diff -druNp --no-dereference linux-libre-3.18.51-gnu/arch/arm/mach-cns3xxx/Makefile linux-libre-3.18.52-gnu/arch/arm/mach-cns3xxx/Makefile
--- linux-libre-3.18.51-gnu/arch/arm/mach-cns3xxx/Makefile	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/arch/arm/mach-cns3xxx/Makefile	2017-05-08 01:44:29.000000000 -0400
@@ -2,4 +2,5 @@ obj-$(CONFIG_ARCH_CNS3XXX)		+= cns3xxx.o
 cns3xxx-y				+= core.o pm.o
 cns3xxx-$(CONFIG_ATAGS)			+= devices.o
 cns3xxx-$(CONFIG_PCI)			+= pcie.o
+CFLAGS_pcie.o				+= -Wframe-larger-than=1536 # override default 1024, this is safe here
 cns3xxx-$(CONFIG_MACH_CNS3420VB)	+= cns3420vb.o
diff -druNp --no-dereference linux-libre-3.18.51-gnu/arch/arm64/include/asm/cpufeature.h linux-libre-3.18.52-gnu/arch/arm64/include/asm/cpufeature.h
--- linux-libre-3.18.51-gnu/arch/arm64/include/asm/cpufeature.h	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/arch/arm64/include/asm/cpufeature.h	2017-05-08 01:44:29.000000000 -0400
@@ -25,11 +25,11 @@
 #define ARM64_WORKAROUND_DEVICE_LOAD_ACQUIRE	1
 #define ARM64_WORKAROUND_845719			2
 
-#define NCAPS					3
+#define ARM64_NCAPS				3
 
 #ifndef __ASSEMBLY__
 
-extern DECLARE_BITMAP(cpu_hwcaps, NCAPS);
+extern DECLARE_BITMAP(cpu_hwcaps, ARM64_NCAPS);
 
 static inline bool cpu_have_feature(unsigned int num)
 {
@@ -38,16 +38,16 @@ static inline bool cpu_have_feature(unsi
 
 static inline bool cpus_have_cap(unsigned int num)
 {
-	if (num >= NCAPS)
+	if (num >= ARM64_NCAPS)
 		return false;
 	return test_bit(num, cpu_hwcaps);
 }
 
 static inline void cpus_set_cap(unsigned int num)
 {
-	if (num >= NCAPS)
+	if (num >= ARM64_NCAPS)
 		pr_warn("Attempt to set an illegal CPU capability (%d >= %d)\n",
-			num, NCAPS);
+			num, ARM64_NCAPS);
 	else
 		__set_bit(num, cpu_hwcaps);
 }
diff -druNp --no-dereference linux-libre-3.18.51-gnu/arch/arm64/kernel/setup.c linux-libre-3.18.52-gnu/arch/arm64/kernel/setup.c
--- linux-libre-3.18.51-gnu/arch/arm64/kernel/setup.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/arch/arm64/kernel/setup.c	2017-05-08 01:44:29.000000000 -0400
@@ -80,7 +80,7 @@ unsigned int compat_elf_hwcap __read_mos
 unsigned int compat_elf_hwcap2 __read_mostly;
 #endif
 
-DECLARE_BITMAP(cpu_hwcaps, NCAPS);
+DECLARE_BITMAP(cpu_hwcaps, ARM64_NCAPS);
 
 static const char *cpu_name;
 phys_addr_t __fdt_pointer __initdata;
diff -druNp --no-dereference linux-libre-3.18.51-gnu/arch/arm64/kernel/vdso/Makefile linux-libre-3.18.52-gnu/arch/arm64/kernel/vdso/Makefile
--- linux-libre-3.18.51-gnu/arch/arm64/kernel/vdso/Makefile	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/arch/arm64/kernel/vdso/Makefile	2017-05-08 01:44:29.000000000 -0400
@@ -15,6 +15,9 @@ ccflags-y := -shared -fno-common -fno-bu
 ccflags-y += -nostdlib -Wl,-soname=linux-vdso.so.1 \
 		$(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
 
+# Disable gcov profiling for VDSO code
+GCOV_PROFILE := n
+
 # Workaround for bare-metal (ELF) toolchains that neglect to pass -shared
 # down to collect2, resulting in silent corruption of the vDSO image.
 ccflags-y += -Wl,-shared
diff -druNp --no-dereference linux-libre-3.18.51-gnu/arch/mips/boot/elf2ecoff.c linux-libre-3.18.52-gnu/arch/mips/boot/elf2ecoff.c
--- linux-libre-3.18.51-gnu/arch/mips/boot/elf2ecoff.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/arch/mips/boot/elf2ecoff.c	2017-05-08 01:44:29.000000000 -0400
@@ -49,7 +49,8 @@
 /*
  * Some extra ELF definitions
  */
-#define PT_MIPS_REGINFO 0x70000000	/* Register usage information */
+#define PT_MIPS_REGINFO 	0x70000000	/* Register usage information */
+#define PT_MIPS_ABIFLAGS	0x70000003	/* Records ABI related flags  */
 
 /* -------------------------------------------------------------------- */
 
@@ -267,7 +268,6 @@ int main(int argc, char *argv[])
 	Elf32_Ehdr ex;
 	Elf32_Phdr *ph;
 	Elf32_Shdr *sh;
-	char *shstrtab;
 	int i, pad;
 	struct sect text, data, bss;
 	struct filehdr efh;
@@ -335,9 +335,6 @@ int main(int argc, char *argv[])
 				     "sh");
 	if (must_convert_endian)
 		convert_elf_shdrs(sh, ex.e_shnum);
-	/* Read in the section string table. */
-	shstrtab = saveRead(infile, sh[ex.e_shstrndx].sh_offset,
-			    sh[ex.e_shstrndx].sh_size, "shstrtab");
 
 	/* Figure out if we can cram the program header into an ECOFF
 	   header...  Basically, we can't handle anything but loadable
@@ -351,7 +348,8 @@ int main(int argc, char *argv[])
 		/* Section types we can ignore... */
 		if (ph[i].p_type == PT_NULL || ph[i].p_type == PT_NOTE ||
 		    ph[i].p_type == PT_PHDR
-		    || ph[i].p_type == PT_MIPS_REGINFO)
+		    || ph[i].p_type == PT_MIPS_REGINFO
+		    || ph[i].p_type == PT_MIPS_ABIFLAGS)
 			continue;
 		/* Section types we can't handle... */
 		else if (ph[i].p_type != PT_LOAD) {
diff -druNp --no-dereference linux-libre-3.18.51-gnu/arch/mips/jz4740/irq.h linux-libre-3.18.52-gnu/arch/mips/jz4740/irq.h
--- linux-libre-3.18.51-gnu/arch/mips/jz4740/irq.h	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/arch/mips/jz4740/irq.h	2017-05-08 01:44:29.000000000 -0400
@@ -16,7 +16,9 @@
 #define __MIPS_JZ4740_IRQ_H__
 
 #include <linux/irq.h>
+#include <asm/mach-jz4740/irq.h>
 
+struct irq_data;
 extern void jz4740_irq_suspend(struct irq_data *data);
 extern void jz4740_irq_resume(struct irq_data *data);
 
diff -druNp --no-dereference linux-libre-3.18.51-gnu/arch/mips/kernel/crash.c linux-libre-3.18.52-gnu/arch/mips/kernel/crash.c
--- linux-libre-3.18.51-gnu/arch/mips/kernel/crash.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/arch/mips/kernel/crash.c	2017-05-08 01:44:29.000000000 -0400
@@ -14,12 +14,22 @@ static int crashing_cpu = -1;
 static cpumask_t cpus_in_crash = CPU_MASK_NONE;
 
 #ifdef CONFIG_SMP
-static void crash_shutdown_secondary(void *ignore)
+static void crash_shutdown_secondary(void *passed_regs)
 {
-	struct pt_regs *regs;
+	struct pt_regs *regs = passed_regs;
 	int cpu = smp_processor_id();
 
-	regs = task_pt_regs(current);
+	/*
+	 * If we are passed registers, use those.  Otherwise get the
+	 * regs from the last interrupt, which should be correct, as
+	 * we are in an interrupt.  But if the regs are not there,
+	 * pull them from the top of the stack.  They are probably
+	 * wrong, but we need something to keep from crashing again.
+	 */
+	if (!regs)
+		regs = get_irq_regs();
+	if (!regs)
+		regs = task_pt_regs(current);
 
 	if (!cpu_online(cpu))
 		return;
diff -druNp --no-dereference linux-libre-3.18.51-gnu/arch/mips/kernel/kgdb.c linux-libre-3.18.52-gnu/arch/mips/kernel/kgdb.c
--- linux-libre-3.18.51-gnu/arch/mips/kernel/kgdb.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/arch/mips/kernel/kgdb.c	2017-05-08 01:44:29.000000000 -0400
@@ -244,9 +244,6 @@ static int compute_signal(int tt)
 void sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *p)
 {
 	int reg;
-	struct thread_info *ti = task_thread_info(p);
-	unsigned long ksp = (unsigned long)ti + THREAD_SIZE - 32;
-	struct pt_regs *regs = (struct pt_regs *)ksp - 1;
 #if (KGDB_GDB_REG_SIZE == 32)
 	u32 *ptr = (u32 *)gdb_regs;
 #else
@@ -254,25 +251,46 @@ void sleeping_thread_to_gdb_regs(unsigne
 #endif
 
 	for (reg = 0; reg < 16; reg++)
-		*(ptr++) = regs->regs[reg];
+		*(ptr++) = 0;
 
 	/* S0 - S7 */
-	for (reg = 16; reg < 24; reg++)
-		*(ptr++) = regs->regs[reg];
+	*(ptr++) = p->thread.reg16;
+	*(ptr++) = p->thread.reg17;
+	*(ptr++) = p->thread.reg18;
+	*(ptr++) = p->thread.reg19;
+	*(ptr++) = p->thread.reg20;
+	*(ptr++) = p->thread.reg21;
+	*(ptr++) = p->thread.reg22;
+	*(ptr++) = p->thread.reg23;
 
 	for (reg = 24; reg < 28; reg++)
 		*(ptr++) = 0;
 
 	/* GP, SP, FP, RA */
-	for (reg = 28; reg < 32; reg++)
-		*(ptr++) = regs->regs[reg];
+	*(ptr++) = (long)p;
+	*(ptr++) = p->thread.reg29;
+	*(ptr++) = p->thread.reg30;
+	*(ptr++) = p->thread.reg31;
 
