diff -druNp --no-dereference linux-libre-3.18.132-gnu/arch/arm/mach-imx/clk-imx6q.c linux-libre-3.18.133-gnu/arch/arm/mach-imx/clk-imx6q.c
--- linux-libre-3.18.132-gnu/arch/arm/mach-imx/clk-imx6q.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/arch/arm/mach-imx/clk-imx6q.c	2019-01-26 03:44:29.000000000 -0500
@@ -222,8 +222,12 @@ static void __init imx6q_clocks_init(str
 	 * lvds1_gate and lvds2_gate are pseudo-gates.  Both can be
 	 * independently configured as clock inputs or outputs.  We treat
 	 * the "output_enable" bit as a gate, even though it's really just
-	 * enabling clock output.
+	 * enabling clock output. Initially the gate bits are cleared, as
+	 * otherwise the exclusive configuration gets locked in the setup done
+	 * by software running before the clock driver, with no way to change
+	 * it.
 	 */
+	writel(readl(base + 0x160) & ~0x3c00, base + 0x160);
 	clk[IMX6QDL_CLK_LVDS1_GATE] = imx_clk_gate_exclusive("lvds1_gate", "lvds1_sel", base + 0x160, 10, BIT(12));
 	clk[IMX6QDL_CLK_LVDS2_GATE] = imx_clk_gate_exclusive("lvds2_gate", "lvds2_sel", base + 0x160, 11, BIT(13));
 
diff -druNp --no-dereference linux-libre-3.18.132-gnu/arch/mips/Kconfig linux-libre-3.18.133-gnu/arch/mips/Kconfig
--- linux-libre-3.18.132-gnu/arch/mips/Kconfig	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/arch/mips/Kconfig	2019-01-26 03:44:29.000000000 -0500
@@ -627,6 +627,7 @@ config SIBYTE_SWARM
 	select SYS_SUPPORTS_HIGHMEM
 	select SYS_SUPPORTS_LITTLE_ENDIAN
 	select ZONE_DMA32 if 64BIT
+	select SWIOTLB if ARCH_DMA_ADDR_T_64BIT && PCI
 
 config SIBYTE_LITTLESUR
 	bool "Sibyte BCM91250C2-LittleSur"
@@ -649,6 +650,7 @@ config SIBYTE_SENTOSA
 	select SYS_HAS_CPU_SB1
 	select SYS_SUPPORTS_BIG_ENDIAN
 	select SYS_SUPPORTS_LITTLE_ENDIAN
+	select SWIOTLB if ARCH_DMA_ADDR_T_64BIT && PCI
 
 config SIBYTE_BIGSUR
 	bool "Sibyte BCM91480B-BigSur"
@@ -662,6 +664,7 @@ config SIBYTE_BIGSUR
 	select SYS_SUPPORTS_HIGHMEM
 	select SYS_SUPPORTS_LITTLE_ENDIAN
 	select ZONE_DMA32 if 64BIT
+	select SWIOTLB if ARCH_DMA_ADDR_T_64BIT && PCI
 
 config SNI_RM
 	bool "SNI RM200/300/400"
diff -druNp --no-dereference linux-libre-3.18.132-gnu/arch/mips/pci/msi-octeon.c linux-libre-3.18.133-gnu/arch/mips/pci/msi-octeon.c
--- linux-libre-3.18.132-gnu/arch/mips/pci/msi-octeon.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/arch/mips/pci/msi-octeon.c	2019-01-26 03:44:29.000000000 -0500
@@ -369,7 +369,9 @@ int __init octeon_msi_initialize(void)
 	int irq;
 	struct irq_chip *msi;
 
-	if (octeon_dma_bar_type == OCTEON_DMA_BAR_TYPE_PCIE) {
+	if (octeon_dma_bar_type == OCTEON_DMA_BAR_TYPE_INVALID) {
+		return 0;
+	} else if (octeon_dma_bar_type == OCTEON_DMA_BAR_TYPE_PCIE) {
 		msi_rcv_reg[0] = CVMX_PEXP_NPEI_MSI_RCV0;
 		msi_rcv_reg[1] = CVMX_PEXP_NPEI_MSI_RCV1;
 		msi_rcv_reg[2] = CVMX_PEXP_NPEI_MSI_RCV2;
diff -druNp --no-dereference linux-libre-3.18.132-gnu/arch/mips/sibyte/common/dma.c linux-libre-3.18.133-gnu/arch/mips/sibyte/common/dma.c
--- linux-libre-3.18.132-gnu/arch/mips/sibyte/common/dma.c	1969-12-31 19:00:00.000000000 -0500
+++ linux-libre-3.18.133-gnu/arch/mips/sibyte/common/dma.c	2019-01-26 03:44:29.000000000 -0500
@@ -0,0 +1,14 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ *	DMA support for Broadcom SiByte platforms.
+ *
+ *	Copyright (c) 2018  Maciej W. Rozycki
+ */
+
+#include <linux/swiotlb.h>
+#include <asm/bootinfo.h>
+
+void __init plat_swiotlb_setup(void)
+{
+	swiotlb_init(1);
+}
diff -druNp --no-dereference linux-libre-3.18.132-gnu/arch/mips/sibyte/common/Makefile linux-libre-3.18.133-gnu/arch/mips/sibyte/common/Makefile
--- linux-libre-3.18.132-gnu/arch/mips/sibyte/common/Makefile	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/arch/mips/sibyte/common/Makefile	2019-01-26 03:44:29.000000000 -0500
@@ -1,4 +1,5 @@
 obj-y := cfe.o
+obj-$(CONFIG_SWIOTLB)			+= dma.o
 obj-$(CONFIG_SIBYTE_BUS_WATCHER)	+= bus_watcher.o
 obj-$(CONFIG_SIBYTE_CFE_CONSOLE)	+= cfe_console.o
 obj-$(CONFIG_SIBYTE_TBPROF)		+= sb_tbprof.o
diff -druNp --no-dereference linux-libre-3.18.132-gnu/arch/sparc/kernel/signal_32.c linux-libre-3.18.133-gnu/arch/sparc/kernel/signal_32.c
--- linux-libre-3.18.132-gnu/arch/sparc/kernel/signal_32.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/arch/sparc/kernel/signal_32.c	2019-01-26 03:44:29.000000000 -0500
@@ -89,7 +89,7 @@ asmlinkage void do_sigreturn(struct pt_r
 	sf = (struct signal_frame __user *) regs->u_regs[UREG_FP];
 
 	/* 1. Make sure we are not getting garbage from the user */
-	if (!invalid_frame_pointer(sf, sizeof(*sf)))
+	if (invalid_frame_pointer(sf, sizeof(*sf)))
 		goto segv_and_exit;
 
 	if (get_user(ufp, &sf->info.si_regs.u_regs[UREG_FP]))
@@ -150,7 +150,7 @@ asmlinkage void do_rt_sigreturn(struct p
 
 	synchronize_user_stack();
 	sf = (struct rt_signal_frame __user *) regs->u_regs[UREG_FP];
-	if (!invalid_frame_pointer(sf, sizeof(*sf)))
+	if (invalid_frame_pointer(sf, sizeof(*sf)))
 		goto segv;
 
 	if (get_user(ufp, &sf->regs.u_regs[UREG_FP]))
diff -druNp --no-dereference linux-libre-3.18.132-gnu/crypto/authenc.c linux-libre-3.18.133-gnu/crypto/authenc.c
--- linux-libre-3.18.132-gnu/crypto/authenc.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/crypto/authenc.c	2019-01-26 03:44:29.000000000 -0500
@@ -62,14 +62,22 @@ int crypto_authenc_extractkeys(struct cr
 		return -EINVAL;
 	if (rta->rta_type != CRYPTO_AUTHENC_KEYA_PARAM)
 		return -EINVAL;
-	if (RTA_PAYLOAD(rta) < sizeof(*param))
+
+	/*
+	 * RTA_OK() didn't align the rtattr's payload when validating that it
+	 * fits in the buffer.  Yet, the keys should start on the next 4-byte
+	 * aligned boundary.  To avoid confusion, require that the rtattr
+	 * payload be exactly the param struct, which has a 4-byte aligned size.
+	 */
+	if (RTA_PAYLOAD(rta) != sizeof(*param))
 		return -EINVAL;
+	BUILD_BUG_ON(sizeof(*param) % RTA_ALIGNTO);
 
 	param = RTA_DATA(rta);
 	keys->enckeylen = be32_to_cpu(param->enckeylen);
 
-	key += RTA_ALIGN(rta->rta_len);
-	keylen -= RTA_ALIGN(rta->rta_len);
+	key += rta->rta_len;
+	keylen -= rta->rta_len;
 
 	if (keylen < keys->enckeylen)
 		return -EINVAL;
diff -druNp --no-dereference linux-libre-3.18.132-gnu/crypto/cts.c linux-libre-3.18.133-gnu/crypto/cts.c
--- linux-libre-3.18.132-gnu/crypto/cts.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/crypto/cts.c	2019-01-26 03:44:29.000000000 -0500
@@ -137,8 +137,8 @@ static int crypto_cts_encrypt(struct blk
 	lcldesc.info = desc->info;
 	lcldesc.flags = desc->flags;
 
-	if (tot_blocks == 1) {
-		err = crypto_blkcipher_encrypt_iv(&lcldesc, dst, src, bsize);
+	if (tot_blocks <= 1) {
+		err = crypto_blkcipher_encrypt_iv(&lcldesc, dst, src, nbytes);
 	} else if (nbytes <= bsize * 2) {
 		err = cts_cbc_encrypt(ctx, desc, dst, src, 0, nbytes);
 	} else {
@@ -232,8 +232,8 @@ static int crypto_cts_decrypt(struct blk
 	lcldesc.info = desc->info;
 	lcldesc.flags = desc->flags;
 
-	if (tot_blocks == 1) {
-		err = crypto_blkcipher_decrypt_iv(&lcldesc, dst, src, bsize);
+	if (tot_blocks <= 1) {
+		err = crypto_blkcipher_decrypt_iv(&lcldesc, dst, src, nbytes);
 	} else if (nbytes <= bsize * 2) {
 		err = cts_cbc_decrypt(ctx, desc, dst, src, 0, nbytes);
 	} else {
diff -druNp --no-dereference linux-libre-3.18.132-gnu/Documentation/filesystems/proc.txt linux-libre-3.18.133-gnu/Documentation/filesystems/proc.txt
--- linux-libre-3.18.132-gnu/Documentation/filesystems/proc.txt	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/Documentation/filesystems/proc.txt	2019-01-26 03:44:29.000000000 -0500
@@ -439,7 +439,9 @@ manner. The codes are the following:
 
 Note that there is no guarantee that every flag and associated mnemonic will
 be present in all further kernel releases. Things get changed, the flags may
-be vanished or the reverse -- new added.
+be vanished or the reverse -- new added. Interpretation of their meaning
+might change in future as well. So each consumer of these flags has to
+follow each specific kernel version for the exact semantic.
 
