diff -druNp --no-dereference linux-libre-3.18.123-gnu/arch/arm/mach-mvebu/pmsu.c linux-libre-3.18.124-gnu/arch/arm/mach-mvebu/pmsu.c
--- linux-libre-3.18.123-gnu/arch/arm/mach-mvebu/pmsu.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/arch/arm/mach-mvebu/pmsu.c	2018-10-13 03:09:32.000000000 -0400
@@ -117,8 +117,8 @@ void mvebu_pmsu_set_cpu_boot_addr(int hw
 		PMSU_BOOT_ADDR_REDIRECT_OFFSET(hw_cpu));
 }
 
-extern unsigned char mvebu_boot_wa_start;
-extern unsigned char mvebu_boot_wa_end;
+extern unsigned char mvebu_boot_wa_start[];
+extern unsigned char mvebu_boot_wa_end[];
 
 /*
  * This function sets up the boot address workaround needed for SMP
@@ -131,7 +131,7 @@ int mvebu_setup_boot_addr_wa(unsigned in
 			     phys_addr_t resume_addr_reg)
 {
 	void __iomem *sram_virt_base;
-	u32 code_len = &mvebu_boot_wa_end - &mvebu_boot_wa_start;
+	u32 code_len = mvebu_boot_wa_end - mvebu_boot_wa_start;
 
 	mvebu_mbus_del_window(BOOTROM_BASE, BOOTROM_SIZE);
 	mvebu_mbus_add_window_by_id(crypto_eng_target, crypto_eng_attribute,
diff -druNp --no-dereference linux-libre-3.18.123-gnu/arch/arm64/include/asm/kvm_emulate.h linux-libre-3.18.124-gnu/arch/arm64/include/asm/kvm_emulate.h
--- linux-libre-3.18.123-gnu/arch/arm64/include/asm/kvm_emulate.h	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/arch/arm64/include/asm/kvm_emulate.h	2018-10-13 03:09:32.000000000 -0400
@@ -38,6 +38,11 @@ void kvm_inject_undefined(struct kvm_vcp
 void kvm_inject_dabt(struct kvm_vcpu *vcpu, unsigned long addr);
 void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr);
 
+static inline bool vcpu_el1_is_32bit(struct kvm_vcpu *vcpu)
+{
+	return !(vcpu->arch.hcr_el2 & HCR_RW);
+}
+
 static inline void vcpu_reset_hcr(struct kvm_vcpu *vcpu)
 {
 	vcpu->arch.hcr_el2 = HCR_GUEST_FLAGS;
diff -druNp --no-dereference linux-libre-3.18.123-gnu/arch/arm64/kernel/entry.S linux-libre-3.18.124-gnu/arch/arm64/kernel/entry.S
--- linux-libre-3.18.123-gnu/arch/arm64/kernel/entry.S	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/arch/arm64/kernel/entry.S	2018-10-13 03:09:32.000000000 -0400
@@ -633,6 +633,9 @@ work_pending:
 	bl	do_notify_resume
 	b	ret_to_user
 work_resched:
+#ifdef CONFIG_TRACE_IRQFLAGS
+	bl	trace_hardirqs_off		// the IRQs are off here, inform the tracing code
+#endif
 	bl	schedule
 
 /*
diff -druNp --no-dereference linux-libre-3.18.123-gnu/arch/arm64/kvm/guest.c linux-libre-3.18.124-gnu/arch/arm64/kvm/guest.c
--- linux-libre-3.18.123-gnu/arch/arm64/kvm/guest.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/arch/arm64/kvm/guest.c	2018-10-13 03:09:32.000000000 -0400
@@ -46,6 +46,45 @@ static u64 core_reg_offset_from_id(u64 i
 	return id & ~(KVM_REG_ARCH_MASK | KVM_REG_SIZE_MASK | KVM_REG_ARM_CORE);
 }
 
+static int validate_core_offset(const struct kvm_one_reg *reg)
+{
+	u64 off = core_reg_offset_from_id(reg->id);
+	int size;
+
+	switch (off) {
+	case KVM_REG_ARM_CORE_REG(regs.regs[0]) ...
+	     KVM_REG_ARM_CORE_REG(regs.regs[30]):
+	case KVM_REG_ARM_CORE_REG(regs.sp):
+	case KVM_REG_ARM_CORE_REG(regs.pc):
+	case KVM_REG_ARM_CORE_REG(regs.pstate):
+	case KVM_REG_ARM_CORE_REG(sp_el1):
+	case KVM_REG_ARM_CORE_REG(elr_el1):
+	case KVM_REG_ARM_CORE_REG(spsr[0]) ...
+	     KVM_REG_ARM_CORE_REG(spsr[KVM_NR_SPSR - 1]):
+		size = sizeof(__u64);
+		break;
+
+	case KVM_REG_ARM_CORE_REG(fp_regs.vregs[0]) ...
+	     KVM_REG_ARM_CORE_REG(fp_regs.vregs[31]):
+		size = sizeof(__uint128_t);
+		break;
+
+	case KVM_REG_ARM_CORE_REG(fp_regs.fpsr):
+	case KVM_REG_ARM_CORE_REG(fp_regs.fpcr):
+		size = sizeof(__u32);
+		break;
+
+	default:
+		return -EINVAL;
+	}
+
+	if (KVM_REG_SIZE(reg->id) == size &&
+	    IS_ALIGNED(off, size / sizeof(__u32)))
+		return 0;
+
+	return -EINVAL;
+}
+
 static int get_core_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
 {
 	/*
@@ -65,6 +104,9 @@ static int get_core_reg(struct kvm_vcpu
 	    (off + (KVM_REG_SIZE(reg->id) / sizeof(__u32))) >= nr_regs)
 		return -ENOENT;
 
+	if (validate_core_offset(reg))
+		return -EINVAL;
+
 	if (copy_to_user(uaddr, ((u32 *)regs) + off, KVM_REG_SIZE(reg->id)))
 		return -EFAULT;
 
@@ -87,6 +129,9 @@ static int set_core_reg(struct kvm_vcpu
 	    (off + (KVM_REG_SIZE(reg->id) / sizeof(__u32))) >= nr_regs)
 		return -ENOENT;
 
+	if (validate_core_offset(reg))
+		return -EINVAL;
+
 	if (KVM_REG_SIZE(reg->id) > sizeof(tmp))
 		return -EINVAL;
 
@@ -96,17 +141,25 @@ static int set_core_reg(struct kvm_vcpu
 	}
 
 	if (off == KVM_REG_ARM_CORE_REG(regs.pstate)) {
-		u32 mode = (*(u32 *)valp) & COMPAT_PSR_MODE_MASK;
+		u64 mode = (*(u64 *)valp) & COMPAT_PSR_MODE_MASK;
 		switch (mode) {
 		case COMPAT_PSR_MODE_USR:
+			if ((read_cpuid(ID_AA64PFR0_EL1) & 0xf) != 2)
+				return -EINVAL;
+			break;
 		case COMPAT_PSR_MODE_FIQ:
 		case COMPAT_PSR_MODE_IRQ:
 		case COMPAT_PSR_MODE_SVC:
 		case COMPAT_PSR_MODE_ABT:
 		case COMPAT_PSR_MODE_UND:
+			if (!vcpu_el1_is_32bit(vcpu))
+				return -EINVAL;
+			break;
 		case PSR_MODE_EL0t:
 		case PSR_MODE_EL1t:
 		case PSR_MODE_EL1h:
+			if (vcpu_el1_is_32bit(vcpu))
+				return -EINVAL;
 			break;
 		default:
 			err = -EINVAL;
diff -druNp --no-dereference linux-libre-3.18.123-gnu/arch/hexagon/include/asm/bitops.h linux-libre-3.18.124-gnu/arch/hexagon/include/asm/bitops.h
--- linux-libre-3.18.123-gnu/arch/hexagon/include/asm/bitops.h	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/arch/hexagon/include/asm/bitops.h	2018-10-13 03:09:32.000000000 -0400
@@ -211,7 +211,7 @@ static inline long ffz(int x)
  * This is defined the same way as ffs.
  * Note fls(0) = 0, fls(1) = 1, fls(0x80000000) = 32.
  */
-static inline long fls(int x)
+static inline int fls(int x)
 {
 	int r;
 
@@ -232,7 +232,7 @@ static inline long fls(int x)
  * the libc and compiler builtin ffs routines, therefore
  * differs in spirit from the above ffz (man ffs).
  */
-static inline long ffs(int x)
+static inline int ffs(int x)
 {
 	int r;
 
diff -druNp --no-dereference linux-libre-3.18.123-gnu/arch/hexagon/kernel/dma.c linux-libre-3.18.124-gnu/arch/hexagon/kernel/dma.c
--- linux-libre-3.18.123-gnu/arch/hexagon/kernel/dma.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/arch/hexagon/kernel/dma.c	2018-10-13 03:09:32.000000000 -0400
@@ -79,7 +79,7 @@ static void *hexagon_dma_alloc_coherent(
 			panic("Can't create %s() memory pool!", __func__);
 		else
 			gen_pool_add(coherent_pool,
-				pfn_to_virt(max_low_pfn),
+				(unsigned long)pfn_to_virt(max_low_pfn),
 				hexagon_coherent_pool_size, -1);
 	}
 
diff -druNp --no-dereference linux-libre-3.18.123-gnu/arch/powerpc/kernel/machine_kexec.c linux-libre-3.18.124-gnu/arch/powerpc/kernel/machine_kexec.c
--- linux-libre-3.18.123-gnu/arch/powerpc/kernel/machine_kexec.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/arch/powerpc/kernel/machine_kexec.c	2018-10-13 03:09:32.000000000 -0400
@@ -186,7 +186,12 @@ void __init reserve_crashkernel(void)
 			(unsigned long)(crashk_res.start >> 20),
 			(unsigned long)(memblock_phys_mem_size() >> 20));
 
-	memblock_reserve(crashk_res.start, crash_size);
+	if (!memblock_is_region_memory(crashk_res.start, crash_size) ||
+	    memblock_reserve(crashk_res.start, crash_size)) {
+		pr_err("Failed to reserve memory for crashkernel!\n");
+		crashk_res.start = crashk_res.end = 0;
+		return;
+	}
 }
 
 int overlaps_crashkernel(unsigned long start, unsigned long size)
diff -druNp --no-dereference linux-libre-3.18.123-gnu/arch/powerpc/kvm/book3s_64_mmu_hv.c linux-libre-3.18.124-gnu/arch/powerpc/kvm/book3s_64_mmu_hv.c
--- linux-libre-3.18.123-gnu/arch/powerpc/kvm/book3s_64_mmu_hv.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/arch/powerpc/kvm/book3s_64_mmu_hv.c	2018-10-13 03:09:32.000000000 -0400
@@ -449,7 +449,7 @@ static int kvmppc_mmu_book3s_64_hv_xlate
 	unsigned long pp, key;
 	unsigned long v, gr;
 	__be64 *hptep;
-	int index;
+	long int index;
 	int virtmode = vcpu->arch.shregs.msr & (data ? MSR_DR : MSR_IR);
 
 	/* Get SLB entry */
diff -druNp --no-dereference linux-libre-3.18.123-gnu/arch/s390/mm/extmem.c linux-libre-3.18.124-gnu/arch/s390/mm/extmem.c
--- linux-libre-3.18.123-gnu/arch/s390/mm/extmem.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/arch/s390/mm/extmem.c	2018-10-13 03:09:32.000000000 -0400
@@ -80,7 +80,7 @@ struct qin64 {
 struct dcss_segment {
 	struct list_head list;
 	char dcss_name[8];
-	char res_name[15];
+	char res_name[16];
 	unsigned long start_addr;
 	unsigned long end;
 	atomic_t ref_count;
@@ -445,7 +445,7 @@ __segment_load (char *name, int do_nonsh
 	memcpy(&seg->res_name, seg->dcss_name, 8);
 	EBCASC(seg->res_name, 8);
 	seg->res_name[8] = '\0';
-	strncat(seg->res_name, " (DCSS)", 7);
+	strlcat(seg->res_name, " (DCSS)", sizeof(seg->res_name));
 	seg->res->name = seg->res_name;
 	rc = seg->vm_segtype;
 	if (rc == SEG_TYPE_SC ||
diff -druNp --no-dereference linux-libre-3.18.123-gnu/arch/x86/kernel/tsc_msr.c linux-libre-3.18.124-gnu/arch/x86/kernel/tsc_msr.c
--- linux-libre-3.18.123-gnu/arch/x86/kernel/tsc_msr.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/arch/x86/kernel/tsc_msr.c	2018-10-13 03:09:32.000000000 -0400
@@ -21,6 +21,7 @@
 #include <asm/setup.h>
 #include <asm/apic.h>
 #include <asm/param.h>
+#include <asm/tsc.h>
 
 /* CPU reference clock frequency: in KHz */
 #define FREQ_83		83200
diff -druNp --no-dereference linux-libre-3.18.123-gnu/arch/x86/mm/numa_emulation.c linux-libre-3.18.124-gnu/arch/x86/mm/numa_emulation.c
--- linux-libre-3.18.123-gnu/arch/x86/mm/numa_emulation.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/arch/x86/mm/numa_emulation.c	2018-10-13 03:09:32.000000000 -0400
@@ -60,7 +60,7 @@ static int __init emu_setup_memblk(struc
 	eb->nid = nid;
 
 	if (emu_nid_to_phys[nid] == NUMA_NO_NODE)
-		emu_nid_to_phys[nid] = nid;
+		emu_nid_to_phys[nid] = pb->nid;
 
 	pb->start += size;
 	if (pb->start >= pb->end) {
diff -druNp --no-dereference linux-libre-3.18.123-gnu/arch/x86/vdso/vclock_gettime.c linux-libre-3.18.124-gnu/arch/x86/vdso/vclock_gettime.c
--- linux-libre-3.18.123-gnu/arch/x86/vdso/vclock_gettime.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/arch/x86/vdso/vclock_gettime.c	2018-10-13 03:09:32.000000000 -0400
@@ -46,8 +46,9 @@ static notrace cycle_t vread_hpet(void)
 notrace static long vdso_fallback_gettime(long clock, struct timespec *ts)
 {
 	long ret;
-	asm("syscall" : "=a" (ret) :
-	    "0" (__NR_clock_gettime), "D" (clock), "S" (ts) : "memory");
+	asm ("syscall" : "=a" (ret), "=m" (*ts) :
+	     "0" (__NR_clock_gettime), "D" (clock), "S" (ts) :
+	     "memory", "rcx", "r11");
 	return ret;
 }
 
@@ -55,8 +56,9 @@ notrace static long vdso_fallback_gtod(s
 {
 	long ret;
 
-	asm("syscall" : "=a" (ret) :
-	    "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "memory");
+	asm ("syscall" : "=a" (ret), "=m" (*tv), "=m" (*tz) :
+	     "0" (__NR_gettimeofday), "D" (tv), "S" (tz) :
+	     "memory", "rcx", "r11");
 	return ret;
 }
 
@@ -136,13 +138,13 @@ notrace static long vdso_fallback_gettim
 {
 	long ret;
 
-	asm(
+	asm (
 		"mov %%ebx, %%edx \n"
-		"mov %2, %%ebx \n"
+		"mov %[clock], %%ebx \n"
 		"call __kernel_vsyscall \n"
 		"mov %%edx, %%ebx \n"
-		: "=a" (ret)
-		: "0" (__NR_clock_gettime), "g" (clock), "c" (ts)
+		: "=a" (ret), "=m" (*ts)
+		: "0" (__NR_clock_gettime), [clock] "g" (clock), "c" (ts)
 		: "memory", "edx");
 	return ret;
 }
@@ -151,13 +153,13 @@ notrace static long vdso_fallback_gtod(s
 {
 	long ret;
 
-	asm(
+	asm (
 		"mov %%ebx, %%edx \n"
-		"mov %2, %%ebx \n"
+		"mov %[tv], %%ebx \n"
 		"call __kernel_vsyscall \n"
 		"mov %%edx, %%ebx \n"
-		: "=a" (ret)
-		: "0" (__NR_gettimeofday), "g" (tv), "c" (tz)
+		: "=a" (ret), "=m" (*tv), "=m" (*tz)
+		: "0" (__NR_gettimeofday), [tv] "g" (tv), "c" (tz)
 		: "memory", "edx");
 	return ret;
 }
diff -druNp --no-dereference linux-libre-3.18.123-gnu/crypto/ablkcipher.c linux-libre-3.18.124-gnu/crypto/ablkcipher.c
--- linux-libre-3.18.123-gnu/crypto/ablkcipher.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/crypto/ablkcipher.c	2018-10-13 03:09:32.000000000 -0400
@@ -382,6 +382,7 @@ static int crypto_ablkcipher_report(stru
 	strncpy(rblkcipher.type, "ablkcipher", sizeof(rblkcipher.type));
 	strncpy(rblkcipher.geniv, alg->cra_ablkcipher.geniv ?: "<default>",
 		sizeof(rblkcipher.geniv));
+	rblkcipher.geniv[sizeof(rblkcipher.geniv) - 1] = '\0';
 
 	rblkcipher.blocksize = alg->cra_blocksize;
 	rblkcipher.min_keysize = alg->cra_ablkcipher.min_keysize;
@@ -463,6 +464,7 @@ static int crypto_givcipher_report(struc
 	strncpy(rblkcipher.type, "givcipher", sizeof(rblkcipher.type));
 	strncpy(rblkcipher.geniv, alg->cra_ablkcipher.geniv ?: "<built-in>",
 		sizeof(rblkcipher.geniv));
+	rblkcipher.geniv[sizeof(rblkcipher.geniv) - 1] = '\0';
 
 	rblkcipher.blocksize = alg->cra_blocksize;
 	rblkcipher.min_keysize = alg->cra_ablkcipher.min_keysize;
diff -druNp --no-dereference linux-libre-3.18.123-gnu/crypto/blkcipher.c linux-libre-3.18.124-gnu/crypto/blkcipher.c
--- linux-libre-3.18.123-gnu/crypto/blkcipher.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/crypto/blkcipher.c	2018-10-13 03:09:32.000000000 -0400
@@ -514,6 +514,7 @@ static int crypto_blkcipher_report(struc
 	strncpy(rblkcipher.type, "blkcipher", sizeof(rblkcipher.type));
 	strncpy(rblkcipher.geniv, alg->cra_blkcipher.geniv ?: "<default>",
 		sizeof(rblkcipher.geniv));
+	rblkcipher.geniv[sizeof(rblkcipher.geniv) - 1] = '\0';
 
 	rblkcipher.blocksize = alg->cra_blocksize;
 	rblkcipher.min_keysize = alg->cra_blkcipher.min_keysize;
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/base/power/main.c linux-libre-3.18.124-gnu/drivers/base/power/main.c
--- linux-libre-3.18.123-gnu/drivers/base/power/main.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/base/power/main.c	2018-10-13 03:09:32.000000000 -0400
@@ -1341,8 +1341,10 @@ static int __device_suspend(struct devic
 
 	dpm_wait_for_children(dev, async);
 
-	if (async_error)
+	if (async_error) {
+		dev->power.direct_complete = false;
 		goto Complete;
+	}
 
 	/*
 	 * If a device configured to wake up the system from sleep states
@@ -1354,6 +1356,7 @@ static int __device_suspend(struct devic
 		pm_wakeup_event(dev, 0);
 
 	if (pm_wakeup_pending()) {
+		dev->power.direct_complete = false;
 		async_error = -EBUSY;
 		goto Complete;
 	}
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/block/floppy.c linux-libre-3.18.124-gnu/drivers/block/floppy.c
--- linux-libre-3.18.123-gnu/drivers/block/floppy.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/block/floppy.c	2018-10-13 03:09:32.000000000 -0400
@@ -3459,6 +3459,9 @@ static int fd_locked_ioctl(struct block_
 					  (struct floppy_struct **)&outparam);
 		if (ret)
 			return ret;
+		memcpy(&inparam.g, outparam,
+				offsetof(struct floppy_struct, name));
+		outparam = &inparam.g;
 		break;
 	case FDMSGON:
 		UDP->flags |= FTD_MSG;
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/crypto/mxs-dcp.c linux-libre-3.18.124-gnu/drivers/crypto/mxs-dcp.c
--- linux-libre-3.18.123-gnu/drivers/crypto/mxs-dcp.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/crypto/mxs-dcp.c	2018-10-13 03:09:32.000000000 -0400
@@ -63,7 +63,7 @@ struct dcp {
 	struct dcp_coherent_block	*coh;
 
 	struct completion		completion[DCP_MAX_CHANS];
-	struct mutex			mutex[DCP_MAX_CHANS];
+	spinlock_t			lock[DCP_MAX_CHANS];
 	struct task_struct		*thread[DCP_MAX_CHANS];
 	struct crypto_queue		queue[DCP_MAX_CHANS];
 };
@@ -349,13 +349,20 @@ static int dcp_chan_thread_aes(void *dat
 
 	int ret;
 
-	do {
-		__set_current_state(TASK_INTERRUPTIBLE);
+	while (!kthread_should_stop()) {
+		set_current_state(TASK_INTERRUPTIBLE);
 
