/loongson/common/cs5536/cs5536_ohci.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/arch/mips/loongson/common/cs5536/cs5536_ohci.c	2018-09-26 02:33:59.000000000 -0400
@@ -138,7 +138,7 @@ u32 pci_ohci_read_reg(int reg)
 		break;
 	case PCI_OHCI_INT_REG:
 		_rdmsr(DIVIL_MSR_REG(PIC_YSEL_LOW), &hi, &lo);
-		if ((lo & 0x00000f00) == CS5536_USB_INTR)
+		if (((lo >> PIC_YSEL_LOW_USB_SHIFT) & 0xf) == CS5536_USB_INTR)
 			conf_data = 1;
 		break;
 	default:
diff -druNp --no-dereference linux-libre-3.18.122-gnu/arch/mips/mm/c-r4k.c linux-libre-3.18.123-gnu/arch/mips/mm/c-r4k.c
--- linux-libre-3.18.122-gnu/arch/mips/mm/c-r4k.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/arch/mips/mm/c-r4k.c	2018-09-26 02:33:59.000000000 -0400
@@ -703,7 +703,8 @@ static void r4k_flush_icache_range(unsig
 static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size)
 {
 	/* Catch bad driver code */
-	BUG_ON(size == 0);
+	if (WARN_ON(size == 0))
+		return;
 
 	preempt_disable();
 	if (cpu_has_inclusive_pcaches) {
@@ -736,7 +737,8 @@ static void r4k_dma_cache_wback_inv(unsi
 static void r4k_dma_cache_inv(unsigned long addr, unsigned long size)
 {
 	/* Catch bad driver code */
-	BUG_ON(size == 0);
+	if (WARN_ON(size == 0))
+		return;
 
 	preempt_disable();
 	if (cpu_has_inclusive_pcaches) {
diff -druNp --no-dereference linux-libre-3.18.122-gnu/arch/openrisc/kernel/process.c linux-libre-3.18.123-gnu/arch/openrisc/kernel/process.c
--- linux-libre-3.18.122-gnu/arch/openrisc/kernel/process.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/arch/openrisc/kernel/process.c	2018-09-26 02:33:59.000000000 -0400
@@ -152,8 +152,6 @@ copy_thread(unsigned long clone_flags, u
 
 	top_of_kernel_stack = sp;
 
-	p->set_child_tid = p->clear_child_tid = NULL;
-
 	/* Locate userspace context on stack... */
 	sp -= STACK_FRAME_OVERHEAD;	/* redzone */
 	sp -= sizeof(struct pt_regs);
diff -druNp --no-dereference linux-libre-3.18.122-gnu/arch/powerpc/platforms/powernv/opal.c linux-libre-3.18.123-gnu/arch/powerpc/platforms/powernv/opal.c
--- linux-libre-3.18.122-gnu/arch/powerpc/platforms/powernv/opal.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/arch/powerpc/platforms/powernv/opal.c	2018-09-26 02:33:59.000000000 -0400
@@ -452,7 +452,7 @@ int opal_put_chars(uint32_t vtermno, con
 		/* Closed or other error drop */
 		if (rc != OPAL_SUCCESS && rc != OPAL_BUSY &&
 		    rc != OPAL_BUSY_EVENT) {
-			written = total_len;
+			written += total_len;
 			break;
 		}
 		if (rc == OPAL_SUCCESS) {
diff -druNp --no-dereference linux-libre-3.18.122-gnu/arch/powerpc/platforms/pseries/ras.c linux-libre-3.18.123-gnu/arch/powerpc/platforms/pseries/ras.c
--- linux-libre-3.18.122-gnu/arch/powerpc/platforms/pseries/ras.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/arch/powerpc/platforms/pseries/ras.c	2018-09-26 02:33:59.000000000 -0400
@@ -309,7 +309,7 @@ static struct rtas_error_log *fwnmi_get_
 		int len, error_log_length;
 
 		error_log_length = 8 + rtas_error_extended_log_length(h);
-		len = max_t(int, error_log_length, RTAS_ERROR_LOG_MAX);
+		len = min_t(int, error_log_length, RTAS_ERROR_LOG_MAX);
 		memset(global_mce_data_buf, 0, RTAS_ERROR_LOG_MAX);
 		memcpy(global_mce_data_buf, h, len);
 		errhdr = (struct rtas_error_log *)global_mce_data_buf;
diff -druNp --no-dereference linux-libre-3.18.122-gnu/arch/powerpc/sysdev/mpic_msgr.c linux-libre-3.18.123-gnu/arch/powerpc/sysdev/mpic_msgr.c
--- linux-libre-3.18.122-gnu/arch/powerpc/sysdev/mpic_msgr.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/arch/powerpc/sysdev/mpic_msgr.c	2018-09-26 02:33:59.000000000 -0400
@@ -196,7 +196,7 @@ static int mpic_msgr_probe(struct platfo
 
 	/* IO map the message register block. */
 	of_address_to_resource(np, 0, &rsrc);
-	msgr_block_addr = ioremap(rsrc.start, rsrc.end - rsrc.start);
+	msgr_block_addr = ioremap(rsrc.start, resource_size(&rsrc));
 	if (!msgr_block_addr) {
 		dev_err(&dev->dev, "Failed to iomap MPIC message registers");
 		return -EFAULT;
diff -druNp --no-dereference linux-libre-3.18.122-gnu/arch/x86/mm/fault.c linux-libre-3.18.123-gnu/arch/x86/mm/fault.c
--- linux-libre-3.18.122-gnu/arch/x86/mm/fault.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/arch/x86/mm/fault.c	2018-09-26 02:33:59.000000000 -0400
@@ -271,8 +271,6 @@ static noinline int vmalloc_fault(unsign
 	if (!(address >= VMALLOC_START && address < VMALLOC_END))
 		return -1;
 
-	WARN_ON_ONCE(in_nmi());
-
 	/*
 	 * Synchronize this task's top level page-table
 	 * with the 'reference' page table.
diff -druNp --no-dereference linux-libre-3.18.122-gnu/block/cfq-iosched.c linux-libre-3.18.123-gnu/block/cfq-iosched.c
--- linux-libre-3.18.122-gnu/block/cfq-iosched.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/block/cfq-iosched.c	2018-09-26 02:33:59.000000000 -0400
@@ -2728,7 +2728,8 @@ static void cfq_arm_slice_timer(struct c
 	 * for devices that support queuing, otherwise we still have a problem
 	 * with sync vs async workloads.
 	 */
-	if (blk_queue_nonrot(cfqd->queue) && cfqd->hw_tag)
+	if (blk_queue_nonrot(cfqd->queue) && cfqd->hw_tag &&
+		!cfqd->cfq_group_idle)
 		return;
 
 	WARN_ON(!RB_EMPTY_ROOT(&cfqq->sort_list));
diff -druNp --no-dereference linux-libre-3.18.122-gnu/block/partitions/aix.c linux-libre-3.18.123-gnu/block/partitions/aix.c
--- linux-libre-3.18.122-gnu/block/partitions/aix.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/block/partitions/aix.c	2018-09-26 02:33:59.000000000 -0400
@@ -177,7 +177,7 @@ int aix_partition(struct parsed_partitio
 	u32 vgda_sector = 0;
 	u32 vgda_len = 0;
 	int numlvs = 0;
-	struct pvd *pvd;
+	struct pvd *pvd = NULL;
 	struct lv_info {
 		unsigned short pps_per_lv;
 		unsigned short pps_found;
@@ -231,10 +231,11 @@ int aix_partition(struct parsed_partitio
 				if (lvip[i].pps_per_lv)
 					foundlvs += 1;
 			}
+			/* pvd loops depend on n[].name and lvip[].pps_per_lv */
+			pvd = alloc_pvd(state, vgda_sector + 17);
 		}
 		put_dev_sector(sect);
 	}
-	pvd = alloc_pvd(state, vgda_sector + 17);
 	if (pvd) {
 		int numpps = be16_to_cpu(pvd->pp_count);
 		int psn_part1 = be32_to_cpu(pvd->psn_part1);
@@ -281,10 +282,14 @@ int aix_partition(struct parsed_partitio
 				next_lp_ix += 1;
 		}
 		for (i = 0; i < state->limit; i += 1)
-			if (lvip[i].pps_found && !lvip[i].lv_is_contiguous)
+			if (lvip[i].pps_found && !lvip[i].lv_is_contiguous) {
+				char tmp[sizeof(n[i].name) + 1]; // null char
+
+				snprintf(tmp, sizeof(tmp), "%s", n[i].name);
 				pr_warn("partition %s (%u pp's found) is "
 					"not contiguous\n",
-					n[i].name, lvip[i].pps_found);
+					tmp, lvip[i].pps_found);
+			}
 		kfree(pvd);
 	}
 	kfree(n);
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/ata/libahci.c linux-libre-3.18.123-gnu/drivers/ata/libahci.c
--- linux-libre-3.18.122-gnu/drivers/ata/libahci.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/ata/libahci.c	2018-09-26 02:33:59.000000000 -0400
@@ -2052,6 +2052,8 @@ static void ahci_set_aggressive_devslp(s
 		deto = 20;
 	}
 
+	/* Make dito, mdat, deto bits to 0s */
+	devslp &= ~GENMASK_ULL(24, 2);
 	devslp |= ((dito << PORT_DEVSLP_DITO_OFFSET) |
 		   (mdat << PORT_DEVSLP_MDAT_OFFSET) |
 		   (deto << PORT_DEVSLP_DETO_OFFSET) |
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/bluetooth/Kconfig linux-libre-3.18.123-gnu/drivers/bluetooth/Kconfig
--- linux-libre-3.18.122-gnu/drivers/bluetooth/Kconfig	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/bluetooth/Kconfig	2018-09-26 02:33:59.000000000 -0400
@@ -85,6 +85,7 @@ config BT_HCIUART_LL
 config BT_HCIUART_3WIRE
 	bool "Three-wire UART (H5) protocol support"
 	depends on BT_HCIUART
+	depends on BT_HCIUART_SERDEV
 	help
 	  The HCI Three-wire UART Transport Layer makes it possible to
 	  user the Bluetooth HCI over a serial port interface. The HCI
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/gpio/gpio-ml-ioh.c linux-libre-3.18.123-gnu/drivers/gpio/gpio-ml-ioh.c
--- linux-libre-3.18.122-gnu/drivers/gpio/gpio-ml-ioh.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/gpio/gpio-ml-ioh.c	2018-09-26 02:33:59.000000000 -0400
@@ -495,9 +495,10 @@ err_irq_alloc_descs:
 
 	chip = chip_save;
 err_gpiochip_add:
+	chip = chip_save;
 	while (--i >= 0) {
-		chip--;
 		gpiochip_remove(&chip->gpio);
+		chip++;
 	}
 	kfree(chip_save);
 
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/gpu/drm/panel/panel-s6e8aa0.c linux-libre-3.18.123-gnu/drivers/gpu/drm/panel/panel-s6e8aa0.c
--- linux-libre-3.18.122-gnu/drivers/gpu/drm/panel/panel-s6e8aa0.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/gpu/drm/panel/panel-s6e8aa0.c	2018-09-26 02:33:59.000000000 -0400
@@ -835,7 +835,7 @@ static void s6e8aa0_read_mtp_id(struct s
 	int ret, i;
 
 	ret = s6e8aa0_dcs_read(ctx, 0xd1, id, ARRAY_SIZE(id));
-	if (ret < ARRAY_SIZE(id) || id[0] == 0x00) {
+	if (ret < 0 || ret < ARRAY_SIZE(id) || id[0] == 0x00) {
 		dev_err(ctx->dev, "read id failed\n");
 		ctx->error = -EIO;
 		return;
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/i2c/busses/i2c-xiic.c linux-libre-3.18.123-gnu/drivers/i2c/busses/i2c-xiic.c
--- linux-libre-3.18.122-gnu/drivers/i2c/busses/i2c-xiic.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/i2c/busses/i2c-xiic.c	2018-09-26 02:33:59.000000000 -0400
@@ -500,6 +500,7 @@ static void xiic_start_recv(struct xiic_
 {
 	u8 rx_watermark;
 	struct i2c_msg *msg = i2c->rx_msg = i2c->tx_msg;
+	unsigned long flags;
 
 	/* Clear and enable Rx full interrupt. */
 	xiic_irq_clr_en(i2c, XIIC_INTR_RX_FULL_MASK | XIIC_INTR_TX_ERROR_MASK);
@@ -515,6 +516,7 @@ static void xiic_start_recv(struct xiic_
 		rx_watermark = IIC_RX_FIFO_DEPTH;
 	xiic_setreg8(i2c, XIIC_RFD_REG_OFFSET, rx_watermark - 1);
 
+	local_irq_save(flags);
 	if (!(msg->flags & I2C_M_NOSTART))
 		/* write the address */
 		xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET,
@@ -525,6 +527,8 @@ static void xiic_start_recv(struct xiic_
 
 	xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET,
 		msg->len | ((i2c->nmsgs == 1) ? XIIC_TX_DYN_STOP_MASK : 0));
+	local_irq_restore(flags);
+
 	if (i2c->nmsgs == 1)
 		/* very last, enable bus not busy as well */
 		xiic_irq_clr_en(i2c, XIIC_INTR_BNB_MASK);
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/infiniband/core/cma.c linux-libre-3.18.123-gnu/drivers/infiniband/core/cma.c
--- linux-libre-3.18.122-gnu/drivers/infiniband/core/cma.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/infiniband/core/cma.c	2018-09-26 02:33:59.000000000 -0400
@@ -434,6 +434,7 @@ static int cma_resolve_ib_dev(struct rdm
 	dgid = (union ib_gid *) &addr->sib_addr;
 	pkey = ntohs(addr->sib_pkey);
 
+	mutex_lock(&lock);
 	list_for_each_entry(cur_dev, &dev_list, list) {
 		if (rdma_node_get_transport(cur_dev->device->node_type) != RDMA_TRANSPORT_IB)
 			continue;
@@ -455,18 +456,19 @@ static int cma_resolve_ib_dev(struct rdm
 					cma_dev = cur_dev;
 					sgid = gid;
 					id_priv->id.port_num = p;
+					goto found;
 				}
 			}
 		}
 	}
-
-	if (!cma_dev)
-		return -ENODEV;
+	mutex_unlock(&lock);
+	return -ENODEV;
 
 found:
 	cma_attach_to_dev(id_priv, cma_dev);
-	addr = (struct sockaddr_ib *) cma_src_addr(id_priv);
-	memcpy(&addr->sib_addr, &sgid, sizeof sgid);
+	mutex_unlock(&lock);
+	addr = (struct sockaddr_ib *)cma_src_addr(id_priv);
+	memcpy(&addr->sib_addr, &sgid, sizeof(sgid));
 	cma_translate_ib(addr, &id_priv->id.route.addr.dev_addr);
 	return 0;
 }
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/infiniband/ulp/ipoib/ipoib_cm.c linux-libre-3.18.123-gnu/drivers/infiniband/ulp/ipoib/ipoib_cm.c
--- linux-libre-3.18.122-gnu/drivers/infiniband/ulp/ipoib/ipoib_cm.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/infiniband/ulp/ipoib/ipoib_cm.c	2018-09-26 02:33:59.000000000 -0400
@@ -997,12 +997,14 @@ static int ipoib_cm_rep_handler(struct i
 
 	skb_queue_head_init(&skqueue);
 