-	*(ptr++) = regs->cp0_status;
-	*(ptr++) = regs->lo;
-	*(ptr++) = regs->hi;
-	*(ptr++) = regs->cp0_badvaddr;
-	*(ptr++) = regs->cp0_cause;
-	*(ptr++) = regs->cp0_epc;
+	*(ptr++) = p->thread.cp0_status;
+
+	/* lo, hi */
+	*(ptr++) = 0;
+	*(ptr++) = 0;
+
+	/*
+	 * BadVAddr, Cause
+	 * Ideally these would come from the last exception frame up the stack
+	 * but that requires unwinding, otherwise we can't know much for sure.
+	 */
+	*(ptr++) = 0;
+	*(ptr++) = 0;
+
+	/*
+	 * PC
+	 * use return address (RA), i.e. the moment after return from resume()
+	 */
+	*(ptr++) = p->thread.reg31;
 }
 
 void kgdb_arch_set_pc(struct pt_regs *regs, unsigned long pc)
diff -druNp --no-dereference linux-libre-3.18.51-gnu/arch/powerpc/kernel/ptrace.c linux-libre-3.18.52-gnu/arch/powerpc/kernel/ptrace.c
--- linux-libre-3.18.51-gnu/arch/powerpc/kernel/ptrace.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/arch/powerpc/kernel/ptrace.c	2017-05-08 01:44:29.000000000 -0400
@@ -376,7 +376,7 @@ static int fpr_get(struct task_struct *t
 
 #else
 	BUILD_BUG_ON(offsetof(struct thread_fp_state, fpscr) !=
-		     offsetof(struct thread_fp_state, fpr[32][0]));
+		     offsetof(struct thread_fp_state, fpr[32]));
 
 	return user_regset_copyout(&pos, &count, &kbuf, &ubuf,
 				   &target->thread.fp_state, 0, -1);
@@ -404,7 +404,7 @@ static int fpr_set(struct task_struct *t
 	return 0;
 #else
 	BUILD_BUG_ON(offsetof(struct thread_fp_state, fpscr) !=
-		     offsetof(struct thread_fp_state, fpr[32][0]));
+		     offsetof(struct thread_fp_state, fpr[32]));
 
 	return user_regset_copyin(&pos, &count, &kbuf, &ubuf,
 				  &target->thread.fp_state, 0, -1);
diff -druNp --no-dereference linux-libre-3.18.51-gnu/arch/sparc/include/asm/pgtable_64.h linux-libre-3.18.52-gnu/arch/sparc/include/asm/pgtable_64.h
--- linux-libre-3.18.51-gnu/arch/sparc/include/asm/pgtable_64.h	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/arch/sparc/include/asm/pgtable_64.h	2017-05-08 01:44:29.000000000 -0400
@@ -666,26 +666,27 @@ static inline unsigned long pmd_pfn(pmd_
 	return pte_pfn(pte);
 }
 
-#ifdef CONFIG_TRANSPARENT_HUGEPAGE
-static inline unsigned long pmd_dirty(pmd_t pmd)
+#define __HAVE_ARCH_PMD_WRITE
+static inline unsigned long pmd_write(pmd_t pmd)
 {
 	pte_t pte = __pte(pmd_val(pmd));
 
-	return pte_dirty(pte);
+	return pte_write(pte);
 }
 
-static inline unsigned long pmd_young(pmd_t pmd)
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+static inline unsigned long pmd_dirty(pmd_t pmd)
 {
 	pte_t pte = __pte(pmd_val(pmd));
 
-	return pte_young(pte);
+	return pte_dirty(pte);
 }
 
-static inline unsigned long pmd_write(pmd_t pmd)
+static inline unsigned long pmd_young(pmd_t pmd)
 {
 	pte_t pte = __pte(pmd_val(pmd));
 
-	return pte_write(pte);
+	return pte_young(pte);
 }
 
 static inline unsigned long pmd_trans_huge(pmd_t pmd)
diff -druNp --no-dereference linux-libre-3.18.51-gnu/arch/sparc/mm/init_64.c linux-libre-3.18.52-gnu/arch/sparc/mm/init_64.c
--- linux-libre-3.18.51-gnu/arch/sparc/mm/init_64.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/arch/sparc/mm/init_64.c	2017-05-08 01:44:29.000000000 -0400
@@ -1377,7 +1377,7 @@ bool kern_addr_valid(unsigned long addr)
 	if ((long)addr < 0L) {
 		unsigned long pa = __pa(addr);
 
-		if ((addr >> max_phys_bits) != 0UL)
+		if ((pa >> max_phys_bits) != 0UL)
 			return false;
 
 		return pfn_valid(pa >> PAGE_SHIFT);
diff -druNp --no-dereference linux-libre-3.18.51-gnu/arch/x86/kernel/ftrace.c linux-libre-3.18.52-gnu/arch/x86/kernel/ftrace.c
--- linux-libre-3.18.51-gnu/arch/x86/kernel/ftrace.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/arch/x86/kernel/ftrace.c	2017-05-08 01:44:29.000000000 -0400
@@ -703,6 +703,18 @@ void prepare_ftrace_return(unsigned long
 	unsigned long return_hooker = (unsigned long)
 				&return_to_handler;
 
+	/*
+	 * When resuming from suspend-to-ram, this function can be indirectly
+	 * called from early CPU startup code while the CPU is in real mode,
+	 * which would fail miserably.  Make sure the stack pointer is a
+	 * virtual address.
+	 *
+	 * This check isn't as accurate as virt_addr_valid(), but it should be
+	 * good enough for this purpose, and it's fast.
+	 */
+	if (unlikely((long)__builtin_frame_address(0) >= 0))
+		return;
+
 	if (unlikely(ftrace_graph_is_dead()))
 		return;
 
diff -druNp --no-dereference linux-libre-3.18.51-gnu/arch/x86/xen/time.c linux-libre-3.18.52-gnu/arch/x86/xen/time.c
--- linux-libre-3.18.51-gnu/arch/x86/xen/time.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/arch/x86/xen/time.c	2017-05-08 01:44:29.000000000 -0400
@@ -362,11 +362,11 @@ static int xen_vcpuop_set_next_event(uns
 	WARN_ON(evt->mode != CLOCK_EVT_MODE_ONESHOT);
 
 	single.timeout_abs_ns = get_abs_timeout(delta);
-	single.flags = VCPU_SSHOTTMR_future;
+	/* Get an event anyway, even if the timeout is already expired */
+	single.flags = 0;
 
 	ret = HYPERVISOR_vcpu_op(VCPUOP_set_singleshot_timer, cpu, &single);
-
-	BUG_ON(ret != 0 && ret != -ETIME);
+	BUG_ON(ret != 0);
 
 	return ret;
 }
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/block/drbd/drbd_bitmap.c linux-libre-3.18.52-gnu/drivers/block/drbd/drbd_bitmap.c
--- linux-libre-3.18.51-gnu/drivers/block/drbd/drbd_bitmap.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/block/drbd/drbd_bitmap.c	2017-05-08 01:44:29.000000000 -0400
@@ -479,8 +479,14 @@ void drbd_bm_cleanup(struct drbd_device
  * this masks out the remaining bits.
  * Returns the number of bits cleared.
  */
+#ifndef BITS_PER_PAGE
 #define BITS_PER_PAGE		(1UL << (PAGE_SHIFT + 3))
 #define BITS_PER_PAGE_MASK	(BITS_PER_PAGE - 1)
+#else
+# if BITS_PER_PAGE != (1UL << (PAGE_SHIFT + 3))
+#  error "ambiguous BITS_PER_PAGE"
+# endif
+#endif
 #define BITS_PER_LONG_MASK	(BITS_PER_LONG - 1)
 static int bm_clear_surplus(struct drbd_bitmap *b)
 {
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/infiniband/hw/ehca/ehca_mrmw.c linux-libre-3.18.52-gnu/drivers/infiniband/hw/ehca/ehca_mrmw.c
--- linux-libre-3.18.51-gnu/drivers/infiniband/hw/ehca/ehca_mrmw.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/infiniband/hw/ehca/ehca_mrmw.c	2017-05-08 01:44:29.000000000 -0400
@@ -1921,7 +1921,7 @@ static int ehca_set_pagebuf_user2(struct
 				  u64 *kpage)
 {
 	int ret = 0;
-	u64 pgaddr, prev_pgaddr;
+	u64 pgaddr, prev_pgaddr = 0;
 	u32 j = 0;
 	int kpages_per_hwpage = pginfo->hwpage_size / PAGE_SIZE;
 	int nr_kpages = kpages_per_hwpage;
@@ -2417,6 +2417,7 @@ static int ehca_reg_bmap_mr_rpages(struc
 		ehca_err(&shca->ib_device, "kpage alloc failed");
 		return -ENOMEM;
 	}
+	hret = H_SUCCESS;
 	for (top = 0; top < EHCA_MAP_ENTRIES; top++) {
 		if (!ehca_bmap_valid(ehca_bmap->top[top]))
 			continue;
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/infiniband/hw/mlx5/mem.c linux-libre-3.18.52-gnu/drivers/infiniband/hw/mlx5/mem.c
--- linux-libre-3.18.51-gnu/drivers/infiniband/hw/mlx5/mem.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/infiniband/hw/mlx5/mem.c	2017-05-08 01:44:29.000000000 -0400
@@ -69,7 +69,7 @@ void mlx5_ib_cont_pages(struct ib_umem *
 		for (k = 0; k < len; k++) {
 			if (!(i & mask)) {
 				tmp = (unsigned long)pfn;
-				m = min(m, find_first_bit(&tmp, sizeof(tmp)));
+				m = min_t(unsigned long, m, find_first_bit(&tmp, sizeof(tmp)));
 				skip = 1 << m;
 				mask = skip - 1;
 				base = pfn;
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/infiniband/hw/qib/qib_qp.c linux-libre-3.18.52-gnu/drivers/infiniband/hw/qib/qib_qp.c
--- linux-libre-3.18.51-gnu/drivers/infiniband/hw/qib/qib_qp.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/infiniband/hw/qib/qib_qp.c	2017-05-08 01:44:29.000000000 -0400
@@ -41,13 +41,13 @@
 
 #include "qib.h"
 