-		mutex_lock(&sdcp->mutex[chan]);
+		spin_lock(&sdcp->lock[chan]);
 		backlog = crypto_get_backlog(&sdcp->queue[chan]);
 		arq = crypto_dequeue_request(&sdcp->queue[chan]);
-		mutex_unlock(&sdcp->mutex[chan]);
+		spin_unlock(&sdcp->lock[chan]);
+
+		if (!backlog && !arq) {
+			schedule();
+			continue;
+		}
+
+		set_current_state(TASK_RUNNING);
 
 		if (backlog)
 			backlog->complete(backlog, -EINPROGRESS);
@@ -363,11 +370,8 @@ static int dcp_chan_thread_aes(void *dat
 		if (arq) {
 			ret = mxs_dcp_aes_block_crypt(arq);
 			arq->complete(arq, ret);
-			continue;
 		}
-
-		schedule();
-	} while (!kthread_should_stop());
+	}
 
 	return 0;
 }
@@ -407,9 +411,9 @@ static int mxs_dcp_aes_enqueue(struct ab
 	rctx->ecb = ecb;
 	actx->chan = DCP_CHAN_CRYPTO;
 
-	mutex_lock(&sdcp->mutex[actx->chan]);
+	spin_lock(&sdcp->lock[actx->chan]);
 	ret = crypto_enqueue_request(&sdcp->queue[actx->chan], &req->base);
-	mutex_unlock(&sdcp->mutex[actx->chan]);
+	spin_unlock(&sdcp->lock[actx->chan]);
 
 	wake_up_process(sdcp->thread[actx->chan]);
 
@@ -645,13 +649,20 @@ static int dcp_chan_thread_sha(void *dat
 	struct ahash_request *req;
 	int ret, fini;
 
-	do {
-		__set_current_state(TASK_INTERRUPTIBLE);
+	while (!kthread_should_stop()) {
+		set_current_state(TASK_INTERRUPTIBLE);
 
-		mutex_lock(&sdcp->mutex[chan]);
+		spin_lock(&sdcp->lock[chan]);
 		backlog = crypto_get_backlog(&sdcp->queue[chan]);
 		arq = crypto_dequeue_request(&sdcp->queue[chan]);
-		mutex_unlock(&sdcp->mutex[chan]);
+		spin_unlock(&sdcp->lock[chan]);
+
+		if (!backlog && !arq) {
+			schedule();
+			continue;
+		}
+
+		set_current_state(TASK_RUNNING);
 
 		if (backlog)
 			backlog->complete(backlog, -EINPROGRESS);
@@ -663,12 +674,8 @@ static int dcp_chan_thread_sha(void *dat
 			ret = dcp_sha_req_to_buf(arq);
 			fini = rctx->fini;
 			arq->complete(arq, ret);
-			if (!fini)
-				continue;
 		}
-
-		schedule();
-	} while (!kthread_should_stop());
+	}
 
 	return 0;
 }
@@ -726,9 +733,9 @@ static int dcp_sha_update_fx(struct ahas
 		rctx->init = 1;
 	}
 
-	mutex_lock(&sdcp->mutex[actx->chan]);
+	spin_lock(&sdcp->lock[actx->chan]);
 	ret = crypto_enqueue_request(&sdcp->queue[actx->chan], &req->base);
-	mutex_unlock(&sdcp->mutex[actx->chan]);
+	spin_unlock(&sdcp->lock[actx->chan]);
 
 	wake_up_process(sdcp->thread[actx->chan]);
 	mutex_unlock(&actx->mutex);
@@ -984,7 +991,7 @@ static int mxs_dcp_probe(struct platform
 	platform_set_drvdata(pdev, sdcp);
 
 	for (i = 0; i < DCP_MAX_CHANS; i++) {
-		mutex_init(&sdcp->mutex[i]);
+		spin_lock_init(&sdcp->lock[i]);
 		init_completion(&sdcp->completion[i]);
 		crypto_init_queue(&sdcp->queue[i], 50);
 	}
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/gpio/gpio-adp5588.c linux-libre-3.18.124-gnu/drivers/gpio/gpio-adp5588.c
--- linux-libre-3.18.123-gnu/drivers/gpio/gpio-adp5588.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/gpio/gpio-adp5588.c	2018-10-13 03:09:32.000000000 -0400
@@ -41,6 +41,8 @@ struct adp5588_gpio {
 	uint8_t int_en[3];
 	uint8_t irq_mask[3];
 	uint8_t irq_stat[3];
+	uint8_t int_input_en[3];
+	uint8_t int_lvl_cached[3];
 };
 
 static int adp5588_gpio_read(struct i2c_client *client, u8 reg)
@@ -177,12 +179,28 @@ static void adp5588_irq_bus_sync_unlock(
 	struct adp5588_gpio *dev = irq_data_get_irq_chip_data(d);
 	int i;
 
-	for (i = 0; i <= ADP5588_BANK(ADP5588_MAXGPIO); i++)
+	for (i = 0; i <= ADP5588_BANK(ADP5588_MAXGPIO); i++) {
+		if (dev->int_input_en[i]) {
+			mutex_lock(&dev->lock);
+			dev->dir[i] &= ~dev->int_input_en[i];
+			dev->int_input_en[i] = 0;
+			adp5588_gpio_write(dev->client, GPIO_DIR1 + i,
+					   dev->dir[i]);
+			mutex_unlock(&dev->lock);
+		}
+
+		if (dev->int_lvl_cached[i] != dev->int_lvl[i]) {
+			dev->int_lvl_cached[i] = dev->int_lvl[i];
+			adp5588_gpio_write(dev->client, GPIO_INT_LVL1 + i,
+					   dev->int_lvl[i]);
+		}
+
 		if (dev->int_en[i] ^ dev->irq_mask[i]) {
 			dev->int_en[i] = dev->irq_mask[i];
 			adp5588_gpio_write(dev->client, GPIO_INT_EN1 + i,
 					   dev->int_en[i]);
 		}
+	}
 
 	mutex_unlock(&dev->irq_lock);
 }
@@ -225,9 +243,7 @@ static int adp5588_irq_set_type(struct i
 	else
 		return -EINVAL;
 
-	adp5588_gpio_direction_input(&dev->gpio_chip, gpio);
-	adp5588_gpio_write(dev->client, GPIO_INT_LVL1 + bank,
-			   dev->int_lvl[bank]);
+	dev->int_input_en[bank] |= bit;
 
 	return 0;
 }
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/hid/hid-core.c linux-libre-3.18.124-gnu/drivers/hid/hid-core.c
--- linux-libre-3.18.123-gnu/drivers/hid/hid-core.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/hid/hid-core.c	2018-10-13 03:09:32.000000000 -0400
@@ -1935,6 +1935,9 @@ static const struct hid_device_id hid_ha
 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS3_CONTROLLER) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER) },
 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_2) },
+	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_2) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_DONGLE) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_VAIO_VGX_MOUSE) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_VAIO_VGP_MOUSE) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_SRWS1) },
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/hid/hid-ids.h linux-libre-3.18.124-gnu/drivers/hid/hid-ids.h
--- linux-libre-3.18.123-gnu/drivers/hid/hid-ids.h	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/hid/hid-ids.h	2018-10-13 03:09:32.000000000 -0400
@@ -846,6 +846,8 @@
 #define USB_DEVICE_ID_SONY_PS3_BDREMOTE		0x0306
 #define USB_DEVICE_ID_SONY_PS3_CONTROLLER	0x0268
 #define USB_DEVICE_ID_SONY_PS4_CONTROLLER	0x05c4
+#define USB_DEVICE_ID_SONY_PS4_CONTROLLER_2	0x09cc
+#define USB_DEVICE_ID_SONY_PS4_CONTROLLER_DONGLE	0x0ba0
 #define USB_DEVICE_ID_SONY_NAVIGATION_CONTROLLER	0x042f
 #define USB_DEVICE_ID_SONY_BUZZ_CONTROLLER		0x0002
 #define USB_DEVICE_ID_SONY_WIRELESS_BUZZ_CONTROLLER	0x1000
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/hid/hid-ntrig.c linux-libre-3.18.124-gnu/drivers/hid/hid-ntrig.c
--- linux-libre-3.18.123-gnu/drivers/hid/hid-ntrig.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/hid/hid-ntrig.c	2018-10-13 03:09:32.000000000 -0400
@@ -953,6 +953,8 @@ static int ntrig_probe(struct hid_device
 
 	ret = sysfs_create_group(&hdev->dev.kobj,
 			&ntrig_attribute_group);
+	if (ret)
+		hid_err(hdev, "cannot create sysfs group\n");
 
 	return 0;
 err_free:
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/hid/hid-sony.c linux-libre-3.18.124-gnu/drivers/hid/hid-sony.c
--- linux-libre-3.18.123-gnu/drivers/hid/hid-sony.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/hid/hid-sony.c	2018-10-13 03:09:32.000000000 -0400
@@ -2042,6 +2042,12 @@ static const struct hid_device_id sony_d
 		.driver_data = DUALSHOCK4_CONTROLLER_USB },
 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER),
 		.driver_data = DUALSHOCK4_CONTROLLER_BT },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_2),
+		.driver_data = DUALSHOCK4_CONTROLLER_USB },
+	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_2),
+		.driver_data = DUALSHOCK4_CONTROLLER_BT },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_DONGLE),
+		.driver_data = DUALSHOCK4_CONTROLLER_USB },
 	{ }
 };
 MODULE_DEVICE_TABLE(hid, sony_devices);
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/hwmon/adt7475.c linux-libre-3.18.124-gnu/drivers/hwmon/adt7475.c
--- linux-libre-3.18.123-gnu/drivers/hwmon/adt7475.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/hwmon/adt7475.c	2018-10-13 03:09:32.000000000 -0400
@@ -274,14 +274,18 @@ static inline u16 volt2reg(int channel,
 	return clamp_val(reg, 0, 1023) & (0xff << 2);
 }
 
-static u16 adt7475_read_word(struct i2c_client *client, int reg)
+static int adt7475_read_word(struct i2c_client *client, int reg)
 {
-	u16 val;
+	int val1, val2;
 
-	val = i2c_smbus_read_byte_data(client, reg);
-	val |= (i2c_smbus_read_byte_data(client, reg + 1) << 8);
+	val1 = i2c_smbus_read_byte_data(client, reg);
+	if (val1 < 0)
+		return val1;
+	val2 = i2c_smbus_read_byte_data(client, reg + 1);
+	if (val2 < 0)
+		return val2;
 
-	return val;
+	return val1 | (val2 << 8);
 }
 
 static void adt7475_write_word(struct i2c_client *client, int reg, u16 val)
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/infiniband/core/ucma.c linux-libre-3.18.124-gnu/drivers/infiniband/core/ucma.c
--- linux-libre-3.18.123-gnu/drivers/infiniband/core/ucma.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/infiniband/core/ucma.c	2018-10-13 03:09:32.000000000 -0400
@@ -113,6 +113,8 @@ static DEFINE_MUTEX(mut);
 static DEFINE_IDR(ctx_idr);
 static DEFINE_IDR(multicast_idr);
 
+static const struct file_operations ucma_fops;
+
 static inline struct ucma_context *_ucma_find_context(int id,
 						      struct ucma_file *file)
 {
@@ -1416,6 +1418,10 @@ static ssize_t ucma_migrate_id(struct uc
 	f = fdget(cmd.fd);
 	if (!f.file)
 		return -ENOENT;
+	if (f.file->f_op != &ucma_fops) {
+		ret = -EINVAL;
+		goto file_put;
+	}
 
 	/* Validate current fd and prevent destruction of id. */
 	ctx = ucma_get_ctx(f.file->private_data, cmd.id);
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/md/dm-thin.c linux-libre-3.18.124-gnu/drivers/md/dm-thin.c
--- linux-libre-3.18.123-gnu/drivers/md/dm-thin.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/md/dm-thin.c	2018-10-13 03:09:32.000000000 -0400
@@ -140,7 +140,13 @@ struct dm_thin_new_mapping;
 enum pool_mode {
 	PM_WRITE,		/* metadata may be changed */
 	PM_OUT_OF_DATA_SPACE,	/* metadata may be changed, though data may not be allocated */
+
+	/*
+	 * Like READ_ONLY, except may switch back to WRITE on metadata resize. Reported as READ_ONLY.
+	 */
+	PM_OUT_OF_METADATA_SPACE,
 	PM_READ_ONLY,		/* metadata may not be changed */
+
 	PM_FAIL,		/* all I/O fails */
 };
 
@@ -994,7 +1000,35 @@ static void set_pool_mode(struct pool *p
 
 static void requeue_bios(struct pool *pool);
 
-static void check_for_space(struct pool *pool)
+static bool is_read_only_pool_mode(enum pool_mode mode)
+{
+	return (mode == PM_OUT_OF_METADATA_SPACE || mode == PM_READ_ONLY);
+}
+
+static bool is_read_only(struct pool *pool)
+{
+	return is_read_only_pool_mode(get_pool_mode(pool));
+}
+
+static void check_for_metadata_space(struct pool *pool)
+{
+	int r;
+	const char *ooms_reason = NULL;
+	dm_block_t nr_free;
+
+	r = dm_pool_get_free_metadata_block_count(pool->pmd, &nr_free);
+	if (r)
+		ooms_reason = "Could not get free metadata blocks";
+	else if (!nr_free)
+		ooms_reason = "No free metadata blocks";
+
+	if (ooms_reason && !is_read_only(pool)) {
+		DMERR("%s", ooms_reason);
+		set_pool_mode(pool, PM_OUT_OF_METADATA_SPACE);
+	}
+}
+
+static void check_for_data_space(struct pool *pool)
 {
 	int r;
 	dm_block_t nr_free;
@@ -1020,14 +1054,16 @@ static int commit(struct pool *pool)
 {
 	int r;
 
-	if (get_pool_mode(pool) >= PM_READ_ONLY)
+	if (get_pool_mode(pool) >= PM_OUT_OF_METADATA_SPACE)
 		return -EINVAL;
 
 	r = dm_pool_commit_metadata(pool->pmd);
 	if (r)
 		metadata_operation_failed(pool, "dm_pool_commit_metadata", r);
-	else
-		check_for_space(pool);
+	else {
+		check_for_metadata_space(pool);
+		check_for_data_space(pool);
+	}
 
 	return r;
 }
@@ -1093,6 +1129,19 @@ static int alloc_data_block(struct thin_
 		return r;
 	}
 
+	r = dm_pool_get_free_metadata_block_count(pool->pmd, &free_blocks);
+	if (r) {
+		metadata_operation_failed(pool, "dm_pool_get_free_metadata_block_count", r);
+		return r;
+	}
+
+	if (!free_blocks) {
+		/* Let's commit before we use up the metadata reserve. */
+		r = commit(pool);
+		if (r)
+			return r;
+	}
+
 	return 0;
 }
 
@@ -1124,6 +1173,7 @@ static int should_error_unserviceable_bi
 	case PM_OUT_OF_DATA_SPACE:
 		return pool->pf.error_if_no_space ? -ENOSPC : 0;
 
+	case PM_OUT_OF_METADATA_SPACE:
 	case PM_READ_ONLY:
 	case PM_FAIL:
 		return -EIO;
@@ -1823,8 +1873,9 @@ static void set_pool_mode(struct pool *p
 		error_retry_list(pool);
 		break;
 
+	case PM_OUT_OF_METADATA_SPACE:
 	case PM_READ_ONLY:
-		if (old_mode != new_mode)
+		if (!is_read_only_pool_mode(old_mode))
 			notify_of_pool_mode_change(pool, "read-only");
 		dm_pool_metadata_read_only(pool->pmd);
 		pool->process_bio = process_bio_read_only;
@@ -2727,6 +2778,10 @@ static int maybe_resize_metadata_dev(str
 		DMINFO("%s: growing the metadata device from %llu to %llu blocks",
 		       dm_device_name(pool->pool_md),
 		       sb_metadata_dev_size, metadata_dev_size);
+
+		if (get_pool_mode(pool) == PM_OUT_OF_METADATA_SPACE)
+			set_pool_mode(pool, PM_WRITE);
+
 		r = dm_pool_resize_metadata_dev(pool->pmd, metadata_dev_size);
 		if (r) {
 			metadata_operation_failed(pool, "dm_pool_resize_metadata_dev", r);
@@ -2974,7 +3029,7 @@ static int pool_message(struct dm_target
 	struct pool_c *pt = ti->private;
 	struct pool *pool = pt->pool;
 
-	if (get_pool_mode(pool) >= PM_READ_ONLY) {
+	if (get_pool_mode(pool) >= PM_OUT_OF_METADATA_SPACE) {
 		DMERR("%s: unable to service pool target messages in READ_ONLY or FAIL mode",
 		      dm_device_name(pool->pool_md));
 		return -EINVAL;
@@ -3047,6 +3102,7 @@ static void pool_status(struct dm_target
 	dm_block_t nr_blocks_data;
 	dm_block_t nr_blocks_metadata;
 	dm_block_t held_root;
+	enum pool_mode mode;
 	char buf[BDEVNAME_SIZE];
 	char buf2[BDEVNAME_SIZE];
 	struct pool_c *pt = ti->private;
@@ -3117,9 +3173,10 @@ static void pool_status(struct dm_target
 		else
 			DMEMIT("- ");
 
-		if (pool->pf.mode == PM_OUT_OF_DATA_SPACE)
+		mode = get_pool_mode(pool);
+		if (mode == PM_OUT_OF_DATA_SPACE)
 			DMEMIT("out_of_data_space ");
-		else if (pool->pf.mode == PM_READ_ONLY)
+		else if (is_read_only_pool_mode(mode))
 			DMEMIT("ro ");
 		else
 			DMEMIT("rw ");
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/md/dm-thin-metadata.c linux-libre-3.18.124-gnu/drivers/md/dm-thin-metadata.c
--- linux-libre-3.18.123-gnu/drivers/md/dm-thin-metadata.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/md/dm-thin-metadata.c	2018-10-13 03:09:32.000000000 -0400
@@ -191,6 +191,12 @@ struct dm_pool_metadata {
 	bool read_only:1;
 
 	/*
+	 * We reserve a section of the metadata for commit overhead.
+	 * All reported space does *not* include this.
+	 */
+	dm_block_t metadata_reserve;
+
+	/*
 	 * Set if a transaction has to be aborted but the attempt to roll back
 	 * to the previous (good) transaction failed.  The only pool metadata
 	 * operation possible in this state is the closing of the device.
@@ -824,6 +830,20 @@ static int __commit_transaction(struct d
 	return dm_tm_commit(pmd->tm, sblock);
 }
 
+static void __set_metadata_reserve(struct dm_pool_metadata *pmd)
+{
+	int r;
+	dm_block_t total;
+	dm_block_t max_blocks = 4096; /* 16M */
+
+	r = dm_sm_get_nr_blocks(pmd->metadata_sm, &total);
+	if (r) {
+		DMERR("could not get size of metadata device");
+		pmd->metadata_reserve = max_blocks;
+	} else
+		pmd->metadata_reserve = min(max_blocks, div_u64(total, 10));
+}
+
 struct dm_pool_metadata *dm_pool_metadata_open(struct block_device *bdev,
 					       sector_t data_block_size,
 					       bool format_device)
@@ -858,6 +878,8 @@ struct dm_pool_metadata *dm_pool_metadat
 		return ERR_PTR(r);
 	}
 
+	__set_metadata_reserve(pmd);
+
 	return pmd;
 }
 
@@ -1625,6 +1647,13 @@ int dm_pool_get_free_metadata_block_coun
 	down_read(&pmd->root_lock);
 	if (!pmd->fail_io)
 		r = dm_sm_get_nr_free(pmd->metadata_sm, result);
+
+	if (!r) {
+		if (*result < pmd->metadata_reserve)
+			*result = 0;
+		else
+			*result -= pmd->metadata_reserve;
+	}
 	up_read(&pmd->root_lock);
 
 	return r;
@@ -1746,8 +1775,11 @@ int dm_pool_resize_metadata_dev(struct d
 	int r = -EINVAL;
 
 	down_write(&pmd->root_lock);
-	if (!pmd->fail_io)
+	if (!pmd->fail_io) {
 		r = __resize_space_map(pmd->metadata_sm, new_count);
+		if (!r)
+			__set_metadata_reserve(pmd);
+	}
 	up_write(&pmd->root_lock);
 
 	return r;
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/md/raid10.c linux-libre-3.18.124-gnu/drivers/md/raid10.c
--- linux-libre-3.18.123-gnu/drivers/md/raid10.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/md/raid10.c	2018-10-13 03:09:32.000000000 -0400
@@ -4423,11 +4423,12 @@ static sector_t reshape_request(struct m
 		allow_barrier(conf);
 	}
 
+	raise_barrier(conf, 0);
 read_more:
 	/* Now schedule reads for blocks from sector_nr to last */
 	r10_bio = mempool_alloc(conf->r10buf_pool, GFP_NOIO);
 	r10_bio->state = 0;
-	raise_barrier(conf, sectors_done != 0);
+	raise_barrier(conf, 1);
 	atomic_set(&r10_bio->remaining, 0);
 	r10_bio->mddev = mddev;
 	r10_bio->sector = sector_nr;
@@ -4532,6 +4533,8 @@ bio_full:
 	if (sector_nr <= last)
 		goto read_more;
 