+	netif_tx_lock_bh(p->dev);
 	spin_lock_irq(&priv->lock);
 	set_bit(IPOIB_FLAG_OPER_UP, &p->flags);
 	if (p->neigh)
 		while ((skb = __skb_dequeue(&p->neigh->queue)))
 			__skb_queue_tail(&skqueue, skb);
 	spin_unlock_irq(&priv->lock);
+	netif_tx_unlock_bh(p->dev);
 
 	while ((skb = __skb_dequeue(&skqueue))) {
 		skb->dev = p->dev;
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/macintosh/via-pmu.c linux-libre-3.18.123-gnu/drivers/macintosh/via-pmu.c
--- linux-libre-3.18.122-gnu/drivers/macintosh/via-pmu.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/macintosh/via-pmu.c	2018-09-26 02:33:59.000000000 -0400
@@ -527,8 +527,9 @@ init_pmu(void)
 	int timeout;
 	struct adb_request req;
 
-	out_8(&via[B], via[B] | TREQ);			/* negate TREQ */
-	out_8(&via[DIRB], (via[DIRB] | TREQ) & ~TACK);	/* TACK in, TREQ out */
+	/* Negate TREQ. Set TACK to input and TREQ to output. */
+	out_8(&via[B], in_8(&via[B]) | TREQ);
+	out_8(&via[DIRB], (in_8(&via[DIRB]) | TREQ) & ~TACK);
 
 	pmu_request(&req, NULL, 2, PMU_SET_INTR_MASK, pmu_intr_mask);
 	timeout =  100000;
@@ -1450,8 +1451,8 @@ pmu_sr_intr(void)
 	struct adb_request *req;
 	int bite = 0;
 
-	if (via[B] & TREQ) {
-		printk(KERN_ERR "PMU: spurious SR intr (%x)\n", via[B]);
+	if (in_8(&via[B]) & TREQ) {
+		printk(KERN_ERR "PMU: spurious SR intr (%x)\n", in_8(&via[B]));
 		out_8(&via[IFR], SR_INT);
 		return NULL;
 	}
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/md/dm-kcopyd.c linux-libre-3.18.123-gnu/drivers/md/dm-kcopyd.c
--- linux-libre-3.18.122-gnu/drivers/md/dm-kcopyd.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/md/dm-kcopyd.c	2018-09-26 02:33:59.000000000 -0400
@@ -454,6 +454,8 @@ static int run_complete_job(struct kcopy
 	if (atomic_dec_and_test(&kc->nr_jobs))
 		wake_up(&kc->destroyq);
 
+	cond_resched();
+
 	return 0;
 }
 
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/md/raid5.c linux-libre-3.18.123-gnu/drivers/md/raid5.c
--- linux-libre-3.18.122-gnu/drivers/md/raid5.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/md/raid5.c	2018-09-26 02:33:59.000000000 -0400
@@ -3703,6 +3703,12 @@ static void analyse_stripe(struct stripe
 			s->failed++;
 			if (rdev && !test_bit(Faulty, &rdev->flags))
 				do_recovery = 1;
+			else if (!rdev) {
+				rdev = rcu_dereference(
+				    conf->disks[i].replacement);
+				if (rdev && !test_bit(Faulty, &rdev->flags))
+					do_recovery = 1;
+			}
 		}
 	}
 	if (test_bit(STRIPE_SYNCING, &sh->state)) {
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/mfd/sm501.c linux-libre-3.18.123-gnu/drivers/mfd/sm501.c
--- linux-libre-3.18.122-gnu/drivers/mfd/sm501.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/mfd/sm501.c	2018-09-26 02:33:59.000000000 -0400
@@ -714,6 +714,7 @@ sm501_create_subdev(struct sm501_devdata
 	smdev->pdev.name = name;
 	smdev->pdev.id = sm->pdev_id;
 	smdev->pdev.dev.parent = sm->dev;
+	smdev->pdev.dev.coherent_dma_mask = 0xffffffff;
 
 	if (res_count) {
 		smdev->pdev.resource = (struct resource *)(smdev+1);
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/mfd/ti_am335x_tscadc.c linux-libre-3.18.123-gnu/drivers/mfd/ti_am335x_tscadc.c
--- linux-libre-3.18.122-gnu/drivers/mfd/ti_am335x_tscadc.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/mfd/ti_am335x_tscadc.c	2018-09-26 02:33:59.000000000 -0400
@@ -227,14 +227,13 @@ static	int ti_tscadc_probe(struct platfo
 	 * The TSC_ADC_SS controller design assumes the OCP clock is
 	 * at least 6x faster than the ADC clock.
 	 */
-	clk = clk_get(&pdev->dev, "adc_tsc_fck");
+	clk = devm_clk_get(&pdev->dev, "adc_tsc_fck");
 	if (IS_ERR(clk)) {
 		dev_err(&pdev->dev, "failed to get TSC fck\n");
 		err = PTR_ERR(clk);
 		goto err_disable_clk;
 	}
 	clock_rate = clk_get_rate(clk);
-	clk_put(clk);
 	tscadc->clk_div = clock_rate / ADC_CLK;
 
 	/* TSCADC_CLKDIV needs to be configured to the value minus 1 */
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/mtd/maps/solutionengine.c linux-libre-3.18.123-gnu/drivers/mtd/maps/solutionengine.c
--- linux-libre-3.18.122-gnu/drivers/mtd/maps/solutionengine.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/mtd/maps/solutionengine.c	2018-09-26 02:33:59.000000000 -0400
@@ -59,9 +59,9 @@ static int __init init_soleng_maps(void)
 			return -ENXIO;
 		}
 	}
-	printk(KERN_NOTICE "Solution Engine: Flash at 0x%08lx, EPROM at 0x%08lx\n",
-	       soleng_flash_map.phys & 0x1fffffff,
-	       soleng_eprom_map.phys & 0x1fffffff);
+	printk(KERN_NOTICE "Solution Engine: Flash at 0x%pap, EPROM at 0x%pap\n",
+	       &soleng_flash_map.phys,
+	       &soleng_eprom_map.phys);
 	flash_mtd->owner = THIS_MODULE;
 
 	eprom_mtd = do_map_probe("map_rom", &soleng_eprom_map);
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/mtd/mtdchar.c linux-libre-3.18.123-gnu/drivers/mtd/mtdchar.c
--- linux-libre-3.18.122-gnu/drivers/mtd/mtdchar.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/mtd/mtdchar.c	2018-09-26 02:33:59.000000000 -0400
@@ -190,8 +190,12 @@ static ssize_t mtdchar_read(struct file
 
 	pr_debug("MTD_read\n");
 
-	if (*ppos + count > mtd->size)
-		count = mtd->size - *ppos;
+	if (*ppos + count > mtd->size) {
+		if (*ppos < mtd->size)
+			count = mtd->size - *ppos;
+		else
+			count = 0;
+	}
 
 	if (!count)
 		return 0;
@@ -276,7 +280,7 @@ static ssize_t mtdchar_write(struct file
 
 	pr_debug("MTD_write\n");
 
-	if (*ppos == mtd->size)
+	if (*ppos >= mtd->size)
 		return -ENOSPC;
 
 	if (*ppos + count > mtd->size)
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/net/ethernet/cisco/enic/enic_main.c linux-libre-3.18.123-gnu/drivers/net/ethernet/cisco/enic/enic_main.c
--- linux-libre-3.18.122-gnu/drivers/net/ethernet/cisco/enic/enic_main.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/net/ethernet/cisco/enic/enic_main.c	2018-09-26 02:33:59.000000000 -0400
@@ -2496,7 +2496,6 @@ static int enic_probe(struct pci_dev *pd
 	 */
 
 	enic->port_mtu = enic->config.mtu;
-	(void)enic_change_mtu(netdev, enic->port_mtu);
 
 	err = enic_set_mac_addr(netdev, enic->mac_addr);
 	if (err) {
@@ -2545,6 +2544,7 @@ static int enic_probe(struct pci_dev *pd
 		netdev->features |= NETIF_F_HIGHDMA;
 
 	netdev->priv_flags |= IFF_UNICAST_FLT;
+	netdev->mtu = enic->port_mtu;
 
 	err = register_netdev(netdev);
 	if (err) {
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/net/ethernet/marvell/mvneta.c linux-libre-3.18.123-gnu/drivers/net/ethernet/marvell/mvneta.c
--- linux-libre-3.18.122-gnu/drivers/net/ethernet/marvell/mvneta.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/net/ethernet/marvell/mvneta.c	2018-09-26 02:33:59.000000000 -0400
@@ -2477,7 +2477,6 @@ static int mvneta_change_mtu(struct net_
 	}
 
 	mvneta_start_dev(pp);
-	mvneta_port_up(pp);
 
 	netdev_update_features(dev);
 
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/net/wireless/ath/ath10k/mac.c linux-libre-3.18.123-gnu/drivers/net/wireless/ath/ath10k/mac.c
--- linux-libre-3.18.122-gnu/drivers/net/wireless/ath/ath10k/mac.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/net/wireless/ath/ath10k/mac.c	2018-09-26 02:33:59.000000000 -0400
@@ -1728,6 +1728,13 @@ static int ath10k_update_channel_list(st
 			passive = channel->flags & IEEE80211_CHAN_NO_IR;
 			ch->passive = passive;
 
+			/* the firmware is ignoring the "radar" flag of the
+			 * channel and is scanning actively using Probe Requests
+			 * on "Radar detection"/DFS channels which are not
+			 * marked as "available"
+			 */
+			ch->passive |= ch->chan_radar;
+
 			ch->freq = channel->center_freq;
 			ch->min_power = 0;
 			ch->max_power = channel->max_power * 2;
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/net/xen-netfront.c linux-libre-3.18.123-gnu/drivers/net/xen-netfront.c
--- linux-libre-3.18.122-gnu/drivers/net/xen-netfront.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/net/xen-netfront.c	2018-09-26 02:33:59.000000000 -0400
@@ -85,8 +85,7 @@ struct netfront_cb {
 /* IRQ name is queue name with "-tx" or "-rx" appended */
 #define IRQ_NAME_SIZE (QUEUE_NAME_SIZE + 3)
 
-static DECLARE_WAIT_QUEUE_HEAD(module_load_q);
-static DECLARE_WAIT_QUEUE_HEAD(module_unload_q);
+static DECLARE_WAIT_QUEUE_HEAD(module_wq);
 
 struct netfront_stats {
 	u64			rx_packets;
@@ -1360,11 +1359,11 @@ static struct net_device *xennet_create_
 	netif_carrier_off(netdev);
 
 	xenbus_switch_state(dev, XenbusStateInitialising);
-	wait_event(module_load_q,
-			   xenbus_read_driver_state(dev->otherend) !=
-			   XenbusStateClosed &&
-			   xenbus_read_driver_state(dev->otherend) !=
-			   XenbusStateUnknown);
+	wait_event(module_wq,
+		   xenbus_read_driver_state(dev->otherend) !=
+		   XenbusStateClosed &&
+		   xenbus_read_driver_state(dev->otherend) !=
+		   XenbusStateUnknown);
 	return netdev;
 
  exit:
@@ -2068,15 +2067,14 @@ static void netback_changed(struct xenbu
 
 	dev_dbg(&dev->dev, "%s\n", xenbus_strstate(backend_state));
 
+	wake_up_all(&module_wq);
+
 	switch (backend_state) {
 	case XenbusStateInitialising:
 	case XenbusStateInitialised:
 	case XenbusStateReconfiguring:
 	case XenbusStateReconfigured:
-		break;
-
 	case XenbusStateUnknown:
-		wake_up_all(&module_unload_q);
 		break;
 
 	case XenbusStateInitWait:
@@ -2092,12 +2090,10 @@ static void netback_changed(struct xenbu
 		break;
 
 	case XenbusStateClosed:
-		wake_up_all(&module_unload_q);
 		if (dev->state == XenbusStateClosed)
 			break;
 		/* Missed the backend's CLOSING state -- fallthrough */
 	case XenbusStateClosing:
-		wake_up_all(&module_unload_q);
 		xenbus_frontend_closed(dev);
 		break;
 	}
@@ -2321,14 +2317,14 @@ static int xennet_remove(struct xenbus_d
 
 	if (xenbus_read_driver_state(dev->otherend) != XenbusStateClosed) {
 		xenbus_switch_state(dev, XenbusStateClosing);
-		wait_event(module_unload_q,
+		wait_event(module_wq,
 			   xenbus_read_driver_state(dev->otherend) ==
 			   XenbusStateClosing ||
 			   xenbus_read_driver_state(dev->otherend) ==
 			   XenbusStateUnknown);
 
 		xenbus_switch_state(dev, XenbusStateClosed);
-		wait_event(module_unload_q,
+		wait_event(module_wq,
 			   xenbus_read_driver_state(dev->otherend) ==
 			   XenbusStateClosed ||
 			   xenbus_read_driver_state(dev->otherend) ==
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/parport/parport_sunbpp.c linux-libre-3.18.123-gnu/drivers/parport/parport_sunbpp.c
--- linux-libre-3.18.122-gnu/drivers/parport/parport_sunbpp.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/parport/parport_sunbpp.c	2018-09-26 02:33:59.000000000 -0400
@@ -286,12 +286,16 @@ static int bpp_probe(struct platform_dev
 
 	ops = kmemdup(&parport_sunbpp_ops, sizeof(struct parport_operations),
 		      GFP_KERNEL);
-        if (!ops)
+	if (!ops) {
+		err = -ENOMEM;
 		goto out_unmap;
+	}
 
 	dprintk(("register_port\n"));
-	if (!(p = parport_register_port((unsigned long)base, irq, dma, ops)))
+	if (!(p = parport_register_port((unsigned long)base, irq, dma, ops))) {
+		err = -ENOMEM;
 		goto out_free_ops;
+	}
 
 	p->size = size;
 	p->dev = &op->dev;
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/pci/host/pci-mvebu.c linux-libre-3.18.123-gnu/drivers/pci/host/pci-mvebu.c
--- linux-libre-3.18.122-gnu/drivers/pci/host/pci-mvebu.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/pci/host/pci-mvebu.c	2018-09-26 02:33:59.000000000 -0400
@@ -940,7 +940,7 @@ static int mvebu_pcie_probe(struct platf
 		pcie->realio.start = PCIBIOS_MIN_IO;
 		pcie->realio.end = min_t(resource_size_t,
 					 IO_SPACE_LIMIT,
-					 resource_size(&pcie->io));
+					 resource_size(&pcie->io) - 1);
 	} else
 		pcie->realio = pcie->io;
 