 This file is only present if the CONFIG_MMU kernel configuration option is
 enabled.
diff -druNp --no-dereference linux-libre-3.18.132-gnu/drivers/acpi/power.c linux-libre-3.18.133-gnu/drivers/acpi/power.c
--- linux-libre-3.18.132-gnu/drivers/acpi/power.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/drivers/acpi/power.c	2019-01-26 03:44:29.000000000 -0500
@@ -132,6 +132,23 @@ void acpi_power_resources_list_free(stru
 	}
 }
 
+static bool acpi_power_resource_is_dup(union acpi_object *package,
+				       unsigned int start, unsigned int i)
+{
+	acpi_handle rhandle, dup;
+	unsigned int j;
+
+	/* The caller is expected to check the package element types */
+	rhandle = package->package.elements[i].reference.handle;
+	for (j = start; j < i; j++) {
+		dup = package->package.elements[j].reference.handle;
+		if (dup == rhandle)
+			return true;
+	}
+
+	return false;
+}
+
 int acpi_extract_power_resources(union acpi_object *package, unsigned int start,
 				 struct list_head *list)
 {
@@ -151,6 +168,11 @@ int acpi_extract_power_resources(union a
 			err = -ENODEV;
 			break;
 		}
+
+		/* Some ACPI tables contain duplicate power resource references */
+		if (acpi_power_resource_is_dup(package, start, i))
+			continue;
+
 		err = acpi_add_power_resource(rhandle);
 		if (err)
 			break;
diff -druNp --no-dereference linux-libre-3.18.132-gnu/drivers/base/bus.c linux-libre-3.18.133-gnu/drivers/base/bus.c
--- linux-libre-3.18.132-gnu/drivers/base/bus.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/drivers/base/bus.c	2019-01-26 03:44:29.000000000 -0500
@@ -32,6 +32,9 @@ static struct kset *system_kset;
 
 #define to_drv_attr(_attr) container_of(_attr, struct driver_attribute, attr)
 
+#define DRIVER_ATTR_IGNORE_LOCKDEP(_name, _mode, _show, _store) \
+	struct driver_attribute driver_attr_##_name =		\
+		__ATTR_IGNORE_LOCKDEP(_name, _mode, _show, _store)
 
 static int __must_check bus_rescan_devices_helper(struct device *dev,
 						void *data);
@@ -197,7 +200,7 @@ static ssize_t unbind_store(struct devic
 	bus_put(bus);
 	return err;
 }
-static DRIVER_ATTR_WO(unbind);
+static DRIVER_ATTR_IGNORE_LOCKDEP(unbind, S_IWUSR, NULL, unbind_store);
 
 /*
  * Manually attach a device to a driver.
@@ -233,7 +236,7 @@ static ssize_t bind_store(struct device_
 	bus_put(bus);
 	return err;
 }
-static DRIVER_ATTR_WO(bind);
+static DRIVER_ATTR_IGNORE_LOCKDEP(bind, S_IWUSR, NULL, bind_store);
 
 static ssize_t show_drivers_autoprobe(struct bus_type *bus, char *buf)
 {
diff -druNp --no-dereference linux-libre-3.18.132-gnu/drivers/block/loop.c linux-libre-3.18.133-gnu/drivers/block/loop.c
--- linux-libre-3.18.132-gnu/drivers/block/loop.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/drivers/block/loop.c	2019-01-26 03:44:29.000000000 -0500
@@ -81,6 +81,7 @@
 
 static DEFINE_IDR(loop_index_idr);
 static DEFINE_MUTEX(loop_index_mutex);
+static DEFINE_MUTEX(loop_ctl_mutex);
 
 static int max_part;
 static int part_shift;
@@ -1012,7 +1013,7 @@ static int loop_clr_fd(struct loop_devic
 	 */
 	if (lo->lo_refcnt > 1) {
 		lo->lo_flags |= LO_FLAGS_AUTOCLEAR;
-		mutex_unlock(&lo->lo_ctl_mutex);
+		mutex_unlock(&loop_ctl_mutex);
 		return 0;
 	}
 
@@ -1061,12 +1062,12 @@ static int loop_clr_fd(struct loop_devic
 	lo->lo_flags = 0;
 	if (!part_shift)
 		lo->lo_disk->flags |= GENHD_FL_NO_PART_SCAN;
-	mutex_unlock(&lo->lo_ctl_mutex);
+	mutex_unlock(&loop_ctl_mutex);
 	/*
-	 * Need not hold lo_ctl_mutex to fput backing file.
-	 * Calling fput holding lo_ctl_mutex triggers a circular
+	 * Need not hold loop_ctl_mutex to fput backing file.
+	 * Calling fput holding loop_ctl_mutex triggers a circular
 	 * lock dependency possibility warning as fput can take
-	 * bd_mutex which is usually taken before lo_ctl_mutex.
+	 * bd_mutex which is usually taken before loop_ctl_mutex.
 	 */
 	fput(filp);
 	return 0;
@@ -1300,7 +1301,7 @@ static int lo_ioctl(struct block_device
 	struct loop_device *lo = bdev->bd_disk->private_data;
 	int err;
 
-	mutex_lock_nested(&lo->lo_ctl_mutex, 1);
+	mutex_lock_nested(&loop_ctl_mutex, 1);
 	switch (cmd) {
 	case LOOP_SET_FD:
 		err = loop_set_fd(lo, mode, bdev, arg);
@@ -1309,7 +1310,7 @@ static int lo_ioctl(struct block_device
 		err = loop_change_fd(lo, bdev, arg);
 		break;
 	case LOOP_CLR_FD:
-		/* loop_clr_fd would have unlocked lo_ctl_mutex on success */
+		/* loop_clr_fd would have unlocked loop_ctl_mutex on success */
 		err = loop_clr_fd(lo);
 		if (!err)
 			goto out_unlocked;
@@ -1340,7 +1341,7 @@ static int lo_ioctl(struct block_device
 	default:
 		err = lo->ioctl ? lo->ioctl(lo, cmd, arg) : -EINVAL;
 	}
-	mutex_unlock(&lo->lo_ctl_mutex);
+	mutex_unlock(&loop_ctl_mutex);
 
 out_unlocked:
 	return err;
@@ -1473,16 +1474,16 @@ static int lo_compat_ioctl(struct block_
 
 	switch(cmd) {
 	case LOOP_SET_STATUS:
-		mutex_lock(&lo->lo_ctl_mutex);
+		mutex_lock(&loop_ctl_mutex);
 		err = loop_set_status_compat(
 			lo, (const struct compat_loop_info __user *) arg);
-		mutex_unlock(&lo->lo_ctl_mutex);
+		mutex_unlock(&loop_ctl_mutex);
 		break;
 	case LOOP_GET_STATUS:
-		mutex_lock(&lo->lo_ctl_mutex);
+		mutex_lock(&loop_ctl_mutex);
 		err = loop_get_status_compat(
 			lo, (struct compat_loop_info __user *) arg);
-		mutex_unlock(&lo->lo_ctl_mutex);
+		mutex_unlock(&loop_ctl_mutex);
 		break;
 	case LOOP_SET_CAPACITY:
 	case LOOP_CLR_FD:
@@ -1513,9 +1514,9 @@ static int lo_open(struct block_device *
 		goto out;
 	}
 
-	mutex_lock(&lo->lo_ctl_mutex);
+	mutex_lock(&loop_ctl_mutex);
 	lo->lo_refcnt++;
-	mutex_unlock(&lo->lo_ctl_mutex);
+	mutex_unlock(&loop_ctl_mutex);
 out:
 	mutex_unlock(&loop_index_mutex);
 	return err;
@@ -1525,7 +1526,7 @@ static void __lo_release(struct loop_dev
 {
 	int err;
 
-	mutex_lock(&lo->lo_ctl_mutex);
+	mutex_lock(&loop_ctl_mutex);
 
 	if (--lo->lo_refcnt)
 		goto out;
@@ -1547,7 +1548,7 @@ static void __lo_release(struct loop_dev
 	}
 
 out:
-	mutex_unlock(&lo->lo_ctl_mutex);
+	mutex_unlock(&loop_ctl_mutex);
 }
 
 static void lo_release(struct gendisk *disk, fmode_t mode)
@@ -1593,10 +1594,10 @@ static int unregister_transfer_cb(int id
 	struct loop_device *lo = ptr;
 	struct loop_func_table *xfer = data;
 
-	mutex_lock(&lo->lo_ctl_mutex);
+	mutex_lock(&loop_ctl_mutex);
 	if (lo->lo_encryption == xfer)
 		loop_release_xfer(lo);
-	mutex_unlock(&lo->lo_ctl_mutex);
+	mutex_unlock(&loop_ctl_mutex);
 	return 0;
 }
 