+	lower_barrier(conf);
+
 	/* Now that we have done the whole section we can
 	 * update reshape_progress
 	 */
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/media/i2c/soc_camera/ov772x.c linux-libre-3.18.124-gnu/drivers/media/i2c/soc_camera/ov772x.c
--- linux-libre-3.18.123-gnu/drivers/media/i2c/soc_camera/ov772x.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/media/i2c/soc_camera/ov772x.c	2018-10-13 03:09:32.000000000 -0400
@@ -834,7 +834,7 @@ static int ov772x_set_params(struct ov77
 	 * set COM8
 	 */
 	if (priv->band_filter) {
-		ret = ov772x_mask_set(client, COM8, BNDF_ON_OFF, 1);
+		ret = ov772x_mask_set(client, COM8, BNDF_ON_OFF, BNDF_ON_OFF);
 		if (!ret)
 			ret = ov772x_mask_set(client, BDBASE,
 					      0xff, 256 - priv->band_filter);
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/media/platform/exynos4-is/fimc-isp-video.c linux-libre-3.18.124-gnu/drivers/media/platform/exynos4-is/fimc-isp-video.c
--- linux-libre-3.18.123-gnu/drivers/media/platform/exynos4-is/fimc-isp-video.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/media/platform/exynos4-is/fimc-isp-video.c	2018-10-13 03:09:32.000000000 -0400
@@ -389,12 +389,17 @@ static void __isp_video_try_fmt(struct f
 				struct v4l2_pix_format_mplane *pixm,
 				const struct fimc_fmt **fmt)
 {
-	*fmt = fimc_isp_find_format(&pixm->pixelformat, NULL, 2);
+	const struct fimc_fmt *__fmt;
+
+	__fmt = fimc_isp_find_format(&pixm->pixelformat, NULL, 2);
+
+	if (fmt)
+		*fmt = __fmt;
 
 	pixm->colorspace = V4L2_COLORSPACE_SRGB;
 	pixm->field = V4L2_FIELD_NONE;
-	pixm->num_planes = (*fmt)->memplanes;
-	pixm->pixelformat = (*fmt)->fourcc;
+	pixm->num_planes = __fmt->memplanes;
+	pixm->pixelformat = __fmt->fourcc;
 	/*
 	 * TODO: double check with the docmentation these width/height
 	 * constraints are correct.
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/media/platform/s3c-camif/camif-capture.c linux-libre-3.18.124-gnu/drivers/media/platform/s3c-camif/camif-capture.c
--- linux-libre-3.18.123-gnu/drivers/media/platform/s3c-camif/camif-capture.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/media/platform/s3c-camif/camif-capture.c	2018-10-13 03:09:32.000000000 -0400
@@ -117,6 +117,8 @@ static int sensor_set_power(struct camif
 
 	if (camif->sensor.power_count == !on)
 		err = v4l2_subdev_call(sensor->sd, core, s_power, on);
+	if (err == -ENOIOCTLCMD)
+		err = 0;
 	if (!err)
 		sensor->power_count += on ? 1 : -1;
 
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/media/usb/tm6000/tm6000-dvb.c linux-libre-3.18.124-gnu/drivers/media/usb/tm6000/tm6000-dvb.c
--- linux-libre-3.18.123-gnu/drivers/media/usb/tm6000/tm6000-dvb.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/media/usb/tm6000/tm6000-dvb.c	2018-10-13 03:09:32.000000000 -0400
@@ -275,6 +275,11 @@ static int register_dvb(struct tm6000_co
 
 	ret = dvb_register_adapter(&dvb->adapter, "Trident TVMaster 6000 DVB-T",
 					THIS_MODULE, &dev->udev->dev, adapter_nr);
+	if (ret < 0) {
+		pr_err("tm6000: couldn't register the adapter!\n");
+		goto err;
+	}
+
 	dvb->adapter.priv = dev;
 
 	if (dvb->frontend) {
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/media/usb/uvc/uvc_video.c linux-libre-3.18.124-gnu/drivers/media/usb/uvc/uvc_video.c
--- linux-libre-3.18.123-gnu/drivers/media/usb/uvc/uvc_video.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/media/usb/uvc/uvc_video.c	2018-10-13 03:09:32.000000000 -0400
@@ -155,14 +155,27 @@ static void uvc_fixup_video_ctrl(struct
 	}
 }
 
+static size_t uvc_video_ctrl_size(struct uvc_streaming *stream)
+{
+	/*
+	 * Return the size of the video probe and commit controls, which depends
+	 * on the protocol version.
+	 */
+	if (stream->dev->uvc_version < 0x0110)
+		return 26;
+	else if (stream->dev->uvc_version < 0x0150)
+		return 34;
+	else
+		return 48;
+}
+
 static int uvc_get_video_ctrl(struct uvc_streaming *stream,
 	struct uvc_streaming_control *ctrl, int probe, __u8 query)
 {
+	__u16 size = uvc_video_ctrl_size(stream);
 	__u8 *data;
-	__u16 size;
 	int ret;
 
-	size = stream->dev->uvc_version >= 0x0110 ? 34 : 26;
 	if ((stream->dev->quirks & UVC_QUIRK_PROBE_DEF) &&
 			query == UVC_GET_DEF)
 		return -EIO;
@@ -217,7 +230,7 @@ static int uvc_get_video_ctrl(struct uvc
 	ctrl->dwMaxVideoFrameSize = get_unaligned_le32(&data[18]);
 	ctrl->dwMaxPayloadTransferSize = get_unaligned_le32(&data[22]);
 
-	if (size == 34) {
+	if (size >= 34) {
 		ctrl->dwClockFrequency = get_unaligned_le32(&data[26]);
 		ctrl->bmFramingInfo = data[30];
 		ctrl->bPreferedVersion = data[31];
@@ -246,11 +259,10 @@ out:
 static int uvc_set_video_ctrl(struct uvc_streaming *stream,
 	struct uvc_streaming_control *ctrl, int probe)
 {
+	__u16 size = uvc_video_ctrl_size(stream);
 	__u8 *data;
-	__u16 size;
 	int ret;
 
-	size = stream->dev->uvc_version >= 0x0110 ? 34 : 26;
 	data = kzalloc(size, GFP_KERNEL);
 	if (data == NULL)
 		return -ENOMEM;
@@ -267,7 +279,7 @@ static int uvc_set_video_ctrl(struct uvc
 	put_unaligned_le32(ctrl->dwMaxVideoFrameSize, &data[18]);
 	put_unaligned_le32(ctrl->dwMaxPayloadTransferSize, &data[22]);
 
-	if (size == 34) {
+	if (size >= 34) {
 		put_unaligned_le32(ctrl->dwClockFrequency, &data[26]);
 		data[30] = ctrl->bmFramingInfo;
 		data[31] = ctrl->bPreferedVersion;
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/media/v4l2-core/v4l2-event.c linux-libre-3.18.124-gnu/drivers/media/v4l2-core/v4l2-event.c
--- linux-libre-3.18.123-gnu/drivers/media/v4l2-core/v4l2-event.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/media/v4l2-core/v4l2-event.c	2018-10-13 03:09:32.000000000 -0400
@@ -119,14 +119,6 @@ static void __v4l2_event_queue_fh(struct
 	if (sev == NULL)
 		return;
 
-	/*
-	 * If the event has been added to the fh->subscribed list, but its
-	 * add op has not completed yet elems will be 0, treat this as
-	 * not being subscribed.
-	 */
-	if (!sev->elems)
-		return;
-
 	/* Increase event sequence number on fh. */
 	fh->sequence++;
 
@@ -209,6 +201,7 @@ int v4l2_event_subscribe(struct v4l2_fh
 	struct v4l2_subscribed_event *sev, *found_ev;
 	unsigned long flags;
 	unsigned i;
+	int ret = 0;
 
 	if (sub->type == V4L2_EVENT_ALL)
 		return -EINVAL;
@@ -226,31 +219,36 @@ int v4l2_event_subscribe(struct v4l2_fh
 	sev->flags = sub->flags;
 	sev->fh = fh;
 	sev->ops = ops;
+	sev->elems = elems;
+
+	mutex_lock(&fh->subscribe_lock);
 
 	spin_lock_irqsave(&fh->vdev->fh_lock, flags);
 	found_ev = v4l2_event_subscribed(fh, sub->type, sub->id);
-	if (!found_ev)
-		list_add(&sev->list, &fh->subscribed);
 	spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
 
 	if (found_ev) {
+		/* Already listening */
 		kfree(sev);
-		return 0; /* Already listening */
+		goto out_unlock;
 	}
 
 	if (sev->ops && sev->ops->add) {
-		int ret = sev->ops->add(sev, elems);
+		ret = sev->ops->add(sev, elems);
 		if (ret) {
-			sev->ops = NULL;
-			v4l2_event_unsubscribe(fh, sub);
-			return ret;
+			kfree(sev);
+			goto out_unlock;
 		}
 	}
 
-	/* Mark as ready for use */
-	sev->elems = elems;
+	spin_lock_irqsave(&fh->vdev->fh_lock, flags);
+	list_add(&sev->list, &fh->subscribed);
+	spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
 
-	return 0;
+out_unlock:
+	mutex_unlock(&fh->subscribe_lock);
+
+	return ret;
 }
 EXPORT_SYMBOL_GPL(v4l2_event_subscribe);
 
@@ -289,6 +287,8 @@ int v4l2_event_unsubscribe(struct v4l2_f
 		return 0;
 	}
 
+	mutex_lock(&fh->subscribe_lock);
+
 	spin_lock_irqsave(&fh->vdev->fh_lock, flags);
 
 	sev = v4l2_event_subscribed(fh, sub->type, sub->id);
@@ -307,6 +307,7 @@ int v4l2_event_unsubscribe(struct v4l2_f
 		sev->ops->del(sev);
 
 	kfree(sev);
+	mutex_unlock(&fh->subscribe_lock);
 
 	return 0;
 }
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/media/v4l2-core/v4l2-fh.c linux-libre-3.18.124-gnu/drivers/media/v4l2-core/v4l2-fh.c
--- linux-libre-3.18.123-gnu/drivers/media/v4l2-core/v4l2-fh.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/media/v4l2-core/v4l2-fh.c	2018-10-13 03:09:32.000000000 -0400
@@ -49,6 +49,7 @@ void v4l2_fh_init(struct v4l2_fh *fh, st
 	INIT_LIST_HEAD(&fh->available);
 	INIT_LIST_HEAD(&fh->subscribed);
 	fh->sequence = -1;
+	mutex_init(&fh->subscribe_lock);
 }
 EXPORT_SYMBOL_GPL(v4l2_fh_init);
 
@@ -93,6 +94,7 @@ void v4l2_fh_exit(struct v4l2_fh *fh)
 	if (fh->vdev == NULL)
 		return;
 	v4l2_event_unsubscribe_all(fh);
+	mutex_destroy(&fh->subscribe_lock);
 	fh->vdev = NULL;
 }
 EXPORT_SYMBOL_GPL(v4l2_fh_exit);
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/misc/tsl2550.c linux-libre-3.18.124-gnu/drivers/misc/tsl2550.c
--- linux-libre-3.18.123-gnu/drivers/misc/tsl2550.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/misc/tsl2550.c	2018-10-13 03:09:32.000000000 -0400
@@ -177,7 +177,7 @@ static int tsl2550_calculate_lux(u8 ch0,
 		} else
 			lux = 0;
 	else
-		return -EAGAIN;
+		return 0;
 
 	/* LUX range check */
 	return lux > TSL2550_MAX_LUX ? TSL2550_MAX_LUX : lux;
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/mtd/spi-nor/fsl-quadspi.c linux-libre-3.18.124-gnu/drivers/mtd/spi-nor/fsl-quadspi.c
--- linux-libre-3.18.123-gnu/drivers/mtd/spi-nor/fsl-quadspi.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/mtd/spi-nor/fsl-quadspi.c	2018-10-13 03:09:32.000000000 -0400
@@ -138,15 +138,15 @@
 #define LUT_MODE		4
 #define LUT_MODE2		5
 #define LUT_MODE4		6
-#define LUT_READ		7
-#define LUT_WRITE		8
+#define LUT_FSL_READ		7
+#define LUT_FSL_WRITE		8
 #define LUT_JMP_ON_CS		9
 #define LUT_ADDR_DDR		10
 #define LUT_MODE_DDR		11
 #define LUT_MODE2_DDR		12
 #define LUT_MODE4_DDR		13
-#define LUT_READ_DDR		14
-#define LUT_WRITE_DDR		15
+#define LUT_FSL_READ_DDR		14
+#define LUT_FSL_WRITE_DDR		15
 #define LUT_DATA_LEARN		16
 
 /*
@@ -306,7 +306,7 @@ static void fsl_qspi_init_lut(struct fsl
 
 	writel(LUT0(CMD, PAD1, cmd) | LUT1(ADDR, PAD1, addrlen),
 			base + QUADSPI_LUT(lut_base));
-	writel(LUT0(DUMMY, PAD1, dummy) | LUT1(READ, PAD4, rxfifo),
+	writel(LUT0(DUMMY, PAD1, dummy) | LUT1(FSL_READ, PAD4, rxfifo),
 			base + QUADSPI_LUT(lut_base + 1));
 
 	/* Write enable */
@@ -327,11 +327,11 @@ static void fsl_qspi_init_lut(struct fsl
 
 	writel(LUT0(CMD, PAD1, cmd) | LUT1(ADDR, PAD1, addrlen),
 			base + QUADSPI_LUT(lut_base));
-	writel(LUT0(WRITE, PAD1, 0), base + QUADSPI_LUT(lut_base + 1));
+	writel(LUT0(FSL_WRITE, PAD1, 0), base + QUADSPI_LUT(lut_base + 1));
 
 	/* Read Status */
 	lut_base = SEQID_RDSR * 4;
-	writel(LUT0(CMD, PAD1, SPINOR_OP_RDSR) | LUT1(READ, PAD1, 0x1),
+	writel(LUT0(CMD, PAD1, SPINOR_OP_RDSR) | LUT1(FSL_READ, PAD1, 0x1),
 			base + QUADSPI_LUT(lut_base));
 
 	/* Erase a sector */
@@ -356,17 +356,17 @@ static void fsl_qspi_init_lut(struct fsl
 
 	/* READ ID */
 	lut_base = SEQID_RDID * 4;
-	writel(LUT0(CMD, PAD1, SPINOR_OP_RDID) | LUT1(READ, PAD1, 0x8),
+	writel(LUT0(CMD, PAD1, SPINOR_OP_RDID) | LUT1(FSL_READ, PAD1, 0x8),
 			base + QUADSPI_LUT(lut_base));
 
 	/* Write Register */
 	lut_base = SEQID_WRSR * 4;
-	writel(LUT0(CMD, PAD1, SPINOR_OP_WRSR) | LUT1(WRITE, PAD1, 0x2),
+	writel(LUT0(CMD, PAD1, SPINOR_OP_WRSR) | LUT1(FSL_WRITE, PAD1, 0x2),
 			base + QUADSPI_LUT(lut_base));
 
 	/* Read Configuration Register */
 	lut_base = SEQID_RDCR * 4;
-	writel(LUT0(CMD, PAD1, SPINOR_OP_RDCR) | LUT1(READ, PAD1, 0x1),
+	writel(LUT0(CMD, PAD1, SPINOR_OP_RDCR) | LUT1(FSL_READ, PAD1, 0x1),
 			base + QUADSPI_LUT(lut_base));
 
 	/* Write disable */
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/net/appletalk/ipddp.c linux-libre-3.18.124-gnu/drivers/net/appletalk/ipddp.c
--- linux-libre-3.18.123-gnu/drivers/net/appletalk/ipddp.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/net/appletalk/ipddp.c	2018-10-13 03:09:32.000000000 -0400
@@ -284,8 +284,12 @@ static int ipddp_ioctl(struct net_device
                 case SIOCFINDIPDDPRT:
 			spin_lock_bh(&ipddp_route_lock);
 			rp = __ipddp_find_route(&rcp);
-			if (rp)
-				memcpy(&rcp2, rp, sizeof(rcp2));
+			if (rp) {
+				memset(&rcp2, 0, sizeof(rcp2));
+				rcp2.ip    = rp->ip;
+				rcp2.at    = rp->at;
+				rcp2.flags = rp->flags;
+			}
 			spin_unlock_bh(&ipddp_route_lock);
 
 			if (rp) {
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/net/ethernet/cadence/macb.c linux-libre-3.18.124-gnu/drivers/net/ethernet/cadence/macb.c
--- linux-libre-3.18.123-gnu/drivers/net/ethernet/cadence/macb.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/net/ethernet/cadence/macb.c	2018-10-13 03:09:32.000000000 -0400
@@ -464,7 +464,7 @@ static int macb_halt_tx(struct macb *bp)
 		if (!(status & MACB_BIT(TGO)))
 			return 0;
 
-		usleep_range(10, 250);
+		udelay(250);
 	} while (time_before(halt_time, timeout));
 
 	return -ETIMEDOUT;
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/net/ethernet/hp/hp100.c linux-libre-3.18.124-gnu/drivers/net/ethernet/hp/hp100.c
--- linux-libre-3.18.123-gnu/drivers/net/ethernet/hp/hp100.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/net/ethernet/hp/hp100.c	2018-10-13 03:09:32.000000000 -0400
@@ -2637,7 +2637,7 @@ static int hp100_login_to_vg_hub(struct
 		/* Wait for link to drop */
 		time = jiffies + (HZ / 10);
 		do {
-			if (~(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST))
+			if (!(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST))
 				break;
 			if (!in_interrupt())
 				schedule_timeout_interruptible(1);
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/net/ethernet/intel/e1000/e1000_ethtool.c linux-libre-3.18.124-gnu/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
--- linux-libre-3.18.123-gnu/drivers/net/ethernet/intel/e1000/e1000_ethtool.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/net/ethernet/intel/e1000/e1000_ethtool.c	2018-10-13 03:09:32.000000000 -0400
@@ -646,14 +646,14 @@ static int e1000_set_ringparam(struct ne
 		adapter->tx_ring = tx_old;
 		e1000_free_all_rx_resources(adapter);
 		e1000_free_all_tx_resources(adapter);
-		kfree(tx_old);
-		kfree(rx_old);
 		adapter->rx_ring = rxdr;
 		adapter->tx_ring = txdr;
 		err = e1000_up(adapter);
 		if (err)
 			goto err_setup;
 	}
+	kfree(tx_old);
+	kfree(rx_old);
 
 	clear_bit(__E1000_RESETTING, &adapter->flags);
 	return 0;
@@ -666,7 +666,8 @@ err_setup_rx:
 err_alloc_rx:
 	kfree(txdr);
 err_alloc_tx:
-	e1000_up(adapter);
+	if (netif_running(adapter->netdev))
+		e1000_up(adapter);
 err_setup:
 	clear_bit(__E1000_RESETTING, &adapter->flags);
 	return err;
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/net/ethernet/realtek/r8169.c linux-libre-3.18.124-gnu/drivers/net/ethernet/realtek/r8169.c
--- linux-libre-3.18.123-gnu/drivers/net/ethernet/realtek/r8169.c	2018-09-26 14:23:20.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/net/ethernet/realtek/r8169.c	2018-10-13 21:50:01.000000000 -0400
@@ -749,7 +749,7 @@ struct rtl8169_counters {
 };
 
 enum rtl_flag {
-	RTL_FLAG_TASK_ENABLED,
+	RTL_FLAG_TASK_ENABLED = 0,
 	RTL_FLAG_TASK_SLOW_PENDING,
 	RTL_FLAG_TASK_RESET_PENDING,
 	RTL_FLAG_TASK_PHY_PENDING,
@@ -7505,7 +7505,8 @@ static int rtl8169_close(struct net_devi
 	rtl8169_update_counters(dev);
 
 	rtl_lock_work(tp);
-	clear_bit(RTL_FLAG_TASK_ENABLED, tp->wk.flags);
+	/* Clear all task flags */
+	bitmap_zero(tp->wk.flags, RTL_FLAG_MAX);
 
 	rtl8169_down(dev);
 	rtl_unlock_work(tp);
@@ -7661,7 +7662,9 @@ static void rtl8169_net_suspend(struct n
 
 	rtl_lock_work(tp);
 	napi_disable(&tp->napi);
-	clear_bit(RTL_FLAG_TASK_ENABLED, tp->wk.flags);
+	/* Clear all task flags */
+	bitmap_zero(tp->wk.flags, RTL_FLAG_MAX);
+
 	rtl_unlock_work(tp);
 
 	rtl_pll_power_down(tp);
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/net/wireless/rndis_wlan.c linux-libre-3.18.124-gnu/drivers/net/wireless/rndis_wlan.c
--- linux-libre-3.18.123-gnu/drivers/net/wireless/rndis_wlan.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/net/wireless/rndis_wlan.c	2018-10-13 03:09:32.000000000 -0400
@@ -2919,6 +2919,8 @@ static void rndis_wlan_auth_indication(s
 
 	while (buflen >= sizeof(*auth_req)) {
 		auth_req = (void *)buf;
+		if (buflen < le32_to_cpu(auth_req->length))
+			return;
 		type = "unknown";
 		flags = le32_to_cpu(auth_req->flags);
 		pairwise_error = false;
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/net/wireless/ti/wlcore/cmd.c linux-libre-3.18.124-gnu/drivers/net/wireless/ti/wlcore/cmd.c
--- linux-libre-3.18.123-gnu/drivers/net/wireless/ti/wlcore/cmd.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/net/wireless/ti/wlcore/cmd.c	2018-10-13 03:09:32.000000000 -0400
@@ -35,6 +35,7 @@
 #include "wl12xx_80211.h"
 #include "cmd.h"
 #include "event.h"
+#include "ps.h"
 #include "tx.h"
 #include "hw_ops.h"
 