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/platform/x86/asus-nb-wmi.c linux-libre-3.18.123-gnu/drivers/platform/x86/asus-nb-wmi.c
--- linux-libre-3.18.122-gnu/drivers/platform/x86/asus-nb-wmi.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/platform/x86/asus-nb-wmi.c	2018-09-26 02:33:59.000000000 -0400
@@ -365,6 +365,7 @@ static const struct key_entry asus_nb_wm
 	{ KE_KEY, 0xC4, { KEY_KBDILLUMUP } },
 	{ KE_KEY, 0xC5, { KEY_KBDILLUMDOWN } },
 	{ KE_IGNORE, 0xC6, },  /* Ambient Light Sensor notification */
+	{ KE_KEY, 0xFA, { KEY_PROG2 } },           /* Lid flip action */
 	{ KE_END, 0},
 };
 
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/platform/x86/toshiba_acpi.c linux-libre-3.18.123-gnu/drivers/platform/x86/toshiba_acpi.c
--- linux-libre-3.18.122-gnu/drivers/platform/x86/toshiba_acpi.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/platform/x86/toshiba_acpi.c	2018-09-26 02:33:59.000000000 -0400
@@ -41,6 +41,7 @@
 #define TOSHIBA_ACPI_VERSION	"0.20"
 #define PROC_INTERFACE_VERSION	1
 
+#include <linux/compiler.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
@@ -1233,7 +1234,7 @@ static const struct file_operations keys
 	.write		= keys_proc_write,
 };
 
-static int version_proc_show(struct seq_file *m, void *v)
+static int __maybe_unused version_proc_show(struct seq_file *m, void *v)
 {
 	seq_printf(m, "driver:                  %s\n", TOSHIBA_ACPI_VERSION);
 	seq_printf(m, "proc_interface:          %d\n", PROC_INTERFACE_VERSION);
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/rtc/rtc-bq4802.c linux-libre-3.18.123-gnu/drivers/rtc/rtc-bq4802.c
--- linux-libre-3.18.122-gnu/drivers/rtc/rtc-bq4802.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/rtc/rtc-bq4802.c	2018-09-26 02:33:59.000000000 -0400
@@ -164,6 +164,10 @@ static int bq4802_probe(struct platform_
 	} else if (p->r->flags & IORESOURCE_MEM) {
 		p->regs = devm_ioremap(&pdev->dev, p->r->start,
 					resource_size(p->r));
+		if (!p->regs){
+			err = -ENOMEM;
+			goto out;
+		}
 		p->read = bq4802_read_mem;
 		p->write = bq4802_write_mem;
 	} else {
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/s390/block/dasd_eckd.c linux-libre-3.18.123-gnu/drivers/s390/block/dasd_eckd.c
--- linux-libre-3.18.122-gnu/drivers/s390/block/dasd_eckd.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/s390/block/dasd_eckd.c	2018-09-26 02:33:59.000000000 -0400
@@ -2066,8 +2066,11 @@ static int dasd_eckd_basic_to_ready(stru
 
 static int dasd_eckd_online_to_ready(struct dasd_device *device)
 {
-	cancel_work_sync(&device->reload_device);
-	cancel_work_sync(&device->kick_validate);
+	if (cancel_work_sync(&device->reload_device))
+		dasd_put_device(device);
+	if (cancel_work_sync(&device->kick_validate))
+		dasd_put_device(device);
+
 	return 0;
 };
 
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/s390/net/qeth_core_main.c linux-libre-3.18.123-gnu/drivers/s390/net/qeth_core_main.c
--- linux-libre-3.18.122-gnu/drivers/s390/net/qeth_core_main.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/s390/net/qeth_core_main.c	2018-09-26 02:33:59.000000000 -0400
@@ -3489,13 +3489,14 @@ static void qeth_flush_buffers(struct qe
 	qdio_flags = QDIO_FLAG_SYNC_OUTPUT;
 	if (atomic_read(&queue->set_pci_flags_count))
 		qdio_flags |= QDIO_FLAG_PCI_OUT;
+	atomic_add(count, &queue->used_buffers);
+
 	rc = do_QDIO(CARD_DDEV(queue->card), qdio_flags,
 		     queue->queue_no, index, count);
 	if (queue->card->options.performance_stats)
 		queue->card->perf_stats.outbound_do_qdio_time +=
 			qeth_get_micros() -
 			queue->card->perf_stats.outbound_do_qdio_start_time;
-	atomic_add(count, &queue->used_buffers);
 	if (rc) {
 		queue->card->stats.tx_errors += count;
 		/* ignore temporary SIGA errors without busy condition */
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/s390/net/qeth_core_sys.c linux-libre-3.18.123-gnu/drivers/s390/net/qeth_core_sys.c
--- linux-libre-3.18.122-gnu/drivers/s390/net/qeth_core_sys.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/s390/net/qeth_core_sys.c	2018-09-26 02:33:59.000000000 -0400
@@ -456,6 +456,7 @@ static ssize_t qeth_dev_layer2_store(str
 	if (card->discipline) {
 		card->discipline->remove(card->gdev);
 		qeth_core_free_discipline(card);
+		card->options.layer2 = -1;
 	}
 
 	rc = qeth_core_load_discipline(card, newdis);
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/scsi/3w-9xxx.c linux-libre-3.18.123-gnu/drivers/scsi/3w-9xxx.c
--- linux-libre-3.18.122-gnu/drivers/scsi/3w-9xxx.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/scsi/3w-9xxx.c	2018-09-26 02:33:59.000000000 -0400
@@ -2057,6 +2057,7 @@ static int twa_probe(struct pci_dev *pde
 
 	if (twa_initialize_device_extension(tw_dev)) {
 		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x25, "Failed to initialize device extension");
+		retval = -ENOMEM;
 		goto out_free_device_extension;
 	}
 
@@ -2079,6 +2080,7 @@ static int twa_probe(struct pci_dev *pde
 	tw_dev->base_addr = ioremap(mem_addr, mem_len);
 	if (!tw_dev->base_addr) {
 		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x35, "Failed to ioremap");
+		retval = -ENOMEM;
 		goto out_release_mem_region;
 	}
 
@@ -2086,8 +2088,10 @@ static int twa_probe(struct pci_dev *pde
 	TW_DISABLE_INTERRUPTS(tw_dev);
 
 	/* Initialize the card */
-	if (twa_reset_sequence(tw_dev, 0))
+	if (twa_reset_sequence(tw_dev, 0)) {
+		retval = -ENOMEM;
 		goto out_iounmap;
+	}
 
 	/* Set host specific parameters */
 	if ((pdev->device == PCI_DEVICE_ID_3WARE_9650SE) ||
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/scsi/3w-sas.c linux-libre-3.18.123-gnu/drivers/scsi/3w-sas.c
--- linux-libre-3.18.122-gnu/drivers/scsi/3w-sas.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/scsi/3w-sas.c	2018-09-26 02:33:59.000000000 -0400
@@ -1613,6 +1613,7 @@ static int twl_probe(struct pci_dev *pde
 
 	if (twl_initialize_device_extension(tw_dev)) {
 		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1a, "Failed to initialize device extension");
+		retval = -ENOMEM;
 		goto out_free_device_extension;
 	}
 
@@ -1627,6 +1628,7 @@ static int twl_probe(struct pci_dev *pde
 	tw_dev->base_addr = pci_iomap(pdev, 1, 0);
 	if (!tw_dev->base_addr) {
 		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1c, "Failed to ioremap");
+		retval = -ENOMEM;
 		goto out_release_mem_region;
 	}
 
@@ -1636,6 +1638,7 @@ static int twl_probe(struct pci_dev *pde
 	/* Initialize the card */
 	if (twl_reset_sequence(tw_dev, 0)) {
 		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1d, "Controller reset failed during probe");
+		retval = -ENOMEM;
 		goto out_iounmap;
 	}
 
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/scsi/3w-xxxx.c linux-libre-3.18.123-gnu/drivers/scsi/3w-xxxx.c
--- linux-libre-3.18.122-gnu/drivers/scsi/3w-xxxx.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/scsi/3w-xxxx.c	2018-09-26 02:33:59.000000000 -0400
@@ -2291,6 +2291,7 @@ static int tw_probe(struct pci_dev *pdev
 
 	if (tw_initialize_device_extension(tw_dev)) {
 		printk(KERN_WARNING "3w-xxxx: Failed to initialize device extension.");
+		retval = -ENOMEM;
 		goto out_free_device_extension;
 	}
 
@@ -2305,6 +2306,7 @@ static int tw_probe(struct pci_dev *pdev
 	tw_dev->base_addr = pci_resource_start(pdev, 0);
 	if (!tw_dev->base_addr) {
 		printk(KERN_WARNING "3w-xxxx: Failed to get io address.");
+		retval = -ENOMEM;
 		goto out_release_mem_region;
 	}
 
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/scsi/aic94xx/aic94xx_init.c linux-libre-3.18.123-gnu/drivers/scsi/aic94xx/aic94xx_init.c
--- linux-libre-3.18.122-gnu/drivers/scsi/aic94xx/aic94xx_init.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/scsi/aic94xx/aic94xx_init.c	2018-09-26 02:33:59.000000000 -0400
@@ -1047,8 +1047,10 @@ static int __init aic94xx_init(void)
 
 	aic94xx_transport_template =
 		sas_domain_attach_transport(&aic94xx_transport_functions);
-	if (!aic94xx_transport_template)
+	if (!aic94xx_transport_template) {
+		err = -ENOMEM;
 		goto out_destroy_caches;
+	}
 
 	err = pci_register_driver(&aic94xx_pci_driver);
 	if (err)
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/staging/comedi/drivers/ni_mio_common.c linux-libre-3.18.123-gnu/drivers/staging/comedi/drivers/ni_mio_common.c
--- linux-libre-3.18.122-gnu/drivers/staging/comedi/drivers/ni_mio_common.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/staging/comedi/drivers/ni_mio_common.c	2018-09-26 02:33:59.000000000 -0400
@@ -5601,11 +5601,11 @@ static int ni_E_init(struct comedi_devic
 	/* Digital I/O (PFI) subdevice */
 	s = &dev->subdevices[NI_PFI_DIO_SUBDEV];
 	s->type		= COMEDI_SUBD_DIO;
-	s->subdev_flags	= SDF_READABLE | SDF_WRITABLE | SDF_INTERNAL;
 	s->maxdata	= 1;
 	if (devpriv->is_m_series) {
 		s->n_chan	= 16;
 		s->insn_bits	= ni_pfi_insn_bits;
+		s->subdev_flags	= SDF_READABLE | SDF_WRITABLE | SDF_INTERNAL;
 
 		ni_writew(dev, s->state, M_Offset_PFI_DO);
 		for (i = 0; i < NUM_PFI_OUTPUT_SELECT_REGS; ++i) {
@@ -5614,6 +5614,7 @@ static int ni_E_init(struct comedi_devic
 		}
 	} else {
 		s->n_chan	= 10;
+		s->subdev_flags	= SDF_INTERNAL;
 	}
 	s->insn_config	= ni_pfi_insn_config;
 
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/staging/rts5208/rtsx_scsi.c linux-libre-3.18.123-gnu/drivers/staging/rts5208/rtsx_scsi.c
--- linux-libre-3.18.122-gnu/drivers/staging/rts5208/rtsx_scsi.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/staging/rts5208/rtsx_scsi.c	2018-09-26 02:33:59.000000000 -0400
@@ -539,7 +539,7 @@ static int inquiry(struct scsi_cmnd *srb
 
 	if (sendbytes > 8) {
 		memcpy(buf, inquiry_buf, 8);
-		memcpy(buf + 8, inquiry_string,	sendbytes - 8);
+		strncpy(buf + 8, inquiry_string, sendbytes - 8);
 		if (pro_formatter_flag) {
 			/* Additional Length */
 			buf[4] = 0x33;
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/staging/rts5208/xd.c linux-libre-3.18.123-gnu/drivers/staging/rts5208/xd.c
--- linux-libre-3.18.122-gnu/drivers/staging/rts5208/xd.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/staging/rts5208/xd.c	2018-09-26 02:33:59.000000000 -0400
@@ -1095,7 +1095,7 @@ static int xd_copy_page(struct rtsx_chip
 			reg = 0;
 			rtsx_read_register(chip, XD_CTL, &reg);
 			if (reg & (XD_ECC1_ERROR | XD_ECC2_ERROR)) {
-				wait_timeout(100);
+				mdelay(100);
 
 				if (detect_card_cd(chip,
 					XD_CARD) != STATUS_SUCCESS) {
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/target/target_core_transport.c linux-libre-3.18.123-gnu/drivers/target/target_core_transport.c
--- linux-libre-3.18.122-gnu/drivers/target/target_core_transport.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/target/target_core_transport.c	2018-09-26 02:33:59.000000000 -0400
@@ -323,6 +323,7 @@ void __transport_register_session(
 	void *fabric_sess_ptr)
 {
 	unsigned char buf[PR_REG_ISID_LEN];
+	unsigned long flags;
 
 	se_sess->se_tpg = se_tpg;
 	se_sess->fabric_sess_ptr = fabric_sess_ptr;
@@ -345,7 +346,7 @@ void __transport_register_session(
 		}
 		kref_get(&se_nacl->acl_kref);
 
-		spin_lock_irq(&se_nacl->nacl_sess_lock);
+		spin_lock_irqsave(&se_nacl->nacl_sess_lock, flags);
 		/*
 		 * The se_nacl->nacl_sess pointer will be set to the
 		 * last active I_T Nexus for each struct se_node_acl.
@@ -354,7 +355,7 @@ void __transport_register_session(
 
 		list_add_tail(&se_sess->sess_acl_list,
 			      &se_nacl->acl_sess_list);
-		spin_unlock_irq(&se_nacl->nacl_sess_lock);
+		spin_unlock_irqrestore(&se_nacl->nacl_sess_lock, flags);
 	}
 	list_add_tail(&se_sess->sess_list, &se_tpg->tpg_sess_list);
 
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/tty/rocket.c linux-libre-3.18.123-gnu/drivers/tty/rocket.c
--- linux-libre-3.18.122-gnu/drivers/tty/rocket.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/tty/rocket.c	2018-09-26 02:33:59.000000000 -0400
@@ -1928,7 +1928,7 @@ static __init int register_PCI(int i, st
 	ByteIO_t UPCIRingInd = 0;
 
 	if (!dev || !pci_match_id(rocket_pci_ids, dev) ||
-	    pci_enable_device(dev))
+	    pci_enable_device(dev) || i >= NUM_BOARDS)
 		return 0;
 
 	rcktpt_io_addr[i] = pci_resource_start(dev, 0);
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/uio/uio.c linux-libre-3.18.123-gnu/drivers/uio/uio.c
--- linux-libre-3.18.122-gnu/drivers/uio/uio.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/uio/uio.c	2018-09-26 02:33:59.000000000 -0400
@@ -832,8 +832,6 @@ int __uio_register_device(struct module
 	if (ret)
 		goto err_uio_dev_add_attributes;
 