@@ -1677,7 +1678,7 @@ static int loop_add(struct loop_device *
 	if (!part_shift)
 		disk->flags |= GENHD_FL_NO_PART_SCAN;
 	disk->flags |= GENHD_FL_EXT_DEVT;
-	mutex_init(&lo->lo_ctl_mutex);
+	mutex_init(&loop_ctl_mutex);
 	lo->lo_number		= i;
 	lo->lo_thread		= NULL;
 	init_waitqueue_head(&lo->lo_event);
@@ -1789,19 +1790,19 @@ static long loop_control_ioctl(struct fi
 		ret = loop_lookup(&lo, parm);
 		if (ret < 0)
 			break;
-		mutex_lock(&lo->lo_ctl_mutex);
+		mutex_lock(&loop_ctl_mutex);
 		if (lo->lo_state != Lo_unbound) {
 			ret = -EBUSY;
-			mutex_unlock(&lo->lo_ctl_mutex);
+			mutex_unlock(&loop_ctl_mutex);
 			break;
 		}
 		if (lo->lo_refcnt > 0) {
 			ret = -EBUSY;
-			mutex_unlock(&lo->lo_ctl_mutex);
+			mutex_unlock(&loop_ctl_mutex);
 			break;
 		}
 		lo->lo_disk->private_data = NULL;
-		mutex_unlock(&lo->lo_ctl_mutex);
+		mutex_unlock(&loop_ctl_mutex);
 		idr_remove(&loop_index_idr, lo->lo_number);
 		loop_remove(lo);
 		break;
diff -druNp --no-dereference linux-libre-3.18.132-gnu/drivers/block/loop.h linux-libre-3.18.133-gnu/drivers/block/loop.h
--- linux-libre-3.18.132-gnu/drivers/block/loop.h	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/drivers/block/loop.h	2019-01-26 03:44:29.000000000 -0500
@@ -55,7 +55,6 @@ struct loop_device {
 	struct bio_list		lo_bio_list;
 	unsigned int		lo_bio_count;
 	int			lo_state;
-	struct mutex		lo_ctl_mutex;
 	struct task_struct	*lo_thread;
 	wait_queue_head_t	lo_event;
 	/* wait queue for incoming requests */
diff -druNp --no-dereference linux-libre-3.18.132-gnu/drivers/cpuidle/cpuidle-pseries.c linux-libre-3.18.133-gnu/drivers/cpuidle/cpuidle-pseries.c
--- linux-libre-3.18.132-gnu/drivers/cpuidle/cpuidle-pseries.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/drivers/cpuidle/cpuidle-pseries.c	2019-01-26 03:44:29.000000000 -0500
@@ -237,7 +237,13 @@ static int pseries_idle_probe(void)
 		return -ENODEV;
 
 	if (firmware_has_feature(FW_FEATURE_SPLPAR)) {
-		if (lppaca_shared_proc(get_lppaca())) {
+		/*
+		 * Use local_paca instead of get_lppaca() since
+		 * preemption is not disabled, and it is not required in
+		 * fact, since lppaca_ptr does not need to be the value
+		 * associated to the current CPU, it can be from any CPU.
+		 */
+		if (lppaca_shared_proc(local_paca->lppaca_ptr)) {
 			cpuidle_state_table = shared_states;
 			max_idle_state = ARRAY_SIZE(shared_states);
 		} else {
diff -druNp --no-dereference linux-libre-3.18.132-gnu/drivers/gpu/drm/drm_fb_helper.c linux-libre-3.18.133-gnu/drivers/gpu/drm/drm_fb_helper.c
--- linux-libre-3.18.132-gnu/drivers/gpu/drm/drm_fb_helper.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/drivers/gpu/drm/drm_fb_helper.c	2019-01-26 03:44:29.000000000 -0500
@@ -822,9 +822,14 @@ int drm_fb_helper_check_var(struct fb_va
 	struct drm_framebuffer *fb = fb_helper->fb;
 	int depth;
 
-	if (var->pixclock != 0 || in_dbg_master())
+	if (in_dbg_master())
 		return -EINVAL;
 
+	if (var->pixclock != 0) {
+		DRM_DEBUG("fbdev emulation doesn't support changing the pixel clock, value of pixclock is ignored\n");
+		var->pixclock = 0;
+	}
+
 	/* Need to resize the fb object !!! */
 	if (var->bits_per_pixel > fb->bits_per_pixel ||
 	    var->xres > fb->width || var->yres > fb->height ||
diff -druNp --no-dereference linux-libre-3.18.132-gnu/drivers/i2c/i2c-dev.c linux-libre-3.18.133-gnu/drivers/i2c/i2c-dev.c
--- linux-libre-3.18.132-gnu/drivers/i2c/i2c-dev.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/drivers/i2c/i2c-dev.c	2019-01-26 03:44:29.000000000 -0500
@@ -462,9 +462,15 @@ static long i2cdev_ioctl(struct file *fi
 		return i2cdev_ioctl_smbus(client, arg);
 
 	case I2C_RETRIES:
+		if (arg > INT_MAX)
+			return -EINVAL;
+
 		client->adapter->retries = arg;
 		break;
 	case I2C_TIMEOUT:
+		if (arg > INT_MAX)
+			return -EINVAL;
+
 		/* For historical reasons, user-space sets the timeout
 		 * value in units of 10 ms.
 		 */
diff -druNp --no-dereference linux-libre-3.18.132-gnu/drivers/md/dm-kcopyd.c linux-libre-3.18.133-gnu/drivers/md/dm-kcopyd.c
--- linux-libre-3.18.132-gnu/drivers/md/dm-kcopyd.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/drivers/md/dm-kcopyd.c	2019-01-26 03:44:29.000000000 -0500
@@ -55,15 +55,17 @@ struct dm_kcopyd_client {
 	struct dm_kcopyd_throttle *throttle;
 
 /*
- * We maintain three lists of jobs:
+ * We maintain four lists of jobs:
  *
  * i)   jobs waiting for pages
  * ii)  jobs that have pages, and are waiting for the io to be issued.
- * iii) jobs that have completed.
+ * iii) jobs that don't need to do any IO and just run a callback
+ * iv) jobs that have completed.
  *
- * All three of these are protected by job_lock.
+ * All four of these are protected by job_lock.
  */
 	spinlock_t job_lock;
+	struct list_head callback_jobs;
 	struct list_head complete_jobs;
 	struct list_head io_jobs;
 	struct list_head pages_jobs;
@@ -583,6 +585,7 @@ static void do_work(struct work_struct *
 	struct dm_kcopyd_client *kc = container_of(work,
 					struct dm_kcopyd_client, kcopyd_work);
 	struct blk_plug plug;
+	unsigned long flags;
 
 	/*
 	 * The order that these are called is *very* important.
@@ -591,6 +594,10 @@ static void do_work(struct work_struct *
 	 * list.  io jobs call wake when they complete and it all
 	 * starts again.
 	 */
+	spin_lock_irqsave(&kc->job_lock, flags);
+	list_splice_tail_init(&kc->callback_jobs, &kc->complete_jobs);
+	spin_unlock_irqrestore(&kc->job_lock, flags);
+
 	blk_start_plug(&plug);
 	process_jobs(&kc->complete_jobs, kc, run_complete_job);
 	process_jobs(&kc->pages_jobs, kc, run_pages_job);
@@ -608,7 +615,7 @@ static void dispatch_job(struct kcopyd_j
 	struct dm_kcopyd_client *kc = job->kc;
 	atomic_inc(&kc->nr_jobs);
 	if (unlikely(!job->source.count))
-		push(&kc->complete_jobs, job);
+		push(&kc->callback_jobs, job);
 	else if (job->pages == &zero_page_list)
 		push(&kc->io_jobs, job);
 	else
@@ -795,7 +802,7 @@ void dm_kcopyd_do_callback(void *j, int
 	job->read_err = read_err;
 	job->write_err = write_err;
 
-	push(&kc->complete_jobs, job);
+	push(&kc->callback_jobs, job);
 	wake(kc);
 }
 EXPORT_SYMBOL(dm_kcopyd_do_callback);
@@ -825,6 +832,7 @@ struct dm_kcopyd_client *dm_kcopyd_clien
 		return ERR_PTR(-ENOMEM);
 
 	spin_lock_init(&kc->job_lock);
+	INIT_LIST_HEAD(&kc->callback_jobs);
 	INIT_LIST_HEAD(&kc->complete_jobs);
 	INIT_LIST_HEAD(&kc->io_jobs);
 	INIT_LIST_HEAD(&kc->pages_jobs);
@@ -874,6 +882,7 @@ void dm_kcopyd_client_destroy(struct dm_
 	/* Wait for completion of all jobs submitted by this client. */
 	wait_event(kc->destroyq, !atomic_read(&kc->nr_jobs));
 
+	BUG_ON(!list_empty(&kc->callback_jobs));
 	BUG_ON(!list_empty(&kc->complete_jobs));
 	BUG_ON(!list_empty(&kc->io_jobs));
 	BUG_ON(!list_empty(&kc->pages_jobs));
diff -druNp --no-dereference linux-libre-3.18.132-gnu/drivers/md/dm-snap.c linux-libre-3.18.133-gnu/drivers/md/dm-snap.c
--- linux-libre-3.18.132-gnu/drivers/md/dm-snap.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/drivers/md/dm-snap.c	2019-01-26 03:44:29.000000000 -0500
@@ -19,6 +19,7 @@
 #include <linux/vmalloc.h>
 #include <linux/log2.h>
 #include <linux/dm-kcopyd.h>
+#include <linux/semaphore.h>
 
 #include "dm.h"
 
@@ -98,6 +99,9 @@ struct dm_snapshot {
 	/* The on disk metadata handler */
 	struct dm_exception_store *store;
 
+	/* Maximum number of in-flight COW jobs. */
+	struct semaphore cow_count;
+
 	struct dm_kcopyd_client *kcopyd_client;
 
 	/* Wait for events based on state_bits */
@@ -138,6 +142,19 @@ struct dm_snapshot {
 #define RUNNING_MERGE          0
 #define SHUTDOWN_MERGE         1
 