@@ -187,6 +188,10 @@ int wlcore_cmd_wait_for_event_or_timeout
 
 	timeout_time = jiffies + msecs_to_jiffies(WL1271_EVENT_TIMEOUT);
 
+	ret = wl1271_ps_elp_wakeup(wl);
+	if (ret < 0)
+		return ret;
+
 	do {
 		if (time_after(jiffies, timeout_time)) {
 			wl1271_debug(DEBUG_CMD, "timeout waiting for event %d",
@@ -218,6 +223,7 @@ int wlcore_cmd_wait_for_event_or_timeout
 	} while (!event);
 
 out:
+	wl1271_ps_elp_sleep(wl);
 	kfree(events_vector);
 	return ret;
 }
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/pci/pci.c linux-libre-3.18.124-gnu/drivers/pci/pci.c
--- linux-libre-3.18.123-gnu/drivers/pci/pci.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/pci/pci.c	2018-10-13 03:09:32.000000000 -0400
@@ -1023,12 +1023,12 @@ int pci_save_state(struct pci_dev *dev)
 EXPORT_SYMBOL(pci_save_state);
 
 static void pci_restore_config_dword(struct pci_dev *pdev, int offset,
-				     u32 saved_val, int retry)
+				     u32 saved_val, int retry, bool force)
 {
 	u32 val;
 
 	pci_read_config_dword(pdev, offset, &val);
-	if (val == saved_val)
+	if (!force && val == saved_val)
 		return;
 
 	for (;;) {
@@ -1047,25 +1047,36 @@ static void pci_restore_config_dword(str
 }
 
 static void pci_restore_config_space_range(struct pci_dev *pdev,
-					   int start, int end, int retry)
+					   int start, int end, int retry,
+					   bool force)
 {
 	int index;
 
 	for (index = end; index >= start; index--)
 		pci_restore_config_dword(pdev, 4 * index,
 					 pdev->saved_config_space[index],
-					 retry);
+					 retry, force);
 }
 
 static void pci_restore_config_space(struct pci_dev *pdev)
 {
 	if (pdev->hdr_type == PCI_HEADER_TYPE_NORMAL) {
-		pci_restore_config_space_range(pdev, 10, 15, 0);
+		pci_restore_config_space_range(pdev, 10, 15, 0, false);
 		/* Restore BARs before the command register. */
-		pci_restore_config_space_range(pdev, 4, 9, 10);
-		pci_restore_config_space_range(pdev, 0, 3, 0);
+		pci_restore_config_space_range(pdev, 4, 9, 10, false);
+		pci_restore_config_space_range(pdev, 0, 3, 0, false);
+	} else if (pdev->hdr_type == PCI_HEADER_TYPE_BRIDGE) {
+		pci_restore_config_space_range(pdev, 12, 15, 0, false);
+
+		/*
+		 * Force rewriting of prefetch registers to avoid S3 resume
+		 * issues on Intel PCI bridges that occur when these
+		 * registers are not explicitly written.
+		 */
+		pci_restore_config_space_range(pdev, 9, 11, 0, true);
+		pci_restore_config_space_range(pdev, 0, 8, 0, false);
 	} else {
-		pci_restore_config_space_range(pdev, 0, 15, 0);
+		pci_restore_config_space_range(pdev, 0, 15, 0, false);
 	}
 }
 
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/s390/net/qeth_l2_main.c linux-libre-3.18.124-gnu/drivers/s390/net/qeth_l2_main.c
--- linux-libre-3.18.123-gnu/drivers/s390/net/qeth_l2_main.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/s390/net/qeth_l2_main.c	2018-10-13 03:09:32.000000000 -0400
@@ -452,7 +452,7 @@ static int qeth_l2_process_inbound_buffe
 		default:
 			dev_kfree_skb_any(skb);
 			QETH_CARD_TEXT(card, 3, "inbunkno");
-			QETH_DBF_HEX(CTRL, 3, hdr, QETH_DBF_CTRL_LEN);
+			QETH_DBF_HEX(CTRL, 3, hdr, sizeof(*hdr));
 			continue;
 		}
 		work_done++;
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/s390/net/qeth_l3_main.c linux-libre-3.18.124-gnu/drivers/s390/net/qeth_l3_main.c
--- linux-libre-3.18.123-gnu/drivers/s390/net/qeth_l3_main.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/s390/net/qeth_l3_main.c	2018-10-13 03:09:32.000000000 -0400
@@ -1993,7 +1993,7 @@ static int qeth_l3_process_inbound_buffe
 		default:
 			dev_kfree_skb_any(skb);
 			QETH_CARD_TEXT(card, 3, "inbunkno");
-			QETH_DBF_HEX(CTRL, 3, hdr, QETH_DBF_CTRL_LEN);
+			QETH_DBF_HEX(CTRL, 3, hdr, sizeof(*hdr));
 			continue;
 		}
 		work_done++;
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/scsi/bnx2i/bnx2i_hwi.c linux-libre-3.18.124-gnu/drivers/scsi/bnx2i/bnx2i_hwi.c
--- linux-libre-3.18.123-gnu/drivers/scsi/bnx2i/bnx2i_hwi.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/scsi/bnx2i/bnx2i_hwi.c	2018-10-13 03:09:32.000000000 -0400
@@ -2742,6 +2742,8 @@ int bnx2i_map_ep_dbell_regs(struct bnx2i
 					      BNX2X_DOORBELL_PCI_BAR);
 		reg_off = (1 << BNX2X_DB_SHIFT) * (cid_num & 0x1FFFF);
 		ep->qp.ctx_base = ioremap_nocache(reg_base + reg_off, 4);
+		if (!ep->qp.ctx_base)
+			return -ENOMEM;
 		goto arm_cq;
 	}
 
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/scsi/ibmvscsi/ibmvscsi.c linux-libre-3.18.124-gnu/drivers/scsi/ibmvscsi/ibmvscsi.c
--- linux-libre-3.18.123-gnu/drivers/scsi/ibmvscsi/ibmvscsi.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/scsi/ibmvscsi/ibmvscsi.c	2018-10-13 03:09:32.000000000 -0400
@@ -93,7 +93,7 @@ static int max_requests = IBMVSCSI_MAX_R
 static int max_events = IBMVSCSI_MAX_REQUESTS_DEFAULT + 2;
 static int fast_fail = 1;
 static int client_reserve = 1;
-static char partition_name[97] = "UNKNOWN";
+static char partition_name[96] = "UNKNOWN";
 static unsigned int partition_number = -1;
 
 static struct scsi_transport_template *ibmvscsi_transport_template;
@@ -261,7 +261,7 @@ static void gather_partition_info(void)
 
 	ppartition_name = of_get_property(rootdn, "ibm,partition-name", NULL);
 	if (ppartition_name)
-		strncpy(partition_name, ppartition_name,
+		strlcpy(partition_name, ppartition_name,
 				sizeof(partition_name));
 	p_number_ptr = of_get_property(rootdn, "ibm,partition-no", NULL);
 	if (p_number_ptr)
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/spi/spi-rspi.c linux-libre-3.18.124-gnu/drivers/spi/spi-rspi.c
--- linux-libre-3.18.123-gnu/drivers/spi/spi-rspi.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/spi/spi-rspi.c	2018-10-13 03:09:32.000000000 -0400
@@ -538,11 +538,13 @@ static int rspi_dma_transfer(struct rspi
 
 	ret = wait_event_interruptible_timeout(rspi->wait,
 					       rspi->dma_callbacked, HZ);
-	if (ret > 0 && rspi->dma_callbacked)
+	if (ret > 0 && rspi->dma_callbacked) {
 		ret = 0;
-	else if (!ret) {
-		dev_err(&rspi->master->dev, "DMA timeout\n");
-		ret = -ETIMEDOUT;
+	} else {
+		if (!ret) {
+			dev_err(&rspi->master->dev, "DMA timeout\n");
+			ret = -ETIMEDOUT;
+		}
 		if (tx)
 			dmaengine_terminate_all(rspi->master->dma_tx);
 		if (rx)
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/spi/spi-sh-msiof.c linux-libre-3.18.124-gnu/drivers/spi/spi-sh-msiof.c
--- linux-libre-3.18.123-gnu/drivers/spi/spi-sh-msiof.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/spi/spi-sh-msiof.c	2018-10-13 03:09:32.000000000 -0400
@@ -332,7 +332,8 @@ static void sh_msiof_spi_set_mode_regs(s
 
 static void sh_msiof_reset_str(struct sh_msiof_spi_priv *p)
 {
-	sh_msiof_write(p, STR, sh_msiof_read(p, STR));
+	sh_msiof_write(p, STR,
+		       sh_msiof_read(p, STR) & ~(STR_TDREQ | STR_RDREQ));
 }
 
 static void sh_msiof_spi_write_fifo_8(struct sh_msiof_spi_priv *p,
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/spi/spi-tegra20-slink.c linux-libre-3.18.124-gnu/drivers/spi/spi-tegra20-slink.c
--- linux-libre-3.18.123-gnu/drivers/spi/spi-tegra20-slink.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/spi/spi-tegra20-slink.c	2018-10-13 03:09:32.000000000 -0400
@@ -1063,6 +1063,24 @@ static int tegra_slink_probe(struct plat
 		goto exit_free_master;
 	}
 
+	/* disabled clock may cause interrupt storm upon request */
+	tspi->clk = devm_clk_get(&pdev->dev, NULL);
+	if (IS_ERR(tspi->clk)) {
+		ret = PTR_ERR(tspi->clk);
+		dev_err(&pdev->dev, "Can not get clock %d\n", ret);
+		goto exit_free_master;
+	}
+	ret = clk_prepare(tspi->clk);
+	if (ret < 0) {
+		dev_err(&pdev->dev, "Clock prepare failed %d\n", ret);
+		goto exit_free_master;
+	}
+	ret = clk_enable(tspi->clk);
+	if (ret < 0) {
+		dev_err(&pdev->dev, "Clock enable failed %d\n", ret);
+		goto exit_free_master;
+	}
+
 	spi_irq = platform_get_irq(pdev, 0);
 	tspi->irq = spi_irq;
 	ret = request_threaded_irq(tspi->irq, tegra_slink_isr,
@@ -1071,14 +1089,7 @@ static int tegra_slink_probe(struct plat
 	if (ret < 0) {
 		dev_err(&pdev->dev, "Failed to register ISR for IRQ %d\n",
 					tspi->irq);
-		goto exit_free_master;
-	}
-
-	tspi->clk = devm_clk_get(&pdev->dev, NULL);
-	if (IS_ERR(tspi->clk)) {
-		dev_err(&pdev->dev, "can not get clock\n");
-		ret = PTR_ERR(tspi->clk);
-		goto exit_free_irq;
+		goto exit_clk_disable;
 	}
 
 	tspi->rst = devm_reset_control_get(&pdev->dev, "spi");
@@ -1138,6 +1149,8 @@ exit_rx_dma_free:
 	tegra_slink_deinit_dma_param(tspi, true);
 exit_free_irq:
 	free_irq(spi_irq, tspi);
+exit_clk_disable:
+	clk_disable(tspi->clk);
 exit_free_master:
 	spi_master_put(master);
 	return ret;
@@ -1150,6 +1163,8 @@ static int tegra_slink_remove(struct pla
 
 	free_irq(tspi->irq, tspi);
 
+	clk_disable(tspi->clk);
+
 	if (tspi->tx_dma_chan)
 		tegra_slink_deinit_dma_param(tspi, false);
 
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/staging/android/ashmem.c linux-libre-3.18.124-gnu/drivers/staging/android/ashmem.c
--- linux-libre-3.18.123-gnu/drivers/staging/android/ashmem.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/staging/android/ashmem.c	2018-10-13 03:09:32.000000000 -0400
@@ -370,6 +370,12 @@ static int ashmem_mmap(struct file *file
 		goto out;
 	}
 
+	/* requested mapping size larger than object size */
+	if (vma->vm_end - vma->vm_start > PAGE_ALIGN(asma->size)) {
+		ret = -EINVAL;
+		goto out;
+	}
+
 	/* requested protection bits must match our allowed protection mask */
 	if (unlikely((vma->vm_flags & ~calc_vm_prot_bits(asma->prot_mask)) &
 		     calc_vm_prot_bits(PROT_MASK))) {
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/staging/android/ion/ion.c linux-libre-3.18.124-gnu/drivers/staging/android/ion/ion.c
--- linux-libre-3.18.123-gnu/drivers/staging/android/ion/ion.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/staging/android/ion/ion.c	2018-10-13 03:09:32.000000000 -0400
@@ -451,18 +451,6 @@ static struct ion_handle *ion_handle_get
 	return ERR_PTR(-EINVAL);
 }
 
-struct ion_handle *ion_handle_get_by_id(struct ion_client *client,
-						int id)
-{
-	struct ion_handle *handle;
-
-	mutex_lock(&client->lock);
-	handle = ion_handle_get_by_id_nolock(client, id);
-	mutex_unlock(&client->lock);
-
-	return handle;
-}
-
 static bool ion_handle_validate(struct ion_client *client,
 				struct ion_handle *handle)
 {
@@ -1138,23 +1126,27 @@ static struct dma_buf_ops dma_buf_ops =
 	.kunmap = ion_dma_buf_kunmap,
 };
 
-struct dma_buf *ion_share_dma_buf(struct ion_client *client,
-						struct ion_handle *handle)
+static struct dma_buf *__ion_share_dma_buf(struct ion_client *client,
+					   struct ion_handle *handle,
+					   bool lock_client)
 {
 	struct ion_buffer *buffer;
 	struct dma_buf *dmabuf;
 	bool valid_handle;
 
-	mutex_lock(&client->lock);
+	if (lock_client)
+		mutex_lock(&client->lock);
 	valid_handle = ion_handle_validate(client, handle);
 	if (!valid_handle) {
 		WARN(1, "%s: invalid handle passed to share.\n", __func__);
-		mutex_unlock(&client->lock);
+		if (lock_client)
+			mutex_unlock(&client->lock);
 		return ERR_PTR(-EINVAL);
 	}
 	buffer = handle->buffer;
 	ion_buffer_get(buffer);
-	mutex_unlock(&client->lock);
+	if (lock_client)
+		mutex_unlock(&client->lock);
 
 	dmabuf = dma_buf_export(buffer, &dma_buf_ops, buffer->size, O_RDWR,
 				NULL);
@@ -1165,14 +1157,21 @@ struct dma_buf *ion_share_dma_buf(struct
 
 	return dmabuf;
 }
+
+struct dma_buf *ion_share_dma_buf(struct ion_client *client,
+				  struct ion_handle *handle)
+{
+	return __ion_share_dma_buf(client, handle, true);
+}
 EXPORT_SYMBOL(ion_share_dma_buf);
 
-int ion_share_dma_buf_fd(struct ion_client *client, struct ion_handle *handle)
+static int __ion_share_dma_buf_fd(struct ion_client *client,
+				  struct ion_handle *handle, bool lock_client)
 {
 	struct dma_buf *dmabuf;
 	int fd;
 
-	dmabuf = ion_share_dma_buf(client, handle);
+	dmabuf = __ion_share_dma_buf(client, handle, lock_client);
 	if (IS_ERR(dmabuf))
 		return PTR_ERR(dmabuf);
 
@@ -1182,8 +1181,19 @@ int ion_share_dma_buf_fd(struct ion_clie
 
 	return fd;
 }
+
+int ion_share_dma_buf_fd(struct ion_client *client, struct ion_handle *handle)
+{
+	return __ion_share_dma_buf_fd(client, handle, true);
+}
 EXPORT_SYMBOL(ion_share_dma_buf_fd);
 
+static int ion_share_dma_buf_fd_nolock(struct ion_client *client,
+				       struct ion_handle *handle)
+{
+	return __ion_share_dma_buf_fd(client, handle, false);
+}
+
 struct ion_handle *ion_import_dma_buf(struct ion_client *client, int fd)
 {
 	struct dma_buf *dmabuf;
@@ -1330,11 +1340,15 @@ static long ion_ioctl(struct file *filp,
 	{
 		struct ion_handle *handle;
 
-		handle = ion_handle_get_by_id(client, data.handle.handle);
-		if (IS_ERR(handle))
+		mutex_lock(&client->lock);
+		handle = ion_handle_get_by_id_nolock(client, data.handle.handle);
+		if (IS_ERR(handle)) {
+			mutex_unlock(&client->lock);
 			return PTR_ERR(handle);
-		data.fd.fd = ion_share_dma_buf_fd(client, handle);
-		ion_handle_put(handle);
+		}
+		data.fd.fd = ion_share_dma_buf_fd_nolock(client, handle);
+		ion_handle_put_nolock(handle);
+		mutex_unlock(&client->lock);
 		if (data.fd.fd < 0)
 			ret = data.fd.fd;
 		break;
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/target/iscsi/iscsi_target_auth.c linux-libre-3.18.124-gnu/drivers/target/iscsi/iscsi_target_auth.c
--- linux-libre-3.18.123-gnu/drivers/target/iscsi/iscsi_target_auth.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/target/iscsi/iscsi_target_auth.c	2018-10-13 03:09:32.000000000 -0400
@@ -26,27 +26,6 @@
 #include "iscsi_target_nego.h"
 #include "iscsi_target_auth.h"
 
-static int chap_string_to_hex(unsigned char *dst, unsigned char *src, int len)
-{
-	int j = DIV_ROUND_UP(len, 2), rc;
-
-	rc = hex2bin(dst, src, j);
-	if (rc < 0)
-		pr_debug("CHAP string contains non hex digit symbols\n");
-
-	dst[j] = '\0';
-	return j;
-}
-
-static void chap_binaryhex_to_asciihex(char *dst, char *src, int src_len)
-{
-	int i;
-
-	for (i = 0; i < src_len; i++) {
-		sprintf(&dst[i*2], "%02x", (int) src[i] & 0xff);
-	}
-}
-
 static void chap_gen_challenge(
 	struct iscsi_conn *conn,
 	int caller,
@@ -59,7 +38,7 @@ static void chap_gen_challenge(
 	memset(challenge_asciihex, 0, CHAP_CHALLENGE_LENGTH * 2 + 1);
 
 	get_random_bytes(chap->challenge, CHAP_CHALLENGE_LENGTH);
-	chap_binaryhex_to_asciihex(challenge_asciihex, chap->challenge,
+	bin2hex(challenge_asciihex, chap->challenge,
 				CHAP_CHALLENGE_LENGTH);
 	/*
 	 * Set CHAP_C, and copy the generated challenge into c_str.
@@ -241,9 +220,16 @@ static int chap_server_compute_md5(
 		pr_err("Could not find CHAP_R.\n");
 		goto out;
 	}
+	if (strlen(chap_r) != MD5_SIGNATURE_SIZE * 2) {
+		pr_err("Malformed CHAP_R\n");
+		goto out;
+	}
+	if (hex2bin(client_digest, chap_r, MD5_SIGNATURE_SIZE) < 0) {
+		pr_err("Malformed CHAP_R\n");
+		goto out;
+	}
 
 	pr_debug("[server] Got CHAP_R=%s\n", chap_r);
-	chap_string_to_hex(client_digest, chap_r, strlen(chap_r));
 
 	tfm = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC);
 	if (IS_ERR(tfm)) {
@@ -292,7 +278,7 @@ static int chap_server_compute_md5(
 	}
 	crypto_free_hash(tfm);
 
-	chap_binaryhex_to_asciihex(response, server_digest, MD5_SIGNATURE_SIZE);
+	bin2hex(response, server_digest, MD5_SIGNATURE_SIZE);
 	pr_debug("[server] MD5 Server Digest: %s\n", response);
 
 	if (memcmp(server_digest, client_digest, MD5_SIGNATURE_SIZE) != 0) {
@@ -348,9 +334,7 @@ static int chap_server_compute_md5(
 		pr_err("Could not find CHAP_C.\n");
 		goto out;
 	}
-	pr_debug("[server] Got CHAP_C=%s\n", challenge);
-	challenge_len = chap_string_to_hex(challenge_binhex, challenge,
-				strlen(challenge));
+	challenge_len = DIV_ROUND_UP(strlen(challenge), 2);
 	if (!challenge_len) {
 		pr_err("Unable to convert incoming challenge\n");
 		goto out;
@@ -359,6 +343,11 @@ static int chap_server_compute_md5(
 		pr_err("CHAP_C exceeds maximum binary size of 1024 bytes\n");
 		goto out;
 	}
+	if (hex2bin(challenge_binhex, challenge, challenge_len) < 0) {
+		pr_err("Malformed CHAP_C\n");
+		goto out;
+	}
+	pr_debug("[server] Got CHAP_C=%s\n", challenge);
 	/*
 	 * During mutual authentication, the CHAP_C generated by the
 	 * initiator must not match the original CHAP_C generated by
@@ -433,7 +422,7 @@ static int chap_server_compute_md5(
 	/*
 	 * Convert response from binary hex to ascii hext.
 	 */
-	chap_binaryhex_to_asciihex(response, digest, MD5_SIGNATURE_SIZE);
+	bin2hex(response, digest, MD5_SIGNATURE_SIZE);
 	*nr_out_len += sprintf(nr_out_ptr + *nr_out_len, "CHAP_R=0x%s",
 			response);
 	*nr_out_len += 1;
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/target/iscsi/iscsi_target_tpg.c linux-libre-3.18.124-gnu/drivers/target/iscsi/iscsi_target_tpg.c
--- linux-libre-3.18.123-gnu/drivers/target/iscsi/iscsi_target_tpg.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/target/iscsi/iscsi_target_tpg.c	2018-10-13 03:09:32.000000000 -0400
@@ -651,8 +651,7 @@ int iscsit_ta_authentication(struct iscs
 		none = strstr(buf1, NONE);
 		if (none)
 			goto out;
-		strncat(buf1, ",", strlen(","));
-		strncat(buf1, NONE, strlen(NONE));
+		strlcat(buf1, "," NONE, sizeof(buf1));
 		if (iscsi_update_param_value(param, buf1) < 0)
 			return -EINVAL;
 	}
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/thermal/of-thermal.c linux-libre-3.18.124-gnu/drivers/thermal/of-thermal.c
--- linux-libre-3.18.123-gnu/drivers/thermal/of-thermal.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/thermal/of-thermal.c	2018-10-13 03:09:32.000000000 -0400
@@ -209,10 +209,13 @@ static int of_thermal_set_mode(struct th
 
 	mutex_lock(&tz->lock);
 