-	info->uio_dev = idev;
-
 	if (info->irq && (info->irq != UIO_IRQ_CUSTOM)) {
 		ret = devm_request_irq(idev->dev, info->irq, uio_interrupt,
 				  info->irq_flags, info->name, idev);
@@ -841,6 +839,7 @@ int __uio_register_device(struct module
 			goto err_request_irq;
 	}
 
+	info->uio_dev = idev;
 	return 0;
 
 err_request_irq:
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/usb/class/cdc-wdm.c linux-libre-3.18.123-gnu/drivers/usb/class/cdc-wdm.c
--- linux-libre-3.18.122-gnu/drivers/usb/class/cdc-wdm.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/usb/class/cdc-wdm.c	2018-09-26 02:33:59.000000000 -0400
@@ -452,7 +452,7 @@ static int clear_wdm_read_flag(struct wd
 
 	set_bit(WDM_RESPONDING, &desc->flags);
 	spin_unlock_irq(&desc->iuspin);
-	rv = usb_submit_urb(desc->response, GFP_KERNEL);
+	rv = usb_submit_urb(desc->response, GFP_ATOMIC);
 	spin_lock_irq(&desc->iuspin);
 	if (rv) {
 		dev_err(&desc->intf->dev,
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/usb/core/hcd-pci.c linux-libre-3.18.123-gnu/drivers/usb/core/hcd-pci.c
--- linux-libre-3.18.122-gnu/drivers/usb/core/hcd-pci.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/usb/core/hcd-pci.c	2018-09-26 02:33:59.000000000 -0400
@@ -530,8 +530,6 @@ static int resume_common(struct device *
 				event == PM_EVENT_RESTORE);
 		if (retval) {
 			dev_err(dev, "PCI post-resume error %d!\n", retval);
-			if (hcd->shared_hcd)
-				usb_hc_died(hcd->shared_hcd);
 			usb_hc_died(hcd);
 		}
 	}
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/usb/core/message.c linux-libre-3.18.123-gnu/drivers/usb/core/message.c
--- linux-libre-3.18.122-gnu/drivers/usb/core/message.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/usb/core/message.c	2018-09-26 02:33:59.000000000 -0400
@@ -1282,6 +1282,11 @@ void usb_enable_interface(struct usb_dev
  * is submitted that needs that bandwidth.  Some other operating systems
  * allocate bandwidth early, when a configuration is chosen.
  *
+ * xHCI reserves bandwidth and configures the alternate setting in
+ * usb_hcd_alloc_bandwidth(). If it fails the original interface altsetting
+ * may be disabled. Drivers cannot rely on any particular alternate
+ * setting being in effect after a failure.
+ *
  * This call is synchronous, and may not be used in an interrupt context.
  * Also, drivers must not change altsettings while urbs are scheduled for
  * endpoints in that interface; all such urbs must first be completed
@@ -1317,6 +1322,12 @@ int usb_set_interface(struct usb_device
 			 alternate);
 		return -EINVAL;
 	}
+	/*
+	 * usb3 hosts configure the interface in usb_hcd_alloc_bandwidth,
+	 * including freeing dropped endpoint ring buffers.
+	 * Make sure the interface endpoints are flushed before that
+	 */
+	usb_disable_interface(dev, iface, false);
 
 	/* Make sure we have enough bandwidth for this alternate interface.
 	 * Remove the current alt setting and add the new alt setting.
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/usb/core/quirks.c linux-libre-3.18.123-gnu/drivers/usb/core/quirks.c
--- linux-libre-3.18.122-gnu/drivers/usb/core/quirks.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/usb/core/quirks.c	2018-09-26 02:33:59.000000000 -0400
@@ -249,6 +249,9 @@ static const struct usb_device_id usb_qu
 	{ USB_DEVICE(0x2040, 0x7200), .driver_info =
 			USB_QUIRK_CONFIG_INTF_STRINGS },
 
+	/* DJI CineSSD */
+	{ USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM },
+
 	/* INTEL VALUE SSD */
 	{ USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
 
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/usb/host/u132-hcd.c linux-libre-3.18.123-gnu/drivers/usb/host/u132-hcd.c
--- linux-libre-3.18.122-gnu/drivers/usb/host/u132-hcd.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/usb/host/u132-hcd.c	2018-09-26 02:33:59.000000000 -0400
@@ -2569,7 +2569,7 @@ static int u132_get_frame(struct usb_hcd
 	} else {
 		int frame = 0;
 		dev_err(&u132->platform_dev->dev, "TODO: u132_get_frame\n");
-		msleep(100);
+		mdelay(100);
 		return frame;
 	}
 }
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/usb/host/xhci.c linux-libre-3.18.123-gnu/drivers/usb/host/xhci.c
--- linux-libre-3.18.122-gnu/drivers/usb/host/xhci.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/usb/host/xhci.c	2018-09-26 02:33:59.000000000 -0400
@@ -3630,6 +3630,9 @@ void xhci_free_dev(struct usb_hcd *hcd,
 	}
 
 	spin_lock_irqsave(&xhci->lock, flags);
+
+	virt_dev->udev = NULL;
+
 	/* Don't disable the slot if the host controller is dead. */
 	state = readl(&xhci->op_regs->status);
 	if (state == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING) ||
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/usb/misc/uss720.c linux-libre-3.18.123-gnu/drivers/usb/misc/uss720.c
--- linux-libre-3.18.122-gnu/drivers/usb/misc/uss720.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/usb/misc/uss720.c	2018-09-26 02:33:59.000000000 -0400
@@ -392,7 +392,7 @@ static unsigned char parport_uss720_frob
 	mask &= 0x0f;
 	val &= 0x0f;
 	d = (priv->reg[1] & (~mask)) ^ val;
-	if (set_1284_register(pp, 2, d, GFP_KERNEL))
+	if (set_1284_register(pp, 2, d, GFP_ATOMIC))
 		return 0;
 	priv->reg[1] = d;
 	return d & 0xf;
@@ -402,7 +402,7 @@ static unsigned char parport_uss720_read
 {
 	unsigned char ret;
 
-	if (get_1284_register(pp, 1, &ret, GFP_KERNEL))
+	if (get_1284_register(pp, 1, &ret, GFP_ATOMIC))
 		return 0;
 	return ret & 0xf8;
 }
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/usb/misc/yurex.c linux-libre-3.18.123-gnu/drivers/usb/misc/yurex.c
--- linux-libre-3.18.122-gnu/drivers/usb/misc/yurex.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/usb/misc/yurex.c	2018-09-26 02:33:59.000000000 -0400
@@ -437,13 +437,13 @@ static ssize_t yurex_write(struct file *
 {
 	struct usb_yurex *dev;
 	int i, set = 0, retval = 0;
-	char buffer[16];
+	char buffer[16 + 1];
 	char *data = buffer;
 	unsigned long long c, c2 = 0;
 	signed long timeout = 0;
 	DEFINE_WAIT(wait);
 
-	count = min(sizeof(buffer), count);
+	count = min(sizeof(buffer) - 1, count);
 	dev = file->private_data;
 
 	/* verify that we actually have some data to write */
@@ -462,6 +462,7 @@ static ssize_t yurex_write(struct file *
 		retval = -EFAULT;
 		goto error;
 	}
+	buffer[count] = 0;
 	memset(dev->cntl_buffer, CMD_PADDING, YUREX_BUF_SIZE);
 
 	switch (buffer[0]) {
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/usb/serial/io_ti.h linux-libre-3.18.123-gnu/drivers/usb/serial/io_ti.h
--- linux-libre-3.18.122-gnu/drivers/usb/serial/io_ti.h	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/usb/serial/io_ti.h	2018-09-26 02:33:59.000000000 -0400
@@ -178,7 +178,7 @@ struct ump_interrupt {
 }  __attribute__((packed));
 
 
-#define TIUMP_GET_PORT_FROM_CODE(c)	(((c) >> 4) - 3)
+#define TIUMP_GET_PORT_FROM_CODE(c)	(((c) >> 6) & 0x01)
 #define TIUMP_GET_FUNC_FROM_CODE(c)	((c) & 0x0f)
 #define TIUMP_INTERRUPT_CODE_LSR	0x03
 #define TIUMP_INTERRUPT_CODE_MSR	0x04
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/usb/serial/ti_usb_3410_5052.h linux-libre-3.18.123-gnu/drivers/usb/serial/ti_usb_3410_5052.h
--- linux-libre-3.18.122-gnu/drivers/usb/serial/ti_usb_3410_5052.h	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/usb/serial/ti_usb_3410_5052.h	2018-09-26 02:33:59.000000000 -0400
@@ -223,7 +223,7 @@ struct ti_interrupt {
 } __attribute__((packed));
 
 /* Interrupt codes */
-#define TI_GET_PORT_FROM_CODE(c)	(((c) >> 4) - 3)
+#define TI_GET_PORT_FROM_CODE(c)	(((c) >> 6) & 0x01)
 #define TI_GET_FUNC_FROM_CODE(c)	((c) & 0x0f)
 #define TI_CODE_HARDWARE_ERROR		0xFF
 #define TI_CODE_DATA_ERROR		0x03
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/usb/storage/scsiglue.c linux-libre-3.18.123-gnu/drivers/usb/storage/scsiglue.c
--- linux-libre-3.18.122-gnu/drivers/usb/storage/scsiglue.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/usb/storage/scsiglue.c	2018-09-26 02:33:59.000000000 -0400
@@ -341,6 +341,15 @@ static int queuecommand_lck(struct scsi_
 		return 0;
 	}
 
+	if ((us->fflags & US_FL_NO_ATA_1X) &&
+			(srb->cmnd[0] == ATA_12 || srb->cmnd[0] == ATA_16)) {
+		memcpy(srb->sense_buffer, usb_stor_sense_invalidCDB,
+		       sizeof(usb_stor_sense_invalidCDB));
+		srb->result = SAM_STAT_CHECK_CONDITION;
+		done(srb);
+		return 0;
+	}
+
 	/* enqueue the command and wake up the control thread */
 	srb->scsi_done = done;
 	us->srb = srb;
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/usb/storage/unusual_devs.h linux-libre-3.18.123-gnu/drivers/usb/storage/unusual_devs.h
--- linux-libre-3.18.122-gnu/drivers/usb/storage/unusual_devs.h	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/usb/storage/unusual_devs.h	2018-09-26 02:33:59.000000000 -0400
@@ -2188,6 +2188,13 @@ UNUSUAL_DEV(  0x4146, 0xba01, 0x0100, 0x
 		"Micro Mini 1GB",
 		USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE ),
 
+/* Reported-by: Tim Anderson <tsa@biglakesoftware.com> */
+UNUSUAL_DEV(  0x2ca3, 0x0031, 0x0000, 0x9999,
+		"DJI",
+		"CineSSD",
+		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+		US_FL_NO_ATA_1X),
+
 /*
  * Nick Bowler <nbowler@elliptictech.com>
  * SCSI stack spams (otherwise harmless) error messages.
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/video/fbdev/core/modedb.c linux-libre-3.18.123-gnu/drivers/video/fbdev/core/modedb.c
--- linux-libre-3.18.122-gnu/drivers/video/fbdev/core/modedb.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/video/fbdev/core/modedb.c	2018-09-26 02:33:59.000000000 -0400
@@ -533,7 +533,7 @@ static int fb_try_mode(struct fb_var_scr
  *
  *     Valid mode specifiers for @mode_option:
  *
- *     <xres>x<yres>[M][R][-<bpp>][@<refresh>][i][m] or
+ *     <xres>x<yres>[M][R][-<bpp>][@<refresh>][i][p][m] or
  *     <name>[-<bpp>][@<refresh>]
  *
  *     with <xres>, <yres>, <bpp> and <refresh> decimal numbers and
@@ -542,10 +542,10 @@ static int fb_try_mode(struct fb_var_scr
  *      If 'M' is present after yres (and before refresh/bpp if present),
  *      the function will compute the timings using VESA(tm) Coordinated
  *      Video Timings (CVT).  If 'R' is present after 'M', will compute with
- *      reduced blanking (for flatpanels).  If 'i' is present, compute
- *      interlaced mode.  If 'm' is present, add margins equal to 1.8%
- *      of xres rounded down to 8 pixels, and 1.8% of yres. The char
- *      'i' and 'm' must be after 'M' and 'R'. Example:
+ *      reduced blanking (for flatpanels).  If 'i' or 'p' are present, compute
+ *      interlaced or progressive mode.  If 'm' is present, add margins equal
+ *      to 1.8% of xres rounded down to 8 pixels, and 1.8% of yres. The chars
+ *      'i', 'p' and 'm' must be after 'M' and 'R'. Example:
  *
  *      1024x768MR-8@60m - Reduced blank with margins at 60Hz.
  *
@@ -586,7 +586,8 @@ int fb_find_mode(struct fb_var_screeninf
 		unsigned int namelen = strlen(name);
 		int res_specified = 0, bpp_specified = 0, refresh_specified = 0;
 		unsigned int xres = 0, yres = 0, bpp = default_bpp, refresh = 0;
-		int yres_specified = 0, cvt = 0, rb = 0, interlace = 0;
+		int yres_specified = 0, cvt = 0, rb = 0;
+		int interlace_specified = 0, interlace = 0;
 		int margins = 0;
 		u32 best, diff, tdiff;
 
@@ -637,9 +638,17 @@ int fb_find_mode(struct fb_var_screeninf
 				if (!cvt)
 					margins = 1;
 				break;
+			case 'p':
+				if (!cvt) {
+					interlace = 0;
+					interlace_specified = 1;
+				}
+				break;
 			case 'i':
-				if (!cvt)
+				if (!cvt) {
 					interlace = 1;
+					interlace_specified = 1;
+				}
 				break;
 			default:
 				goto done;
@@ -708,11 +717,21 @@ done:
 			if ((name_matches(db[i], name, namelen) ||
 			     (res_specified && res_matches(db[i], xres, yres))) &&
 			    !fb_try_mode(var, info, &db[i], bpp)) {
-				if (refresh_specified && db[i].refresh == refresh)
-					return 1;
+				const int db_interlace = (db[i].vmode &
+					FB_VMODE_INTERLACED ? 1 : 0);
+				int score = abs(db[i].refresh - refresh);
 