+/*
+ * Maximum number of chunks being copied on write.
+ *
+ * The value was decided experimentally as a trade-off between memory
+ * consumption, stalling the kernel's workqueues and maintaining a high enough
+ * throughput.
+ */
+#define DEFAULT_COW_THRESHOLD 2048
+
+static int cow_threshold = DEFAULT_COW_THRESHOLD;
+module_param_named(snapshot_cow_threshold, cow_threshold, int, 0644);
+MODULE_PARM_DESC(snapshot_cow_threshold, "Maximum number of chunks being copied on write");
+
 DECLARE_DM_KCOPYD_THROTTLE_WITH_MODULE_PARM(snapshot_copy_throttle,
 		"A percentage of time allocated for copy on write");
 
@@ -1173,6 +1190,8 @@ static int snapshot_ctr(struct dm_target
 		goto bad_hash_tables;
 	}
 
+	sema_init(&s->cow_count, (cow_threshold > 0) ? cow_threshold : INT_MAX);
+
 	s->kcopyd_client = dm_kcopyd_client_create(&dm_kcopyd_throttle);
 	if (IS_ERR(s->kcopyd_client)) {
 		r = PTR_ERR(s->kcopyd_client);
@@ -1545,6 +1564,7 @@ static void copy_callback(int read_err,
 		}
 		list_add(&pe->out_of_order_entry, lh);
 	}
+	up(&s->cow_count);
 }
 
 /*
@@ -1568,6 +1588,7 @@ static void start_copy(struct dm_snap_pe
 	dest.count = src.count;
 
 	/* Hand over to kcopyd */
+	down(&s->cow_count);
 	dm_kcopyd_copy(s->kcopyd_client, &src, 1, &dest, 0, copy_callback, pe);
 }
 
@@ -1588,6 +1609,7 @@ static void start_full_bio(struct dm_sna
 	pe->full_bio_end_io = bio->bi_end_io;
 	pe->full_bio_private = bio->bi_private;
 
+	down(&s->cow_count);
 	callback_data = dm_kcopyd_prepare_callback(s->kcopyd_client,
 						   copy_callback, pe);
 
diff -druNp --no-dereference linux-libre-3.18.132-gnu/drivers/media/firewire/firedtv-avc.c linux-libre-3.18.133-gnu/drivers/media/firewire/firedtv-avc.c
--- linux-libre-3.18.132-gnu/drivers/media/firewire/firedtv-avc.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/drivers/media/firewire/firedtv-avc.c	2019-01-26 03:44:29.000000000 -0500
@@ -968,7 +968,8 @@ static int get_ca_object_length(struct a
 	return r->operand[7];
 }
 
-int avc_ca_app_info(struct firedtv *fdtv, char *app_info, unsigned int *len)
+int avc_ca_app_info(struct firedtv *fdtv, unsigned char *app_info,
+		    unsigned int *len)
 {
 	struct avc_command_frame *c = (void *)fdtv->avc_data;
 	struct avc_response_frame *r = (void *)fdtv->avc_data;
@@ -1009,7 +1010,8 @@ out:
 	return ret;
 }
 
-int avc_ca_info(struct firedtv *fdtv, char *app_info, unsigned int *len)
+int avc_ca_info(struct firedtv *fdtv, unsigned char *app_info,
+		unsigned int *len)
 {
 	struct avc_command_frame *c = (void *)fdtv->avc_data;
 	struct avc_response_frame *r = (void *)fdtv->avc_data;
diff -druNp --no-dereference linux-libre-3.18.132-gnu/drivers/media/firewire/firedtv.h linux-libre-3.18.133-gnu/drivers/media/firewire/firedtv.h
--- linux-libre-3.18.132-gnu/drivers/media/firewire/firedtv.h	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/drivers/media/firewire/firedtv.h	2019-01-26 03:44:29.000000000 -0500
@@ -124,8 +124,10 @@ int avc_lnb_control(struct firedtv *fdtv
 		    struct dvb_diseqc_master_cmd *diseqcmd);
 void avc_remote_ctrl_work(struct work_struct *work);
 int avc_register_remote_control(struct firedtv *fdtv);
-int avc_ca_app_info(struct firedtv *fdtv, char *app_info, unsigned int *len);
-int avc_ca_info(struct firedtv *fdtv, char *app_info, unsigned int *len);
+int avc_ca_app_info(struct firedtv *fdtv, unsigned char *app_info,
+		    unsigned int *len);
+int avc_ca_info(struct firedtv *fdtv, unsigned char *app_info,
+		unsigned int *len);
 int avc_ca_reset(struct firedtv *fdtv);
 int avc_ca_pmt(struct firedtv *fdtv, char *app_info, int length);
 int avc_ca_get_time_date(struct firedtv *fdtv, int *interval);
diff -druNp --no-dereference linux-libre-3.18.132-gnu/drivers/media/platform/vivid/vivid-kthread-cap.c linux-libre-3.18.133-gnu/drivers/media/platform/vivid/vivid-kthread-cap.c
--- linux-libre-3.18.132-gnu/drivers/media/platform/vivid/vivid-kthread-cap.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/drivers/media/platform/vivid/vivid-kthread-cap.c	2019-01-26 03:44:29.000000000 -0500
@@ -829,8 +829,11 @@ int vivid_start_generating_vid_cap(struc
 			"%s-vid-cap", dev->v4l2_dev.name);
 
 	if (IS_ERR(dev->kthread_vid_cap)) {
+		int err = PTR_ERR(dev->kthread_vid_cap);
+
+		dev->kthread_vid_cap = NULL;
 		v4l2_err(&dev->v4l2_dev, "kernel_thread() failed\n");
-		return PTR_ERR(dev->kthread_vid_cap);
+		return err;
 	}
 	*pstreaming = true;
 	vivid_grab_controls(dev, true);
diff -druNp --no-dereference linux-libre-3.18.132-gnu/drivers/media/platform/vivid/vivid-kthread-out.c linux-libre-3.18.133-gnu/drivers/media/platform/vivid/vivid-kthread-out.c
--- linux-libre-3.18.132-gnu/drivers/media/platform/vivid/vivid-kthread-out.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/drivers/media/platform/vivid/vivid-kthread-out.c	2019-01-26 03:44:29.000000000 -0500
@@ -248,8 +248,11 @@ int vivid_start_generating_vid_out(struc
 			"%s-vid-out", dev->v4l2_dev.name);
 
 	if (IS_ERR(dev->kthread_vid_out)) {
+		int err = PTR_ERR(dev->kthread_vid_out);
+
+		dev->kthread_vid_out = NULL;
 		v4l2_err(&dev->v4l2_dev, "kernel_thread() failed\n");
-		return PTR_ERR(dev->kthread_vid_out);
+		return err;
 	}
 	*pstreaming = true;
 	vivid_grab_controls(dev, true);
diff -druNp --no-dereference linux-libre-3.18.132-gnu/drivers/media/platform/vivid/vivid-vid-common.c linux-libre-3.18.133-gnu/drivers/media/platform/vivid/vivid-vid-common.c
--- linux-libre-3.18.132-gnu/drivers/media/platform/vivid/vivid-vid-common.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/drivers/media/platform/vivid/vivid-vid-common.c	2019-01-26 03:44:29.000000000 -0500
@@ -33,7 +33,7 @@ const struct v4l2_dv_timings_cap vivid_d
 	.type = V4L2_DV_BT_656_1120,
 	/* keep this initialization for compatibility with GCC < 4.4.6 */
 	.reserved = { 0 },
-	V4L2_INIT_BT_TIMINGS(0, MAX_WIDTH, 0, MAX_HEIGHT, 25000000, 600000000,
+	V4L2_INIT_BT_TIMINGS(16, MAX_WIDTH, 16, MAX_HEIGHT, 25000000, 600000000,
 		V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT,
 		V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_INTERLACED)
 };
diff -druNp --no-dereference linux-libre-3.18.132-gnu/drivers/media/usb/em28xx/em28xx-video.c linux-libre-3.18.133-gnu/drivers/media/usb/em28xx/em28xx-video.c
--- linux-libre-3.18.132-gnu/drivers/media/usb/em28xx/em28xx-video.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/drivers/media/usb/em28xx/em28xx-video.c	2019-01-26 03:44:29.000000000 -0500
@@ -931,6 +931,8 @@ int em28xx_start_analog_streaming(struct
 
 	em28xx_videodbg("%s\n", __func__);
 
+	dev->v4l2->field_count = 0;
+
 	/* Make sure streaming is not already in progress for this type
 	   of filehandle (e.g. video, vbi) */
 	rc = res_get(dev, vq->type);
@@ -1141,8 +1143,6 @@ static void em28xx_ctrl_notify(struct v4
 {
 	struct em28xx *dev = priv;
 
-	dev->v4l2->field_count = 0;
-
 	/*
 	 * In the case of non-AC97 volume controls, we still need
 	 * to do some setups at em28xx, in order to mute/unmute
diff -druNp --no-dereference linux-libre-3.18.132-gnu/drivers/media/v4l2-core/videobuf2-core.c linux-libre-3.18.133-gnu/drivers/media/v4l2-core/videobuf2-core.c
--- linux-libre-3.18.132-gnu/drivers/media/v4l2-core/videobuf2-core.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/drivers/media/v4l2-core/videobuf2-core.c	2019-01-26 03:44:29.000000000 -0500
@@ -2474,9 +2474,13 @@ int vb2_mmap(struct vb2_queue *q, struct
 			return -EINVAL;
 		}
 	}
+
+	mutex_lock(&q->mmap_lock);
+
 	if (vb2_fileio_is_active(q)) {
 		dprintk(1, "mmap: file io in progress\n");
-		return -EBUSY;
+		ret = -EBUSY;
+		goto unlock;
 	}
 
 	/*
@@ -2484,7 +2488,7 @@ int vb2_mmap(struct vb2_queue *q, struct
 	 */
 	ret = __find_plane_by_offset(q, off, &buffer, &plane);
 	if (ret)
-		return ret;
+		goto unlock;
 
 	vb = q->bufs[buffer];
 