-	if (mode == THERMAL_DEVICE_ENABLED)
+	if (mode == THERMAL_DEVICE_ENABLED) {
 		tz->polling_delay = data->polling_delay;
-	else
+		tz->passive_delay = data->passive_delay;
+	} else {
 		tz->polling_delay = 0;
+		tz->passive_delay = 0;
+	}
 
 	mutex_unlock(&tz->lock);
 
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/tty/serial/8250/serial_cs.c linux-libre-3.18.124-gnu/drivers/tty/serial/8250/serial_cs.c
--- linux-libre-3.18.123-gnu/drivers/tty/serial/8250/serial_cs.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/tty/serial/8250/serial_cs.c	2018-10-13 03:09:32.000000000 -0400
@@ -629,8 +629,10 @@ static int serial_config(struct pcmcia_d
 	    (link->has_func_id) &&
 	    (link->socket->pcmcia_pfc == 0) &&
 	    ((link->func_id == CISTPL_FUNCID_MULTI) ||
-	     (link->func_id == CISTPL_FUNCID_SERIAL)))
-		pcmcia_loop_config(link, serial_check_for_multi, info);
+	     (link->func_id == CISTPL_FUNCID_SERIAL))) {
+		if (pcmcia_loop_config(link, serial_check_for_multi, info))
+			goto failed;
+	}
 
 	/*
 	 * Apply any multi-port quirk.
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/tty/serial/cpm_uart/cpm_uart_core.c linux-libre-3.18.124-gnu/drivers/tty/serial/cpm_uart/cpm_uart_core.c
--- linux-libre-3.18.123-gnu/drivers/tty/serial/cpm_uart/cpm_uart_core.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/tty/serial/cpm_uart/cpm_uart_core.c	2018-10-13 03:09:32.000000000 -0400
@@ -1054,8 +1054,8 @@ static int poll_wait_key(char *obuf, str
 	/* Get the address of the host memory buffer.
 	 */
 	bdp = pinfo->rx_cur;
-	while (bdp->cbd_sc & BD_SC_EMPTY)
-		;
+	if (bdp->cbd_sc & BD_SC_EMPTY)
+		return NO_POLL_CHAR;
 
 	/* If the buffer address is in the CPM DPRAM, don't
 	 * convert it.
@@ -1089,7 +1089,11 @@ static int cpm_get_poll_char(struct uart
 		poll_chars = 0;
 	}
 	if (poll_chars <= 0) {
-		poll_chars = poll_wait_key(poll_buf, pinfo);
+		int ret = poll_wait_key(poll_buf, pinfo);
+
+		if (ret == NO_POLL_CHAR)
+			return ret;
+		poll_chars = ret;
 		pollp = poll_buf;
 	}
 	poll_chars--;
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/usb/class/cdc-wdm.c linux-libre-3.18.124-gnu/drivers/usb/class/cdc-wdm.c
--- linux-libre-3.18.123-gnu/drivers/usb/class/cdc-wdm.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/usb/class/cdc-wdm.c	2018-10-13 03:09:32.000000000 -0400
@@ -452,7 +452,7 @@ static int clear_wdm_read_flag(struct wd
 
 	set_bit(WDM_RESPONDING, &desc->flags);
 	spin_unlock_irq(&desc->iuspin);
-	rv = usb_submit_urb(desc->response, GFP_ATOMIC);
+	rv = usb_submit_urb(desc->response, GFP_KERNEL);
 	spin_lock_irq(&desc->iuspin);
 	if (rv) {
 		dev_err(&desc->intf->dev,
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/usb/core/devio.c linux-libre-3.18.124-gnu/drivers/usb/core/devio.c
--- linux-libre-3.18.123-gnu/drivers/usb/core/devio.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/usb/core/devio.c	2018-10-13 03:09:32.000000000 -0400
@@ -1286,10 +1286,13 @@ static int proc_do_submiturb(struct usb_
 	struct async *as = NULL;
 	struct usb_ctrlrequest *dr = NULL;
 	unsigned int u, totlen, isofrmlen;
-	int i, ret, is_in, num_sgs = 0, ifnum = -1;
+	int i, ret, num_sgs = 0, ifnum = -1;
 	int number_of_packets = 0;
 	unsigned int stream_id = 0;
 	void *buf;
+	bool is_in;
+	bool allow_short = false;
+	bool allow_zero = false;
 	unsigned long mask =	USBDEVFS_URB_SHORT_NOT_OK |
 				USBDEVFS_URB_BULK_CONTINUATION |
 				USBDEVFS_URB_NO_FSBR |
@@ -1323,6 +1326,8 @@ static int proc_do_submiturb(struct usb_
 	u = 0;
 	switch(uurb->type) {
 	case USBDEVFS_URB_TYPE_CONTROL:
+		if (is_in)
+			allow_short = true;
 		if (!usb_endpoint_xfer_control(&ep->desc))
 			return -EINVAL;
 		/* min 8 byte setup packet */
@@ -1363,6 +1368,10 @@ static int proc_do_submiturb(struct usb_
 		break;
 
 	case USBDEVFS_URB_TYPE_BULK:
+		if (!is_in)
+			allow_zero = true;
+		else
+			allow_short = true;
 		switch (usb_endpoint_type(&ep->desc)) {
 		case USB_ENDPOINT_XFER_CONTROL:
 		case USB_ENDPOINT_XFER_ISOC:
@@ -1383,6 +1392,10 @@ static int proc_do_submiturb(struct usb_
 		if (!usb_endpoint_xfer_int(&ep->desc))
 			return -EINVAL;
  interrupt_urb:
+		if (!is_in)
+			allow_zero = true;
+		else
+			allow_short = true;
 		break;
 
 	case USBDEVFS_URB_TYPE_ISO:
@@ -1508,16 +1521,21 @@ static int proc_do_submiturb(struct usb_
 	u = (is_in ? URB_DIR_IN : URB_DIR_OUT);
 	if (uurb->flags & USBDEVFS_URB_ISO_ASAP)
 		u |= URB_ISO_ASAP;
-	if (uurb->flags & USBDEVFS_URB_SHORT_NOT_OK && is_in)
+	if (allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)
 		u |= URB_SHORT_NOT_OK;
 	if (uurb->flags & USBDEVFS_URB_NO_FSBR)
 		u |= URB_NO_FSBR;
-	if (uurb->flags & USBDEVFS_URB_ZERO_PACKET)
+	if (allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET)
 		u |= URB_ZERO_PACKET;
 	if (uurb->flags & USBDEVFS_URB_NO_INTERRUPT)
 		u |= URB_NO_INTERRUPT;
 	as->urb->transfer_flags = u;
 
+	if (!allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)
+		dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK.\n");
+	if (!allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET)
+		dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_ZERO_PACKET.\n");
+
 	as->urb->transfer_buffer_length = uurb->buffer_length;
 	as->urb->setup_packet = (unsigned char *)dr;
 	dr = NULL;
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/usb/core/driver.c linux-libre-3.18.124-gnu/drivers/usb/core/driver.c
--- linux-libre-3.18.123-gnu/drivers/usb/core/driver.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/usb/core/driver.c	2018-10-13 03:09:32.000000000 -0400
@@ -506,7 +506,6 @@ int usb_driver_claim_interface(struct us
 	struct device *dev;
 	struct usb_device *udev;
 	int retval = 0;
-	int lpm_disable_error = -ENODEV;
 
 	if (!iface)
 		return -ENODEV;
@@ -523,16 +522,6 @@ int usb_driver_claim_interface(struct us
 
 	iface->condition = USB_INTERFACE_BOUND;
 
-	/* See the comment about disabling LPM in usb_probe_interface(). */
-	if (driver->disable_hub_initiated_lpm) {
-		lpm_disable_error = usb_unlocked_disable_lpm(udev);
-		if (lpm_disable_error) {
-			dev_err(&iface->dev, "%s Failed to disable LPM for driver %s\n.",
-					__func__, driver->name);
-			return -ENOMEM;
-		}
-	}
-
 	/* Claimed interfaces are initially inactive (suspended) and
 	 * runtime-PM-enabled, but only if the driver has autosuspend
 	 * support.  Otherwise they are marked active, to prevent the
@@ -551,9 +540,20 @@ int usb_driver_claim_interface(struct us
 	if (device_is_registered(dev))
 		retval = device_bind_driver(dev);
 
-	/* Attempt to re-enable USB3 LPM, if the disable was successful. */
-	if (!lpm_disable_error)
-		usb_unlocked_enable_lpm(udev);
+	if (retval) {
+		dev->driver = NULL;
+		usb_set_intfdata(iface, NULL);
+		iface->needs_remote_wakeup = 0;
+		iface->condition = USB_INTERFACE_UNBOUND;
+
+		/*
+		 * Unbound interfaces are always runtime-PM-disabled
+		 * and runtime-PM-suspended
+		 */
+		if (driver->supports_autosuspend)
+			pm_runtime_disable(dev);
+		pm_runtime_set_suspended(dev);
+	}
 
 	return retval;
 }
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/usb/core/usb.c linux-libre-3.18.124-gnu/drivers/usb/core/usb.c
--- linux-libre-3.18.123-gnu/drivers/usb/core/usb.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/usb/core/usb.c	2018-10-13 03:09:32.000000000 -0400
@@ -79,6 +79,8 @@ struct usb_host_interface *usb_find_alt_
 	struct usb_interface_cache *intf_cache = NULL;
 	int i;
 
+	if (!config)
+		return NULL;
 	for (i = 0; i < config->desc.bNumInterfaces; i++) {
 		if (config->intf_cache[i]->altsetting[0].desc.bInterfaceNumber
 				== iface_num) {
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/usb/misc/yurex.c linux-libre-3.18.124-gnu/drivers/usb/misc/yurex.c
--- linux-libre-3.18.123-gnu/drivers/usb/misc/yurex.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/usb/misc/yurex.c	2018-10-13 03:09:32.000000000 -0400
@@ -430,6 +430,9 @@ static ssize_t yurex_read(struct file *f
 	spin_unlock_irqrestore(&dev->lock, flags);
 	mutex_unlock(&dev->io_mutex);
 
+	if (WARN_ON_ONCE(len >= sizeof(in_buffer)))
+		return -EIO;
+
 	return simple_read_from_buffer(buffer, count, ppos, in_buffer, len);
 }
 
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/usb/serial/kobil_sct.c linux-libre-3.18.124-gnu/drivers/usb/serial/kobil_sct.c
--- linux-libre-3.18.123-gnu/drivers/usb/serial/kobil_sct.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/usb/serial/kobil_sct.c	2018-10-13 03:09:32.000000000 -0400
@@ -396,12 +396,20 @@ static int kobil_tiocmget(struct tty_str
 			  transfer_buffer_length,
 			  KOBIL_TIMEOUT);
 
-	dev_dbg(&port->dev, "%s - Send get_status_line_state URB returns: %i. Statusline: %02x\n",
-		__func__, result, transfer_buffer[0]);
+	dev_dbg(&port->dev, "Send get_status_line_state URB returns: %i\n",
+			result);
+	if (result < 1) {
+		if (result >= 0)
+			result = -EIO;
+		goto out_free;
+	}
+
+	dev_dbg(&port->dev, "Statusline: %02x\n", transfer_buffer[0]);
 
 	result = 0;
 	if ((transfer_buffer[0] & SUSBCR_GSL_DSR) != 0)
 		result = TIOCM_DSR;
+out_free:
 	kfree(transfer_buffer);
 	return result;
 }
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/usb/serial/usb-serial-simple.c linux-libre-3.18.124-gnu/drivers/usb/serial/usb-serial-simple.c
--- linux-libre-3.18.123-gnu/drivers/usb/serial/usb-serial-simple.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/usb/serial/usb-serial-simple.c	2018-10-13 03:09:32.000000000 -0400
@@ -74,7 +74,8 @@ DEVICE(moto_modem, MOTO_IDS);
 
 /* Motorola Tetra driver */
 #define MOTOROLA_TETRA_IDS()			\
-	{ USB_DEVICE(0x0cad, 0x9011) }	/* Motorola Solutions TETRA PEI */
+	{ USB_DEVICE(0x0cad, 0x9011) },	/* Motorola Solutions TETRA PEI */ \
+	{ USB_DEVICE(0x0cad, 0x9012) }	/* MTP6550 */
 DEVICE(motorola_tetra, MOTOROLA_TETRA_IDS);
 
 /* Novatel Wireless GPS driver */
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/usb/wusbcore/security.c linux-libre-3.18.124-gnu/drivers/usb/wusbcore/security.c
--- linux-libre-3.18.123-gnu/drivers/usb/wusbcore/security.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/usb/wusbcore/security.c	2018-10-13 03:09:32.000000000 -0400
@@ -230,7 +230,7 @@ int wusb_dev_sec_add(struct wusbhc *wusb
 
 	result = usb_get_descriptor(usb_dev, USB_DT_SECURITY,
 				    0, secd, sizeof(*secd));
-	if (result < sizeof(*secd)) {
+	if (result < (int)sizeof(*secd)) {
 		dev_err(dev, "Can't read security descriptor or "
 			"not enough data: %d\n", result);
 		goto out;
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/uwb/hwa-rc.c linux-libre-3.18.124-gnu/drivers/uwb/hwa-rc.c
--- linux-libre-3.18.123-gnu/drivers/uwb/hwa-rc.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/uwb/hwa-rc.c	2018-10-13 03:09:32.000000000 -0400
@@ -875,6 +875,7 @@ error_get_version:
 error_rc_add:
 	usb_put_intf(iface);
 	usb_put_dev(hwarc->usb_dev);
+	kfree(hwarc);
 error_alloc:
 	uwb_rc_put(uwb_rc);
 error_rc_alloc:
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c linux-libre-3.18.124-gnu/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c
--- linux-libre-3.18.123-gnu/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c	2018-10-13 03:09:32.000000000 -0400
@@ -493,6 +493,9 @@ static int omapfb_memory_read(struct fb_
 	if (!access_ok(VERIFY_WRITE, mr->buffer, mr->buffer_size))
 		return -EFAULT;
 
+	if (mr->w > 4096 || mr->h > 4096)
+		return -EINVAL;
+
 	if (mr->w * mr->h * 3 > mr->buffer_size)
 		return -EINVAL;
 
@@ -506,7 +509,7 @@ static int omapfb_memory_read(struct fb_
 			mr->x, mr->y, mr->w, mr->h);
 
 	if (r > 0) {
-		if (copy_to_user(mr->buffer, buf, mr->buffer_size))
+		if (copy_to_user(mr->buffer, buf, r))
 			r = -EFAULT;
 	}
 
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/xen/events/events_base.c linux-libre-3.18.124-gnu/drivers/xen/events/events_base.c
--- linux-libre-3.18.123-gnu/drivers/xen/events/events_base.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/xen/events/events_base.c	2018-10-13 03:09:32.000000000 -0400
@@ -138,7 +138,7 @@ static int set_evtchn_to_irq(unsigned ev
 		clear_evtchn_to_irq_row(row);
 	}
 
-	evtchn_to_irq[EVTCHN_ROW(evtchn)][EVTCHN_COL(evtchn)] = irq;
+	evtchn_to_irq[row][col] = irq;
 	return 0;
 }
 
diff -druNp --no-dereference linux-libre-3.18.123-gnu/drivers/xen/manage.c linux-libre-3.18.124-gnu/drivers/xen/manage.c
--- linux-libre-3.18.123-gnu/drivers/xen/manage.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/drivers/xen/manage.c	2018-10-13 03:09:32.000000000 -0400
@@ -277,9 +277,11 @@ static void sysrq_handler(struct xenbus_
 		/*
 		 * The Xenstore watch fires directly after registering it and
 		 * after a suspend/resume cycle. So ENOENT is no error but
-		 * might happen in those cases.
+		 * might happen in those cases. ERANGE is observed when we get
+		 * an empty value (''), this happens when we acknowledge the
+		 * request by writing '\0' below.
 		 */
-		if (err != -ENOENT)
+		if (err != -ENOENT && err != -ERANGE)
 			pr_err("Error %d reading sysrq code in control/sysrq\n",
 			       err);
 		xenbus_transaction_end(xbt, 1);
diff -druNp --no-dereference linux-libre-3.18.123-gnu/fs/cifs/cifssmb.c linux-libre-3.18.124-gnu/fs/cifs/cifssmb.c
--- linux-libre-3.18.123-gnu/fs/cifs/cifssmb.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/fs/cifs/cifssmb.c	2018-10-13 03:09:32.000000000 -0400
@@ -577,10 +577,15 @@ CIFSSMBNegotiate(const unsigned int xid,
 	}
 
 	count = 0;
+	/*
+	 * We know that all the name entries in the protocols array
+	 * are short (< 16 bytes anyway) and are NUL terminated.
+	 */
 	for (i = 0; i < CIFS_NUM_PROT; i++) {
-		strncpy(pSMB->DialectsArray+count, protocols[i].name, 16);
-		count += strlen(protocols[i].name) + 1;
-		/* null at end of source and target buffers anyway */
+		size_t len = strlen(protocols[i].name) + 1;
+
+		memcpy(pSMB->DialectsArray+count, protocols[i].name, len);
+		count += len;
 	}
 	inc_rfc1001_len(pSMB, count);
 	pSMB->ByteCount = cpu_to_le16(count);
diff -druNp --no-dereference linux-libre-3.18.123-gnu/fs/cifs/cifs_unicode.c linux-libre-3.18.124-gnu/fs/cifs/cifs_unicode.c
--- linux-libre-3.18.123-gnu/fs/cifs/cifs_unicode.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/fs/cifs/cifs_unicode.c	2018-10-13 03:09:32.000000000 -0400
@@ -136,9 +136,6 @@ convert_sfm_char(const __u16 src_char, c
 	case SFM_LESSTHAN:
 		*target = '<';
 		break;
-	case SFM_SLASH:
-		*target = '\\';
-		break;
 	case SFM_SPACE:
 		*target = ' ';
 		break;
diff -druNp --no-dereference linux-libre-3.18.123-gnu/fs/cifs/misc.c linux-libre-3.18.124-gnu/fs/cifs/misc.c
--- linux-libre-3.18.123-gnu/fs/cifs/misc.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/fs/cifs/misc.c	2018-10-13 03:09:32.000000000 -0400
@@ -405,9 +405,17 @@ is_valid_oplock_break(char *buffer, stru
 			(struct smb_com_transaction_change_notify_rsp *)buf;
 		struct file_notify_information *pnotify;
 		__u32 data_offset = 0;
+		size_t len = srv->total_read - sizeof(pSMBr->hdr.smb_buf_length);
+
 		if (get_bcc(buf) > sizeof(struct file_notify_information)) {
 			data_offset = le32_to_cpu(pSMBr->DataOffset);
 
+			if (data_offset >
+			    len - sizeof(struct file_notify_information)) {
+				cifs_dbg(FYI, "invalid data_offset %u\n",
+					 data_offset);
+				return true;
+			}
 			pnotify = (struct file_notify_information *)
 				((char *)&pSMBr->hdr.Protocol + data_offset);
 			cifs_dbg(FYI, "dnotify on %s Action: 0x%x\n",
diff -druNp --no-dereference linux-libre-3.18.123-gnu/fs/cifs/smb2ops.c linux-libre-3.18.124-gnu/fs/cifs/smb2ops.c
--- linux-libre-3.18.123-gnu/fs/cifs/smb2ops.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/fs/cifs/smb2ops.c	2018-10-13 03:09:32.000000000 -0400
@@ -847,7 +847,7 @@ smb2_query_dir_first(const unsigned int
 	}
 
 	srch_inf->entries_in_buffer = 0;
-	srch_inf->index_of_last_entry = 0;
+	srch_inf->index_of_last_entry = 2;
 
 	rc = SMB2_query_directory(xid, tcon, fid->persistent_fid,
 				  fid->volatile_fid, 0, srch_inf);
diff -druNp --no-dereference linux-libre-3.18.123-gnu/fs/ext4/balloc.c linux-libre-3.18.124-gnu/fs/ext4/balloc.c
--- linux-libre-3.18.123-gnu/fs/ext4/balloc.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/fs/ext4/balloc.c	2018-10-13 03:09:32.000000000 -0400
@@ -184,7 +184,6 @@ static int ext4_init_block_bitmap(struct
 	unsigned int bit, bit_max;
 	struct ext4_sb_info *sbi = EXT4_SB(sb);
 	ext4_fsblk_t start, tmp;
-	int flex_bg = 0;
 	struct ext4_group_info *grp;
 