-#define BITS_PER_PAGE           (PAGE_SIZE*BITS_PER_BYTE)
-#define BITS_PER_PAGE_MASK      (BITS_PER_PAGE-1)
+#define RVT_BITS_PER_PAGE           (PAGE_SIZE*BITS_PER_BYTE)
+#define RVT_BITS_PER_PAGE_MASK      (RVT_BITS_PER_PAGE-1)
 
 static inline unsigned mk_qpn(struct qib_qpn_table *qpt,
 			      struct qpn_map *map, unsigned off)
 {
-	return (map - qpt->map) * BITS_PER_PAGE + off;
+	return (map - qpt->map) * RVT_BITS_PER_PAGE + off;
 }
 
 static inline unsigned find_next_offset(struct qib_qpn_table *qpt,
@@ -59,7 +59,7 @@ static inline unsigned find_next_offset(
 		if (((off & qpt->mask) >> 1) >= n)
 			off = (off | qpt->mask) + 2;
 	} else
-		off = find_next_zero_bit(map->page, BITS_PER_PAGE, off);
+		off = find_next_zero_bit(map->page, RVT_BITS_PER_PAGE, off);
 	return off;
 }
 
@@ -147,8 +147,8 @@ static int alloc_qpn(struct qib_devdata
 		qpn = 2;
 	if (qpt->mask && ((qpn & qpt->mask) >> 1) >= dd->n_krcv_queues)
 		qpn = (qpn | qpt->mask) + 2;
-	offset = qpn & BITS_PER_PAGE_MASK;
-	map = &qpt->map[qpn / BITS_PER_PAGE];
+	offset = qpn & RVT_BITS_PER_PAGE_MASK;
+	map = &qpt->map[qpn / RVT_BITS_PER_PAGE];
 	max_scan = qpt->nmaps - !offset;
 	for (i = 0;;) {
 		if (unlikely(!map->page)) {
@@ -173,7 +173,7 @@ static int alloc_qpn(struct qib_devdata
 			 * We just need to be sure we don't loop
 			 * forever.
 			 */
-		} while (offset < BITS_PER_PAGE && qpn < QPN_MAX);
+		} while (offset < RVT_BITS_PER_PAGE && qpn < QPN_MAX);
 		/*
 		 * In order to keep the number of pages allocated to a
 		 * minimum, we scan the all existing pages before increasing
@@ -204,9 +204,9 @@ static void free_qpn(struct qib_qpn_tabl
 {
 	struct qpn_map *map;
 
-	map = qpt->map + qpn / BITS_PER_PAGE;
+	map = qpt->map + qpn / RVT_BITS_PER_PAGE;
 	if (map->page)
-		clear_bit(qpn & BITS_PER_PAGE_MASK, map->page);
+		clear_bit(qpn & RVT_BITS_PER_PAGE_MASK, map->page);
 }
 
 static inline unsigned qpn_hash(struct qib_ibdev *dev, u32 qpn)
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/infiniband/ulp/iser/iser_memory.c linux-libre-3.18.52-gnu/drivers/infiniband/ulp/iser/iser_memory.c
--- linux-libre-3.18.51-gnu/drivers/infiniband/ulp/iser/iser_memory.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/infiniband/ulp/iser/iser_memory.c	2017-05-08 01:44:29.000000000 -0400
@@ -73,7 +73,6 @@ static int iser_start_rdma_unaligned_sg(
 
 	if (cmd_dir == ISER_DIR_OUT) {
 		/* copy the unaligned sg the buffer which is used for RDMA */
-		int i;
 		char *p, *from;
 
 		sgl = (struct scatterlist *)data->buf;
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/infiniband/ulp/iser/iser_verbs.c linux-libre-3.18.52-gnu/drivers/infiniband/ulp/iser/iser_verbs.c
--- linux-libre-3.18.51-gnu/drivers/infiniband/ulp/iser/iser_verbs.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/infiniband/ulp/iser/iser_verbs.c	2017-05-08 01:44:29.000000000 -0400
@@ -1052,7 +1052,7 @@ int iser_post_recvl(struct iser_conn *is
 	sge.length = ISER_RX_LOGIN_SIZE;
 	sge.lkey   = ib_conn->device->mr->lkey;
 
-	rx_wr.wr_id   = (unsigned long)iser_conn->login_resp_buf;
+	rx_wr.wr_id   = (uintptr_t)iser_conn->login_resp_buf;
 	rx_wr.sg_list = &sge;
 	rx_wr.num_sge = 1;
 	rx_wr.next    = NULL;
@@ -1076,7 +1076,7 @@ int iser_post_recvm(struct iser_conn *is
 
 	for (rx_wr = ib_conn->rx_wr, i = 0; i < count; i++, rx_wr++) {
 		rx_desc		= &iser_conn->rx_descs[my_rx_head];
-		rx_wr->wr_id	= (unsigned long)rx_desc;
+		rx_wr->wr_id	= (uintptr_t)rx_desc;
 		rx_wr->sg_list	= &rx_desc->rx_sg;
 		rx_wr->num_sge	= 1;
 		rx_wr->next	= rx_wr + 1;
@@ -1113,7 +1113,7 @@ int iser_post_send(struct ib_conn *ib_co
 				      DMA_TO_DEVICE);
 
 	send_wr.next	   = NULL;
-	send_wr.wr_id	   = (unsigned long)tx_desc;
+	send_wr.wr_id	   = (uintptr_t)tx_desc;
 	send_wr.sg_list	   = tx_desc->tx_sg;
 	send_wr.num_sge	   = tx_desc->num_sge;
 	send_wr.opcode	   = IB_WR_SEND;
@@ -1163,6 +1163,7 @@ static void
 iser_handle_comp_error(struct ib_conn *ib_conn,
 		       struct ib_wc *wc)
 {
+	void *wr_id = (void *)(uintptr_t)wc->wr_id;
 	struct iser_conn *iser_conn = container_of(ib_conn, struct iser_conn,
 						   ib_conn);
 
@@ -1171,8 +1172,8 @@ iser_handle_comp_error(struct ib_conn *i
 			iscsi_conn_failure(iser_conn->iscsi_conn,
 					   ISCSI_ERR_CONN_FAILED);
 
-	if (is_iser_tx_desc(iser_conn, (void *)wc->wr_id)) {
-		struct iser_tx_desc *desc = (struct iser_tx_desc *)wc->wr_id;
+	if (is_iser_tx_desc(iser_conn, wr_id)) {
+		struct iser_tx_desc *desc = wr_id;
 
 		if (desc->type == ISCSI_TX_DATAOUT)
 			kmem_cache_free(ig.desc_cache, desc);
@@ -1198,12 +1199,12 @@ static void iser_handle_wc(struct ib_wc
 	ib_conn = wc->qp->qp_context;
 	if (wc->status == IB_WC_SUCCESS) {
 		if (wc->opcode == IB_WC_RECV) {
-			rx_desc = (struct iser_rx_desc *)wc->wr_id;
+			rx_desc = (struct iser_rx_desc *)(uintptr_t)wc->wr_id;
 			iser_rcv_completion(rx_desc, wc->byte_len,
 					    ib_conn);
 		} else
 		if (wc->opcode == IB_WC_SEND) {
-			tx_desc = (struct iser_tx_desc *)wc->wr_id;
+			tx_desc = (struct iser_tx_desc *)(uintptr_t)wc->wr_id;
 			iser_snd_completion(tx_desc, ib_conn);
 		} else {
 			iser_err("Unknown wc opcode %d\n", wc->opcode);
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/input/serio/i8042-x86ia64io.h linux-libre-3.18.52-gnu/drivers/input/serio/i8042-x86ia64io.h
--- linux-libre-3.18.51-gnu/drivers/input/serio/i8042-x86ia64io.h	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/input/serio/i8042-x86ia64io.h	2017-05-08 01:44:29.000000000 -0400
@@ -595,6 +595,13 @@ static const struct dmi_system_id __init
 			DMI_MATCH(DMI_PRODUCT_NAME, "20046"),
 		},
 	},
+	{
+		/* Clevo P650RS, 650RP6, Sager NP8152-S, and others */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Notebook"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "P65xRP"),
+		},
+	},
 	{ }
 };
 
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/isdn/hardware/mISDN/mISDNipac.c linux-libre-3.18.52-gnu/drivers/isdn/hardware/mISDN/mISDNipac.c
--- linux-libre-3.18.51-gnu/drivers/isdn/hardware/mISDN/mISDNipac.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/isdn/hardware/mISDN/mISDNipac.c	2017-05-08 01:44:29.000000000 -0400
@@ -754,10 +754,10 @@ dbusy_timer_handler(struct isac_hw *isac
 }
 
 static int
-open_dchannel(struct isac_hw *isac, struct channel_req *rq)
+open_dchannel_caller(struct isac_hw *isac, struct channel_req *rq, void *caller)
 {
 	pr_debug("%s: %s dev(%d) open from %p\n", isac->name, __func__,
-		 isac->dch.dev.id, __builtin_return_address(1));
+		 isac->dch.dev.id, caller);
 	if (rq->protocol != ISDN_P_TE_S0)
 		return -EINVAL;
 	if (rq->adr.channel == 1)
@@ -771,6 +771,12 @@ open_dchannel(struct isac_hw *isac, stru
 	return 0;
 }
 
+static int
+open_dchannel(struct isac_hw *isac, struct channel_req *rq)
+{
+	return open_dchannel_caller(isac, rq, __builtin_return_address(0));
+}
+
 static const char *ISACVer[] =
 {"2086/2186 V1.1", "2085 B1", "2085 B2",
  "2085 V2.3"};
@@ -1548,7 +1554,7 @@ ipac_dctrl(struct mISDNchannel *ch, u32
 	case OPEN_CHANNEL:
 		rq = arg;
 		if (rq->protocol == ISDN_P_TE_S0)
-			err = open_dchannel(isac, rq);
+			err = open_dchannel_caller(isac, rq, __builtin_return_address(0));
 		else
 			err = open_bchannel(ipac, rq);
 		if (err)
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/isdn/hardware/mISDN/w6692.c linux-libre-3.18.52-gnu/drivers/isdn/hardware/mISDN/w6692.c
--- linux-libre-3.18.51-gnu/drivers/isdn/hardware/mISDN/w6692.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/isdn/hardware/mISDN/w6692.c	2017-05-08 01:44:29.000000000 -0400
@@ -1176,10 +1176,10 @@ w6692_l1callback(struct dchannel *dch, u
 }
 
 static int
-open_dchannel(struct w6692_hw *card, struct channel_req *rq)
+open_dchannel(struct w6692_hw *card, struct channel_req *rq, void *caller)
 {
 	pr_debug("%s: %s dev(%d) open from %p\n", card->name, __func__,
-		 card->dch.dev.id, __builtin_return_address(1));
+		 card->dch.dev.id, caller);
 	if (rq->protocol != ISDN_P_TE_S0)
 		return -EINVAL;
 	if (rq->adr.channel == 1)
@@ -1207,7 +1207,7 @@ w6692_dctrl(struct mISDNchannel *ch, u32
 	case OPEN_CHANNEL:
 		rq = arg;
 		if (rq->protocol == ISDN_P_TE_S0)
-			err = open_dchannel(card, rq);
+			err = open_dchannel(card, rq, __builtin_return_address(0));
 		else
 			err = open_bchannel(card, rq);
 		if (err)
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/md/dm-ioctl.c linux-libre-3.18.52-gnu/drivers/md/dm-ioctl.c
--- linux-libre-3.18.51-gnu/drivers/md/dm-ioctl.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/md/dm-ioctl.c	2017-05-08 01:44:29.000000000 -0400
@@ -1839,7 +1839,7 @@ static int ctl_ioctl(uint command, struc
 	if (r)
 		goto out;
 