@@ -2497,11 +2501,13 @@ int vb2_mmap(struct vb2_queue *q, struct
 	if (length < (vma->vm_end - vma->vm_start)) {
 		dprintk(1,
 			"MMAP invalid, as it would overflow buffer length\n");
-		return -EINVAL;
+		ret = -EINVAL;
+		goto unlock;
 	}
 
-	mutex_lock(&q->mmap_lock);
 	ret = call_memop(vb, mmap, vb->planes[plane].mem_priv, vma);
+
+unlock:
 	mutex_unlock(&q->mmap_lock);
 	if (ret)
 		return ret;
diff -druNp --no-dereference linux-libre-3.18.132-gnu/drivers/mfd/tps6586x.c linux-libre-3.18.133-gnu/drivers/mfd/tps6586x.c
--- linux-libre-3.18.132-gnu/drivers/mfd/tps6586x.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/drivers/mfd/tps6586x.c	2019-01-26 03:44:29.000000000 -0500
@@ -601,6 +601,29 @@ static int tps6586x_i2c_remove(struct i2
 	return 0;
 }
 
+static int __maybe_unused tps6586x_i2c_suspend(struct device *dev)
+{
+	struct tps6586x *tps6586x = dev_get_drvdata(dev);
+
+	if (tps6586x->client->irq)
+		disable_irq(tps6586x->client->irq);
+
+	return 0;
+}
+
+static int __maybe_unused tps6586x_i2c_resume(struct device *dev)
+{
+	struct tps6586x *tps6586x = dev_get_drvdata(dev);
+
+	if (tps6586x->client->irq)
+		enable_irq(tps6586x->client->irq);
+
+	return 0;
+}
+
+static SIMPLE_DEV_PM_OPS(tps6586x_pm_ops, tps6586x_i2c_suspend,
+			 tps6586x_i2c_resume);
+
 static const struct i2c_device_id tps6586x_id_table[] = {
 	{ "tps6586x", 0 },
 	{ },
@@ -612,6 +635,7 @@ static struct i2c_driver tps6586x_driver
 		.name	= "tps6586x",
 		.owner	= THIS_MODULE,
 		.of_match_table = of_match_ptr(tps6586x_of_match),
+		.pm	= &tps6586x_pm_ops,
 	},
 	.probe		= tps6586x_i2c_probe,
 	.remove		= tps6586x_i2c_remove,
diff -druNp --no-dereference linux-libre-3.18.132-gnu/drivers/mmc/host/atmel-mci.c linux-libre-3.18.133-gnu/drivers/mmc/host/atmel-mci.c
--- linux-libre-3.18.132-gnu/drivers/mmc/host/atmel-mci.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/drivers/mmc/host/atmel-mci.c	2019-01-26 03:44:29.000000000 -0500
@@ -1838,13 +1838,14 @@ static void atmci_tasklet_func(unsigned
 			}
 
 			atmci_request_end(host, host->mrq);
-			state = STATE_IDLE;
+			goto unlock; /* atmci_request_end() sets host->state */
 			break;
 		}
 	} while (state != prev_state);
 
 	host->state = state;
 
+unlock:
 	spin_unlock(&host->lock);
 }
 
diff -druNp --no-dereference linux-libre-3.18.132-gnu/drivers/net/ethernet/realtek/r8169.c linux-libre-3.18.133-gnu/drivers/net/ethernet/realtek/r8169.c
--- linux-libre-3.18.132-gnu/drivers/net/ethernet/realtek/r8169.c	2019-01-13 20:15:24.000000000 -0500
+++ linux-libre-3.18.133-gnu/drivers/net/ethernet/realtek/r8169.c	2019-01-26 14:40:33.000000000 -0500
@@ -324,6 +324,8 @@ enum cfg_version {
 };
 
 static const struct pci_device_id rtl8169_pci_tbl[] = {
+	{ PCI_VDEVICE(REALTEK,	0x2502), RTL_CFG_1 },
+	{ PCI_VDEVICE(REALTEK,	0x2600), RTL_CFG_1 },
 	{ PCI_DEVICE(PCI_VENDOR_ID_REALTEK,	0x8129), 0, 0, RTL_CFG_0 },
 	{ PCI_DEVICE(PCI_VENDOR_ID_REALTEK,	0x8136), 0, 0, RTL_CFG_2 },
 	{ PCI_DEVICE(PCI_VENDOR_ID_REALTEK,	0x8161), 0, 0, RTL_CFG_1 },
diff -druNp --no-dereference linux-libre-3.18.132-gnu/drivers/scsi/sd.c linux-libre-3.18.133-gnu/drivers/scsi/sd.c
--- linux-libre-3.18.132-gnu/drivers/scsi/sd.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/drivers/scsi/sd.c	2019-01-26 03:44:29.000000000 -0500
@@ -205,6 +205,12 @@ cache_type_store(struct device *dev, str
 	buffer_data[2] |= wce << 2 | rcd;
 	sp = buffer_data[0] & 0x80 ? 1 : 0;
 
+	/*
+	 * Ensure WP, DPOFUA, and RESERVED fields are cleared in
+	 * received mode parameter buffer before doing MODE SELECT.
+	 */
+	data.device_specific = 0;
+
 	if (scsi_mode_select(sdp, 1, sp, 8, buffer_data, len, SD_TIMEOUT,
 			     SD_MAX_RETRIES, &data, &sshdr)) {
 		if (scsi_sense_valid(&sshdr))
diff -druNp --no-dereference linux-libre-3.18.132-gnu/drivers/target/target_core_spc.c linux-libre-3.18.133-gnu/drivers/target/target_core_spc.c
--- linux-libre-3.18.132-gnu/drivers/target/target_core_spc.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/drivers/target/target_core_spc.c	2019-01-26 03:44:29.000000000 -0500
@@ -112,12 +112,17 @@ spc_emulate_inquiry_std(struct se_cmd *c
 
 	buf[7] = 0x2; /* CmdQue=1 */
 
-	memcpy(&buf[8], "LIO-ORG ", 8);
-	memset(&buf[16], 0x20, 16);
+	/*
+	 * ASCII data fields described as being left-aligned shall have any
+	 * unused bytes at the end of the field (i.e., highest offset) and the
+	 * unused bytes shall be filled with ASCII space characters (20h).
+	 */
+	memset(&buf[8], 0x20, 8 + 16 + 4);
+	memcpy(&buf[8], "LIO-ORG", sizeof("LIO-ORG") - 1);
 	memcpy(&buf[16], dev->t10_wwn.model,
-	       min_t(size_t, strlen(dev->t10_wwn.model), 16));
+	       strnlen(dev->t10_wwn.model, 16));
 	memcpy(&buf[32], dev->t10_wwn.revision,
-	       min_t(size_t, strlen(dev->t10_wwn.revision), 4));
+	       strnlen(dev->t10_wwn.revision, 4));
 	buf[4] = 31; /* Set additional length to 31 */
 
 	return 0;
@@ -257,7 +262,9 @@ check_t10_vend_desc:
 	buf[off] = 0x2; /* ASCII */
 	buf[off+1] = 0x1; /* T10 Vendor ID */
 	buf[off+2] = 0x0;
-	memcpy(&buf[off+4], "LIO-ORG", 8);
+	/* left align Vendor ID and pad with spaces */
+	memset(&buf[off+4], 0x20, 8);
+	memcpy(&buf[off+4], "LIO-ORG", sizeof("LIO-ORG") - 1);
 	/* Extra Byte for NULL Terminator */
 	id_len++;
 	/* Identifier Length */
diff -druNp --no-dereference linux-libre-3.18.132-gnu/drivers/tty/tty_ldsem.c linux-libre-3.18.133-gnu/drivers/tty/tty_ldsem.c
--- linux-libre-3.18.132-gnu/drivers/tty/tty_ldsem.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/drivers/tty/tty_ldsem.c	2019-01-26 03:44:29.000000000 -0500
@@ -306,6 +306,16 @@ down_write_failed(struct ld_semaphore *s
 	if (!locked)
 		ldsem_atomic_update(-LDSEM_WAIT_BIAS, sem);
 	list_del(&waiter.list);
+
+	/*
+	 * In case of timeout, wake up every reader who gave the right of way
+	 * to writer. Prevent separation readers into two groups:
+	 * one that helds semaphore and another that sleeps.
+	 * (in case of no contention with a writer)
+	 */
+	if (!locked && list_empty(&sem->write_wait))
+		__ldsem_wake_readers(sem);
+
 	raw_spin_unlock_irq(&sem->wait_lock);
 
 	__set_task_state(tsk, TASK_RUNNING);
diff -druNp --no-dereference linux-libre-3.18.132-gnu/drivers/usb/class/cdc-acm.c linux-libre-3.18.133-gnu/drivers/usb/class/cdc-acm.c
--- linux-libre-3.18.132-gnu/drivers/usb/class/cdc-acm.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/drivers/usb/class/cdc-acm.c	2019-01-26 03:44:29.000000000 -0500
@@ -1904,6 +1904,13 @@ static const struct usb_device_id acm_id
 	.driver_info = IGNORE_DEVICE,
 	},
 
+	{ USB_DEVICE(0x1bc7, 0x0021), /* Telit 3G ACM only composition */
+	.driver_info = SEND_ZERO_PACKET,
+	},
+	{ USB_DEVICE(0x1bc7, 0x0023), /* Telit 3G ACM + ECM composition */
+	.driver_info = SEND_ZERO_PACKET,
+	},
+
 	/* control interfaces without any protocol set */
 	{ USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
 		USB_CDC_PROTO_NONE) },
diff -druNp --no-dereference linux-libre-3.18.132-gnu/drivers/usb/storage/scsiglue.c linux-libre-3.18.133-gnu/drivers/usb/storage/scsiglue.c
--- linux-libre-3.18.132-gnu/drivers/usb/storage/scsiglue.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/drivers/usb/storage/scsiglue.c	2019-01-26 03:44:29.000000000 -0500
@@ -223,8 +223,12 @@ static int slave_configure(struct scsi_d
 		if (!(us->fflags & US_FL_NEEDS_CAP16))
 			sdev->try_rc_10_first = 1;
 