 	J_ASSERT_BH(bh, buffer_locked(bh));
@@ -217,22 +216,19 @@ static int ext4_init_block_bitmap(struct
 
 	start = ext4_group_first_block_no(sb, block_group);
 
-	if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_FLEX_BG))
-		flex_bg = 1;
-
 	/* Set bits for block and inode bitmaps, and inode table */
 	tmp = ext4_block_bitmap(sb, gdp);
-	if (!flex_bg || ext4_block_in_group(sb, tmp, block_group))
+	if (ext4_block_in_group(sb, tmp, block_group))
 		ext4_set_bit(EXT4_B2C(sbi, tmp - start), bh->b_data);
 
 	tmp = ext4_inode_bitmap(sb, gdp);
-	if (!flex_bg || ext4_block_in_group(sb, tmp, block_group))
+	if (ext4_block_in_group(sb, tmp, block_group))
 		ext4_set_bit(EXT4_B2C(sbi, tmp - start), bh->b_data);
 
 	tmp = ext4_inode_table(sb, gdp);
 	for (; tmp < ext4_inode_table(sb, gdp) +
 		     sbi->s_itb_per_group; tmp++) {
-		if (!flex_bg || ext4_block_in_group(sb, tmp, block_group))
+		if (ext4_block_in_group(sb, tmp, block_group))
 			ext4_set_bit(EXT4_B2C(sbi, tmp - start), bh->b_data);
 	}
 
@@ -451,9 +447,18 @@ ext4_read_block_bitmap_nowait(struct sup
 		goto verify;
 	}
 	ext4_lock_group(sb, block_group);
-	if (desc->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)) {
+	if (ext4_has_group_desc_csum(sb) &&
+	    (desc->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT))) {
 		int err;
 
+		if (block_group == 0) {
+			ext4_unlock_group(sb, block_group);
+			unlock_buffer(bh);
+			ext4_error(sb, "Block bitmap for bg 0 marked "
+				   "uninitialized");
+			put_bh(bh);
+			return NULL;
+		}
 		err = ext4_init_block_bitmap(sb, bh, block_group, desc);
 		set_bitmap_uptodate(bh);
 		set_buffer_uptodate(bh);
diff -druNp --no-dereference linux-libre-3.18.123-gnu/fs/ext4/dir.c linux-libre-3.18.124-gnu/fs/ext4/dir.c
--- linux-libre-3.18.123-gnu/fs/ext4/dir.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/fs/ext4/dir.c	2018-10-13 03:09:32.000000000 -0400
@@ -77,7 +77,7 @@ int __ext4_check_dir_entry(const char *f
 	else if (unlikely(rlen < EXT4_DIR_REC_LEN(de->name_len)))
 		error_msg = "rec_len is too small for name_len";
 	else if (unlikely(((char *) de - buf) + rlen > size))
-		error_msg = "directory entry across range";
+		error_msg = "directory entry overrun";
 	else if (unlikely(le32_to_cpu(de->inode) >
 			le32_to_cpu(EXT4_SB(dir->i_sb)->s_es->s_inodes_count)))
 		error_msg = "inode out of bounds";
@@ -86,18 +86,16 @@ int __ext4_check_dir_entry(const char *f
 
 	if (filp)
 		ext4_error_file(filp, function, line, bh->b_blocknr,
-				"bad entry in directory: %s - offset=%u(%u), "
-				"inode=%u, rec_len=%d, name_len=%d",
-				error_msg, (unsigned) (offset % size),
-				offset, le32_to_cpu(de->inode),
-				rlen, de->name_len);
+				"bad entry in directory: %s - offset=%u, "
+				"inode=%u, rec_len=%d, name_len=%d, size=%d",
+				error_msg, offset, le32_to_cpu(de->inode),
+				rlen, de->name_len, size);
 	else
 		ext4_error_inode(dir, function, line, bh->b_blocknr,
-				"bad entry in directory: %s - offset=%u(%u), "
-				"inode=%u, rec_len=%d, name_len=%d",
-				error_msg, (unsigned) (offset % size),
-				offset, le32_to_cpu(de->inode),
-				rlen, de->name_len);
+				"bad entry in directory: %s - offset=%u, "
+				"inode=%u, rec_len=%d, name_len=%d, size=%d",
+				 error_msg, offset, le32_to_cpu(de->inode),
+				 rlen, de->name_len, size);
 
 	return 1;
 }
diff -druNp --no-dereference linux-libre-3.18.123-gnu/fs/ext4/ext4_extents.h linux-libre-3.18.124-gnu/fs/ext4/ext4_extents.h
--- linux-libre-3.18.123-gnu/fs/ext4/ext4_extents.h	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/fs/ext4/ext4_extents.h	2018-10-13 03:09:32.000000000 -0400
@@ -103,6 +103,7 @@ struct ext4_extent_header {
 };
 
 #define EXT4_EXT_MAGIC		cpu_to_le16(0xf30a)
+#define EXT4_MAX_EXTENT_DEPTH 5
 
 #define EXT4_EXTENT_TAIL_OFFSET(hdr) \
 	(sizeof(struct ext4_extent_header) + \
diff -druNp --no-dereference linux-libre-3.18.123-gnu/fs/ext4/ext4.h linux-libre-3.18.124-gnu/fs/ext4/ext4.h
--- linux-libre-3.18.123-gnu/fs/ext4/ext4.h	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/fs/ext4/ext4.h	2018-10-13 03:09:32.000000000 -0400
@@ -1386,11 +1386,6 @@ static inline struct timespec ext4_curre
 static inline int ext4_valid_inum(struct super_block *sb, unsigned long ino)
 {
 	return ino == EXT4_ROOT_INO ||
-		ino == EXT4_USR_QUOTA_INO ||
-		ino == EXT4_GRP_QUOTA_INO ||
-		ino == EXT4_BOOT_LOADER_INO ||
-		ino == EXT4_JOURNAL_INO ||
-		ino == EXT4_RESIZE_INO ||
 		(ino >= EXT4_FIRST_INO(sb) &&
 		 ino <= le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count));
 }
@@ -2668,9 +2663,6 @@ extern struct buffer_head *ext4_get_firs
 extern int ext4_inline_data_fiemap(struct inode *inode,
 				   struct fiemap_extent_info *fieinfo,
 				   int *has_inline);
-extern int ext4_try_to_evict_inline_data(handle_t *handle,
-					 struct inode *inode,
-					 int needed);
 extern void ext4_inline_data_truncate(struct inode *inode, int *has_inline);
 
 extern int ext4_convert_inline_data(struct inode *inode);
diff -druNp --no-dereference linux-libre-3.18.123-gnu/fs/ext4/extents.c linux-libre-3.18.124-gnu/fs/ext4/extents.c
--- linux-libre-3.18.123-gnu/fs/ext4/extents.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/fs/ext4/extents.c	2018-10-13 03:09:32.000000000 -0400
@@ -870,6 +870,12 @@ ext4_find_extent(struct inode *inode, ex
 
 	eh = ext_inode_hdr(inode);
 	depth = ext_depth(inode);
+	if (depth < 0 || depth > EXT4_MAX_EXTENT_DEPTH) {
+		EXT4_ERROR_INODE(inode, "inode has invalid extent depth: %d",
+				 depth);
+		ret = -EIO;
+		goto err;
+	}
 
 	if (path) {
 		ext4_ext_drop_refs(path);
diff -druNp --no-dereference linux-libre-3.18.123-gnu/fs/ext4/ialloc.c linux-libre-3.18.124-gnu/fs/ext4/ialloc.c
--- linux-libre-3.18.123-gnu/fs/ext4/ialloc.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/fs/ext4/ialloc.c	2018-10-13 03:09:32.000000000 -0400
@@ -117,7 +117,16 @@ ext4_read_inode_bitmap(struct super_bloc
 	}
 
 	ext4_lock_group(sb, block_group);
-	if (desc->bg_flags & cpu_to_le16(EXT4_BG_INODE_UNINIT)) {
+	if (ext4_has_group_desc_csum(sb) &&
+	    (desc->bg_flags & cpu_to_le16(EXT4_BG_INODE_UNINIT))) {
+		if (block_group == 0) {
+			ext4_unlock_group(sb, block_group);
+			unlock_buffer(bh);
+			ext4_error(sb, "Inode bitmap for bg 0 marked "
+				   "uninitialized");
+			put_bh(bh);
+			return NULL;
+		}
 		memset(bh->b_data, 0, (EXT4_INODES_PER_GROUP(sb) + 7) / 8);
 		ext4_mark_bitmap_end(EXT4_INODES_PER_GROUP(sb),
 				     sb->s_blocksize * 8, bh->b_data);
@@ -873,7 +882,8 @@ got:
 
 		/* recheck and clear flag under lock if we still need to */
 		ext4_lock_group(sb, group);
-		if (gdp->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)) {
+		if (ext4_has_group_desc_csum(sb) &&
+		    (gdp->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT))) {
 			gdp->bg_flags &= cpu_to_le16(~EXT4_BG_BLOCK_UNINIT);
 			ext4_free_group_clusters_set(sb, gdp,
 				ext4_free_clusters_after_init(sb, group, gdp));
@@ -1243,7 +1253,10 @@ int ext4_init_inode_table(struct super_b
 			    ext4_itable_unused_count(sb, gdp)),
 			    sbi->s_inodes_per_block);
 
-	if ((used_blks < 0) || (used_blks > sbi->s_itb_per_group)) {
+	if ((used_blks < 0) || (used_blks > sbi->s_itb_per_group) ||
+	    ((group == 0) && ((EXT4_INODES_PER_GROUP(sb) -
+			       ext4_itable_unused_count(sb, gdp)) <
+			      EXT4_FIRST_INO(sb)))) {
 		ext4_error(sb, "Something is wrong with group %u: "
 			   "used itable blocks: %d; "
 			   "itable unused count: %u",
diff -druNp --no-dereference linux-libre-3.18.123-gnu/fs/ext4/inline.c linux-libre-3.18.124-gnu/fs/ext4/inline.c
--- linux-libre-3.18.123-gnu/fs/ext4/inline.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/fs/ext4/inline.c	2018-10-13 03:09:32.000000000 -0400
@@ -873,11 +873,11 @@ retry_journal:
 	}
 
 	if (ret == -ENOSPC) {
+		ext4_journal_stop(handle);
 		ret = ext4_da_convert_inline_data_to_extent(mapping,
 							    inode,
 							    flags,
 							    fsdata);
-		ext4_journal_stop(handle);
 		if (ret == -ENOSPC &&
 		    ext4_should_retry_alloc(inode->i_sb, &retries))
 			goto retry_journal;
@@ -1738,6 +1738,7 @@ int empty_inline_dir(struct inode *dir,
 {
 	int err, inline_size;
 	struct ext4_iloc iloc;
+	size_t inline_len;
 	void *inline_pos;
 	unsigned int offset;
 	struct ext4_dir_entry_2 *de;
@@ -1765,8 +1766,9 @@ int empty_inline_dir(struct inode *dir,
 		goto out;
 	}
 
+	inline_len = ext4_get_inline_size(dir);
 	offset = EXT4_INLINE_DOTDOT_SIZE;
-	while (offset < dir->i_size) {
+	while (offset < inline_len) {
 		de = ext4_get_inline_entry(dir, &iloc, offset,
 					   &inline_pos, &inline_size);
 		if (ext4_check_dir_entry(dir, NULL, de,
@@ -1840,42 +1842,6 @@ out:
 	return (error < 0 ? error : 0);
 }
 
-/*
- * Called during xattr set, and if we can sparse space 'needed',
- * just create the extent tree evict the data to the outer block.
- *
- * We use jbd2 instead of page cache to move data to the 1st block
- * so that the whole transaction can be committed as a whole and
- * the data isn't lost because of the delayed page cache write.
- */
-int ext4_try_to_evict_inline_data(handle_t *handle,
-				  struct inode *inode,
-				  int needed)
-{
-	int error;
-	struct ext4_xattr_entry *entry;
-	struct ext4_inode *raw_inode;
-	struct ext4_iloc iloc;
-
-	error = ext4_get_inode_loc(inode, &iloc);
-	if (error)
-		return error;
-
-	raw_inode = ext4_raw_inode(&iloc);
-	entry = (struct ext4_xattr_entry *)((void *)raw_inode +
-					    EXT4_I(inode)->i_inline_off);
-	if (EXT4_XATTR_LEN(entry->e_name_len) +
-	    EXT4_XATTR_SIZE(le32_to_cpu(entry->e_value_size)) < needed) {
-		error = -ENOSPC;
-		goto out;
-	}
-
-	error = ext4_convert_inline_data_nolock(handle, inode, &iloc);
-out:
-	brelse(iloc.bh);
-	return error;
-}
-
 void ext4_inline_data_truncate(struct inode *inode, int *has_inline)
 {
 	handle_t *handle;
diff -druNp --no-dereference linux-libre-3.18.123-gnu/fs/ext4/inode.c linux-libre-3.18.124-gnu/fs/ext4/inode.c
--- linux-libre-3.18.123-gnu/fs/ext4/inode.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/fs/ext4/inode.c	2018-10-13 03:09:32.000000000 -0400
@@ -3737,7 +3737,8 @@ static int __ext4_get_inode_loc(struct i
 	int			inodes_per_block, inode_offset;
 
 	iloc->bh = NULL;
-	if (!ext4_valid_inum(sb, inode->i_ino))
+	if (inode->i_ino < EXT4_ROOT_INO ||
+	    inode->i_ino > le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count))
 		return -EIO;
 
 	iloc->block_group = (inode->i_ino - 1) / EXT4_INODES_PER_GROUP(sb);
diff -druNp --no-dereference linux-libre-3.18.123-gnu/fs/ext4/mballoc.c linux-libre-3.18.124-gnu/fs/ext4/mballoc.c
--- linux-libre-3.18.123-gnu/fs/ext4/mballoc.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/fs/ext4/mballoc.c	2018-10-13 03:09:32.000000000 -0400
@@ -2415,7 +2415,8 @@ int ext4_mb_add_groupinfo(struct super_b
 	 * initialize bb_free to be able to skip
 	 * empty groups without initialization
 	 */
-	if (desc->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)) {
+	if (ext4_has_group_desc_csum(sb) &&
+	    (desc->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT))) {
 		meta_group_info[i]->bb_free =
 			ext4_free_clusters_after_init(sb, group, desc);
 	} else {
@@ -2942,7 +2943,8 @@ ext4_mb_mark_diskspace_used(struct ext4_
 #endif
 	ext4_set_bits(bitmap_bh->b_data, ac->ac_b_ex.fe_start,
 		      ac->ac_b_ex.fe_len);
-	if (gdp->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)) {
+	if (ext4_has_group_desc_csum(sb) &&
+	    (gdp->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT))) {
 		gdp->bg_flags &= cpu_to_le16(~EXT4_BG_BLOCK_UNINIT);
 		ext4_free_group_clusters_set(sb, gdp,
 					     ext4_free_clusters_after_init(sb,
diff -druNp --no-dereference linux-libre-3.18.123-gnu/fs/ext4/mmp.c linux-libre-3.18.124-gnu/fs/ext4/mmp.c
--- linux-libre-3.18.123-gnu/fs/ext4/mmp.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/fs/ext4/mmp.c	2018-10-13 03:09:32.000000000 -0400
@@ -48,7 +48,6 @@ static int write_mmp_block(struct super_
 	 */
 	sb_start_write(sb);
 	ext4_mmp_csum_set(sb, mmp);
-	mark_buffer_dirty(bh);
 	lock_buffer(bh);
 	bh->b_end_io = end_buffer_write_sync;
 	get_bh(bh);
diff -druNp --no-dereference linux-libre-3.18.123-gnu/fs/ext4/resize.c linux-libre-3.18.124-gnu/fs/ext4/resize.c
--- linux-libre-3.18.123-gnu/fs/ext4/resize.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/fs/ext4/resize.c	2018-10-13 03:09:32.000000000 -0400
@@ -1957,6 +1957,26 @@ retry:
 		}
 	}
 
+	/*
+	 * Make sure the last group has enough space so that it's
+	 * guaranteed to have enough space for all metadata blocks
+	 * that it might need to hold.  (We might not need to store
+	 * the inode table blocks in the last block group, but there
+	 * will be cases where this might be needed.)
+	 */
+	if ((ext4_group_first_block_no(sb, n_group) +
+	     ext4_group_overhead_blocks(sb, n_group) + 2 +
+	     sbi->s_itb_per_group + sbi->s_cluster_ratio) >= n_blocks_count) {
+		n_blocks_count = ext4_group_first_block_no(sb, n_group);
+		n_group--;
+		n_blocks_count_retry = 0;
+		if (resize_inode) {
+			iput(resize_inode);
+			resize_inode = NULL;
+		}
+		goto retry;
+	}
+
 	/* extend the last group */
 	if (n_group == o_group)
 		add = n_blocks_count - o_blocks_count;
diff -druNp --no-dereference linux-libre-3.18.123-gnu/fs/ext4/super.c linux-libre-3.18.124-gnu/fs/ext4/super.c
--- linux-libre-3.18.123-gnu/fs/ext4/super.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/fs/ext4/super.c	2018-10-13 03:09:32.000000000 -0400
@@ -2064,7 +2064,7 @@ static int ext4_check_descriptors(struct
 	struct ext4_sb_info *sbi = EXT4_SB(sb);
 	ext4_fsblk_t first_block = le32_to_cpu(sbi->s_es->s_first_data_block);
 	ext4_fsblk_t last_block;
-	ext4_fsblk_t last_bg_block = sb_block + ext4_bg_num_gdb(sb, 0) + 1;
+	ext4_fsblk_t last_bg_block = sb_block + ext4_bg_num_gdb(sb, 0);
 	ext4_fsblk_t block_bitmap;
 	ext4_fsblk_t inode_bitmap;
 	ext4_fsblk_t inode_table;
@@ -3132,6 +3132,9 @@ static ext4_group_t ext4_has_uninit_itab
 	ext4_group_t group, ngroups = EXT4_SB(sb)->s_groups_count;
 	struct ext4_group_desc *gdp = NULL;
 
+	if (!ext4_has_group_desc_csum(sb))
+		return ngroups;
+
 	for (group = 0; group < ngroups; group++) {
 		gdp = ext4_get_group_desc(sb, group, NULL);
 		if (!gdp)
@@ -3791,6 +3794,11 @@ static int ext4_fill_super(struct super_
 	} else {
 		sbi->s_inode_size = le16_to_cpu(es->s_inode_size);
 		sbi->s_first_ino = le32_to_cpu(es->s_first_ino);
+		if (sbi->s_first_ino < EXT4_GOOD_OLD_FIRST_INO) {
+			ext4_msg(sb, KERN_ERR, "invalid first ino: %u",
+				 sbi->s_first_ino);
+			goto failed_mount;
+		}
 		if ((sbi->s_inode_size < EXT4_GOOD_OLD_INODE_SIZE) ||
 		    (!is_power_of_2(sbi->s_inode_size)) ||
 		    (sbi->s_inode_size > blocksize)) {
@@ -4015,12 +4023,12 @@ static int ext4_fill_super(struct super_
 			goto failed_mount2;
 		}
 	}
+	sbi->s_gdb_count = db_count;
 	if (!ext4_check_descriptors(sb, logical_sb_block, &first_not_zeroed)) {
 		ext4_msg(sb, KERN_ERR, "group descriptors corrupted!");
 		goto failed_mount2;
 	}
 
-	sbi->s_gdb_count = db_count;
 	get_random_bytes(&sbi->s_next_generation, sizeof(u32));
 	spin_lock_init(&sbi->s_next_gen_lock);
 
@@ -4237,11 +4245,13 @@ no_journal:
 	block = ext4_count_free_clusters(sb);
 	ext4_free_blocks_count_set(sbi->s_es, 
 				   EXT4_C2B(sbi, block));
+	ext4_superblock_csum_set(sb);
 	err = percpu_counter_init(&sbi->s_freeclusters_counter, block,
 				  GFP_KERNEL);
 	if (!err) {
 		unsigned long freei = ext4_count_free_inodes(sb);
 		sbi->s_es->s_free_inodes_count = cpu_to_le32(freei);
+		ext4_superblock_csum_set(sb);
 		err = percpu_counter_init(&sbi->s_freeinodes_counter, freei,
 					  GFP_KERNEL);
 	}
diff -druNp --no-dereference linux-libre-3.18.123-gnu/fs/ext4/xattr.c linux-libre-3.18.124-gnu/fs/ext4/xattr.c
--- linux-libre-3.18.123-gnu/fs/ext4/xattr.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/fs/ext4/xattr.c	2018-10-13 03:09:32.000000000 -0400
@@ -218,12 +218,12 @@ ext4_xattr_check_block(struct inode *ino
 {
 	int error;
 