-				if (abs(db[i].refresh - refresh) < diff) {
-					diff = abs(db[i].refresh - refresh);
+				if (interlace_specified)
+					score += abs(db_interlace - interlace);
+
+				if (!interlace_specified ||
+				    db_interlace == interlace)
+					if (refresh_specified &&
+					    db[i].refresh == refresh)
+						return 1;
+
+				if (score < diff) {
+					diff = score;
 					best = i;
 				}
 			}
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/video/fbdev/goldfishfb.c linux-libre-3.18.123-gnu/drivers/video/fbdev/goldfishfb.c
--- linux-libre-3.18.122-gnu/drivers/video/fbdev/goldfishfb.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/video/fbdev/goldfishfb.c	2018-09-26 02:33:59.000000000 -0400
@@ -301,6 +301,7 @@ static int goldfish_fb_remove(struct pla
 	dma_free_coherent(&pdev->dev, framesize, (void *)fb->fb.screen_base,
 						fb->fb.fix.smem_start);
 	iounmap(fb->reg_base);
+	kfree(fb);
 	return 0;
 }
 
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/video/fbdev/omap/omapfb_main.c linux-libre-3.18.123-gnu/drivers/video/fbdev/omap/omapfb_main.c
--- linux-libre-3.18.122-gnu/drivers/video/fbdev/omap/omapfb_main.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/video/fbdev/omap/omapfb_main.c	2018-09-26 02:33:59.000000000 -0400
@@ -982,7 +982,7 @@ int omapfb_register_client(struct omapfb
 {
 	int r;
 
-	if ((unsigned)omapfb_nb->plane_idx > OMAPFB_PLANE_NUM)
+	if ((unsigned)omapfb_nb->plane_idx >= OMAPFB_PLANE_NUM)
 		return -EINVAL;
 
 	if (!notifier_inited) {
diff -druNp --no-dereference linux-libre-3.18.122-gnu/drivers/video/fbdev/via/viafbdev.c linux-libre-3.18.123-gnu/drivers/video/fbdev/via/viafbdev.c
--- linux-libre-3.18.122-gnu/drivers/video/fbdev/via/viafbdev.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/drivers/video/fbdev/via/viafbdev.c	2018-09-26 02:33:59.000000000 -0400
@@ -19,6 +19,7 @@
  * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  */
 
+#include <linux/compiler.h>
 #include <linux/module.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
@@ -1468,7 +1469,7 @@ static const struct file_operations viaf
 
 #endif /* CONFIG_FB_VIA_DIRECT_PROCFS */
 
-static int viafb_sup_odev_proc_show(struct seq_file *m, void *v)
+static int __maybe_unused viafb_sup_odev_proc_show(struct seq_file *m, void *v)
 {
 	via_odev_to_seq(m, supported_odev_map[
 		viaparinfo->shared->chip_info.gfx_chip_name]);
diff -druNp --no-dereference linux-libre-3.18.122-gnu/fs/binfmt_elf.c linux-libre-3.18.123-gnu/fs/binfmt_elf.c
--- linux-libre-3.18.122-gnu/fs/binfmt_elf.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/fs/binfmt_elf.c	2018-09-26 02:33:59.000000000 -0400
@@ -1552,7 +1552,7 @@ static int fill_thread_core_info(struct
 		const struct user_regset *regset = &view->regsets[i];
 		do_thread_regset_writeback(t->task, regset);
 		if (regset->core_note_type && regset->get &&
-		    (!regset->active || regset->active(t->task, regset))) {
+		    (!regset->active || regset->active(t->task, regset) > 0)) {
 			int ret;
 			size_t size = regset->n * regset->size;
 			void *data = kmalloc(size, GFP_KERNEL);
diff -druNp --no-dereference linux-libre-3.18.122-gnu/fs/btrfs/dev-replace.c linux-libre-3.18.123-gnu/fs/btrfs/dev-replace.c
--- linux-libre-3.18.122-gnu/fs/btrfs/dev-replace.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/fs/btrfs/dev-replace.c	2018-09-26 02:33:59.000000000 -0400
@@ -584,6 +584,12 @@ static int btrfs_dev_replace_finishing(s
 	btrfs_rm_dev_replace_unblocked(fs_info);
 
 	/*
+	 * Increment dev_stats_ccnt so that btrfs_run_dev_stats() will
+	 * update on-disk dev stats value during commit transaction
+	 */
+	atomic_inc(&tgt_device->dev_stats_ccnt);
+
+	/*
 	 * this is again a consistent state where no dev_replace procedure
 	 * is running, the target device is part of the filesystem, the
 	 * source device is not part of the filesystem anymore and its 1st
diff -druNp --no-dereference linux-libre-3.18.122-gnu/fs/btrfs/extent-tree.c linux-libre-3.18.123-gnu/fs/btrfs/extent-tree.c
--- linux-libre-3.18.122-gnu/fs/btrfs/extent-tree.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/fs/btrfs/extent-tree.c	2018-09-26 02:33:59.000000000 -0400
@@ -9487,7 +9487,7 @@ void btrfs_delete_unused_bgs(struct btrf
 		/* Don't want to race with allocators so take the groups_sem */
 		down_write(&space_info->groups_sem);
 		spin_lock(&block_group->lock);
-		if (block_group->reserved ||
+		if (block_group->reserved || block_group->pinned ||
 		    btrfs_block_group_used(&block_group->item) ||
 		    block_group->ro) {
 			/*
diff -druNp --no-dereference linux-libre-3.18.122-gnu/fs/btrfs/relocation.c linux-libre-3.18.123-gnu/fs/btrfs/relocation.c
--- linux-libre-3.18.122-gnu/fs/btrfs/relocation.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/fs/btrfs/relocation.c	2018-09-26 02:33:59.000000000 -0400
@@ -1311,18 +1311,19 @@ static void __del_reloc_root(struct btrf
 	struct mapping_node *node = NULL;
 	struct reloc_control *rc = root->fs_info->reloc_ctl;
 
-	spin_lock(&rc->reloc_root_tree.lock);
-	rb_node = tree_search(&rc->reloc_root_tree.rb_root,
-			      root->node->start);
-	if (rb_node) {
-		node = rb_entry(rb_node, struct mapping_node, rb_node);
-		rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
+	if (rc) {
+		spin_lock(&rc->reloc_root_tree.lock);
+		rb_node = tree_search(&rc->reloc_root_tree.rb_root,
+				      root->node->start);
+		if (rb_node) {
+			node = rb_entry(rb_node, struct mapping_node, rb_node);
+			rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
+		}
+		spin_unlock(&rc->reloc_root_tree.lock);
+		if (!node)
+			return;
+		BUG_ON((struct btrfs_root *)node->data != root);
 	}
-	spin_unlock(&rc->reloc_root_tree.lock);
-
-	if (!node)
-		return;
-	BUG_ON((struct btrfs_root *)node->data != root);
 
 	spin_lock(&root->fs_info->trans_lock);
 	list_del_init(&root->root_list);
diff -druNp --no-dereference linux-libre-3.18.122-gnu/fs/cifs/cifs_debug.c linux-libre-3.18.123-gnu/fs/cifs/cifs_debug.c
--- linux-libre-3.18.122-gnu/fs/cifs/cifs_debug.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/fs/cifs/cifs_debug.c	2018-09-26 02:33:59.000000000 -0400
@@ -271,6 +271,10 @@ static ssize_t cifs_stats_proc_write(str
 		atomic_set(&totBufAllocCount, 0);
 		atomic_set(&totSmBufAllocCount, 0);
 #endif /* CONFIG_CIFS_STATS2 */
+		spin_lock(&GlobalMid_Lock);
+		GlobalMaxActiveXid = 0;
+		GlobalCurrentXid = 0;
+		spin_unlock(&GlobalMid_Lock);
 		spin_lock(&cifs_tcp_ses_lock);
 		list_for_each(tmp1, &cifs_tcp_ses_list) {
 			server = list_entry(tmp1, struct TCP_Server_Info,
@@ -283,6 +287,10 @@ static ssize_t cifs_stats_proc_write(str
 							  struct cifs_tcon,
 							  tcon_list);
 					atomic_set(&tcon->num_smbs_sent, 0);
+					spin_lock(&tcon->stat_lock);
+					tcon->bytes_read = 0;
+					tcon->bytes_written = 0;
+					spin_unlock(&tcon->stat_lock);
 					if (server->ops->clear_stats)
 						server->ops->clear_stats(tcon);
 				}
diff -druNp --no-dereference linux-libre-3.18.122-gnu/fs/cifs/readdir.c linux-libre-3.18.123-gnu/fs/cifs/readdir.c
--- linux-libre-3.18.122-gnu/fs/cifs/readdir.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/fs/cifs/readdir.c	2018-09-26 02:33:59.000000000 -0400
@@ -366,8 +366,15 @@ static char *nxt_dir_entry(char *old_ent
 
 		new_entry = old_entry + sizeof(FIND_FILE_STANDARD_INFO) +
 				pfData->FileNameLength;
-	} else
-		new_entry = old_entry + le32_to_cpu(pDirInfo->NextEntryOffset);
+	} else {
+		u32 next_offset = le32_to_cpu(pDirInfo->NextEntryOffset);
+
+		if (old_entry + next_offset < old_entry) {
+			cifs_dbg(VFS, "invalid offset %u\n", next_offset);
+			return NULL;
+		}
+		new_entry = old_entry + next_offset;
+	}
 	cifs_dbg(FYI, "new entry %p old entry %p\n", new_entry, old_entry);
 	/* validate that new_entry is not past end of SMB */
 	if (new_entry >= end_of_smb) {
diff -druNp --no-dereference linux-libre-3.18.122-gnu/fs/cifs/smb2misc.c linux-libre-3.18.123-gnu/fs/cifs/smb2misc.c
--- linux-libre-3.18.122-gnu/fs/cifs/smb2misc.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/fs/cifs/smb2misc.c	2018-09-26 02:33:59.000000000 -0400
@@ -183,6 +183,13 @@ smb2_check_message(char *buf, unsigned i
 			return 0;
 
 		/*
+		 * Some windows servers (win2016) will pad also the final
+		 * PDU in a compound to 8 bytes.
+		 */
+		if (((clc_len + 7) & ~7) == len)
+			return 0;
+
+		/*
 		 * MacOS server pads after SMB2.1 write response with 3 bytes
 		 * of junk. Other servers match RFC1001 len to actual
 		 * SMB2/SMB3 frame length (header + smb2 response specific data)
diff -druNp --no-dereference linux-libre-3.18.122-gnu/fs/cifs/smb2pdu.c linux-libre-3.18.123-gnu/fs/cifs/smb2pdu.c
--- linux-libre-3.18.122-gnu/fs/cifs/smb2pdu.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/fs/cifs/smb2pdu.c	2018-09-26 02:33:59.000000000 -0400
@@ -301,7 +301,7 @@ small_smb2_init(__le16 smb2_command, str
 	smb2_hdr_assemble((struct smb2_hdr *) *request_buf, smb2_command, tcon);
 
 	if (tcon != NULL) {
-#ifdef CONFIG_CIFS_STATS2
+#ifdef CONFIG_CIFS_STATS
 		uint16_t com_code = le16_to_cpu(smb2_command);
 		cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_sent[com_code]);
 #endif
@@ -2188,33 +2188,38 @@ num_entries(char *bufstart, char *end_of
 	int len;
 	unsigned int entrycount = 0;
 	unsigned int next_offset = 0;
-	FILE_DIRECTORY_INFO *entryptr;
+	char *entryptr;
+	FILE_DIRECTORY_INFO *dir_info;
 
 	if (bufstart == NULL)
 		return 0;
 
-	entryptr = (FILE_DIRECTORY_INFO *)bufstart;
+	entryptr = bufstart;
 
 	while (1) {
-		entryptr = (FILE_DIRECTORY_INFO *)
-					((char *)entryptr + next_offset);
-
-		if ((char *)entryptr + size > end_of_buf) {
+		if (entryptr + next_offset < entryptr ||
+		    entryptr + next_offset > end_of_buf ||
+		    entryptr + next_offset + size > end_of_buf) {
 			cifs_dbg(VFS, "malformed search entry would overflow\n");
 			break;
 		}
 
-		len = le32_to_cpu(entryptr->FileNameLength);
-		if ((char *)entryptr + len + size > end_of_buf) {
+		entryptr = entryptr + next_offset;
+		dir_info = (FILE_DIRECTORY_INFO *)entryptr;
+
+		len = le32_to_cpu(dir_info->FileNameLength);
+		if (entryptr + len < entryptr ||
+		    entryptr + len > end_of_buf ||
+		    entryptr + len + size > end_of_buf) {
 			cifs_dbg(VFS, "directory entry name would overflow frame end of buf %p\n",
 				 end_of_buf);
 			break;
 		}
 
-		*lastentry = (char *)entryptr;
+		*lastentry = entryptr;
 		entrycount++;
 
-		next_offset = le32_to_cpu(entryptr->NextEntryOffset);
+		next_offset = le32_to_cpu(dir_info->NextEntryOffset);
 		if (!next_offset)
 			break;
 	}
diff -druNp --no-dereference linux-libre-3.18.122-gnu/fs/f2fs/super.c linux-libre-3.18.123-gnu/fs/f2fs/super.c
--- linux-libre-3.18.122-gnu/fs/f2fs/super.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/fs/f2fs/super.c	2018-09-26 02:33:59.000000000 -0400
@@ -933,12 +933,17 @@ static int sanity_check_ckpt(struct f2fs
 	struct f2fs_super_block *raw_super = F2FS_RAW_SUPER(sbi);
 	struct f2fs_checkpoint *ckpt = F2FS_CKPT(sbi);
 	unsigned int main_segs, blocks_per_seg;
+	unsigned int sit_segs, nat_segs;
+	unsigned int sit_bitmap_size, nat_bitmap_size;
+	unsigned int log_blocks_per_seg;
 	int i;
 
 	total = le32_to_cpu(raw_super->segment_count);
 	fsmeta = le32_to_cpu(raw_super->segment_count_ckpt);
-	fsmeta += le32_to_cpu(raw_super->segment_count_sit);
-	fsmeta += le32_to_cpu(raw_super->segment_count_nat);
+	sit_segs = le32_to_cpu(raw_super->segment_count_sit);
+	fsmeta += sit_segs;
+	nat_segs = le32_to_cpu(raw_super->segment_count_nat);
+	fsmeta += nat_segs;
 	fsmeta += le32_to_cpu(ckpt->rsvd_segment_count);
 	fsmeta += le32_to_cpu(raw_super->segment_count_ssa);
 