-		/* assume SPC3 or latter devices support sense size > 18 */
-		if (sdev->scsi_level > SCSI_SPC_2)
+		/*
+		 * assume SPC3 or latter devices support sense size > 18
+		 * unless US_FL_BAD_SENSE quirk is specified.
+		 */
+		if (sdev->scsi_level > SCSI_SPC_2 &&
+		    !(us->fflags & US_FL_BAD_SENSE))
 			us->fflags |= US_FL_SANE_SENSE;
 
 		/* USB-IDE bridges tend to report SK = 0x04 (Non-recoverable
diff -druNp --no-dereference linux-libre-3.18.132-gnu/drivers/usb/storage/unusual_devs.h linux-libre-3.18.133-gnu/drivers/usb/storage/unusual_devs.h
--- linux-libre-3.18.132-gnu/drivers/usb/storage/unusual_devs.h	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/drivers/usb/storage/unusual_devs.h	2019-01-26 03:44:29.000000000 -0500
@@ -1393,6 +1393,18 @@ UNUSUAL_DEV(  0x0d49, 0x7310, 0x0000, 0x
 		US_FL_SANE_SENSE),
 
 /*
+ * Reported by Icenowy Zheng <icenowy@aosc.io>
+ * The SMI SM3350 USB-UFS bridge controller will enter a wrong state
+ * that do not process read/write command if a long sense is requested,
+ * so force to use 18-byte sense.
+ */
+UNUSUAL_DEV(  0x090c, 0x3350, 0x0000, 0xffff,
+		"SMI",
+		"SM3350 UFS-to-USB-Mass-Storage bridge",
+		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+		US_FL_BAD_SENSE ),
+
+/*
  * Pete Zaitcev <zaitcev@yahoo.com>, bz#164688.
  * The device blatantly ignores LUN and returns 1 in GetMaxLUN.
  */
diff -druNp --no-dereference linux-libre-3.18.132-gnu/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c linux-libre-3.18.133-gnu/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c
--- linux-libre-3.18.132-gnu/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c	2019-01-26 03:44:29.000000000 -0500
@@ -606,6 +606,8 @@ int omapfb_ioctl(struct fb_info *fbi, un
 
 	int r = 0;
 
+	memset(&p, 0, sizeof(p));
+
 	switch (cmd) {
 	case OMAPFB_SYNC_GFX:
 		DBG("ioctl SYNC_GFX\n");
diff -druNp --no-dereference linux-libre-3.18.132-gnu/fs/btrfs/disk-io.c linux-libre-3.18.133-gnu/fs/btrfs/disk-io.c
--- linux-libre-3.18.132-gnu/fs/btrfs/disk-io.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/fs/btrfs/disk-io.c	2019-01-26 03:44:29.000000000 -0500
@@ -3942,6 +3942,14 @@ static void btrfs_destroy_all_ordered_ex
 		spin_lock(&fs_info->ordered_root_lock);
 	}
 	spin_unlock(&fs_info->ordered_root_lock);
+
+	/*
+	 * We need this here because if we've been flipped read-only we won't
+	 * get sync() from the umount, so we need to make sure any ordered
+	 * extents that haven't had their dirty pages IO start writeout yet
+	 * actually get run and error out properly.
+	 */
+	btrfs_wait_ordered_roots(fs_info, -1);
 }
 
 static int btrfs_destroy_delayed_refs(struct btrfs_transaction *trans,
diff -druNp --no-dereference linux-libre-3.18.132-gnu/fs/cifs/file.c linux-libre-3.18.133-gnu/fs/cifs/file.c
--- linux-libre-3.18.132-gnu/fs/cifs/file.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/fs/cifs/file.c	2019-01-26 03:44:29.000000000 -0500
@@ -1067,10 +1067,10 @@ cifs_push_mandatory_locks(struct cifsFil
 
 	/*
 	 * Accessing maxBuf is racy with cifs_reconnect - need to store value
-	 * and check it for zero before using.
+	 * and check it before using.
 	 */
 	max_buf = tcon->ses->server->maxBuf;
-	if (!max_buf) {
+	if (max_buf < (sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE))) {
 		free_xid(xid);
 		return -EINVAL;
 	}
@@ -1404,10 +1404,10 @@ cifs_unlock_range(struct cifsFileInfo *c
 
 	/*
 	 * Accessing maxBuf is racy with cifs_reconnect - need to store value
-	 * and check it for zero before using.
+	 * and check it before using.
 	 */
 	max_buf = tcon->ses->server->maxBuf;
-	if (!max_buf)
+	if (max_buf < (sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE)))
 		return -EINVAL;
 
 	max_num = (max_buf - sizeof(struct smb_hdr)) /
diff -druNp --no-dereference linux-libre-3.18.132-gnu/fs/cifs/smb2file.c linux-libre-3.18.133-gnu/fs/cifs/smb2file.c
--- linux-libre-3.18.132-gnu/fs/cifs/smb2file.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/fs/cifs/smb2file.c	2019-01-26 03:44:29.000000000 -0500
@@ -104,10 +104,10 @@ smb2_unlock_range(struct cifsFileInfo *c
 
 	/*
 	 * Accessing maxBuf is racy with cifs_reconnect - need to store value
-	 * and check it for zero before using.
+	 * and check it before using.
 	 */
 	max_buf = tcon->ses->server->maxBuf;
-	if (!max_buf)
+	if (max_buf < sizeof(struct smb2_lock_element))
 		return -EINVAL;
 
 	max_num = max_buf / sizeof(struct smb2_lock_element);
diff -druNp --no-dereference linux-libre-3.18.132-gnu/fs/cifs/transport.c linux-libre-3.18.133-gnu/fs/cifs/transport.c
--- linux-libre-3.18.132-gnu/fs/cifs/transport.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/fs/cifs/transport.c	2019-01-26 03:44:29.000000000 -0500
@@ -360,7 +360,7 @@ uncork:
 	if (rc < 0 && rc != -EINTR)
 		cifs_dbg(VFS, "Error %d sending data on socket to server\n",
 			 rc);
-	else
+	else if (rc > 0)
 		rc = 0;
 
 	return rc;
diff -druNp --no-dereference linux-libre-3.18.132-gnu/fs/jffs2/super.c linux-libre-3.18.133-gnu/fs/jffs2/super.c
--- linux-libre-3.18.132-gnu/fs/jffs2/super.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/fs/jffs2/super.c	2019-01-26 03:44:29.000000000 -0500
@@ -101,7 +101,8 @@ static int jffs2_sync_fs(struct super_bl
 	struct jffs2_sb_info *c = JFFS2_SB_INFO(sb);
 
 #ifdef CONFIG_JFFS2_FS_WRITEBUFFER
-	cancel_delayed_work_sync(&c->wbuf_dwork);
+	if (jffs2_is_writebuffered(c))
+		cancel_delayed_work_sync(&c->wbuf_dwork);
 #endif
 
 	mutex_lock(&c->alloc_sem);
diff -druNp --no-dereference linux-libre-3.18.132-gnu/fs/ocfs2/localalloc.c linux-libre-3.18.133-gnu/fs/ocfs2/localalloc.c
--- linux-libre-3.18.132-gnu/fs/ocfs2/localalloc.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/fs/ocfs2/localalloc.c	2019-01-26 03:44:29.000000000 -0500
@@ -345,13 +345,18 @@ int ocfs2_load_local_alloc(struct ocfs2_
 	if (num_used
 	    || alloc->id1.bitmap1.i_used
 	    || alloc->id1.bitmap1.i_total
-	    || la->la_bm_off)
-		mlog(ML_ERROR, "Local alloc hasn't been recovered!\n"
+	    || la->la_bm_off) {
+		mlog(ML_ERROR, "inconsistent detected, clean journal with"
+		     " unrecovered local alloc, please run fsck.ocfs2!\n"
 		     "found = %u, set = %u, taken = %u, off = %u\n",
 		     num_used, le32_to_cpu(alloc->id1.bitmap1.i_used),
 		     le32_to_cpu(alloc->id1.bitmap1.i_total),
 		     OCFS2_LOCAL_ALLOC(alloc)->la_bm_off);
 
+		status = -EINVAL;
+		goto bail;
+	}
+
 	osb->local_alloc_bh = alloc_bh;
 	osb->local_alloc_state = OCFS2_LA_ENABLED;
 
diff -druNp --no-dereference linux-libre-3.18.132-gnu/fs/pstore/ram_core.c linux-libre-3.18.133-gnu/fs/pstore/ram_core.c
--- linux-libre-3.18.132-gnu/fs/pstore/ram_core.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/fs/pstore/ram_core.c	2019-01-26 03:44:29.000000000 -0500
@@ -484,6 +484,11 @@ static int persistent_ram_post_init(stru
 	sig ^= PERSISTENT_RAM_SIG;
 
 	if (prz->buffer->sig == sig) {
+		if (buffer_size(prz) == 0) {
+			pr_debug("found existing empty buffer\n");
+			return 0;
+		}
+
 		if (buffer_size(prz) > prz->buffer_size ||
 		    buffer_start(prz) > buffer_size(prz))
 			pr_info("found existing invalid buffer, size %zu, start %zu\n",
diff -druNp --no-dereference linux-libre-3.18.132-gnu/include/linux/sunrpc/svc.h linux-libre-3.18.133-gnu/include/linux/sunrpc/svc.h
--- linux-libre-3.18.132-gnu/include/linux/sunrpc/svc.h	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/include/linux/sunrpc/svc.h	2019-01-26 03:44:29.000000000 -0500
@@ -281,9 +281,12 @@ struct svc_rqst {
 						 * to prevent encrypting page
 						 * cache pages */
 	struct task_struct	*rq_task;	/* service thread */
+	struct net		*rq_bc_net;	/* pointer to backchannel's
+						 * net namespace
+						 */
 };
 