-	if (buffer_verified(bh))
-		return 0;
-
 	if (BHDR(bh)->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC) ||
 	    BHDR(bh)->h_blocks != cpu_to_le32(1))
 		return -EIO;
+	if (buffer_verified(bh))
+		return 0;
+
 	if (!ext4_xattr_block_csum_verify(inode, bh->b_blocknr, BHDR(bh)))
 		return -EIO;
 	error = ext4_xattr_check_names(BFIRST(bh), bh->b_data + bh->b_size,
@@ -637,14 +637,20 @@ static size_t ext4_xattr_free_space(stru
 }
 
 static int
-ext4_xattr_set_entry(struct ext4_xattr_info *i, struct ext4_xattr_search *s)
+ext4_xattr_set_entry(struct ext4_xattr_info *i, struct ext4_xattr_search *s,
+		     struct inode *inode)
 {
-	struct ext4_xattr_entry *last;
+	struct ext4_xattr_entry *last, *next;
 	size_t free, min_offs = s->end - s->base, name_len = strlen(i->name);
 
 	/* Compute min_offs and last. */
 	last = s->first;
-	for (; !IS_LAST_ENTRY(last); last = EXT4_XATTR_NEXT(last)) {
+	for (; !IS_LAST_ENTRY(last); last = next) {
+		next = EXT4_XATTR_NEXT(last);
+		if ((void *)next >= s->end) {
+			EXT4_ERROR_INODE(inode, "corrupted xattr entries");
+			return -EIO;
+		}
 		if (!last->e_value_block && last->e_value_size) {
 			size_t offs = le16_to_cpu(last->e_value_offs);
 			if (offs < min_offs)
@@ -825,7 +831,7 @@ ext4_xattr_block_set(handle_t *handle, s
 				ce = NULL;
 			}
 			ea_bdebug(bs->bh, "modifying in-place");
-			error = ext4_xattr_set_entry(i, s);
+			error = ext4_xattr_set_entry(i, s, inode);
 			if (!error) {
 				if (!IS_LAST_ENTRY(s->first))
 					ext4_xattr_rehash(header(s->base),
@@ -877,7 +883,7 @@ ext4_xattr_block_set(handle_t *handle, s
 		s->end = s->base + sb->s_blocksize;
 	}
 
-	error = ext4_xattr_set_entry(i, s);
+	error = ext4_xattr_set_entry(i, s, inode);
 	if (error == -EIO)
 		goto bad_block;
 	if (error)
@@ -1038,23 +1044,9 @@ int ext4_xattr_ibody_inline_set(handle_t
 
 	if (EXT4_I(inode)->i_extra_isize == 0)
 		return -ENOSPC;
-	error = ext4_xattr_set_entry(i, s);
-	if (error) {
-		if (error == -ENOSPC &&
-		    ext4_has_inline_data(inode)) {
-			error = ext4_try_to_evict_inline_data(handle, inode,
-					EXT4_XATTR_LEN(strlen(i->name) +
-					EXT4_XATTR_SIZE(i->value_len)));
-			if (error)
-				return error;
-			error = ext4_xattr_ibody_find(inode, i, is);
-			if (error)
-				return error;
-			error = ext4_xattr_set_entry(i, s);
-		}
-		if (error)
-			return error;
-	}
+	error = ext4_xattr_set_entry(i, s, inode);
+	if (error)
+		return error;
 	header = IHDR(inode, ext4_raw_inode(&is->iloc));
 	if (!IS_LAST_ENTRY(s->first)) {
 		header->h_magic = cpu_to_le32(EXT4_XATTR_MAGIC);
@@ -1076,7 +1068,7 @@ static int ext4_xattr_ibody_set(handle_t
 
 	if (EXT4_I(inode)->i_extra_isize == 0)
 		return -ENOSPC;
-	error = ext4_xattr_set_entry(i, s);
+	error = ext4_xattr_set_entry(i, s, inode);
 	if (error)
 		return error;
 	header = IHDR(inode, ext4_raw_inode(&is->iloc));
@@ -1385,6 +1377,11 @@ retry:
 		/* Find the entry best suited to be pushed into EA block */
 		entry = NULL;
 		for (; !IS_LAST_ENTRY(last); last = EXT4_XATTR_NEXT(last)) {
+			/* never move system.data out of the inode */
+			if ((last->e_name_len == 4) &&
+			    (last->e_name_index == EXT4_XATTR_INDEX_SYSTEM) &&
+			    !memcmp(last->e_name, "data", 4))
+				continue;
 			total_size =
 			EXT4_XATTR_SIZE(le32_to_cpu(last->e_value_size)) +
 					EXT4_XATTR_LEN(last->e_name_len);
diff -druNp --no-dereference linux-libre-3.18.123-gnu/fs/jbd2/transaction.c linux-libre-3.18.124-gnu/fs/jbd2/transaction.c
--- linux-libre-3.18.123-gnu/fs/jbd2/transaction.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/fs/jbd2/transaction.c	2018-10-13 03:09:32.000000000 -0400
@@ -1283,11 +1283,11 @@ int jbd2_journal_dirty_metadata(handle_t
 		 * of the transaction. This needs to be done
 		 * once a transaction -bzzz
 		 */
-		jh->b_modified = 1;
 		if (handle->h_buffer_credits <= 0) {
 			ret = -ENOSPC;
 			goto out_unlock_bh;
 		}
+		jh->b_modified = 1;
 		handle->h_buffer_credits--;
 	}
 
diff -druNp --no-dereference linux-libre-3.18.123-gnu/fs/nfsd/nfs4proc.c linux-libre-3.18.124-gnu/fs/nfsd/nfs4proc.c
--- linux-libre-3.18.123-gnu/fs/nfsd/nfs4proc.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/fs/nfsd/nfs4proc.c	2018-10-13 03:09:32.000000000 -0400
@@ -1347,6 +1347,7 @@ nfsd4_proc_compound(struct svc_rqst *rqs
 	if (status) {
 		op = &args->ops[0];
 		op->status = status;
+		resp->opcnt = 1;
 		goto encode_op;
 	}
 
diff -druNp --no-dereference linux-libre-3.18.123-gnu/fs/ocfs2/buffer_head_io.c linux-libre-3.18.124-gnu/fs/ocfs2/buffer_head_io.c
--- linux-libre-3.18.123-gnu/fs/ocfs2/buffer_head_io.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/fs/ocfs2/buffer_head_io.c	2018-10-13 03:09:32.000000000 -0400
@@ -330,6 +330,7 @@ int ocfs2_read_blocks(struct ocfs2_cachi
 				 * for this bh as it's not marked locally
 				 * uptodate. */
 				status = -EIO;
+				clear_buffer_needs_validate(bh);
 				put_bh(bh);
 				bhs[i] = NULL;
 				continue;
diff -druNp --no-dereference linux-libre-3.18.123-gnu/fs/ocfs2/dlm/dlmmaster.c linux-libre-3.18.124-gnu/fs/ocfs2/dlm/dlmmaster.c
--- linux-libre-3.18.123-gnu/fs/ocfs2/dlm/dlmmaster.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/fs/ocfs2/dlm/dlmmaster.c	2018-10-13 03:09:32.000000000 -0400
@@ -599,9 +599,9 @@ static void dlm_init_lockres(struct dlm_
 
 	res->last_used = 0;
 
-	spin_lock(&dlm->spinlock);
+	spin_lock(&dlm->track_lock);
 	list_add_tail(&res->tracking, &dlm->tracking_list);
-	spin_unlock(&dlm->spinlock);
+	spin_unlock(&dlm->track_lock);
 
 	memset(res->lvb, 0, DLM_LVB_LEN);
 	memset(res->refmap, 0, sizeof(res->refmap));
diff -druNp --no-dereference linux-libre-3.18.123-gnu/fs/proc/base.c linux-libre-3.18.124-gnu/fs/proc/base.c
--- linux-libre-3.18.123-gnu/fs/proc/base.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/fs/proc/base.c	2018-10-13 03:09:32.000000000 -0400
@@ -279,6 +279,20 @@ static int proc_pid_stack(struct seq_fil
 	int err;
 	int i;
 
+	/*
+	 * The ability to racily run the kernel stack unwinder on a running task
+	 * and then observe the unwinder output is scary; while it is useful for
+	 * debugging kernel issues, it can also allow an attacker to leak kernel
+	 * stack contents.
+	 * Doing this in a manner that is at least safe from races would require
+	 * some work to ensure that the remote task can not be scheduled; and
+	 * even then, this would still expose the unwinder as local attack
+	 * surface.
+	 * Therefore, this interface is restricted to root.
+	 */
+	if (!file_ns_capable(m->file, &init_user_ns, CAP_SYS_ADMIN))
+		return -EACCES;
+
 	entries = kmalloc(MAX_STACK_TRACE_DEPTH * sizeof(*entries), GFP_KERNEL);
 	if (!entries)
 		return -ENOMEM;
diff -druNp --no-dereference linux-libre-3.18.123-gnu/fs/seq_file.c linux-libre-3.18.124-gnu/fs/seq_file.c
--- linux-libre-3.18.123-gnu/fs/seq_file.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/fs/seq_file.c	2018-10-13 03:09:32.000000000 -0400
@@ -69,9 +69,10 @@ int seq_open(struct file *file, const st
 	memset(p, 0, sizeof(*p));
 	mutex_init(&p->lock);
 	p->op = op;
-#ifdef CONFIG_USER_NS
-	p->user_ns = file->f_cred->user_ns;
-#endif
+
+	// No refcounting: the lifetime of 'p' is constrained
+	// to the lifetime of the file.
+	p->file = file;
 
 	/*
 	 * Wrappers around seq_open(e.g. swaps_open) need to be
diff -druNp --no-dereference linux-libre-3.18.123-gnu/fs/ubifs/super.c linux-libre-3.18.124-gnu/fs/ubifs/super.c
--- linux-libre-3.18.123-gnu/fs/ubifs/super.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/fs/ubifs/super.c	2018-10-13 03:09:32.000000000 -0400
@@ -1917,6 +1917,9 @@ static struct ubi_volume_desc *open_ubi(
 	int dev, vol;
 	char *endptr;
 
+	if (!name || !*name)
+		return ERR_PTR(-EINVAL);
+
 	/* First, try to open using the device node path method */
 	ubi = ubi_open_volume_path(name, mode);
 	if (!IS_ERR(ubi))
diff -druNp --no-dereference linux-libre-3.18.123-gnu/include/linux/netfilter_bridge/ebtables.h linux-libre-3.18.124-gnu/include/linux/netfilter_bridge/ebtables.h
--- linux-libre-3.18.123-gnu/include/linux/netfilter_bridge/ebtables.h	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/include/linux/netfilter_bridge/ebtables.h	2018-10-13 03:09:32.000000000 -0400
@@ -124,4 +124,9 @@ extern unsigned int ebt_do_table(unsigne
 /* True if the target is not a standard target */
 #define INVALID_TARGET (info->target < -NUM_STANDARD_TARGETS || info->target >= 0)
 
+static inline bool ebt_invalid_target(int target)
+{
+	return (target < -NUM_STANDARD_TARGETS || target >= 0);
+}
+
 #endif
diff -druNp --no-dereference linux-libre-3.18.123-gnu/include/linux/seq_file.h linux-libre-3.18.124-gnu/include/linux/seq_file.h
--- linux-libre-3.18.123-gnu/include/linux/seq_file.h	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/include/linux/seq_file.h	2018-10-13 03:09:32.000000000 -0400
@@ -7,13 +7,10 @@
 #include <linux/mutex.h>
 #include <linux/cpumask.h>
 #include <linux/nodemask.h>
+#include <linux/fs.h>
+#include <linux/cred.h>
 
 struct seq_operations;
-struct file;
-struct path;
-struct inode;
-struct dentry;
-struct user_namespace;
 
 struct seq_file {
 	char *buf;
@@ -27,9 +24,7 @@ struct seq_file {
 	struct mutex lock;
 	const struct seq_operations *op;
 	int poll_event;
-#ifdef CONFIG_USER_NS
-	struct user_namespace *user_ns;
-#endif
+	const struct file *file;
 	void *private;
 };
 
@@ -151,7 +146,7 @@ int seq_put_decimal_ll(struct seq_file *
 static inline struct user_namespace *seq_user_ns(struct seq_file *seq)
 {
 #ifdef CONFIG_USER_NS
-	return seq->user_ns;
+	return seq->file->f_cred->user_ns;
 #else
 	extern struct user_namespace init_user_ns;
 	return &init_user_ns;
diff -druNp --no-dereference linux-libre-3.18.123-gnu/include/linux/slub_def.h linux-libre-3.18.124-gnu/include/linux/slub_def.h
--- linux-libre-3.18.123-gnu/include/linux/slub_def.h	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/include/linux/slub_def.h	2018-10-13 03:09:32.000000000 -0400
@@ -67,7 +67,8 @@ struct kmem_cache {
 	int size;		/* The size of an object including meta data */
 	int object_size;	/* The size of an object without meta data */
 	int offset;		/* Free pointer offset. */
-	int cpu_partial;	/* Number of per cpu partial objects to keep around */
+	/* Number of per cpu partial objects to keep around */
+	unsigned int cpu_partial;
 	struct kmem_cache_order_objects oo;
 
 	/* Allocation and freeing of slabs */
diff -druNp --no-dereference linux-libre-3.18.123-gnu/include/media/v4l2-fh.h linux-libre-3.18.124-gnu/include/media/v4l2-fh.h
--- linux-libre-3.18.123-gnu/include/media/v4l2-fh.h	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/include/media/v4l2-fh.h	2018-10-13 03:09:32.000000000 -0400
@@ -43,6 +43,7 @@ struct v4l2_fh {
 	wait_queue_head_t	wait;
 	struct list_head	subscribed; /* Subscribed events */
 	struct list_head	available; /* Dequeueable event */
+	struct mutex		subscribe_lock;
 	unsigned int		navailable;
 	u32			sequence;
 
diff -druNp --no-dereference linux-libre-3.18.123-gnu/kernel/cgroup.c linux-libre-3.18.124-gnu/kernel/cgroup.c
--- linux-libre-3.18.123-gnu/kernel/cgroup.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/kernel/cgroup.c	2018-10-13 03:09:32.000000000 -0400
@@ -3669,7 +3669,11 @@ int cgroup_transfer_tasks(struct cgroup
 	 */
 	do {
 		css_task_iter_start(&from->self, &it);
-		task = css_task_iter_next(&it);
+
+		do {
+			task = css_task_iter_next(&it);
+		} while (task && (task->flags & PF_EXITING));
+
 		if (task)
 			get_task_struct(task);
 		css_task_iter_end(&it);
diff -druNp --no-dereference linux-libre-3.18.123-gnu/kernel/module.c linux-libre-3.18.124-gnu/kernel/module.c
--- linux-libre-3.18.123-gnu/kernel/module.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/kernel/module.c	2018-10-13 03:09:32.000000000 -0400
@@ -3592,7 +3592,7 @@ static unsigned long mod_find_symname(st
 
 	for (i = 0; i < kallsyms->num_symtab; i++)
 		if (strcmp(name, symname(kallsyms, i)) == 0 &&
-		    kallsyms->symtab[i].st_info != 'U')
+		    kallsyms->symtab[i].st_shndx != SHN_UNDEF)
 			return kallsyms->symtab[i].st_value;
 	return 0;
 }
@@ -3636,6 +3636,10 @@ int module_kallsyms_on_each_symbol(int (
 		if (mod->state == MODULE_STATE_UNFORMED)
 			continue;
 		for (i = 0; i < kallsyms->num_symtab; i++) {
+
+			if (kallsyms->symtab[i].st_shndx == SHN_UNDEF)
+				continue;
+
 			ret = fn(data, symname(kallsyms, i),
 				 mod, kallsyms->symtab[i].st_value);
 			if (ret != 0)
diff -druNp --no-dereference linux-libre-3.18.123-gnu/kernel/time/alarmtimer.c linux-libre-3.18.124-gnu/kernel/time/alarmtimer.c
--- linux-libre-3.18.123-gnu/kernel/time/alarmtimer.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/kernel/time/alarmtimer.c	2018-10-13 03:09:32.000000000 -0400
@@ -776,7 +776,8 @@ static int alarm_timer_nsleep(const cloc
 	/* Convert (if necessary) to absolute time */
 	if (flags != TIMER_ABSTIME) {
 		ktime_t now = alarm_bases[type].gettime();
-		exp = ktime_add(now, exp);
+
+		exp = ktime_add_safe(now, exp);
 	}
 
 	if (alarmtimer_do_nsleep(&alarm, exp))
diff -druNp --no-dereference linux-libre-3.18.123-gnu/kernel/trace/ring_buffer.c linux-libre-3.18.124-gnu/kernel/trace/ring_buffer.c
--- linux-libre-3.18.123-gnu/kernel/trace/ring_buffer.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/kernel/trace/ring_buffer.c	2018-10-13 03:09:32.000000000 -0400
@@ -1542,6 +1542,8 @@ rb_remove_pages(struct ring_buffer_per_c
 	tmp_iter_page = first_page;
 
 	do {
+		cond_resched();
+
 		to_remove_page = tmp_iter_page;
 		rb_inc_page(cpu_buffer, &tmp_iter_page);
 
diff -druNp --no-dereference linux-libre-3.18.123-gnu/Makefile linux-libre-3.18.124-gnu/Makefile
--- linux-libre-3.18.123-gnu/Makefile	2018-09-26 14:12:48.000000000 -0400
+++ linux-libre-3.18.124-gnu/Makefile	2018-10-13 21:41:30.000000000 -0400
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 18
-SUBLEVEL = 123
+SUBLEVEL = 124
 EXTRAVERSION =-gnu
 NAME = Diseased Newt
 
diff -druNp --no-dereference linux-libre-3.18.123-gnu/mm/madvise.c linux-libre-3.18.124-gnu/mm/madvise.c
--- linux-libre-3.18.123-gnu/mm/madvise.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/mm/madvise.c	2018-10-13 03:09:32.000000000 -0400
@@ -75,7 +75,7 @@ static long madvise_behavior(struct vm_a
 		new_flags |= VM_DONTDUMP;
 		break;
 	case MADV_DODUMP:
-		if (new_flags & VM_SPECIAL) {
+		if (!is_vm_hugetlb_page(vma) && new_flags & VM_SPECIAL) {
 			error = -EINVAL;
 			goto out;
 		}
diff -druNp --no-dereference linux-libre-3.18.123-gnu/mm/shmem.c linux-libre-3.18.124-gnu/mm/shmem.c
--- linux-libre-3.18.123-gnu/mm/shmem.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/mm/shmem.c	2018-10-13 03:09:32.000000000 -0400
@@ -1454,6 +1454,8 @@ static struct inode *shmem_get_inode(str
 			mpol_shared_policy_init(&info->policy, NULL);
 			break;
 		}
+
+		lockdep_annotate_inode_mutex_key(inode);
 	} else
 		shmem_free_inode(sb);
 	return inode;
diff -druNp --no-dereference linux-libre-3.18.123-gnu/mm/slub.c linux-libre-3.18.124-gnu/mm/slub.c
--- linux-libre-3.18.123-gnu/mm/slub.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/mm/slub.c	2018-10-13 03:09:32.000000000 -0400
@@ -1577,7 +1577,7 @@ static void *get_partial_node(struct kme
 {
 	struct page *page, *page2;
 	void *object = NULL;
-	int available = 0;
+	unsigned int available = 0;
 	int objects;
 
 	/*
@@ -4366,10 +4366,10 @@ static ssize_t cpu_partial_show(struct k
 static ssize_t cpu_partial_store(struct kmem_cache *s, const char *buf,
 				 size_t length)
 {
-	unsigned long objects;
+	unsigned int objects;
 	int err;
 
-	err = kstrtoul(buf, 10, &objects);
+	err = kstrtouint(buf, 10, &objects);
 	if (err)
 		return err;
 	if (objects && !kmem_cache_has_cpu_partial(s))
diff -druNp --no-dereference linux-libre-3.18.123-gnu/net/bridge/netfilter/ebt_arpreply.c linux-libre-3.18.124-gnu/net/bridge/netfilter/ebt_arpreply.c
--- linux-libre-3.18.123-gnu/net/bridge/netfilter/ebt_arpreply.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/net/bridge/netfilter/ebt_arpreply.c	2018-10-13 03:09:32.000000000 -0400
@@ -67,6 +67,9 @@ static int ebt_arpreply_tg_check(const s
 	if (e->ethproto != htons(ETH_P_ARP) ||
 	    e->invflags & EBT_IPROTO)
 		return -EINVAL;
+	if (ebt_invalid_target(info->target))
+		return -EINVAL;
+
 	return 0;
 }
 
diff -druNp --no-dereference linux-libre-3.18.123-gnu/net/core/neighbour.c linux-libre-3.18.124-gnu/net/core/neighbour.c
--- linux-libre-3.18.123-gnu/net/core/neighbour.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/net/core/neighbour.c	2018-10-13 03:09:32.000000000 -0400
@@ -1147,6 +1147,12 @@ int neigh_update(struct neighbour *neigh
 		lladdr = neigh->ha;
 	}
 