@@ -959,6 +964,18 @@ static int sanity_check_ckpt(struct f2fs
 			return 1;
 	}
 
+	sit_bitmap_size = le32_to_cpu(ckpt->sit_ver_bitmap_bytesize);
+	nat_bitmap_size = le32_to_cpu(ckpt->nat_ver_bitmap_bytesize);
+	log_blocks_per_seg = le32_to_cpu(raw_super->log_blocks_per_seg);
+
+	if (sit_bitmap_size != ((sit_segs / 2) << log_blocks_per_seg) / 8 ||
+		nat_bitmap_size != ((nat_segs / 2) << log_blocks_per_seg) / 8) {
+		f2fs_msg(sbi->sb, KERN_ERR,
+			"Wrong bitmap size: sit: %u, nat:%u",
+			sit_bitmap_size, nat_bitmap_size);
+		return 1;
+	}
+
 	if (unlikely(f2fs_cp_error(sbi))) {
 		f2fs_msg(sbi->sb, KERN_ERR, "A bug case: need to run fsck");
 		return 1;
diff -druNp --no-dereference linux-libre-3.18.122-gnu/fs/fat/cache.c linux-libre-3.18.123-gnu/fs/fat/cache.c
--- linux-libre-3.18.122-gnu/fs/fat/cache.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/fs/fat/cache.c	2018-09-26 02:33:59.000000000 -0400
@@ -226,7 +226,8 @@ static inline void cache_init(struct fat
 int fat_get_cluster(struct inode *inode, int cluster, int *fclus, int *dclus)
 {
 	struct super_block *sb = inode->i_sb;
-	const int limit = sb->s_maxbytes >> MSDOS_SB(sb)->cluster_bits;
+	struct msdos_sb_info *sbi = MSDOS_SB(sb);
+	const int limit = sb->s_maxbytes >> sbi->cluster_bits;
 	struct fat_entry fatent;
 	struct fat_cache_id cid;
 	int nr;
@@ -235,6 +236,12 @@ int fat_get_cluster(struct inode *inode,
 
 	*fclus = 0;
 	*dclus = MSDOS_I(inode)->i_start;
+	if (!fat_valid_entry(sbi, *dclus)) {
+		fat_fs_error_ratelimit(sb,
+			"%s: invalid start cluster (i_pos %lld, start %08x)",
+			__func__, MSDOS_I(inode)->i_pos, *dclus);
+		return -EIO;
+	}
 	if (cluster == 0)
 		return 0;
 
@@ -251,9 +258,8 @@ int fat_get_cluster(struct inode *inode,
 		/* prevent the infinite loop of cluster chain */
 		if (*fclus > limit) {
 			fat_fs_error_ratelimit(sb,
-					"%s: detected the cluster chain loop"
-					" (i_pos %lld)", __func__,
-					MSDOS_I(inode)->i_pos);
+				"%s: detected the cluster chain loop (i_pos %lld)",
+				__func__, MSDOS_I(inode)->i_pos);
 			nr = -EIO;
 			goto out;
 		}
@@ -263,9 +269,8 @@ int fat_get_cluster(struct inode *inode,
 			goto out;
 		else if (nr == FAT_ENT_FREE) {
 			fat_fs_error_ratelimit(sb,
-				       "%s: invalid cluster chain (i_pos %lld)",
-				       __func__,
-				       MSDOS_I(inode)->i_pos);
+				"%s: invalid cluster chain (i_pos %lld)",
+				__func__, MSDOS_I(inode)->i_pos);
 			nr = -EIO;
 			goto out;
 		} else if (nr == FAT_ENT_EOF) {
diff -druNp --no-dereference linux-libre-3.18.122-gnu/fs/fat/fatent.c linux-libre-3.18.123-gnu/fs/fat/fatent.c
--- linux-libre-3.18.122-gnu/fs/fat/fatent.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/fs/fat/fatent.c	2018-09-26 02:33:59.000000000 -0400
@@ -26,7 +26,7 @@ static void fat12_ent_blocknr(struct sup
 {
 	struct msdos_sb_info *sbi = MSDOS_SB(sb);
 	int bytes = entry + (entry >> 1);
-	WARN_ON(entry < FAT_START_ENT || sbi->max_cluster <= entry);
+	WARN_ON(!fat_valid_entry(sbi, entry));
 	*offset = bytes & (sb->s_blocksize - 1);
 	*blocknr = sbi->fat_start + (bytes >> sb->s_blocksize_bits);
 }
@@ -36,7 +36,7 @@ static void fat_ent_blocknr(struct super
 {
 	struct msdos_sb_info *sbi = MSDOS_SB(sb);
 	int bytes = (entry << sbi->fatent_shift);
-	WARN_ON(entry < FAT_START_ENT || sbi->max_cluster <= entry);
+	WARN_ON(!fat_valid_entry(sbi, entry));
 	*offset = bytes & (sb->s_blocksize - 1);
 	*blocknr = sbi->fat_start + (bytes >> sb->s_blocksize_bits);
 }
@@ -356,7 +356,7 @@ int fat_ent_read(struct inode *inode, st
 	int err, offset;
 	sector_t blocknr;
 
-	if (entry < FAT_START_ENT || sbi->max_cluster <= entry) {
+	if (!fat_valid_entry(sbi, entry)) {
 		fatent_brelse(fatent);
 		fat_fs_error(sb, "invalid access to FAT (entry 0x%08x)", entry);
 		return -EIO;
diff -druNp --no-dereference linux-libre-3.18.122-gnu/fs/fat/fat.h linux-libre-3.18.123-gnu/fs/fat/fat.h
--- linux-libre-3.18.122-gnu/fs/fat/fat.h	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/fs/fat/fat.h	2018-09-26 02:33:59.000000000 -0400
@@ -347,6 +347,11 @@ static inline void fatent_brelse(struct
 	fatent->fat_inode = NULL;
 }
 
+static inline bool fat_valid_entry(struct msdos_sb_info *sbi, int entry)
+{
+	return FAT_START_ENT <= entry && entry < sbi->max_cluster;
+}
+
 extern void fat_ent_access_init(struct super_block *sb);
 extern int fat_ent_read(struct inode *inode, struct fat_entry *fatent,
 			int entry);
diff -druNp --no-dereference linux-libre-3.18.122-gnu/fs/gfs2/bmap.c linux-libre-3.18.123-gnu/fs/gfs2/bmap.c
--- linux-libre-3.18.122-gnu/fs/gfs2/bmap.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/fs/gfs2/bmap.c	2018-09-26 02:33:59.000000000 -0400
@@ -1476,7 +1476,7 @@ int gfs2_write_alloc_required(struct gfs
 	end_of_file = (i_size_read(&ip->i_inode) + sdp->sd_sb.sb_bsize - 1) >> shift;
 	lblock = offset >> shift;
 	lblock_stop = (offset + len + sdp->sd_sb.sb_bsize - 1) >> shift;
-	if (lblock_stop > end_of_file)
+	if (lblock_stop > end_of_file && ip != GFS2_I(sdp->sd_rindex))
 		return 1;
 
 	size = (lblock_stop - lblock) << shift;
diff -druNp --no-dereference linux-libre-3.18.122-gnu/fs/hfs/brec.c linux-libre-3.18.123-gnu/fs/hfs/brec.c
--- linux-libre-3.18.122-gnu/fs/hfs/brec.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/fs/hfs/brec.c	2018-09-26 02:33:59.000000000 -0400
@@ -74,9 +74,10 @@ int hfs_brec_insert(struct hfs_find_data
 	if (!fd->bnode) {
 		if (!tree->root)
 			hfs_btree_inc_height(tree);
-		fd->bnode = hfs_bnode_find(tree, tree->leaf_head);
-		if (IS_ERR(fd->bnode))
-			return PTR_ERR(fd->bnode);
+		node = hfs_bnode_find(tree, tree->leaf_head);
+		if (IS_ERR(node))
+			return PTR_ERR(node);
+		fd->bnode = node;
 		fd->record = -1;
 	}
 	new_node = NULL;
diff -druNp --no-dereference linux-libre-3.18.122-gnu/fs/hfsplus/super.c linux-libre-3.18.123-gnu/fs/hfsplus/super.c
--- linux-libre-3.18.122-gnu/fs/hfsplus/super.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/fs/hfsplus/super.c	2018-09-26 02:33:59.000000000 -0400
@@ -518,8 +518,10 @@ static int hfsplus_fill_super(struct sup
 	hfsplus_cat_build_key(sb, fd.search_key, HFSPLUS_ROOT_CNID, &str);
 	if (!hfs_brec_read(&fd, &entry, sizeof(entry))) {
 		hfs_find_exit(&fd);
-		if (entry.type != cpu_to_be16(HFSPLUS_FOLDER))
+		if (entry.type != cpu_to_be16(HFSPLUS_FOLDER)) {
+			err = -EINVAL;
 			goto out_put_root;
+		}
 		inode = hfsplus_iget(sb, be32_to_cpu(entry.folder.id));
 		if (IS_ERR(inode)) {
 			err = PTR_ERR(inode);
diff -druNp --no-dereference linux-libre-3.18.122-gnu/fs/pstore/ram_core.c linux-libre-3.18.123-gnu/fs/pstore/ram_core.c
--- linux-libre-3.18.122-gnu/fs/pstore/ram_core.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/fs/pstore/ram_core.c	2018-09-26 02:33:59.000000000 -0400
@@ -414,7 +414,12 @@ static void *persistent_ram_vmap(phys_ad
 	vaddr = vmap(pages, page_count, VM_MAP, prot);
 	kfree(pages);
 
-	return vaddr;
+	/*
+	 * Since vmap() uses page granularity, we must add the offset
+	 * into the page here, to get the byte granularity address
+	 * into the mapping to represent the actual "start" location.
+	 */
+	return vaddr + offset_in_page(start);
 }
 
 static void *persistent_ram_iomap(phys_addr_t start, size_t size,
@@ -436,6 +441,11 @@ static void *persistent_ram_iomap(phys_a
 	else
 		va = ioremap_wc(start, size);
 
+	/*
+	 * Since request_mem_region() and ioremap() are byte-granularity
+	 * there is no need handle anything special like we do when the
+	 * vmap() case in persistent_ram_vmap() above.
+	 */
 	return va;
 }
 
@@ -456,7 +466,7 @@ static int persistent_ram_buffer_map(phy
 		return -ENOMEM;
 	}
 
-	prz->buffer = prz->vaddr + offset_in_page(start);
+	prz->buffer = prz->vaddr;
 	prz->buffer_size = size - sizeof(struct persistent_ram_buffer);
 
 	return 0;
@@ -503,7 +513,8 @@ void persistent_ram_free(struct persiste
 
 	if (prz->vaddr) {
 		if (pfn_valid(prz->paddr >> PAGE_SHIFT)) {
-			vunmap(prz->vaddr);
+			/* We must vunmap() at page-granularity. */
+			vunmap(prz->vaddr - offset_in_page(prz->paddr));
 		} else {
 			iounmap(prz->vaddr);
 			release_mem_region(prz->paddr, prz->size);
diff -druNp --no-dereference linux-libre-3.18.122-gnu/fs/reiserfs/reiserfs.h linux-libre-3.18.123-gnu/fs/reiserfs/reiserfs.h
--- linux-libre-3.18.122-gnu/fs/reiserfs/reiserfs.h	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/fs/reiserfs/reiserfs.h	2018-09-26 02:33:59.000000000 -0400
@@ -266,7 +266,7 @@ struct reiserfs_journal_list {
 
 	struct mutex j_commit_mutex;
 	unsigned int j_trans_id;
-	time_t j_timestamp;
+	time64_t j_timestamp; /* write-only but useful for crash dump analysis */
 	struct reiserfs_list_bitmap *j_list_bitmap;
 	struct buffer_head *j_commit_bh;	/* commit buffer head */
 	struct reiserfs_journal_cnode *j_realblock;
diff -druNp --no-dereference linux-libre-3.18.122-gnu/include/linux/mm_types.h linux-libre-3.18.123-gnu/include/linux/mm_types.h
--- linux-libre-3.18.122-gnu/include/linux/mm_types.h	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/include/linux/mm_types.h	2018-09-26 02:33:59.000000000 -0400
@@ -345,7 +345,7 @@ struct kioctx_table;
 struct mm_struct {
 	struct vm_area_struct *mmap;		/* list of VMAs */
 	struct rb_root mm_rb;
-	u32 vmacache_seqnum;                   /* per-thread vmacache */
+	u64 vmacache_seqnum;                   /* per-thread vmacache */
 #ifdef CONFIG_MMU
 	unsigned long (*get_unmapped_area) (struct file *filp,
 				unsigned long addr, unsigned long len,
diff -druNp --no-dereference linux-libre-3.18.122-gnu/include/linux/sched.h linux-libre-3.18.123-gnu/include/linux/sched.h
--- linux-libre-3.18.122-gnu/include/linux/sched.h	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/include/linux/sched.h	2018-09-26 02:33:59.000000000 -0400
@@ -1315,7 +1315,7 @@ struct task_struct {
 	unsigned brk_randomized:1;
 #endif
 	/* per-thread vma caching */
-	u32 vmacache_seqnum;
+	u64 vmacache_seqnum;
 	struct vm_area_struct *vmacache[VMACACHE_SIZE];
 #if defined(SPLIT_RSS_COUNTING)
 	struct task_rss_stat	rss_stat;
diff -druNp --no-dereference linux-libre-3.18.122-gnu/include/linux/vmacache.h linux-libre-3.18.123-gnu/include/linux/vmacache.h
--- linux-libre-3.18.122-gnu/include/linux/vmacache.h	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/include/linux/vmacache.h	2018-09-26 02:33:59.000000000 -0400
@@ -15,7 +15,6 @@ static inline void vmacache_flush(struct
 	memset(tsk->vmacache, 0, sizeof(tsk->vmacache));
 }
 
-extern void vmacache_flush_all(struct mm_struct *mm);
 extern void vmacache_update(unsigned long addr, struct vm_area_struct *newvma);
 extern struct vm_area_struct *vmacache_find(struct mm_struct *mm,
 						    unsigned long addr);
@@ -29,10 +28,6 @@ extern struct vm_area_struct *vmacache_f
 static inline void vmacache_invalidate(struct mm_struct *mm)
 {
 	mm->vmacache_seqnum++;
-
-	/* deal with overflows */
-	if (unlikely(mm->vmacache_seqnum == 0))
-		vmacache_flush_all(mm);
 }
 
 #endif /* __LINUX_VMACACHE_H */
diff -druNp --no-dereference linux-libre-3.18.122-gnu/kernel/audit_watch.c linux-libre-3.18.123-gnu/kernel/audit_watch.c
--- linux-libre-3.18.122-gnu/kernel/audit_watch.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/kernel/audit_watch.c	2018-09-26 02:33:59.000000000 -0400
@@ -414,6 +414,13 @@ int audit_add_watch(struct audit_krule *
 	struct path parent_path;
 	int h, ret = 0;
 
+	/*
+	 * When we will be calling audit_add_to_parent, krule->watch might have
+	 * been updated and watch might have been freed.
+	 * So we need to keep a reference of watch.
+	 */
+	audit_get_watch(watch);
+
 	mutex_unlock(&audit_filter_mutex);
 
 	/* Avoid calling path_lookup under audit_filter_mutex. */
@@ -422,8 +429,10 @@ int audit_add_watch(struct audit_krule *
 	/* caller expects mutex locked */
 	mutex_lock(&audit_filter_mutex);
 