-	param->data_size = sizeof(*param);
+	param->data_size = offsetof(struct dm_ioctl, data);
 	r = fn(param, input_param_size);
 
 	if (unlikely(param->flags & DM_BUFFER_FULL_FLAG) &&
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/md/raid1.c linux-libre-3.18.52-gnu/drivers/md/raid1.c
--- linux-libre-3.18.51-gnu/drivers/md/raid1.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/md/raid1.c	2017-05-08 01:44:29.000000000 -0400
@@ -563,7 +563,7 @@ static int read_balance(struct r1conf *c
 			if (best_dist_disk < 0) {
 				if (is_badblock(rdev, this_sector, sectors,
 						&first_bad, &bad_sectors)) {
-					if (first_bad < this_sector)
+					if (first_bad <= this_sector)
 						/* Cannot use this */
 						continue;
 					best_good_sectors = first_bad - this_sector;
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/media/tuners/tuner-xc2028.c linux-libre-3.18.52-gnu/drivers/media/tuners/tuner-xc2028.c
--- linux-libre-3.18.51-gnu/drivers/media/tuners/tuner-xc2028.c	2017-04-30 00:56:20.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/media/tuners/tuner-xc2028.c	2017-05-08 02:51:48.000000000 -0400
@@ -1407,8 +1407,10 @@ static int xc2028_set_config(struct dvb_
 	memcpy(&priv->ctrl, p, sizeof(priv->ctrl));
 	if (p->fname) {
 		priv->ctrl.fname = kstrdup(p->fname, GFP_KERNEL);
-		if (priv->ctrl.fname == NULL)
-			return -ENOMEM;
+		if (priv->ctrl.fname == NULL) {
+			rc = -ENOMEM;
+			goto unlock;
+		}
 	}
 
 	/*
@@ -1440,6 +1442,7 @@ static int xc2028_set_config(struct dvb_
 		} else
 			priv->state = XC2028_WAITING_FIRMWARE;
 	}
+unlock:
 	mutex_unlock(&priv->lock);
 
 	return rc;
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/message/i2o/i2o_config.c linux-libre-3.18.52-gnu/drivers/message/i2o/i2o_config.c
--- linux-libre-3.18.51-gnu/drivers/message/i2o/i2o_config.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/message/i2o/i2o_config.c	2017-05-08 01:44:29.000000000 -0400
@@ -772,7 +772,7 @@ static long i2o_cfg_compat_ioctl(struct
 
 #endif
 
-#ifdef CONFIG_I2O_EXT_ADAPTEC
+#if defined(CONFIG_I2O_EXT_ADAPTEC) && !defined(CONFIG_64BIT)
 static int i2o_cfg_passthru(unsigned long arg)
 {
 	struct i2o_cmd_passthru __user *cmd =
@@ -1045,7 +1045,7 @@ static long i2o_cfg_ioctl(struct file *f
 		ret = i2o_cfg_evt_get(arg, fp);
 		break;
 
-#ifdef CONFIG_I2O_EXT_ADAPTEC
+#if defined(CONFIG_I2O_EXT_ADAPTEC) && !defined(CONFIG_64BIT)
 	case I2OPASSTHRU:
 		ret = i2o_cfg_passthru(arg);
 		break;
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/mtd/chips/Kconfig linux-libre-3.18.52-gnu/drivers/mtd/chips/Kconfig
--- linux-libre-3.18.51-gnu/drivers/mtd/chips/Kconfig	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/mtd/chips/Kconfig	2017-05-08 01:44:29.000000000 -0400
@@ -110,6 +110,7 @@ config MTD_MAP_BANK_WIDTH_16
 
 config MTD_MAP_BANK_WIDTH_32
 	bool "Support 256-bit buswidth" if MTD_CFI_GEOMETRY
+	select MTD_COMPLEX_MAPPINGS if HAS_IOMEM
 	default n
 	help
 	  If you wish to support CFI devices on a physical bus which is
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/net/ethernet/broadcom/tg3.c linux-libre-3.18.52-gnu/drivers/net/ethernet/broadcom/tg3.c
--- linux-libre-3.18.51-gnu/drivers/net/ethernet/broadcom/tg3.c	2017-04-30 01:07:13.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/net/ethernet/broadcom/tg3.c	2017-05-08 03:02:22.000000000 -0400
@@ -12012,7 +12012,7 @@ static int tg3_set_eeprom(struct net_dev
 	int ret;
 	u32 offset, len, b_offset, odd_len;
 	u8 *buf;
-	__be32 start, end;
+	__be32 start = 0, end;
 
 	if (tg3_flag(tp, NO_NVRAM) ||
 	    eeprom->magic != TG3_EEPROM_MAGIC)
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/net/ethernet/intel/e1000e/ich8lan.c linux-libre-3.18.52-gnu/drivers/net/ethernet/intel/e1000e/ich8lan.c
--- linux-libre-3.18.51-gnu/drivers/net/ethernet/intel/e1000e/ich8lan.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/net/ethernet/intel/e1000e/ich8lan.c	2017-05-08 01:44:29.000000000 -0400
@@ -983,7 +983,7 @@ static s32 e1000_platform_pm_pch_lpt(str
 		u16 max_snoop, max_nosnoop;
 		u16 max_ltr_enc;	/* max LTR latency encoded */
 		s64 lat_ns;	/* latency (ns) */
-		s64 value;
+		u64 value;
 		u32 rxa;
 
 		if (!hw->adapter->max_frame_size) {
@@ -1010,12 +1010,13 @@ static s32 e1000_platform_pm_pch_lpt(str
 		 */
 		lat_ns = ((s64)rxa * 1024 -
 			  (2 * (s64)hw->adapter->max_frame_size)) * 8 * 1000;
-		if (lat_ns < 0)
-			lat_ns = 0;
-		else
-			do_div(lat_ns, speed);
+		if (lat_ns < 0) {
+			value = 0;
+		} else {
+			value = lat_ns;
+			do_div(value, speed);
+		}
 
-		value = lat_ns;
 		while (value > PCI_LTR_VALUE_MASK) {
 			scale++;
 			value = DIV_ROUND_UP(value, (1 << 5));
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/net/ethernet/mellanox/mlx4/en_netdev.c linux-libre-3.18.52-gnu/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
--- linux-libre-3.18.51-gnu/drivers/net/ethernet/mellanox/mlx4/en_netdev.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/net/ethernet/mellanox/mlx4/en_netdev.c	2017-05-08 01:44:29.000000000 -0400
@@ -1500,17 +1500,13 @@ static int mlx4_en_init_affinity_hint(st
 {
 	struct mlx4_en_rx_ring *ring = priv->rx_ring[ring_idx];
 	int numa_node = priv->mdev->dev->numa_node;
-	int ret = 0;
 
 	if (!zalloc_cpumask_var(&ring->affinity_mask, GFP_KERNEL))
 		return -ENOMEM;
 
-	ret = cpumask_set_cpu_local_first(ring_idx, numa_node,
-					  ring->affinity_mask);
-	if (ret)
-		free_cpumask_var(ring->affinity_mask);
-
-	return ret;
+	cpumask_set_cpu(cpumask_local_spread(ring_idx, numa_node),
+			ring->affinity_mask);
+	return 0;
 }
 
 static void mlx4_en_free_affinity_hint(struct mlx4_en_priv *priv, int ring_idx)
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/net/ethernet/mellanox/mlx4/en_tx.c linux-libre-3.18.52-gnu/drivers/net/ethernet/mellanox/mlx4/en_tx.c
--- linux-libre-3.18.51-gnu/drivers/net/ethernet/mellanox/mlx4/en_tx.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/net/ethernet/mellanox/mlx4/en_tx.c	2017-05-08 01:44:29.000000000 -0400
@@ -139,9 +139,9 @@ int mlx4_en_create_tx_ring(struct mlx4_e
 	ring->queue_index = queue_index;
 
 	if (queue_index < priv->num_tx_rings_p_up)
-		cpumask_set_cpu_local_first(queue_index,
-					    priv->mdev->dev->numa_node,
-					    &ring->affinity_mask);
+		cpumask_set_cpu(cpumask_local_spread(queue_index,
+						     priv->mdev->dev->numa_node),
+				&ring->affinity_mask);
 
 	*pring = ring;
 	return 0;
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c linux-libre-3.18.52-gnu/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c
--- linux-libre-3.18.51-gnu/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c	2017-05-08 01:44:29.000000000 -0400
@@ -300,11 +300,11 @@ static u64 qp_read_field(struct mlx5_cor
 		param = qp->pid;
 		break;
 	case QP_STATE:
-		param = (u64)mlx5_qp_state_str(be32_to_cpu(ctx->flags) >> 28);
+		param = (unsigned long)mlx5_qp_state_str(be32_to_cpu(ctx->flags) >> 28);
 		*is_str = 1;
 		break;
 	case QP_XPORT:
-		param = (u64)mlx5_qp_type_str((be32_to_cpu(ctx->flags) >> 16) & 0xff);
+		param = (unsigned long)mlx5_qp_type_str((be32_to_cpu(ctx->flags) >> 16) & 0xff);
 		*is_str = 1;
 		break;
 	case QP_MTU:
@@ -464,7 +464,7 @@ static ssize_t dbg_read(struct file *fil
 
 
 	if (is_str)
-		ret = snprintf(tbuf, sizeof(tbuf), "%s\n", (const char *)field);
+		ret = snprintf(tbuf, sizeof(tbuf), "%s\n", (const char *)(unsigned long)field);
 	else
 		ret = snprintf(tbuf, sizeof(tbuf), "0x%llx\n", field);
 