+	/* Update confirmed timestamp for neighbour entry after we
+	 * received ARP packet even if it doesn't change IP to MAC binding.
+	 */
+	if (new & NUD_CONNECTED)
+		neigh->confirmed = jiffies;
+
 	/* If entry was valid and address is not changed,
 	   do not change entry state, if new one is STALE.
 	 */
@@ -1170,15 +1176,12 @@ int neigh_update(struct neighbour *neigh
 		}
 	}
 
-	/* Update timestamps only once we know we will make a change to the
+	/* Update timestamp only once we know we will make a change to the
 	 * neighbour entry. Otherwise we risk to move the locktime window with
 	 * noop updates and ignore relevant ARP updates.
 	 */
-	if (new != old || lladdr != neigh->ha) {
-		if (new & NUD_CONNECTED)
-			neigh->confirmed = jiffies;
+	if (new != old || lladdr != neigh->ha)
 		neigh->updated = jiffies;
-	}
 
 	if (new != old) {
 		neigh_del_timer(neigh);
diff -druNp --no-dereference linux-libre-3.18.123-gnu/net/ipv4/af_inet.c linux-libre-3.18.124-gnu/net/ipv4/af_inet.c
--- linux-libre-3.18.123-gnu/net/ipv4/af_inet.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/net/ipv4/af_inet.c	2018-10-13 03:09:32.000000000 -0400
@@ -1288,6 +1288,7 @@ static struct sk_buff *inet_gso_segment(
 		if (encap)
 			skb_reset_inner_headers(skb);
 		skb->network_header = (u8 *)iph - skb->head;
+		skb_reset_mac_len(skb);
 	} while ((skb = skb->next));
 
 out:
diff -druNp --no-dereference linux-libre-3.18.123-gnu/net/ipv6/ip6_offload.c linux-libre-3.18.124-gnu/net/ipv6/ip6_offload.c
--- linux-libre-3.18.123-gnu/net/ipv6/ip6_offload.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/net/ipv6/ip6_offload.c	2018-10-13 03:09:32.000000000 -0400
@@ -118,6 +118,7 @@ static struct sk_buff *ipv6_gso_segment(
 		ipv6h = (struct ipv6hdr *)(skb_mac_header(skb) + nhoff);
 		ipv6h->payload_len = htons(skb->len - nhoff - sizeof(*ipv6h));
 		skb->network_header = (u8 *)ipv6h - skb->head;
+		skb_reset_mac_len(skb);
 
 		if (udpfrag) {
 			int err = ip6_find_1stfragopt(skb, &prevhdr);
diff -druNp --no-dereference linux-libre-3.18.123-gnu/net/ipv6/ip6_output.c linux-libre-3.18.124-gnu/net/ipv6/ip6_output.c
--- linux-libre-3.18.123-gnu/net/ipv6/ip6_output.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/net/ipv6/ip6_output.c	2018-10-13 03:09:32.000000000 -0400
@@ -183,9 +183,10 @@ int ip6_xmit(struct sock *sk, struct sk_
 				kfree_skb(skb);
 				return -ENOBUFS;
 			}
+			if (skb->sk)
+				skb_set_owner_w(skb2, skb->sk);
 			consume_skb(skb);
 			skb = skb2;
-			skb_set_owner_w(skb, sk);
 		}
 		if (opt->opt_flen)
 			ipv6_push_frag_opts(skb, opt, &proto);
diff -druNp --no-dereference linux-libre-3.18.123-gnu/net/mac80211/cfg.c linux-libre-3.18.124-gnu/net/mac80211/cfg.c
--- linux-libre-3.18.123-gnu/net/mac80211/cfg.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/net/mac80211/cfg.c	2018-10-13 03:09:32.000000000 -0400
@@ -210,7 +210,7 @@ static int ieee80211_add_key(struct wiph
 	case NL80211_IFTYPE_AP:
 	case NL80211_IFTYPE_AP_VLAN:
 		/* Keys without a station are used for TX only */
-		if (key->sta && test_sta_flag(key->sta, WLAN_STA_MFP))
+		if (sta && test_sta_flag(sta, WLAN_STA_MFP))
 			key->conf.flags |= IEEE80211_KEY_FLAG_RX_MGMT;
 		break;
 	case NL80211_IFTYPE_ADHOC:
diff -druNp --no-dereference linux-libre-3.18.123-gnu/net/mac80211/ibss.c linux-libre-3.18.124-gnu/net/mac80211/ibss.c
--- linux-libre-3.18.123-gnu/net/mac80211/ibss.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/net/mac80211/ibss.c	2018-10-13 03:09:32.000000000 -0400
@@ -944,8 +944,8 @@ static void ieee80211_rx_mgmt_deauth_ibs
 	if (len < IEEE80211_DEAUTH_FRAME_LEN)
 		return;
 
-	ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM BSSID=%pM (reason: %d)\n",
-		 mgmt->sa, mgmt->da, mgmt->bssid, reason);
+	ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM\n", mgmt->sa, mgmt->da);
+	ibss_dbg(sdata, "\tBSSID=%pM (reason: %d)\n", mgmt->bssid, reason);
 	sta_info_destroy_addr(sdata, mgmt->sa);
 }
 
@@ -963,9 +963,9 @@ static void ieee80211_rx_mgmt_auth_ibss(
 	auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
 	auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
 
-	ibss_dbg(sdata,
-		 "RX Auth SA=%pM DA=%pM BSSID=%pM (auth_transaction=%d)\n",
-		 mgmt->sa, mgmt->da, mgmt->bssid, auth_transaction);
+	ibss_dbg(sdata, "RX Auth SA=%pM DA=%pM\n", mgmt->sa, mgmt->da);
+	ibss_dbg(sdata, "\tBSSID=%pM (auth_transaction=%d)\n",
+		 mgmt->bssid, auth_transaction);
 
 	if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1)
 		return;
@@ -1130,10 +1130,10 @@ static void ieee80211_rx_bss_info(struct
 		rx_timestamp = drv_get_tsf(local, sdata);
 	}
 
-	ibss_dbg(sdata,
-		 "RX beacon SA=%pM BSSID=%pM TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
+	ibss_dbg(sdata, "RX beacon SA=%pM BSSID=%pM TSF=0x%llx\n",
 		 mgmt->sa, mgmt->bssid,
-		 (unsigned long long)rx_timestamp,
+		 (unsigned long long)rx_timestamp);
+	ibss_dbg(sdata, "\tBCN=0x%llx diff=%lld @%lu\n",
 		 (unsigned long long)beacon_timestamp,
 		 (unsigned long long)(rx_timestamp - beacon_timestamp),
 		 jiffies);
@@ -1414,9 +1414,9 @@ static void ieee80211_rx_mgmt_probe_req(
 
 	tx_last_beacon = drv_tx_last_beacon(local);
 
-	ibss_dbg(sdata,
-		 "RX ProbeReq SA=%pM DA=%pM BSSID=%pM (tx_last_beacon=%d)\n",
-		 mgmt->sa, mgmt->da, mgmt->bssid, tx_last_beacon);
+	ibss_dbg(sdata, "RX ProbeReq SA=%pM DA=%pM\n", mgmt->sa, mgmt->da);
+	ibss_dbg(sdata, "\tBSSID=%pM (tx_last_beacon=%d)\n",
+		 mgmt->bssid, tx_last_beacon);
 
 	if (!tx_last_beacon && is_multicast_ether_addr(mgmt->da))
 		return;
diff -druNp --no-dereference linux-libre-3.18.123-gnu/net/mac80211/main.c linux-libre-3.18.124-gnu/net/mac80211/main.c
--- linux-libre-3.18.123-gnu/net/mac80211/main.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/net/mac80211/main.c	2018-10-13 03:09:32.000000000 -0400
@@ -258,8 +258,27 @@ static void ieee80211_restart_work(struc
 	     "%s called with hardware scan in progress\n", __func__);
 
 	rtnl_lock();
-	list_for_each_entry(sdata, &local->interfaces, list)
+	list_for_each_entry(sdata, &local->interfaces, list) {
+		/*
+		 * XXX: there may be more work for other vif types and even
+		 * for station mode: a good thing would be to run most of
+		 * the iface type's dependent _stop (ieee80211_mg_stop,
+		 * ieee80211_ibss_stop) etc...
+		 * For now, fix only the specific bug that was seen: race
+		 * between csa_connection_drop_work and us.
+		 */
+		if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+			/*
+			 * This worker is scheduled from the iface worker that
+			 * runs on mac80211's workqueue, so we can't be
+			 * scheduling this worker after the cancel right here.
+			 * The exception is ieee80211_chswitch_done.
+			 * Then we can have a race...
+			 */
+			cancel_work_sync(&sdata->u.mgd.csa_connection_drop_work);
+		}
 		flush_delayed_work(&sdata->dec_tailroom_needed_wk);
+	}
 	ieee80211_scan_cancel(local);
 	ieee80211_reconfig(local);
 	rtnl_unlock();
@@ -465,10 +484,7 @@ static const struct ieee80211_vht_cap ma
 		cpu_to_le32(IEEE80211_VHT_CAP_RXLDPC |
 			    IEEE80211_VHT_CAP_SHORT_GI_80 |
 			    IEEE80211_VHT_CAP_SHORT_GI_160 |
-			    IEEE80211_VHT_CAP_RXSTBC_1 |
-			    IEEE80211_VHT_CAP_RXSTBC_2 |
-			    IEEE80211_VHT_CAP_RXSTBC_3 |
-			    IEEE80211_VHT_CAP_RXSTBC_4 |
+			    IEEE80211_VHT_CAP_RXSTBC_MASK |
 			    IEEE80211_VHT_CAP_TXSTBC |
 			    IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
 			    IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
diff -druNp --no-dereference linux-libre-3.18.123-gnu/net/mac80211/mlme.c linux-libre-3.18.124-gnu/net/mac80211/mlme.c
--- linux-libre-3.18.123-gnu/net/mac80211/mlme.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/net/mac80211/mlme.c	2018-10-13 03:09:32.000000000 -0400
@@ -970,6 +970,10 @@ static void ieee80211_chswitch_work(stru
 	 */
 
 	if (sdata->reserved_chanctx) {
+		struct ieee80211_supported_band *sband = NULL;
+		struct sta_info *mgd_sta = NULL;
+		enum ieee80211_sta_rx_bandwidth bw = IEEE80211_STA_RX_BW_20;
+
 		/*
 		 * with multi-vif csa driver may call ieee80211_csa_finish()
 		 * many times while waiting for other interfaces to use their
@@ -978,6 +982,48 @@ static void ieee80211_chswitch_work(stru
 		if (sdata->reserved_ready)
 			goto out;
 
+		if (sdata->vif.bss_conf.chandef.width !=
+		    sdata->csa_chandef.width) {
+			/*
+			 * For managed interface, we need to also update the AP
+			 * station bandwidth and align the rate scale algorithm
+			 * on the bandwidth change. Here we only consider the
+			 * bandwidth of the new channel definition (as channel
+			 * switch flow does not have the full HT/VHT/HE
+			 * information), assuming that if additional changes are
+			 * required they would be done as part of the processing
+			 * of the next beacon from the AP.
+			 */
+			switch (sdata->csa_chandef.width) {
+			case NL80211_CHAN_WIDTH_20_NOHT:
+			case NL80211_CHAN_WIDTH_20:
+			default:
+				bw = IEEE80211_STA_RX_BW_20;
+				break;
+			case NL80211_CHAN_WIDTH_40:
+				bw = IEEE80211_STA_RX_BW_40;
+				break;
+			case NL80211_CHAN_WIDTH_80:
+				bw = IEEE80211_STA_RX_BW_80;
+				break;
+			case NL80211_CHAN_WIDTH_80P80:
+			case NL80211_CHAN_WIDTH_160:
+				bw = IEEE80211_STA_RX_BW_160;
+				break;
+			}
+
+			mgd_sta = sta_info_get(sdata, ifmgd->bssid);
+			sband =
+				local->hw.wiphy->bands[sdata->csa_chandef.chan->band];
+		}
+
+		if (sdata->vif.bss_conf.chandef.width >
+		    sdata->csa_chandef.width) {
+			mgd_sta->sta.bandwidth = bw;
+			rate_control_rate_update(local, sband, mgd_sta,
+						 IEEE80211_RC_BW_CHANGED);
+		}
+
 		ret = ieee80211_vif_use_reserved_context(sdata);
 		if (ret) {
 			sdata_info(sdata,
@@ -988,6 +1034,13 @@ static void ieee80211_chswitch_work(stru
 			goto out;
 		}
 
+		if (sdata->vif.bss_conf.chandef.width <
+		    sdata->csa_chandef.width) {
+			mgd_sta->sta.bandwidth = bw;
+			rate_control_rate_update(local, sband, mgd_sta,
+						 IEEE80211_RC_BW_CHANGED);
+		}
+
 		goto out;
 	}
 
diff -druNp --no-dereference linux-libre-3.18.123-gnu/net/wireless/nl80211.c linux-libre-3.18.124-gnu/net/wireless/nl80211.c
--- linux-libre-3.18.123-gnu/net/wireless/nl80211.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/net/wireless/nl80211.c	2018-10-13 03:09:32.000000000 -0400
@@ -9223,6 +9223,7 @@ static int nl80211_update_ft_ies(struct
 		return -EOPNOTSUPP;
 
 	if (!info->attrs[NL80211_ATTR_MDID] ||
+	    !info->attrs[NL80211_ATTR_IE] ||
 	    !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
 		return -EINVAL;
 
diff -druNp --no-dereference linux-libre-3.18.123-gnu/sound/aoa/core/gpio-feature.c linux-libre-3.18.124-gnu/sound/aoa/core/gpio-feature.c
--- linux-libre-3.18.123-gnu/sound/aoa/core/gpio-feature.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/sound/aoa/core/gpio-feature.c	2018-10-13 03:09:32.000000000 -0400
@@ -88,8 +88,10 @@ static struct device_node *get_gpio(char
 	}
 
 	reg = of_get_property(np, "reg", NULL);
-	if (!reg)
+	if (!reg) {
+		of_node_put(np);
 		return NULL;
+	}
 
 	*gpioptr = *reg;
 
diff -druNp --no-dereference linux-libre-3.18.123-gnu/sound/firewire/bebob/bebob_maudio.c linux-libre-3.18.124-gnu/sound/firewire/bebob/bebob_maudio.c
--- linux-libre-3.18.123-gnu/sound/firewire/bebob/bebob_maudio.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/sound/firewire/bebob/bebob_maudio.c	2018-10-13 03:09:32.000000000 -0400
@@ -96,17 +96,13 @@ int snd_bebob_maudio_load_firmware(struc
 	struct fw_device *device = fw_parent_device(unit);
 	int err, rcode;
 	u64 date;
-	__le32 cues[3] = {
-		cpu_to_le32(MAUDIO_BOOTLOADER_CUE1),
-		cpu_to_le32(MAUDIO_BOOTLOADER_CUE2),
-		cpu_to_le32(MAUDIO_BOOTLOADER_CUE3)
-	};
+	__le32 *cues;
 
 	/* check date of software used to build */
 	err = snd_bebob_read_block(unit, INFO_OFFSET_SW_DATE,
 				   &date, sizeof(u64));
 	if (err < 0)
-		goto end;
+		return err;
 	/*
 	 * firmware version 5058 or later has date later than "20070401", but
 	 * 'date' is not null-terminated.
@@ -114,20 +110,28 @@ int snd_bebob_maudio_load_firmware(struc
 	if (date < 0x3230303730343031LL) {
 		dev_err(&unit->device,
 			"Use firmware version 5058 or later\n");
-		err = -ENOSYS;
-		goto end;
+		return -ENXIO;
 	}
 
+	cues = kmalloc_array(3, sizeof(*cues), GFP_KERNEL);
+	if (!cues)
+		return -ENOMEM;
+
+	cues[0] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE1);
+	cues[1] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE2);
+	cues[2] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE3);
+
 	rcode = fw_run_transaction(device->card, TCODE_WRITE_BLOCK_REQUEST,
 				   device->node_id, device->generation,
 				   device->max_speed, BEBOB_ADDR_REG_REQ,
-				   cues, sizeof(cues));
+				   cues, 3 * sizeof(*cues));
+	kfree(cues);
 	if (rcode != RCODE_COMPLETE) {
 		dev_err(&unit->device,
 			"Failed to send a cue to load firmware\n");
 		err = -EIO;
 	}
-end:
+
 	return err;
 }
 
diff -druNp --no-dereference linux-libre-3.18.123-gnu/sound/pci/emu10k1/emufx.c linux-libre-3.18.124-gnu/sound/pci/emu10k1/emufx.c
--- linux-libre-3.18.123-gnu/sound/pci/emu10k1/emufx.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/sound/pci/emu10k1/emufx.c	2018-10-13 03:09:32.000000000 -0400
@@ -2521,7 +2521,7 @@ static int snd_emu10k1_fx8010_ioctl(stru
 		emu->support_tlv = 1;
 		return put_user(SNDRV_EMU10K1_VERSION, (int __user *)argp);
 	case SNDRV_EMU10K1_IOCTL_INFO:
-		info = kmalloc(sizeof(*info), GFP_KERNEL);
+		info = kzalloc(sizeof(*info), GFP_KERNEL);
 		if (!info)
 			return -ENOMEM;
 		snd_emu10k1_fx8010_info(emu, info);
diff -druNp --no-dereference linux-libre-3.18.123-gnu/sound/pci/hda/hda_intel.c linux-libre-3.18.124-gnu/sound/pci/hda/hda_intel.c
--- linux-libre-3.18.123-gnu/sound/pci/hda/hda_intel.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/sound/pci/hda/hda_intel.c	2018-10-13 03:09:32.000000000 -0400
@@ -2094,7 +2094,8 @@ static const struct pci_device_id azx_id
 	  .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
 	/* AMD Raven */
 	{ PCI_DEVICE(0x1022, 0x15e3),
-	  .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
+	  .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB |
+			 AZX_DCAPS_PM_RUNTIME },
 	/* ATI HDMI */
 	{ PCI_DEVICE(0x1002, 0x0002),
 	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
diff -druNp --no-dereference linux-libre-3.18.123-gnu/sound/soc/codecs/cs4265.c linux-libre-3.18.124-gnu/sound/soc/codecs/cs4265.c
--- linux-libre-3.18.123-gnu/sound/soc/codecs/cs4265.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/sound/soc/codecs/cs4265.c	2018-10-13 03:09:32.000000000 -0400
@@ -174,8 +174,8 @@ static const struct snd_kcontrol_new cs4
 	SOC_SINGLE("Validity Bit Control Switch", CS4265_SPDIF_CTL2,
 				3, 1, 0),
 	SOC_ENUM("SPDIF Mono/Stereo", spdif_mono_stereo_enum),
-	SOC_SINGLE("MMTLR Data Switch", 0,
-				1, 1, 0),
+	SOC_SINGLE("MMTLR Data Switch", CS4265_SPDIF_CTL2,
+				0, 1, 0),
 	SOC_ENUM("Mono Channel Select", spdif_mono_select_enum),
 	SND_SOC_BYTES("C Data Buffer", CS4265_C_DATA_BUFF, 24),
 };
diff -druNp --no-dereference linux-libre-3.18.123-gnu/sound/soc/soc-dapm.c linux-libre-3.18.124-gnu/sound/soc/soc-dapm.c
--- linux-libre-3.18.123-gnu/sound/soc/soc-dapm.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/sound/soc/soc-dapm.c	2018-10-13 03:09:32.000000000 -0400
@@ -3400,6 +3400,13 @@ int snd_soc_dapm_link_dai_widgets(struct
 			continue;
 		}
 
+		/* let users know there is no DAI to link */
+		if (!dai_w->priv) {
+			dev_dbg(card->dev, "dai widget %s has no DAI\n",
+				dai_w->name);
+			continue;
+		}
+
 		dai = dai_w->priv;
 
 		/* ...find all widgets with the same stream and link them */
diff -druNp --no-dereference linux-libre-3.18.123-gnu/tools/vm/page-types.c linux-libre-3.18.124-gnu/tools/vm/page-types.c
--- linux-libre-3.18.123-gnu/tools/vm/page-types.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/tools/vm/page-types.c	2018-10-13 03:09:32.000000000 -0400
@@ -151,12 +151,6 @@ static const char * const page_flag_name
 };
 
 
-static const char * const debugfs_known_mountpoints[] = {
-	"/sys/kernel/debug",
-	"/debug",
-	0,
-};
-
 /*
  * data structures
  */
diff -druNp --no-dereference linux-libre-3.18.123-gnu/tools/vm/slabinfo.c linux-libre-3.18.124-gnu/tools/vm/slabinfo.c
--- linux-libre-3.18.123-gnu/tools/vm/slabinfo.c	2018-09-26 02:33:59.000000000 -0400
+++ linux-libre-3.18.124-gnu/tools/vm/slabinfo.c	2018-10-13 03:09:32.000000000 -0400
@@ -29,8 +29,8 @@ struct slabinfo {
 	int alias;
 	int refs;
 	int aliases, align, cache_dma, cpu_slabs, destroy_by_rcu;
-	int hwcache_align, object_size, objs_per_slab;
-	int sanity_checks, slab_size, store_user, trace;
+	unsigned int hwcache_align, object_size, objs_per_slab;
+	unsigned int sanity_checks, slab_size, store_user, trace;
 	int order, poison, reclaim_account, red_zone;
 	unsigned long partial, objects, slabs, objects_partial, objects_total;
 	unsigned long alloc_fastpath, alloc_slowpath;