-	if (ret)
+	if (ret) {
+		audit_put_watch(watch);
 		return ret;
+	}
 
 	/* either find an old parent or attach a new one */
 	parent = audit_find_parent(parent_path.dentry->d_inode);
@@ -444,6 +453,7 @@ int audit_add_watch(struct audit_krule *
 	*list = &audit_inode_hash[h];
 error:
 	path_put(&parent_path);
+	audit_put_watch(watch);
 	return ret;
 }
 
diff -druNp --no-dereference linux-libre-3.18.122-gnu/kernel/fork.c linux-libre-3.18.123-gnu/kernel/fork.c
--- linux-libre-3.18.122-gnu/kernel/fork.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/kernel/fork.c	2018-09-26 02:33:59.000000000 -0400
@@ -1014,7 +1014,9 @@ static int copy_sighand(unsigned long cl
 	if (!sig)
 		return -ENOMEM;
 	atomic_set(&sig->count, 1);
+	spin_lock_irq(&current->sighand->siglock);
 	memcpy(sig->action, current->sighand->action, sizeof(sig->action));
+	spin_unlock_irq(&current->sighand->siglock);
 	return 0;
 }
 
@@ -1241,6 +1243,18 @@ static struct task_struct *copy_process(
 	if (!p)
 		goto fork_out;
 
+	/*
+	 * This _must_ happen before we call free_task(), i.e. before we jump
+	 * to any of the bad_fork_* labels. This is to avoid freeing
+	 * p->set_child_tid which is (ab)used as a kthread's data pointer for
+	 * kernel threads (PF_KTHREAD).
+	 */
+	p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
+	/*
+	 * Clear TID on mm_release()?
+	 */
+	p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL;
+
 	ftrace_graph_init_task(p);
 
 	rt_mutex_init_task(p);
@@ -1404,11 +1418,6 @@ static struct task_struct *copy_process(
 			goto bad_fork_cleanup_io;
 	}
 
-	p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
-	/*
-	 * Clear TID on mm_release()?
-	 */
-	p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL;
 #ifdef CONFIG_BLOCK
 	p->plug = NULL;
 #endif
diff -druNp --no-dereference linux-libre-3.18.122-gnu/lib/debugobjects.c linux-libre-3.18.123-gnu/lib/debugobjects.c
--- linux-libre-3.18.122-gnu/lib/debugobjects.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/lib/debugobjects.c	2018-09-26 02:33:59.000000000 -0400
@@ -295,9 +295,12 @@ static void debug_object_is_on_stack(voi
 
 	limit++;
 	if (is_on_stack)
-		pr_warn("object is on stack, but not annotated\n");
+		pr_warn("object %p is on stack %p, but NOT annotated.\n", addr,
+			 task_stack_page(current));
 	else
-		pr_warn("object is not on stack, but annotated\n");
+		pr_warn("object %p is NOT on stack %p, but annotated.\n", addr,
+			 task_stack_page(current));
+
 	WARN_ON(1);
 }
 
diff -druNp --no-dereference linux-libre-3.18.122-gnu/Makefile linux-libre-3.18.123-gnu/Makefile
--- linux-libre-3.18.122-gnu/Makefile	2018-09-09 19:16:26.000000000 -0400
+++ linux-libre-3.18.123-gnu/Makefile	2018-09-26 14:12:48.000000000 -0400
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 18
-SUBLEVEL = 122
+SUBLEVEL = 123
 EXTRAVERSION =-gnu
 NAME = Diseased Newt
 
diff -druNp --no-dereference linux-libre-3.18.122-gnu/mm/debug.c linux-libre-3.18.123-gnu/mm/debug.c
--- linux-libre-3.18.122-gnu/mm/debug.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/mm/debug.c	2018-09-26 02:33:59.000000000 -0400
@@ -166,7 +166,7 @@ EXPORT_SYMBOL(dump_vma);
 
 void dump_mm(const struct mm_struct *mm)
 {
-	pr_emerg("mm %p mmap %p seqnum %d task_size %lu\n"
+	pr_emerg("mm %p mmap %p seqnum %llu task_size %lu\n"
 #ifdef CONFIG_MMU
 		"get_unmapped_area %p\n"
 #endif
@@ -196,7 +196,7 @@ void dump_mm(const struct mm_struct *mm)
 #endif
 		"%s",	/* This is here to hold the comma */
 
-		mm, mm->mmap, mm->vmacache_seqnum, mm->task_size,
+		mm, mm->mmap, (long long) mm->vmacache_seqnum, mm->task_size,
 #ifdef CONFIG_MMU
 		mm->get_unmapped_area,
 #endif
diff -druNp --no-dereference linux-libre-3.18.122-gnu/mm/fadvise.c linux-libre-3.18.123-gnu/mm/fadvise.c
--- linux-libre-3.18.122-gnu/mm/fadvise.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/mm/fadvise.c	2018-09-26 02:33:59.000000000 -0400
@@ -66,8 +66,12 @@ SYSCALL_DEFINE4(fadvise64_64, int, fd, l
 		goto out;
 	}
 
-	/* Careful about overflows. Len == 0 means "as much as possible" */
-	endbyte = offset + len;
+	/*
+	 * Careful about overflows. Len == 0 means "as much as possible".  Use
+	 * unsigned math because signed overflows are undefined and UBSan
+	 * complains.
+	 */
+	endbyte = (u64)offset + (u64)len;
 	if (!len || endbyte < len)
 		endbyte = -1;
 	else
diff -druNp --no-dereference linux-libre-3.18.122-gnu/mm/huge_memory.c linux-libre-3.18.123-gnu/mm/huge_memory.c
--- linux-libre-3.18.122-gnu/mm/huge_memory.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/mm/huge_memory.c	2018-09-26 02:33:59.000000000 -0400
@@ -1329,12 +1329,12 @@ int do_huge_pmd_numa_page(struct mm_stru
 
 	/* Migration could have started since the pmd_trans_migrating check */
 	if (!page_locked) {
+		page_nid = -1;
 		if (!get_page_unless_zero(page))
 			goto out_unlock;
 		spin_unlock(ptl);
 		wait_on_page_locked(page);
 		put_page(page);
-		page_nid = -1;
 		goto out;
 	}
 
diff -druNp --no-dereference linux-libre-3.18.122-gnu/mm/vmacache.c linux-libre-3.18.123-gnu/mm/vmacache.c
--- linux-libre-3.18.122-gnu/mm/vmacache.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/mm/vmacache.c	2018-09-26 02:33:59.000000000 -0400
@@ -6,42 +6,6 @@
 #include <linux/vmacache.h>
 
 /*
- * Flush vma caches for threads that share a given mm.
- *
- * The operation is safe because the caller holds the mmap_sem
- * exclusively and other threads accessing the vma cache will
- * have mmap_sem held at least for read, so no extra locking
- * is required to maintain the vma cache.
- */
-void vmacache_flush_all(struct mm_struct *mm)
-{
-	struct task_struct *g, *p;
-
-	/*
-	 * Single threaded tasks need not iterate the entire
-	 * list of process. We can avoid the flushing as well
-	 * since the mm's seqnum was increased and don't have
-	 * to worry about other threads' seqnum. Current's
-	 * flush will occur upon the next lookup.
-	 */
-	if (atomic_read(&mm->mm_users) == 1)
-		return;
-
-	rcu_read_lock();
-	for_each_process_thread(g, p) {
-		/*
-		 * Only flush the vmacache pointers as the
-		 * mm seqnum is already set and curr's will
-		 * be set upon invalidation when the next
-		 * lookup is done.
-		 */
-		if (mm == p->mm)
-			vmacache_flush(p);
-	}
-	rcu_read_unlock();
-}
-
-/*
  * This task may be accessing a foreign mm via (for example)
  * get_user_pages()->find_vma().  The vmacache is task-local and this
  * task's vmacache pertains to a different mm (ie, its own).  There is
diff -druNp --no-dereference linux-libre-3.18.122-gnu/net/9p/trans_virtio.c linux-libre-3.18.123-gnu/net/9p/trans_virtio.c
--- linux-libre-3.18.122-gnu/net/9p/trans_virtio.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/net/9p/trans_virtio.c	2018-09-26 02:33:59.000000000 -0400
@@ -537,7 +537,7 @@ static int p9_virtio_probe(struct virtio
 	chan->vq = virtio_find_single_vq(vdev, req_done, "requests");
 	if (IS_ERR(chan->vq)) {
 		err = PTR_ERR(chan->vq);
-		goto out_free_vq;
+		goto out_free_chan;
 	}
 	chan->vq->vdev->priv = chan;
 	spin_lock_init(&chan->lock);
@@ -590,6 +590,7 @@ out_free_tag:
 	kfree(tag);
 out_free_vq:
 	vdev->config->del_vqs(vdev);
+out_free_chan:
 	kfree(chan);
 fail:
 	return err;
diff -druNp --no-dereference linux-libre-3.18.122-gnu/net/bluetooth/hidp/core.c linux-libre-3.18.123-gnu/net/bluetooth/hidp/core.c
--- linux-libre-3.18.122-gnu/net/bluetooth/hidp/core.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/net/bluetooth/hidp/core.c	2018-09-26 02:33:59.000000000 -0400
@@ -763,7 +763,7 @@ static int hidp_setup_hid(struct hidp_se
 	hid->version = req->version;
 	hid->country = req->country;
 
-	strncpy(hid->name, req->name, sizeof(req->name) - 1);
+	strncpy(hid->name, req->name, sizeof(hid->name));
 
 	snprintf(hid->phys, sizeof(hid->phys), "%pMR",
 		 &l2cap_pi(session->ctrl_sock->sk)->chan->src);
diff -druNp --no-dereference linux-libre-3.18.122-gnu/net/dcb/dcbnl.c linux-libre-3.18.123-gnu/net/dcb/dcbnl.c
--- linux-libre-3.18.122-gnu/net/dcb/dcbnl.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/net/dcb/dcbnl.c	2018-09-26 02:33:59.000000000 -0400
@@ -1728,7 +1728,7 @@ static struct dcb_app_type *dcb_app_look
 		if (itr->app.selector == app->selector &&
 		    itr->app.protocol == app->protocol &&
 		    itr->ifindex == ifindex &&
-		    (!prio || itr->app.priority == prio))
+		    ((prio == -1) || itr->app.priority == prio))
 			return itr;
 	}
 
@@ -1763,7 +1763,8 @@ u8 dcb_getapp(struct net_device *dev, st
 	u8 prio = 0;
 
 	spin_lock_bh(&dcb_lock);
-	if ((itr = dcb_app_lookup(app, dev->ifindex, 0)))
+	itr = dcb_app_lookup(app, dev->ifindex, -1);
+	if (itr)
 		prio = itr->app.priority;
 	spin_unlock_bh(&dcb_lock);
 
@@ -1791,7 +1792,8 @@ int dcb_setapp(struct net_device *dev, s
 
 	spin_lock_bh(&dcb_lock);
 	/* Search for existing match and replace */
-	if ((itr = dcb_app_lookup(new, dev->ifindex, 0))) {
+	itr = dcb_app_lookup(new, dev->ifindex, -1);
+	if (itr) {
 		if (new->priority)
 			itr->app.priority = new->priority;
 		else {
@@ -1824,7 +1826,8 @@ u8 dcb_ieee_getapp_mask(struct net_devic
 	u8 prio = 0;
 
 	spin_lock_bh(&dcb_lock);
-	if ((itr = dcb_app_lookup(app, dev->ifindex, 0)))
+	itr = dcb_app_lookup(app, dev->ifindex, -1);
+	if (itr)
 		prio |= 1 << itr->app.priority;
 	spin_unlock_bh(&dcb_lock);
 
diff -druNp --no-dereference linux-libre-3.18.122-gnu/net/irda/af_irda.c linux-libre-3.18.123-gnu/net/irda/af_irda.c
--- linux-libre-3.18.122-gnu/net/irda/af_irda.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/net/irda/af_irda.c	2018-09-26 02:33:59.000000000 -0400
@@ -785,6 +785,13 @@ static int irda_bind(struct socket *sock
 		return -EINVAL;
 
 	lock_sock(sk);
+
+	/* Ensure that the socket is not already bound */
+	if (self->ias_obj) {
+		err = -EINVAL;
+		goto out;
+	}
+
 #ifdef CONFIG_IRDA_ULTRA
 	/* Special care for Ultra sockets */
 	if ((sk->sk_type == SOCK_DGRAM) &&
@@ -2044,7 +2051,11 @@ static int irda_setsockopt(struct socket
 			err = -EINVAL;
 			goto out;
 		}
-		irias_insert_object(ias_obj);
+
+		/* Only insert newly allocated objects */
+		if (free_ias)
+			irias_insert_object(ias_obj);
+
 		kfree(ias_opt);
 		break;
 	case IRLMP_IAS_DEL:
diff -druNp --no-dereference linux-libre-3.18.122-gnu/net/mac80211/cfg.c linux-libre-3.18.123-gnu/net/mac80211/cfg.c
--- linux-libre-3.18.122-gnu/net/mac80211/cfg.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/net/mac80211/cfg.c	2018-09-26 02:33:59.000000000 -0400
@@ -276,7 +276,7 @@ static int ieee80211_del_key(struct wiph
 		goto out_unlock;
 	}
 
-	ieee80211_key_free(key, true);
+	ieee80211_key_free(key, sdata->vif.type == NL80211_IFTYPE_STATION);
 
 	ret = 0;
  out_unlock:
diff -druNp --no-dereference linux-libre-3.18.122-gnu/net/mac80211/key.c linux-libre-3.18.123-gnu/net/mac80211/key.c
--- linux-libre-3.18.122-gnu/net/mac80211/key.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/net/mac80211/key.c	2018-09-26 02:33:59.000000000 -0400
@@ -515,11 +515,15 @@ int ieee80211_key_link(struct ieee80211_
 {
 	struct ieee80211_local *local = sdata->local;
 	struct ieee80211_key *old_key;
-	int idx, ret;
-	bool pairwise;
-
-	pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE;
-	idx = key->conf.keyidx;
+	int idx = key->conf.keyidx;
+	bool pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE;
+	/*
+	 * We want to delay tailroom updates only for station - in that
+	 * case it helps roaming speed, but in other cases it hurts and
+	 * can cause warnings to appear.
+	 */
+	bool delay_tailroom = sdata->vif.type == NL80211_IFTYPE_STATION;
+	int ret;
 
 	mutex_lock(&sdata->local->key_mtx);
 