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/net/phy/phy.c linux-libre-3.18.52-gnu/drivers/net/phy/phy.c
--- linux-libre-3.18.51-gnu/drivers/net/phy/phy.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/net/phy/phy.c	2017-05-08 01:44:29.000000000 -0400
@@ -506,7 +506,7 @@ void phy_stop_machine(struct phy_device
 	cancel_delayed_work_sync(&phydev->state_queue);
 
 	mutex_lock(&phydev->lock);
-	if (phydev->state > PHY_UP)
+	if (phydev->state > PHY_UP && phydev->state != PHY_HALTED)
 		phydev->state = PHY_UP;
 	mutex_unlock(&phydev->lock);
 }
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/pci/host/pcie-xilinx.c linux-libre-3.18.52-gnu/drivers/pci/host/pcie-xilinx.c
--- linux-libre-3.18.51-gnu/drivers/pci/host/pcie-xilinx.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/pci/host/pcie-xilinx.c	2017-05-08 01:44:29.000000000 -0400
@@ -148,10 +148,10 @@ static inline bool xilinx_pcie_link_is_u
  */
 static void xilinx_pcie_clear_err_interrupts(struct xilinx_pcie_port *port)
 {
-	u32 val = pcie_read(port, XILINX_PCIE_REG_RPEFR);
+	unsigned long val = pcie_read(port, XILINX_PCIE_REG_RPEFR);
 
 	if (val & XILINX_PCIE_RPEFR_ERR_VALID) {
-		dev_dbg(port->dev, "Requester ID %d\n",
+		dev_dbg(port->dev, "Requester ID %lu\n",
 			val & XILINX_PCIE_RPEFR_REQ_ID);
 		pcie_write(port, XILINX_PCIE_RPEFR_ALL_MASK,
 			   XILINX_PCIE_REG_RPEFR);
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/regulator/core.c linux-libre-3.18.52-gnu/drivers/regulator/core.c
--- linux-libre-3.18.51-gnu/drivers/regulator/core.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/regulator/core.c	2017-05-08 01:44:29.000000000 -0400
@@ -1720,6 +1720,8 @@ static void regulator_ena_gpio_free(stru
 				gpiod_put(pin->gpiod);
 				list_del(&pin->list);
 				kfree(pin);
+				rdev->ena_pin = NULL;
+				return;
 			} else {
 				pin->request_count--;
 			}
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/scsi/advansys.c linux-libre-3.18.52-gnu/drivers/scsi/advansys.c
--- linux-libre-3.18.51-gnu/drivers/scsi/advansys.c	2017-04-30 01:17:43.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/scsi/advansys.c	2017-05-08 03:21:05.000000000 -0400
@@ -49,7 +49,7 @@
 #include <scsi/scsi.h>
 #include <scsi/scsi_host.h>
 
-/* FIXME:
+/* Fixed in linux-4.2, not backported to 3.18:
  *
  *  1. Although all of the necessary command mapping places have the
  *     appropriate dma_map.. APIs, the driver still processes its internal
@@ -68,7 +68,6 @@
  *  7. advansys_info is not safe against multiple simultaneous callers
  *  8. Add module_param to override ISA/VLB ioport array
  */
-#warning this driver is still not properly converted to the DMA API
 
 /* Enable driver /proc statistics. */
 #define ADVANSYS_STATS
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/scsi/ips.c linux-libre-3.18.52-gnu/drivers/scsi/ips.c
--- linux-libre-3.18.51-gnu/drivers/scsi/ips.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/scsi/ips.c	2017-05-08 01:44:29.000000000 -0400
@@ -206,10 +206,6 @@ module_param(ips, charp, 0);
 #define IPS_VERSION_HIGH        IPS_VER_MAJOR_STRING "." IPS_VER_MINOR_STRING
 #define IPS_VERSION_LOW         "." IPS_VER_BUILD_STRING " "
 
-#if !defined(__i386__) && !defined(__ia64__) && !defined(__x86_64__)
-#warning "This driver has only been tested on the x86/ia64/x86_64 platforms"
-#endif
-
 #define IPS_DMA_DIR(scb) ((!scb->scsi_cmd || ips_is_passthru(scb->scsi_cmd) || \
                          DMA_NONE == scb->scsi_cmd->sc_data_direction) ? \
                          PCI_DMA_BIDIRECTIONAL : \
@@ -6789,6 +6785,11 @@ ips_remove_device(struct pci_dev *pci_de
 static int __init
 ips_module_init(void)
 {
+#if !defined(__i386__) && !defined(__ia64__) && !defined(__x86_64__)
+	printk(KERN_ERR "ips: This driver has only been tested on the x86/ia64/x86_64 platforms\n");
+	add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK);
+#endif
+
 	if (pci_register_driver(&ips_pci_driver) < 0)
 		return -ENODEV;
 	ips_driver_template.module = THIS_MODULE;
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/staging/bcm/Kconfig linux-libre-3.18.52-gnu/drivers/staging/bcm/Kconfig
--- linux-libre-3.18.51-gnu/drivers/staging/bcm/Kconfig	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/staging/bcm/Kconfig	2017-05-08 01:44:29.000000000 -0400
@@ -1,6 +1,7 @@
 config BCM_WIMAX
        tristate "Beceem BCS200/BCS220-3 and BCSM250 wimax support"
        depends on USB && NET
+	depends on !64BIT
        help
          This is an experimental driver for the Beceem WIMAX chipset used
 	 by Sprint 4G.
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/staging/imx-drm/imx-hdmi.c linux-libre-3.18.52-gnu/drivers/staging/imx-drm/imx-hdmi.c
--- linux-libre-3.18.51-gnu/drivers/staging/imx-drm/imx-hdmi.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/staging/imx-drm/imx-hdmi.c	2017-05-08 01:44:29.000000000 -0400
@@ -967,7 +967,7 @@ static void hdmi_config_AVI(struct imx_h
 	else
 		pix_fmt = HDMI_FC_AVICONF0_PIX_FMT_RGB;
 
-		under_scan =  HDMI_FC_AVICONF0_SCAN_INFO_NODATA;
+	under_scan =  HDMI_FC_AVICONF0_SCAN_INFO_NODATA;
 
 	/*
 	 * Active format identification data is present in the AVI InfoFrame.
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/staging/unisys/visorutil/periodic_work.c linux-libre-3.18.52-gnu/drivers/staging/unisys/visorutil/periodic_work.c
--- linux-libre-3.18.51-gnu/drivers/staging/unisys/visorutil/periodic_work.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/staging/unisys/visorutil/periodic_work.c	2017-05-08 01:44:29.000000000 -0400
@@ -98,8 +98,8 @@ BOOL visor_periodic_work_nextperiod(stru
 		pw->want_to_stop = FALSE;
 		rc = TRUE;  /* yes, TRUE; see visor_periodic_work_stop() */
 		goto unlock;
-	} else if (queue_delayed_work(pw->workqueue, &pw->work,
-				      pw->jiffy_interval) < 0) {
+	} else if (!queue_delayed_work(pw->workqueue, &pw->work,
+				       pw->jiffy_interval)) {
 		ERRDEV(pw->devnam, "queue_delayed_work failed!");
 		pw->is_scheduled = FALSE;
 		rc = FALSE;
@@ -134,8 +134,8 @@ BOOL visor_periodic_work_start(struct pe
 		goto unlock;
 	}
 	INIT_DELAYED_WORK(&pw->work, &periodic_work_func);
-	if (queue_delayed_work(pw->workqueue, &pw->work,
-			       pw->jiffy_interval) < 0) {
+	if (!queue_delayed_work(pw->workqueue, &pw->work,
+				pw->jiffy_interval)) {
 		ERRDEV(pw->devnam, "%s queue_delayed_work failed!", __func__);
 		rc = FALSE;
 		goto unlock;
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/staging/vt6655/device_main.c linux-libre-3.18.52-gnu/drivers/staging/vt6655/device_main.c
--- linux-libre-3.18.51-gnu/drivers/staging/vt6655/device_main.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/staging/vt6655/device_main.c	2017-05-08 01:44:29.000000000 -0400
@@ -2818,11 +2818,13 @@ static int  device_ioctl(struct net_devi
 		pr_debug(" SIOCSIWSENS\n");
 		rc = -EOPNOTSUPP;
 		break;
-
 	case SIOCGIWAPLIST: {
-		char buffer[IW_MAX_AP * (sizeof(struct sockaddr) + sizeof(struct iw_quality))];
+		char *buffer = kzalloc(IW_MAX_AP * (sizeof(struct sockaddr) +
+				       sizeof(struct iw_quality)), GFP_KERNEL);
 
-		if (wrq->u.data.pointer) {
+		if (!buffer) {
+			rc = -ENOMEM;
+		} else if (wrq->u.data.pointer) {
 			rc = iwctl_giwaplist(dev, NULL, &(wrq->u.data), buffer);
 			if (rc == 0) {
 				if (copy_to_user(wrq->u.data.pointer,
@@ -2832,6 +2834,7 @@ static int  device_ioctl(struct net_devi
 					rc = -EFAULT;
 			}
 		}
+		kfree(buffer);
 	}
 	break;
 
@@ -2878,7 +2881,6 @@ static int  device_ioctl(struct net_devi
 		pr_debug(" SIOCGIWGENIE\n");
 		rc = iwctl_giwgenie(dev, NULL, &(wrq->u.data), wrq->u.data.pointer);
 		break;
-
 	case SIOCSIWENCODEEXT: {
 		char extra[sizeof(struct iw_encode_ext)+MAX_KEY_LEN+1];
 