-#define SVC_NET(svc_rqst)	(svc_rqst->rq_xprt->xpt_net)
+#define SVC_NET(rqst) (rqst->rq_xprt ? rqst->rq_xprt->xpt_net : rqst->rq_bc_net)
 
 /*
  * Rigorous type checking on sockaddr type conversions
diff -druNp --no-dereference linux-libre-3.18.132-gnu/Makefile linux-libre-3.18.133-gnu/Makefile
--- linux-libre-3.18.132-gnu/Makefile	2019-01-13 20:06:05.000000000 -0500
+++ linux-libre-3.18.133-gnu/Makefile	2019-01-26 14:30:47.000000000 -0500
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 18
-SUBLEVEL = 132
+SUBLEVEL = 133
 EXTRAVERSION =-gnu
 NAME = Diseased Newt
 
diff -druNp --no-dereference linux-libre-3.18.132-gnu/mm/slab.c linux-libre-3.18.133-gnu/mm/slab.c
--- linux-libre-3.18.132-gnu/mm/slab.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/mm/slab.c	2019-01-26 03:44:29.000000000 -0500
@@ -869,8 +869,10 @@ static struct alien_cache *__alloc_alien
 	struct alien_cache *alc = NULL;
 
 	alc = kmalloc_node(memsize, gfp, node);
-	init_arraycache(&alc->ac, entries, batch);
-	spin_lock_init(&alc->lock);
+	if (alc) {
+		init_arraycache(&alc->ac, entries, batch);
+		spin_lock_init(&alc->lock);
+	}
 	return alc;
 }
 
diff -druNp --no-dereference linux-libre-3.18.132-gnu/net/bridge/br_netfilter.c linux-libre-3.18.133-gnu/net/bridge/br_netfilter.c
--- linux-libre-3.18.132-gnu/net/bridge/br_netfilter.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/net/bridge/br_netfilter.c	2019-01-26 03:44:29.000000000 -0500
@@ -287,7 +287,7 @@ static int br_nf_pre_routing_finish_brid
 	if (neigh) {
 		int ret;
 
-		if (neigh->hh.hh_len) {
+		if ((neigh->nud_state & NUD_CONNECTED) && neigh->hh.hh_len) {
 			neigh_hh_bridge(&neigh->hh, skb);
 			skb->dev = nf_bridge->physindev;
 			ret = br_handle_frame_finish(skb);
diff -druNp --no-dereference linux-libre-3.18.132-gnu/net/can/gw.c linux-libre-3.18.133-gnu/net/can/gw.c
--- linux-libre-3.18.132-gnu/net/can/gw.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/net/can/gw.c	2019-01-26 03:44:29.000000000 -0500
@@ -417,13 +417,29 @@ static void can_can_gw_rcv(struct sk_buf
 	while (modidx < MAX_MODFUNCTIONS && gwj->mod.modfunc[modidx])
 		(*gwj->mod.modfunc[modidx++])(cf, &gwj->mod);
 
-	/* check for checksum updates when the CAN frame has been modified */
+	/* Has the CAN frame been modified? */
 	if (modidx) {
-		if (gwj->mod.csumfunc.crc8)
+		/* get available space for the processed CAN frame type */
+		int max_len = nskb->len - offsetof(struct can_frame, data);
+
+		/* dlc may have changed, make sure it fits to the CAN frame */
+		if (cf->can_dlc > max_len)
+			goto out_delete;
+
+		/* check for checksum updates in classic CAN length only */
+		if (gwj->mod.csumfunc.crc8) {
+			if (cf->can_dlc > 8)
+				goto out_delete;
+
 			(*gwj->mod.csumfunc.crc8)(cf, &gwj->mod.csum.crc8);
+		}
+
+		if (gwj->mod.csumfunc.xor) {
+			if (cf->can_dlc > 8)
+				goto out_delete;
 
-		if (gwj->mod.csumfunc.xor)
 			(*gwj->mod.csumfunc.xor)(cf, &gwj->mod.csum.xor);
+		}
 	}
 
 	/* clear the skb timestamp if not configured the other way */
@@ -435,6 +451,14 @@ static void can_can_gw_rcv(struct sk_buf
 		gwj->dropped_frames++;
 	else
 		gwj->handled_frames++;
+
+	return;
+
+ out_delete:
+	/* delete frame due to misconfiguration */
+	gwj->deleted_frames++;
+	kfree_skb(nskb);
+	return;
 }
 
 static inline int cgw_register_filter(struct cgw_job *gwj)
diff -druNp --no-dereference linux-libre-3.18.132-gnu/net/core/sock.c linux-libre-3.18.133-gnu/net/core/sock.c
--- linux-libre-3.18.132-gnu/net/core/sock.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/net/core/sock.c	2019-01-26 03:44:29.000000000 -0500
@@ -720,6 +720,7 @@ int sock_setsockopt(struct socket *sock,
 		break;
 	case SO_DONTROUTE:
 		sock_valbool_flag(sk, SOCK_LOCALROUTE, valbool);
+		sk_dst_reset(sk);
 		break;
 	case SO_BROADCAST:
 		sock_valbool_flag(sk, SOCK_BROADCAST, valbool);
diff -druNp --no-dereference linux-libre-3.18.132-gnu/net/ipv6/datagram.c linux-libre-3.18.133-gnu/net/ipv6/datagram.c
--- linux-libre-3.18.132-gnu/net/ipv6/datagram.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/net/ipv6/datagram.c	2019-01-26 03:44:29.000000000 -0500
@@ -287,6 +287,7 @@ void ipv6_local_error(struct sock *sk, i
 	skb_reset_network_header(skb);
 	iph = ipv6_hdr(skb);
 	iph->daddr = fl6->daddr;
+	ip6_flow_hdr(iph, 0, 0);
 
 	serr = SKB_EXT_ERR(skb);
 	serr->ee.ee_errno = err;
diff -druNp --no-dereference linux-libre-3.18.132-gnu/net/packet/af_packet.c linux-libre-3.18.133-gnu/net/packet/af_packet.c
--- linux-libre-3.18.132-gnu/net/packet/af_packet.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/net/packet/af_packet.c	2019-01-26 03:44:29.000000000 -0500
@@ -2276,7 +2276,7 @@ static int tpacket_snd(struct packet_soc
 		addr	= saddr->sll_halen ? saddr->sll_addr : NULL;
 		dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex);
 		if (addr && dev && saddr->sll_halen < dev->addr_len)
-			goto out;
+			goto out_put;
 	}
 
 	err = -ENXIO;
@@ -2439,7 +2439,7 @@ static int packet_snd(struct socket *soc
 		addr	= saddr->sll_halen ? saddr->sll_addr : NULL;
 		dev = dev_get_by_index(sock_net(sk), saddr->sll_ifindex);
 		if (addr && dev && saddr->sll_halen < dev->addr_len)
-			goto out;
+			goto out_unlock;
 	}
 
 	err = -ENXIO;
diff -druNp --no-dereference linux-libre-3.18.132-gnu/net/sctp/ipv6.c linux-libre-3.18.133-gnu/net/sctp/ipv6.c
--- linux-libre-3.18.132-gnu/net/sctp/ipv6.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/net/sctp/ipv6.c	2019-01-26 03:44:29.000000000 -0500
@@ -97,11 +97,9 @@ static int sctp_inet6addr_event(struct n
 
 	switch (ev) {
 	case NETDEV_UP:
-		addr = kmalloc(sizeof(struct sctp_sockaddr_entry), GFP_ATOMIC);
+		addr = kzalloc(sizeof(*addr), GFP_ATOMIC);
 		if (addr) {
 			addr->a.v6.sin6_family = AF_INET6;
-			addr->a.v6.sin6_port = 0;
-			addr->a.v6.sin6_flowinfo = 0;
 			addr->a.v6.sin6_addr = ifa->addr;
 			addr->a.v6.sin6_scope_id = ifa->idev->dev->ifindex;
 			addr->valid = 1;
@@ -411,7 +409,6 @@ static void sctp_v6_copy_addrlist(struct
 		addr = kzalloc(sizeof(*addr), GFP_ATOMIC);
 		if (addr) {
 			addr->a.v6.sin6_family = AF_INET6;
-			addr->a.v6.sin6_port = 0;
 			addr->a.v6.sin6_addr = ifp->addr;
 			addr->a.v6.sin6_scope_id = dev->ifindex;
 			addr->valid = 1;
diff -druNp --no-dereference linux-libre-3.18.132-gnu/net/sctp/protocol.c linux-libre-3.18.133-gnu/net/sctp/protocol.c
--- linux-libre-3.18.132-gnu/net/sctp/protocol.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/net/sctp/protocol.c	2019-01-26 03:44:29.000000000 -0500
@@ -149,7 +149,6 @@ static void sctp_v4_copy_addrlist(struct
 		addr = kzalloc(sizeof(*addr), GFP_ATOMIC);
 		if (addr) {
 			addr->a.v4.sin_family = AF_INET;
-			addr->a.v4.sin_port = 0;
 			addr->a.v4.sin_addr.s_addr = ifa->ifa_local;
 			addr->valid = 1;
 			INIT_LIST_HEAD(&addr->list);
@@ -755,10 +754,9 @@ static int sctp_inetaddr_event(struct no
 
 	switch (ev) {
 	case NETDEV_UP:
-		addr = kmalloc(sizeof(struct sctp_sockaddr_entry), GFP_ATOMIC);
+		addr = kzalloc(sizeof(*addr), GFP_ATOMIC);
 		if (addr) {
 			addr->a.v4.sin_family = AF_INET;
-			addr->a.v4.sin_port = 0;
 			addr->a.v4.sin_addr.s_addr = ifa->ifa_local;
 			addr->valid = 1;
 			spin_lock_bh(&net->sctp.local_addr_lock);
diff -druNp --no-dereference linux-libre-3.18.132-gnu/net/sunrpc/rpcb_clnt.c linux-libre-3.18.133-gnu/net/sunrpc/rpcb_clnt.c
--- linux-libre-3.18.132-gnu/net/sunrpc/rpcb_clnt.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/net/sunrpc/rpcb_clnt.c	2019-01-26 03:44:29.000000000 -0500
@@ -772,6 +772,12 @@ void rpcb_getport_async(struct rpc_task
 	case RPCBVERS_3:
 		map->r_netid = xprt->address_strings[RPC_DISPLAY_NETID];
 		map->r_addr = rpc_sockaddr2uaddr(sap, GFP_ATOMIC);
+		if (!map->r_addr) {
+			status = -ENOMEM;
+			dprintk("RPC: %5u %s: no memory available\n",
+				task->tk_pid, __func__);
+			goto bailout_free_args;
+		}
 		map->r_owner = "";
 		break;
 	case RPCBVERS_2:
@@ -794,6 +800,8 @@ void rpcb_getport_async(struct rpc_task
 	rpc_put_task(child);
 	return;
 