@@ -547,14 +551,14 @@ int ieee80211_key_link(struct ieee80211_
 	increment_tailroom_need_count(sdata);
 
 	ieee80211_key_replace(sdata, sta, pairwise, old_key, key);
-	ieee80211_key_destroy(old_key, true);
+	ieee80211_key_destroy(old_key, delay_tailroom);
 
 	ieee80211_debugfs_key_add(key);
 
 	if (!local->wowlan) {
 		ret = ieee80211_key_enable_hw_accel(key);
 		if (ret)
-			ieee80211_key_free(key, true);
+			ieee80211_key_free(key, delay_tailroom);
 	} else {
 		ret = 0;
 	}
@@ -705,7 +709,8 @@ void ieee80211_free_sta_keys(struct ieee
 		ieee80211_key_replace(key->sdata, key->sta,
 				key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE,
 				key, NULL);
-		__ieee80211_key_destroy(key, true);
+		__ieee80211_key_destroy(key, key->sdata->vif.type ==
+					NL80211_IFTYPE_STATION);
 	}
 
 	for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
@@ -715,7 +720,8 @@ void ieee80211_free_sta_keys(struct ieee
 		ieee80211_key_replace(key->sdata, key->sta,
 				key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE,
 				key, NULL);
-		__ieee80211_key_destroy(key, true);
+		__ieee80211_key_destroy(key, key->sdata->vif.type ==
+					NL80211_IFTYPE_STATION);
 	}
 
 	mutex_unlock(&local->key_mtx);
diff -druNp --no-dereference linux-libre-3.18.122-gnu/net/netfilter/ipvs/ip_vs_core.c linux-libre-3.18.123-gnu/net/netfilter/ipvs/ip_vs_core.c
--- linux-libre-3.18.122-gnu/net/netfilter/ipvs/ip_vs_core.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/net/netfilter/ipvs/ip_vs_core.c	2018-09-26 02:33:59.000000000 -0400
@@ -1692,13 +1692,20 @@ ip_vs_in(unsigned int hooknum, struct sk
 	if (cp->dest && !(cp->dest->flags & IP_VS_DEST_F_AVAILABLE)) {
 		/* the destination server is not available */
 
-		if (sysctl_expire_nodest_conn(ipvs)) {
+		__u32 flags = cp->flags;
+
+		/* when timer already started, silently drop the packet.*/
+		if (timer_pending(&cp->timer))
+			__ip_vs_conn_put(cp);
+		else
+			ip_vs_conn_put(cp);
+
+		if (sysctl_expire_nodest_conn(ipvs) &&
+		    !(flags & IP_VS_CONN_F_ONE_PACKET)) {
 			/* try to expire the connection immediately */
 			ip_vs_conn_expire_now(cp);
 		}
-		/* don't restart its timer, and silently
-		   drop the packet. */
-		__ip_vs_conn_put(cp);
+
 		return NF_DROP;
 	}
 
diff -druNp --no-dereference linux-libre-3.18.122-gnu/net/netfilter/x_tables.c linux-libre-3.18.123-gnu/net/netfilter/x_tables.c
--- linux-libre-3.18.122-gnu/net/netfilter/x_tables.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/net/netfilter/x_tables.c	2018-09-26 02:33:59.000000000 -0400
@@ -877,7 +877,7 @@ void *xt_copy_counters_from_user(const v
 		if (copy_from_user(&compat_tmp, user, sizeof(compat_tmp)) != 0)
 			return ERR_PTR(-EFAULT);
 
-		strlcpy(info->name, compat_tmp.name, sizeof(info->name));
+		memcpy(info->name, compat_tmp.name, sizeof(info->name) - 1);
 		info->num_counters = compat_tmp.num_counters;
 		user += sizeof(compat_tmp);
 	} else
@@ -890,9 +890,9 @@ void *xt_copy_counters_from_user(const v
 		if (copy_from_user(info, user, sizeof(*info)) != 0)
 			return ERR_PTR(-EFAULT);
 
-		info->name[sizeof(info->name) - 1] = '\0';
 		user += sizeof(*info);
 	}
+	info->name[sizeof(info->name) - 1] = '\0';
 
 	size = sizeof(struct xt_counters);
 	size *= info->num_counters;
diff -druNp --no-dereference linux-libre-3.18.122-gnu/net/xfrm/xfrm_policy.c linux-libre-3.18.123-gnu/net/xfrm/xfrm_policy.c
--- linux-libre-3.18.122-gnu/net/xfrm/xfrm_policy.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/net/xfrm/xfrm_policy.c	2018-09-26 02:33:59.000000000 -0400
@@ -1809,7 +1809,10 @@ xfrm_resolve_and_create_bundle(struct xf
 	/* Try to instantiate a bundle */
 	err = xfrm_tmpl_resolve(pols, num_pols, fl, xfrm, family);
 	if (err <= 0) {
-		if (err != 0 && err != -EAGAIN)
+		if (err == 0)
+			return NULL;
+
+		if (err != -EAGAIN)
 			XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR);
 		return ERR_PTR(err);
 	}
diff -druNp --no-dereference linux-libre-3.18.122-gnu/scripts/depmod.sh linux-libre-3.18.123-gnu/scripts/depmod.sh
--- linux-libre-3.18.122-gnu/scripts/depmod.sh	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/scripts/depmod.sh	2018-09-26 02:33:59.000000000 -0400
@@ -15,9 +15,9 @@ if ! test -r System.map ; then
 fi
 
 if [ -z $(command -v $DEPMOD) ]; then
-	echo "'make modules_install' requires $DEPMOD. Please install it." >&2
+	echo "Warning: 'make modules_install' requires $DEPMOD. Please install it." >&2
 	echo "This is probably in the kmod package." >&2
-	exit 1
+	exit 0
 fi
 
 # older versions of depmod don't support -P <symbol-prefix>
diff -druNp --no-dereference linux-libre-3.18.122-gnu/scripts/mod/modpost.c linux-libre-3.18.123-gnu/scripts/mod/modpost.c
--- linux-libre-3.18.122-gnu/scripts/mod/modpost.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/scripts/mod/modpost.c	2018-09-26 02:33:59.000000000 -0400
@@ -647,7 +647,7 @@ static void handle_modversions(struct mo
 			if (ELF_ST_TYPE(sym->st_info) == STT_SPARC_REGISTER)
 				break;
 			if (symname[0] == '.') {
-				char *munged = strdup(symname);
+				char *munged = NOFAIL(strdup(symname));
 				munged[0] = '_';
 				munged[1] = toupper(munged[1]);
 				symname = munged;
@@ -1248,7 +1248,7 @@ static Elf_Sym *find_elf_symbol2(struct
 static char *sec2annotation(const char *s)
 {
 	if (match(s, init_exit_sections)) {
-		char *p = malloc(20);
+		char *p = NOFAIL(malloc(20));
 		char *r = p;
 
 		*p++ = '_';
@@ -1268,7 +1268,7 @@ static char *sec2annotation(const char *
 			strcat(p, " ");
 		return r;
 	} else {
-		return strdup("");
+		return NOFAIL(strdup(""));
 	}
 }
 
@@ -1826,7 +1826,7 @@ void buf_write(struct buffer *buf, const
 {
 	if (buf->size - buf->pos < len) {
 		buf->size += len + SZ;
-		buf->p = realloc(buf->p, buf->size);
+		buf->p = NOFAIL(realloc(buf->p, buf->size));
 	}
 	strncpy(buf->p + buf->pos, s, len);
 	buf->pos += len;
diff -druNp --no-dereference linux-libre-3.18.122-gnu/sound/core/pcm_lib.c linux-libre-3.18.123-gnu/sound/core/pcm_lib.c
--- linux-libre-3.18.122-gnu/sound/core/pcm_lib.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/sound/core/pcm_lib.c	2018-09-26 02:33:59.000000000 -0400
@@ -714,27 +714,33 @@ EXPORT_SYMBOL(snd_interval_refine);
 
 static int snd_interval_refine_first(struct snd_interval *i)
 {
+	const unsigned int last_max = i->max;
+
 	if (snd_BUG_ON(snd_interval_empty(i)))
 		return -EINVAL;
 	if (snd_interval_single(i))
 		return 0;
 	i->max = i->min;
-	i->openmax = i->openmin;
-	if (i->openmax)
+	if (i->openmin)
 		i->max++;
+	/* only exclude max value if also excluded before refine */
+	i->openmax = (i->openmax && i->max >= last_max);
 	return 1;
 }
 
 static int snd_interval_refine_last(struct snd_interval *i)
 {
+	const unsigned int last_min = i->min;
+
 	if (snd_BUG_ON(snd_interval_empty(i)))
 		return -EINVAL;
 	if (snd_interval_single(i))
 		return 0;
 	i->min = i->max;
-	i->openmin = i->openmax;
-	if (i->openmin)
+	if (i->openmax)
 		i->min--;
+	/* only exclude min value if also excluded before refine */
+	i->openmin = (i->openmin && i->min <= last_min);
 	return 1;
 }
 
diff -druNp --no-dereference linux-libre-3.18.122-gnu/sound/isa/msnd/msnd_pinnacle.c linux-libre-3.18.123-gnu/sound/isa/msnd/msnd_pinnacle.c
--- linux-libre-3.18.122-gnu/sound/isa/msnd/msnd_pinnacle.c	2018-09-09 19:34:03.000000000 -0400
+++ linux-libre-3.18.123-gnu/sound/isa/msnd/msnd_pinnacle.c	2018-09-26 14:32:47.000000000 -0400
@@ -82,10 +82,10 @@
 
 static void set_default_audio_parameters(struct snd_msnd *chip)
 {
-	chip->play_sample_size = DEFSAMPLESIZE;
+	chip->play_sample_size = snd_pcm_format_width(DEFSAMPLESIZE);
 	chip->play_sample_rate = DEFSAMPLERATE;
 	chip->play_channels = DEFCHANNELS;
-	chip->capture_sample_size = DEFSAMPLESIZE;
+	chip->capture_sample_size = snd_pcm_format_width(DEFSAMPLESIZE);
 	chip->capture_sample_rate = DEFSAMPLERATE;
 	chip->capture_channels = DEFCHANNELS;
 }
diff -druNp --no-dereference linux-libre-3.18.122-gnu/sound/soc/codecs/wm8994.c linux-libre-3.18.123-gnu/sound/soc/codecs/wm8994.c
--- linux-libre-3.18.122-gnu/sound/soc/codecs/wm8994.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/sound/soc/codecs/wm8994.c	2018-09-26 02:33:59.000000000 -0400
@@ -2427,6 +2427,7 @@ static int wm8994_set_dai_sysclk(struct
 			snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_2,
 					    WM8994_OPCLK_ENA, 0);
 		}
+		break;
 
 	default:
 		return -EINVAL;
diff -druNp --no-dereference linux-libre-3.18.122-gnu/sound/usb/quirks-table.h linux-libre-3.18.123-gnu/sound/usb/quirks-table.h
--- linux-libre-3.18.122-gnu/sound/usb/quirks-table.h	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/sound/usb/quirks-table.h	2018-09-26 02:33:59.000000000 -0400
@@ -2910,7 +2910,8 @@ YAMAHA_DEVICE(0x7010, "UB99"),
  */
 
 #define AU0828_DEVICE(vid, pid, vname, pname) { \
-	USB_DEVICE_VENDOR_SPEC(vid, pid), \
+	.idVendor = vid, \
+	.idProduct = pid, \
 	.match_flags = USB_DEVICE_ID_MATCH_DEVICE | \
 		       USB_DEVICE_ID_MATCH_INT_CLASS | \
 		       USB_DEVICE_ID_MATCH_INT_SUBCLASS, \
diff -druNp --no-dereference linux-libre-3.18.122-gnu/tools/hv/hv_kvp_daemon.c linux-libre-3.18.123-gnu/tools/hv/hv_kvp_daemon.c
--- linux-libre-3.18.122-gnu/tools/hv/hv_kvp_daemon.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/tools/hv/hv_kvp_daemon.c	2018-09-26 02:33:59.000000000 -0400
@@ -289,7 +289,7 @@ static int kvp_key_delete(int pool, cons
 		 * Found a match; just move the remaining
 		 * entries up.
 		 */
-		if (i == num_records) {
+		if (i == (num_records - 1)) {
 			kvp_file_info[pool].num_records--;
 			kvp_update_file(pool);
 			return 0;
diff -druNp --no-dereference linux-libre-3.18.122-gnu/tools/perf/arch/powerpc/util/skip-callchain-idx.c linux-libre-3.18.123-gnu/tools/perf/arch/powerpc/util/skip-callchain-idx.c
--- linux-libre-3.18.122-gnu/tools/perf/arch/powerpc/util/skip-callchain-idx.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/tools/perf/arch/powerpc/util/skip-callchain-idx.c	2018-09-26 02:33:59.000000000 -0400
@@ -58,9 +58,13 @@ static int check_return_reg(int ra_regno
 	}
 
 	/*
-	 * Check if return address is on the stack.
+	 * Check if return address is on the stack. If return address
+	 * is in a register (typically R0), it is yet to be saved on
+	 * the stack.
 	 */
-	if (nops != 0 || ops != NULL)
+	if ((nops != 0 || ops != NULL) &&
+		!(nops == 1 && ops[0].atom == DW_OP_regx &&
+			ops[0].number2 == 0 && ops[0].offset == 0))
 		return 0;
 
 	/*
@@ -233,7 +237,7 @@ int arch_skip_callchain_idx(struct machi
 	if (!chain || chain->nr < 3)
 		return skip_slot;
 
-	ip = chain->ips[2];
+	ip = chain->ips[1];
 
 	thread__find_addr_location(thread, machine, PERF_RECORD_MISC_USER,
 			MAP__FUNCTION, ip, &al);
diff -druNp --no-dereference linux-libre-3.18.122-gnu/tools/testing/selftests/powerpc/harness.c linux-libre-3.18.123-gnu/tools/testing/selftests/powerpc/harness.c
--- linux-libre-3.18.122-gnu/tools/testing/selftests/powerpc/harness.c	2018-09-09 14:07:57.000000000 -0400
+++ linux-libre-3.18.123-gnu/tools/testing/selftests/powerpc/harness.c	2018-09-26 02:33:59.000000000 -0400
@@ -81,13 +81,13 @@ wait:
 	return status;
 }
 
-static void alarm_handler(int signum)
+static void sig_handler(int signum)
 {
-	/* Jut wake us up from waitpid */
+	/* Just wake us up from waitpid */
 }
 
-static struct sigaction alarm_action = {
-	.sa_handler = alarm_handler,
+static struct sigaction sig_action = {
+	.sa_handler = sig_handler,
 };
 
 int test_harness(int (test_function)(void), char *name)
@@ -97,8 +97,14 @@ int test_harness(int (test_function)(voi
 	test_start(name);
 	test_set_git_version(GIT_VERSION);
 
-	if (sigaction(SIGALRM, &alarm_action, NULL)) {
-		perror("sigaction");
+	if (sigaction(SIGINT, &sig_action, NULL)) {
+		perror("sigaction (sigint)");
+		test_error(name);
+		return 1;
+	}
+
+	if (sigaction(SIGALRM, &sig_action, NULL)) {
+		perror("sigaction (sigalrm)");
 		test_error(name);
 		return 1;
 	}