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/tty/isicom.c linux-libre-3.18.52-gnu/drivers/tty/isicom.c
--- linux-libre-3.18.51-gnu/drivers/tty/isicom.c	2017-04-30 00:53:38.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/tty/isicom.c	2017-05-08 02:49:31.000000000 -0400
@@ -1055,7 +1055,7 @@ static int isicom_send_break(struct tty_
 
 	outw(0x8000 | ((port->channel) << (card->shift_count)) | 0x3, base);
 	outw((length & 0xff) << 8 | 0x00, base);
-	outw((length & 0xff00), base);
+	outw((length & 0xff00u), base);
 	InterruptTheCard(base);
 
 	unlock_card(card);
diff -druNp --no-dereference linux-libre-3.18.51-gnu/drivers/usb/gadget/function/f_midi.c linux-libre-3.18.52-gnu/drivers/usb/gadget/function/f_midi.c
--- linux-libre-3.18.51-gnu/drivers/usb/gadget/function/f_midi.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/drivers/usb/gadget/function/f_midi.c	2017-05-08 01:44:29.000000000 -0400
@@ -357,7 +357,9 @@ static int f_midi_set_alt(struct usb_fun
 	/* allocate a bunch of read buffers and queue them all at once. */
 	for (i = 0; i < midi->qlen && err == 0; i++) {
 		struct usb_request *req =
-			midi_alloc_ep_req(midi->out_ep, midi->buflen);
+			midi_alloc_ep_req(midi->out_ep,
+				max_t(unsigned, midi->buflen,
+					bulk_out_desc.wMaxPacketSize));
 		if (req == NULL)
 			return -ENOMEM;
 
diff -druNp --no-dereference linux-libre-3.18.51-gnu/fs/9p/acl.c linux-libre-3.18.52-gnu/fs/9p/acl.c
--- linux-libre-3.18.51-gnu/fs/9p/acl.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/fs/9p/acl.c	2017-05-08 01:44:29.000000000 -0400
@@ -320,32 +320,26 @@ static int v9fs_xattr_set_acl(struct den
 	case ACL_TYPE_ACCESS:
 		name = POSIX_ACL_XATTR_ACCESS;
 		if (acl) {
-			umode_t mode = inode->i_mode;
-			retval = posix_acl_equiv_mode(acl, &mode);
-			if (retval < 0)
+			struct iattr iattr;
+
+			retval = posix_acl_update_mode(inode, &iattr.ia_mode, &acl);
+			if (retval)
 				goto err_out;
-			else {
-				struct iattr iattr;
-				if (retval == 0) {
-					/*
-					 * ACL can be represented
-					 * by the mode bits. So don't
-					 * update ACL.
-					 */
-					acl = NULL;
-					value = NULL;
-					size = 0;
-				}
-				/* Updte the mode bits */
-				iattr.ia_mode = ((mode & S_IALLUGO) |
-						 (inode->i_mode & ~S_IALLUGO));
-				iattr.ia_valid = ATTR_MODE;
-				/* FIXME should we update ctime ?
-				 * What is the following setxattr update the
-				 * mode ?
+			if (!acl) {
+				/*
+				 * ACL can be represented
+				 * by the mode bits. So don't
+				 * update ACL.
 				 */
-				v9fs_vfs_setattr_dotl(dentry, &iattr);
+				value = NULL;
+				size = 0;
 			}
+			iattr.ia_valid = ATTR_MODE;
+			/* FIXME should we update ctime ?
+			 * What is the following setxattr update the
+			 * mode ?
+			 */
+			v9fs_vfs_setattr_dotl(dentry, &iattr);
 		}
 		break;
 	case ACL_TYPE_DEFAULT:
diff -druNp --no-dereference linux-libre-3.18.51-gnu/fs/btrfs/acl.c linux-libre-3.18.52-gnu/fs/btrfs/acl.c
--- linux-libre-3.18.51-gnu/fs/btrfs/acl.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/fs/btrfs/acl.c	2017-05-08 01:44:29.000000000 -0400
@@ -83,11 +83,9 @@ static int __btrfs_set_acl(struct btrfs_
 	case ACL_TYPE_ACCESS:
 		name = POSIX_ACL_XATTR_ACCESS;
 		if (acl) {
-			ret = posix_acl_equiv_mode(acl, &inode->i_mode);
-			if (ret < 0)
+			ret = posix_acl_update_mode(inode, &inode->i_mode, &acl);
+			if (ret)
 				return ret;
-			if (ret == 0)
-				acl = NULL;
 		}
 		ret = 0;
 		break;
diff -druNp --no-dereference linux-libre-3.18.51-gnu/fs/ceph/acl.c linux-libre-3.18.52-gnu/fs/ceph/acl.c
--- linux-libre-3.18.51-gnu/fs/ceph/acl.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/fs/ceph/acl.c	2017-05-08 01:44:29.000000000 -0400
@@ -108,11 +108,9 @@ int ceph_set_acl(struct inode *inode, st
 	case ACL_TYPE_ACCESS:
 		name = POSIX_ACL_XATTR_ACCESS;
 		if (acl) {
-			ret = posix_acl_equiv_mode(acl, &new_mode);
-			if (ret < 0)
+			ret = posix_acl_update_mode(inode, &new_mode, &acl);
+			if (ret)
 				goto out;
-			if (ret == 0)
-				acl = NULL;
 		}
 		break;
 	case ACL_TYPE_DEFAULT:
diff -druNp --no-dereference linux-libre-3.18.51-gnu/fs/cifs/cifsglob.h linux-libre-3.18.52-gnu/fs/cifs/cifsglob.h
--- linux-libre-3.18.51-gnu/fs/cifs/cifsglob.h	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/fs/cifs/cifsglob.h	2017-05-08 01:44:29.000000000 -0400
@@ -223,6 +223,7 @@ struct smb_version_operations {
 	/* verify the message */
 	int (*check_message)(char *, unsigned int);
 	bool (*is_oplock_break)(char *, struct TCP_Server_Info *);
+	int (*handle_cancelled_mid)(char *, struct TCP_Server_Info *);
 	void (*downgrade_oplock)(struct TCP_Server_Info *,
 					struct cifsInodeInfo *, bool);
 	/* process transaction2 response */
@@ -1264,12 +1265,19 @@ struct mid_q_entry {
 	void *callback_data;	  /* general purpose pointer for callback */
 	void *resp_buf;		/* pointer to received SMB header */
 	int mid_state;	/* wish this were enum but can not pass to wait_event */
+	unsigned int mid_flags;
 	__le16 command;		/* smb command code */
 	bool large_buf:1;	/* if valid response, is pointer to large buf */
 	bool multiRsp:1;	/* multiple trans2 responses for one request  */
 	bool multiEnd:1;	/* both received */
 };
 
+struct close_cancelled_open {
+	struct cifs_fid         fid;
+	struct cifs_tcon        *tcon;
+	struct work_struct      work;
+};
+
 /*	Make code in transport.c a little cleaner by moving
 	update of optional stats into function below */
 #ifdef CONFIG_CIFS_STATS2
@@ -1401,6 +1409,9 @@ static inline void free_dfs_info_array(s
 #define   MID_RESPONSE_MALFORMED 0x10
 #define   MID_SHUTDOWN		 0x20
 
+/* Flags */
+#define   MID_WAIT_CANCELLED	 1 /* Cancelled while waiting for response */
+
 /* Types of response buffer returned from SendReceive2 */
 #define   CIFS_NO_BUFFER        0    /* Response buffer not returned */
 #define   CIFS_SMALL_BUFFER     1
diff -druNp --no-dereference linux-libre-3.18.51-gnu/fs/cifs/cifssmb.c linux-libre-3.18.52-gnu/fs/cifs/cifssmb.c
--- linux-libre-3.18.51-gnu/fs/cifs/cifssmb.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/fs/cifs/cifssmb.c	2017-05-08 01:44:29.000000000 -0400
@@ -1422,6 +1422,8 @@ cifs_readv_discard(struct TCP_Server_Inf
 
 	length = discard_remaining_data(server);
 	dequeue_mid(mid, rdata->result);
+	mid->resp_buf = server->smallbuf;
+	server->smallbuf = NULL;
 	return length;
 }
 
@@ -1536,6 +1538,8 @@ cifs_readv_receive(struct TCP_Server_Inf
 		return cifs_readv_discard(server, mid);
 
 	dequeue_mid(mid, false);
+	mid->resp_buf = server->smallbuf;
+	server->smallbuf = NULL;
 	return length;
 }
 
diff -druNp --no-dereference linux-libre-3.18.51-gnu/fs/cifs/connect.c linux-libre-3.18.52-gnu/fs/cifs/connect.c
--- linux-libre-3.18.51-gnu/fs/cifs/connect.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/fs/cifs/connect.c	2017-05-08 01:44:29.000000000 -0400
@@ -914,10 +914,19 @@ cifs_demultiplex_thread(void *p)
 