+bailout_free_args:
+	kfree(map);
 bailout_release_client:
 	rpc_release_client(rpcb_clnt);
 bailout_nofree:
diff -druNp --no-dereference linux-libre-3.18.132-gnu/net/sunrpc/svc.c linux-libre-3.18.133-gnu/net/sunrpc/svc.c
--- linux-libre-3.18.132-gnu/net/sunrpc/svc.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/net/sunrpc/svc.c	2019-01-26 03:44:29.000000000 -0500
@@ -1061,6 +1061,8 @@ void svc_printk(struct svc_rqst *rqstp,
 static __printf(2,3) void svc_printk(struct svc_rqst *rqstp, const char *fmt, ...) {}
 #endif
 
+extern void svc_tcp_prep_reply_hdr(struct svc_rqst *);
+
 /*
  * Common routine for processing the RPC request.
  */
@@ -1090,7 +1092,8 @@ svc_process_common(struct svc_rqst *rqst
 	rqstp->rq_dropme = false;
 
 	/* Setup reply header */
-	rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp);
+	if (rqstp->rq_prot == IPPROTO_TCP)
+		svc_tcp_prep_reply_hdr(rqstp);
 
 	svc_putu32(resv, rqstp->rq_xid);
 
@@ -1137,7 +1140,8 @@ svc_process_common(struct svc_rqst *rqst
 	case SVC_DENIED:
 		goto err_bad_auth;
 	case SVC_CLOSE:
-		if (test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
+		if (rqstp->rq_xprt &&
+		    test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
 			svc_close_xprt(rqstp->rq_xprt);
 	case SVC_DROP:
 		goto dropit;
@@ -1347,10 +1351,10 @@ bc_svc_process(struct svc_serv *serv, st
 	struct kvec	*resv = &rqstp->rq_res.head[0];
 
 	/* Build the svc_rqst used by the common processing routine */
-	rqstp->rq_xprt = serv->sv_bc_xprt;
 	rqstp->rq_xid = req->rq_xid;
 	rqstp->rq_prot = req->rq_xprt->prot;
 	rqstp->rq_server = serv;
+	rqstp->rq_bc_net = req->rq_xprt->xprt_net;
 
 	rqstp->rq_addrlen = sizeof(req->rq_xprt->addr);
 	memcpy(&rqstp->rq_addr, &req->rq_xprt->addr, rqstp->rq_addrlen);
diff -druNp --no-dereference linux-libre-3.18.132-gnu/net/sunrpc/svcsock.c linux-libre-3.18.133-gnu/net/sunrpc/svcsock.c
--- linux-libre-3.18.132-gnu/net/sunrpc/svcsock.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/net/sunrpc/svcsock.c	2019-01-26 03:44:29.000000000 -0500
@@ -1212,7 +1212,7 @@ static int svc_tcp_sendto(struct svc_rqs
 /*
  * Setup response header. TCP has a 4B record length field.
  */
-static void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp)
+void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp)
 {
 	struct kvec *resv = &rqstp->rq_res.head[0];
 
diff -druNp --no-dereference linux-libre-3.18.132-gnu/net/sunrpc/svc_xprt.c linux-libre-3.18.133-gnu/net/sunrpc/svc_xprt.c
--- linux-libre-3.18.132-gnu/net/sunrpc/svc_xprt.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/net/sunrpc/svc_xprt.c	2019-01-26 03:44:29.000000000 -0500
@@ -438,10 +438,11 @@ static struct svc_xprt *svc_xprt_dequeue
  */
 void svc_reserve(struct svc_rqst *rqstp, int space)
 {
+	struct svc_xprt *xprt = rqstp->rq_xprt;
+
 	space += rqstp->rq_res.head[0].iov_len;
 
-	if (space < rqstp->rq_reserved) {
-		struct svc_xprt *xprt = rqstp->rq_xprt;
+	if (xprt && space < rqstp->rq_reserved) {
 		atomic_sub((rqstp->rq_reserved - space), &xprt->xpt_reserved);
 		rqstp->rq_reserved = space;
 
diff -druNp --no-dereference linux-libre-3.18.132-gnu/scripts/kconfig/zconf.l linux-libre-3.18.133-gnu/scripts/kconfig/zconf.l
--- linux-libre-3.18.132-gnu/scripts/kconfig/zconf.l	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/scripts/kconfig/zconf.l	2019-01-26 03:44:29.000000000 -0500
@@ -180,6 +180,8 @@ n	[A-Za-z0-9_]
 	}
 	<<EOF>>	{
 		BEGIN(INITIAL);
+		yylval.string = text;
+		return T_WORD_QUOTE;
 	}
 }
 
diff -druNp --no-dereference linux-libre-3.18.132-gnu/security/selinux/ss/policydb.c linux-libre-3.18.133-gnu/security/selinux/ss/policydb.c
--- linux-libre-3.18.132-gnu/security/selinux/ss/policydb.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/security/selinux/ss/policydb.c	2019-01-26 03:44:29.000000000 -0500
@@ -717,7 +717,8 @@ static int sens_destroy(void *key, void
 	kfree(key);
 	if (datum) {
 		levdatum = datum;
-		ebitmap_destroy(&levdatum->level->cat);
+		if (levdatum->level)
+			ebitmap_destroy(&levdatum->level->cat);
 		kfree(levdatum->level);
 	}
 	kfree(datum);
diff -druNp --no-dereference linux-libre-3.18.132-gnu/security/yama/yama_lsm.c linux-libre-3.18.133-gnu/security/yama/yama_lsm.c
--- linux-libre-3.18.132-gnu/security/yama/yama_lsm.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/security/yama/yama_lsm.c	2019-01-26 03:44:29.000000000 -0500
@@ -299,7 +299,9 @@ int yama_ptrace_access_check(struct task
 			break;
 		case YAMA_SCOPE_RELATIONAL:
 			rcu_read_lock();
-			if (!task_is_descendant(current, child) &&
+			if (!pid_alive(child))
+				rc = -EPERM;
+			if (!rc && !task_is_descendant(current, child) &&
 			    !ptracer_exception_found(current, child) &&
 			    !ns_capable(__task_cred(child)->user_ns, CAP_SYS_PTRACE))
 				rc = -EPERM;
diff -druNp --no-dereference linux-libre-3.18.132-gnu/sound/firewire/bebob/bebob.c linux-libre-3.18.133-gnu/sound/firewire/bebob/bebob.c
--- linux-libre-3.18.132-gnu/sound/firewire/bebob/bebob.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/sound/firewire/bebob/bebob.c	2019-01-26 03:44:29.000000000 -0500
@@ -356,7 +356,7 @@ static const struct ieee1394_device_id b
 	/* Apogee Electronics, DA/AD/DD-16X (X-FireWire card) */
 	SND_BEBOB_DEV_ENTRY(VEN_APOGEE, 0x00010048, &spec_normal),
 	/* Apogee Electronics, Ensemble */
-	SND_BEBOB_DEV_ENTRY(VEN_APOGEE, 0x00001eee, &spec_normal),
+	SND_BEBOB_DEV_ENTRY(VEN_APOGEE, 0x01eeee, &spec_normal),
 	/* ESI, Quatafire610 */
 	SND_BEBOB_DEV_ENTRY(VEN_ESI, 0x00010064, &spec_normal),
 	/* AcousticReality, eARMasterOne */
diff -druNp --no-dereference linux-libre-3.18.132-gnu/tools/perf/util/parse-events.c linux-libre-3.18.133-gnu/tools/perf/util/parse-events.c
--- linux-libre-3.18.132-gnu/tools/perf/util/parse-events.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/tools/perf/util/parse-events.c	2019-01-26 03:44:29.000000000 -0500
@@ -1319,7 +1319,7 @@ static void print_symbol_events(const ch
 		if (strlen(syms->alias))
 			snprintf(name, MAX_NAME_LEN, "%s OR %s", syms->symbol, syms->alias);
 		else
-			strncpy(name, syms->symbol, MAX_NAME_LEN);
+			strlcpy(name, syms->symbol, MAX_NAME_LEN);
 
 		printf("  %-50s [%s]\n", name, event_type_descriptors[type]);
 
diff -druNp --no-dereference linux-libre-3.18.132-gnu/tools/perf/util/svghelper.c linux-libre-3.18.133-gnu/tools/perf/util/svghelper.c
--- linux-libre-3.18.132-gnu/tools/perf/util/svghelper.c	2019-01-13 04:07:13.000000000 -0500
+++ linux-libre-3.18.133-gnu/tools/perf/util/svghelper.c	2019-01-26 03:44:29.000000000 -0500
@@ -333,7 +333,7 @@ static char *cpu_model(void)
 	if (file) {
 		while (fgets(buf, 255, file)) {
 			if (strstr(buf, "model name")) {
-				strncpy(cpu_m, &buf[13], 255);
+				strlcpy(cpu_m, &buf[13], 255);
 				break;
 			}
 		}