 		server->lstrp = jiffies;
 		if (mid_entry != NULL) {
+			if ((mid_entry->mid_flags & MID_WAIT_CANCELLED) &&
+			     mid_entry->mid_state == MID_RESPONSE_RECEIVED &&
+					server->ops->handle_cancelled_mid)
+				server->ops->handle_cancelled_mid(
+							mid_entry->resp_buf,
+							server);
+
 			if (!mid_entry->multiRsp || mid_entry->multiEnd)
 				mid_entry->callback(mid_entry);
-		} else if (!server->ops->is_oplock_break ||
-			   !server->ops->is_oplock_break(buf, server)) {
+		} else if (server->ops->is_oplock_break &&
+			   server->ops->is_oplock_break(buf, server)) {
+			cifs_dbg(FYI, "Received oplock break\n");
+		} else {
 			cifs_dbg(VFS, "No task to wake, unknown frame received! NumMids %d\n",
 				 atomic_read(&midCount));
 			cifs_dump_mem("Received Data is: ", buf,
diff -druNp --no-dereference linux-libre-3.18.51-gnu/fs/cifs/smb2misc.c linux-libre-3.18.52-gnu/fs/cifs/smb2misc.c
--- linux-libre-3.18.51-gnu/fs/cifs/smb2misc.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/fs/cifs/smb2misc.c	2017-05-08 01:44:29.000000000 -0400
@@ -628,3 +628,47 @@ smb2_is_valid_oplock_break(char *buffer,
 	cifs_dbg(FYI, "Can not process oplock break for non-existent connection\n");
 	return false;
 }
+
+void
+smb2_cancelled_close_fid(struct work_struct *work)
+{
+	struct close_cancelled_open *cancelled = container_of(work,
+					struct close_cancelled_open, work);
+
+	cifs_dbg(VFS, "Close unmatched open\n");
+
+	SMB2_close(0, cancelled->tcon, cancelled->fid.persistent_fid,
+		   cancelled->fid.volatile_fid);
+	cifs_put_tcon(cancelled->tcon);
+	kfree(cancelled);
+}
+
+int
+smb2_handle_cancelled_mid(char *buffer, struct TCP_Server_Info *server)
+{
+	struct smb2_hdr *hdr = (struct smb2_hdr *)buffer;
+	struct smb2_create_rsp *rsp = (struct smb2_create_rsp *)buffer;
+	struct cifs_tcon *tcon;
+	struct close_cancelled_open *cancelled;
+
+	if (hdr->Command != SMB2_CREATE || hdr->Status != STATUS_SUCCESS)
+		return 0;
+
+	cancelled = kzalloc(sizeof(*cancelled), GFP_KERNEL);
+	if (!cancelled)
+		return -ENOMEM;
+
+	tcon = smb2_find_smb_tcon(server, hdr->SessionId, hdr->TreeId);
+	if (!tcon) {
+		kfree(cancelled);
+		return -ENOENT;
+	}
+
+	cancelled->fid.persistent_fid = rsp->PersistentFileId;
+	cancelled->fid.volatile_fid = rsp->VolatileFileId;
+	cancelled->tcon = tcon;
+	INIT_WORK(&cancelled->work, smb2_cancelled_close_fid);
+	queue_work(cifsiod_wq, &cancelled->work);
+
+	return 0;
+}
diff -druNp --no-dereference linux-libre-3.18.51-gnu/fs/cifs/smb2ops.c linux-libre-3.18.52-gnu/fs/cifs/smb2ops.c
--- linux-libre-3.18.51-gnu/fs/cifs/smb2ops.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/fs/cifs/smb2ops.c	2017-05-08 01:44:29.000000000 -0400
@@ -1461,6 +1461,8 @@ struct smb_version_operations smb21_oper
 	.clear_stats = smb2_clear_stats,
 	.print_stats = smb2_print_stats,
 	.is_oplock_break = smb2_is_valid_oplock_break,
+	.handle_cancelled_mid = smb2_handle_cancelled_mid,
+	.handle_cancelled_mid = smb2_handle_cancelled_mid,
 	.downgrade_oplock = smb2_downgrade_oplock,
 	.need_neg = smb2_need_neg,
 	.negotiate = smb2_negotiate,
@@ -1542,6 +1544,8 @@ struct smb_version_operations smb30_oper
 	.print_stats = smb2_print_stats,
 	.dump_share_caps = smb2_dump_share_caps,
 	.is_oplock_break = smb2_is_valid_oplock_break,
+	.handle_cancelled_mid = smb2_handle_cancelled_mid,
+	.handle_cancelled_mid = smb2_handle_cancelled_mid,
 	.downgrade_oplock = smb2_downgrade_oplock,
 	.need_neg = smb2_need_neg,
 	.negotiate = smb2_negotiate,
diff -druNp --no-dereference linux-libre-3.18.51-gnu/fs/cifs/smb2proto.h linux-libre-3.18.52-gnu/fs/cifs/smb2proto.h
--- linux-libre-3.18.51-gnu/fs/cifs/smb2proto.h	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/fs/cifs/smb2proto.h	2017-05-08 01:44:29.000000000 -0400
@@ -47,6 +47,10 @@ extern struct mid_q_entry *smb2_setup_re
 			      struct smb_rqst *rqst);
 extern struct mid_q_entry *smb2_setup_async_request(
 			struct TCP_Server_Info *server, struct smb_rqst *rqst);
+extern struct cifs_ses *smb2_find_smb_ses(struct TCP_Server_Info *server,
+					   __u64 ses_id);
+extern struct cifs_tcon *smb2_find_smb_tcon(struct TCP_Server_Info *server,
+						__u64 ses_id, __u32  tid);
 extern int smb2_calc_signature(struct smb_rqst *rqst,
 				struct TCP_Server_Info *server);
 extern int smb3_calc_signature(struct smb_rqst *rqst,
@@ -157,6 +161,9 @@ extern int SMB2_set_compression(const un
 extern int SMB2_oplock_break(const unsigned int xid, struct cifs_tcon *tcon,
 			     const u64 persistent_fid, const u64 volatile_fid,
 			     const __u8 oplock_level);
+extern int smb2_handle_cancelled_mid(char *buffer,
+					struct TCP_Server_Info *server);
+void smb2_cancelled_close_fid(struct work_struct *work);
 extern int SMB2_QFS_info(const unsigned int xid, struct cifs_tcon *tcon,
 			 u64 persistent_file_id, u64 volatile_file_id,
 			 struct kstatfs *FSData);
diff -druNp --no-dereference linux-libre-3.18.51-gnu/fs/cifs/smb2transport.c linux-libre-3.18.52-gnu/fs/cifs/smb2transport.c
--- linux-libre-3.18.51-gnu/fs/cifs/smb2transport.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/fs/cifs/smb2transport.c	2017-05-08 01:44:29.000000000 -0400
@@ -115,22 +115,68 @@ smb3_crypto_shash_allocate(struct TCP_Se
 }
 
 static struct cifs_ses *
-smb2_find_smb_ses(struct smb2_hdr *smb2hdr, struct TCP_Server_Info *server)
+smb2_find_smb_ses_unlocked(struct TCP_Server_Info *server, __u64 ses_id)
 {
 	struct cifs_ses *ses;
 
-	spin_lock(&cifs_tcp_ses_lock);
 	list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
-		if (ses->Suid != smb2hdr->SessionId)
+		if (ses->Suid != ses_id)
 			continue;
-		spin_unlock(&cifs_tcp_ses_lock);
 		return ses;
 	}
+
+	return NULL;
+}
+
+struct cifs_ses *
+smb2_find_smb_ses(struct TCP_Server_Info *server, __u64 ses_id)
+{
+	struct cifs_ses *ses;
+
+	spin_lock(&cifs_tcp_ses_lock);
+	ses = smb2_find_smb_ses_unlocked(server, ses_id);
 	spin_unlock(&cifs_tcp_ses_lock);
 
+	return ses;
+}
+
+static struct cifs_tcon *
+smb2_find_smb_sess_tcon_unlocked(struct cifs_ses *ses, __u32  tid)
+{
+	struct cifs_tcon *tcon;
+
+	list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {
+		if (tcon->tid != tid)
+			continue;
+		++tcon->tc_count;
+		return tcon;
+	}
+
 	return NULL;
 }
 
+/*
+ * Obtain tcon corresponding to the tid in the given
+ * cifs_ses
+ */
+
+struct cifs_tcon *
+smb2_find_smb_tcon(struct TCP_Server_Info *server, __u64 ses_id, __u32 tid)
+{
+	struct cifs_ses *ses;
+	struct cifs_tcon *tcon;
+
+	spin_lock(&cifs_tcp_ses_lock);
+	ses = smb2_find_smb_ses_unlocked(server, ses_id);
+	if (!ses) {
+		spin_unlock(&cifs_tcp_ses_lock);
+		return NULL;
+	}
+	tcon = smb2_find_smb_sess_tcon_unlocked(ses, tid);
+	spin_unlock(&cifs_tcp_ses_lock);
+
+	return tcon;
+}
 
 int
 smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server)
@@ -143,7 +189,7 @@ smb2_calc_signature(struct smb_rqst *rqs
 	struct smb2_hdr *smb2_pdu = (struct smb2_hdr *)iov[0].iov_base;
 	struct cifs_ses *ses;
 
-	ses = smb2_find_smb_ses(smb2_pdu, server);
+	ses = smb2_find_smb_ses(server, smb2_pdu->SessionId);
 	if (!ses) {
 		cifs_dbg(VFS, "%s: Could not find session\n", __func__);
 		return 0;
@@ -314,7 +360,7 @@ smb3_calc_signature(struct smb_rqst *rqs
 	struct smb2_hdr *smb2_pdu = (struct smb2_hdr *)iov[0].iov_base;
 	struct cifs_ses *ses;
 
-	ses = smb2_find_smb_ses(smb2_pdu, server);
+	ses = smb2_find_smb_ses(server, smb2_pdu->SessionId);
 	if (!ses) {
 		cifs_dbg(VFS, "%s: Could not find session\n", __func__);
 		return 0;
diff -druNp --no-dereference linux-libre-3.18.51-gnu/fs/cifs/transport.c linux-libre-3.18.52-gnu/fs/cifs/transport.c
--- linux-libre-3.18.51-gnu/fs/cifs/transport.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/fs/cifs/transport.c	2017-05-08 01:44:29.000000000 -0400
@@ -784,9 +784,11 @@ SendReceive2(const unsigned int xid, str
 
 	rc = wait_for_response(ses->server, midQ);
 	if (rc != 0) {
+		cifs_dbg(FYI, "Cancelling wait for mid %llu\n",	midQ->mid);
 		send_cancel(ses->server, buf, midQ);
 		spin_lock(&GlobalMid_Lock);
 		if (midQ->mid_state == MID_REQUEST_SUBMITTED) {
+			midQ->mid_flags |= MID_WAIT_CANCELLED;
 			midQ->callback = DeleteMidQEntry;
 			spin_unlock(&GlobalMid_Lock);
 			cifs_small_buf_release(buf);
diff -druNp --no-dereference linux-libre-3.18.51-gnu/fs/ext2/acl.c linux-libre-3.18.52-gnu/fs/ext2/acl.c
--- linux-libre-3.18.51-gnu/fs/ext2/acl.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/fs/ext2/acl.c	2017-05-08 01:44:29.000000000 -0400
@@ -193,15 +193,11 @@ ext2_set_acl(struct inode *inode, struct
 		case ACL_TYPE_ACCESS:
 			name_index = EXT2_XATTR_INDEX_POSIX_ACL_ACCESS;
 			if (acl) {
-				error = posix_acl_equiv_mode(acl, &inode->i_mode);
-				if (error < 0)
+				error = posix_acl_update_mode(inode, &inode->i_mode, &acl);
+				if (error)
 					return error;
-				else {
-					inode->i_ctime = CURRENT_TIME_SEC;
-					mark_inode_dirty(inode);
-					if (error == 0)
-						acl = NULL;
-				}
+				inode->i_ctime = CURRENT_TIME_SEC;
+				mark_inode_dirty(inode);
 			}
 			break;
 
diff -druNp --no-dereference linux-libre-3.18.51-gnu/fs/ext4/acl.c linux-libre-3.18.52-gnu/fs/ext4/acl.c
--- linux-libre-3.18.51-gnu/fs/ext4/acl.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/fs/ext4/acl.c	2017-05-08 01:44:29.000000000 -0400
@@ -201,15 +201,11 @@ __ext4_set_acl(handle_t *handle, struct
 	case ACL_TYPE_ACCESS:
 		name_index = EXT4_XATTR_INDEX_POSIX_ACL_ACCESS;
 		if (acl) {
-			error = posix_acl_equiv_mode(acl, &inode->i_mode);
-			if (error < 0)
+			error = posix_acl_update_mode(inode, &inode->i_mode, &acl);
+			if (error)
 				return error;
-			else {
-				inode->i_ctime = ext4_current_time(inode);
-				ext4_mark_inode_dirty(handle, inode);
-				if (error == 0)
-					acl = NULL;
-			}
+			inode->i_ctime = ext4_current_time(inode);
+			ext4_mark_inode_dirty(handle, inode);
 		}
 		break;
 
diff -druNp --no-dereference linux-libre-3.18.51-gnu/fs/ext4/xattr.c linux-libre-3.18.52-gnu/fs/ext4/xattr.c
--- linux-libre-3.18.51-gnu/fs/ext4/xattr.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/fs/ext4/xattr.c	2017-05-08 01:44:29.000000000 -0400
@@ -233,6 +233,27 @@ ext4_xattr_check_block(struct inode *ino
 	return error;
 }
 
+static int
+__xattr_check_inode(struct inode *inode, struct ext4_xattr_ibody_header *header,
+			 void *end, const char *function, unsigned int line)
+{
+	struct ext4_xattr_entry *entry = IFIRST(header);
+	int error = -EIO;
+
+	if (((void *) header >= end) ||
+	    (header->h_magic != le32_to_cpu(EXT4_XATTR_MAGIC)))
+		goto errout;
+	error = ext4_xattr_check_names(entry, end, entry);
+errout:
+	if (error)
+		__ext4_error_inode(inode, function, line, 0,
+				   "corrupted in-inode xattr");
+	return error;
+}
+
+#define xattr_check_inode(inode, header, end) \
+	__xattr_check_inode((inode), (header), (end), __func__, __LINE__)
+
 static inline int
 ext4_xattr_check_entry(struct ext4_xattr_entry *entry, size_t size)
 {
@@ -344,7 +365,7 @@ ext4_xattr_ibody_get(struct inode *inode
 	header = IHDR(inode, raw_inode);
 	entry = IFIRST(header);
 	end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size;
-	error = ext4_xattr_check_names(entry, end, entry);
+	error = xattr_check_inode(inode, header, end);
 	if (error)
 		goto cleanup;
 	error = ext4_xattr_find_entry(&entry, name_index, name,
@@ -476,7 +497,7 @@ ext4_xattr_ibody_list(struct dentry *den
 	raw_inode = ext4_raw_inode(&iloc);
 	header = IHDR(inode, raw_inode);
 	end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size;
-	error = ext4_xattr_check_names(IFIRST(header), end, IFIRST(header));
+	error = xattr_check_inode(inode, header, end);
 	if (error)
 		goto cleanup;
 	error = ext4_xattr_list_entries(dentry, IFIRST(header),
@@ -993,8 +1014,7 @@ int ext4_xattr_ibody_find(struct inode *
 	is->s.here = is->s.first;
 	is->s.end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size;
 	if (ext4_test_inode_state(inode, EXT4_STATE_XATTR)) {
-		error = ext4_xattr_check_names(IFIRST(header), is->s.end,
-					       IFIRST(header));
+		error = xattr_check_inode(inode, header, is->s.end);
 		if (error)
 			return error;
 		/* Find the named attribute. */
@@ -1291,6 +1311,10 @@ retry:
 	last = entry;
 	total_ino = sizeof(struct ext4_xattr_ibody_header);
 
+	error = xattr_check_inode(inode, header, end);
+	if (error)
+		goto cleanup;
+
 	free = ext4_xattr_free_space(last, &min_offs, base, &total_ino);
 	if (free >= new_extra_isize) {
 		entry = IFIRST(header);
diff -druNp --no-dereference linux-libre-3.18.51-gnu/fs/f2fs/acl.c linux-libre-3.18.52-gnu/fs/f2fs/acl.c
--- linux-libre-3.18.51-gnu/fs/f2fs/acl.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/fs/f2fs/acl.c	2017-05-08 01:44:29.000000000 -0400
@@ -207,12 +207,10 @@ static int __f2fs_set_acl(struct inode *
 	case ACL_TYPE_ACCESS:
 		name_index = F2FS_XATTR_INDEX_POSIX_ACL_ACCESS;
 		if (acl) {
-			error = posix_acl_equiv_mode(acl, &inode->i_mode);
-			if (error < 0)
+			error = posix_acl_update_mode(inode, &inode->i_mode, &acl);
+			if (error)
 				return error;
 			set_acl_inode(fi, inode->i_mode);
-			if (error == 0)
-				acl = NULL;
 		}
 		break;
 
diff -druNp --no-dereference linux-libre-3.18.51-gnu/fs/f2fs/super.c linux-libre-3.18.52-gnu/fs/f2fs/super.c
--- linux-libre-3.18.51-gnu/fs/f2fs/super.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/fs/f2fs/super.c	2017-05-08 01:44:29.000000000 -0400
@@ -772,6 +772,79 @@ static loff_t max_file_size(unsigned bit
 	return result;
 }
 
+static inline bool sanity_check_area_boundary(struct super_block *sb,
+					struct f2fs_super_block *raw_super)
+{
+	u32 segment0_blkaddr = le32_to_cpu(raw_super->segment0_blkaddr);
+	u32 cp_blkaddr = le32_to_cpu(raw_super->cp_blkaddr);
+	u32 sit_blkaddr = le32_to_cpu(raw_super->sit_blkaddr);
+	u32 nat_blkaddr = le32_to_cpu(raw_super->nat_blkaddr);
+	u32 ssa_blkaddr = le32_to_cpu(raw_super->ssa_blkaddr);
+	u32 main_blkaddr = le32_to_cpu(raw_super->main_blkaddr);
+	u32 segment_count_ckpt = le32_to_cpu(raw_super->segment_count_ckpt);
+	u32 segment_count_sit = le32_to_cpu(raw_super->segment_count_sit);
+	u32 segment_count_nat = le32_to_cpu(raw_super->segment_count_nat);
+	u32 segment_count_ssa = le32_to_cpu(raw_super->segment_count_ssa);
+	u32 segment_count_main = le32_to_cpu(raw_super->segment_count_main);
+	u32 segment_count = le32_to_cpu(raw_super->segment_count);
+	u32 log_blocks_per_seg = le32_to_cpu(raw_super->log_blocks_per_seg);
+
+	if (segment0_blkaddr != cp_blkaddr) {
+		f2fs_msg(sb, KERN_INFO,
+			"Mismatch start address, segment0(%u) cp_blkaddr(%u)",
+			segment0_blkaddr, cp_blkaddr);
+		return true;
+	}
+
+	if (cp_blkaddr + (segment_count_ckpt << log_blocks_per_seg) !=
+							sit_blkaddr) {
+		f2fs_msg(sb, KERN_INFO,
+			"Wrong CP boundary, start(%u) end(%u) blocks(%u)",
+			cp_blkaddr, sit_blkaddr,
+			segment_count_ckpt << log_blocks_per_seg);
+		return true;
+	}
+
+	if (sit_blkaddr + (segment_count_sit << log_blocks_per_seg) !=
+							nat_blkaddr) {
+		f2fs_msg(sb, KERN_INFO,
+			"Wrong SIT boundary, start(%u) end(%u) blocks(%u)",
+			sit_blkaddr, nat_blkaddr,
+			segment_count_sit << log_blocks_per_seg);
+		return true;
+	}
+
+	if (nat_blkaddr + (segment_count_nat << log_blocks_per_seg) !=
+							ssa_blkaddr) {
+		f2fs_msg(sb, KERN_INFO,
+			"Wrong NAT boundary, start(%u) end(%u) blocks(%u)",
+			nat_blkaddr, ssa_blkaddr,
+			segment_count_nat << log_blocks_per_seg);
+		return true;
+	}
+
+	if (ssa_blkaddr + (segment_count_ssa << log_blocks_per_seg) !=
+							main_blkaddr) {
+		f2fs_msg(sb, KERN_INFO,
+			"Wrong SSA boundary, start(%u) end(%u) blocks(%u)",
+			ssa_blkaddr, main_blkaddr,
+			segment_count_ssa << log_blocks_per_seg);
+		return true;
+	}
+
+	if (main_blkaddr + (segment_count_main << log_blocks_per_seg) !=
+		segment0_blkaddr + (segment_count << log_blocks_per_seg)) {
+		f2fs_msg(sb, KERN_INFO,
+			"Wrong MAIN_AREA boundary, start(%u) end(%u) blocks(%u)",
+			main_blkaddr,
+			segment0_blkaddr + (segment_count << log_blocks_per_seg),
+			segment_count_main << log_blocks_per_seg);
+		return true;
+	}
+
+	return false;
+}
+
 static int sanity_check_raw_super(struct super_block *sb,
 			struct f2fs_super_block *raw_super)
 {
@@ -801,6 +874,14 @@ static int sanity_check_raw_super(struct
 		return 1;
 	}
 
+	/* check log blocks per segment */
+	if (le32_to_cpu(raw_super->log_blocks_per_seg) != 9) {
+		f2fs_msg(sb, KERN_INFO,
+			"Invalid log blocks per segment (%u)\n",
+			le32_to_cpu(raw_super->log_blocks_per_seg));
+		return 1;
+	}
+
 	/* Currently, support 512/1024/2048/4096 bytes sector size */
 	if (le32_to_cpu(raw_super->log_sectorsize) >
 				F2FS_MAX_LOG_SECTOR_SIZE ||
@@ -819,6 +900,23 @@ static int sanity_check_raw_super(struct
 			le32_to_cpu(raw_super->log_sectorsize));
 		return 1;
 	}
+
+	/* check reserved ino info */
+	if (le32_to_cpu(raw_super->node_ino) != 1 ||
+		le32_to_cpu(raw_super->meta_ino) != 2 ||
+		le32_to_cpu(raw_super->root_ino) != 3) {
+		f2fs_msg(sb, KERN_INFO,
+			"Invalid Fs Meta Ino: node(%u) meta(%u) root(%u)",
+			le32_to_cpu(raw_super->node_ino),
+			le32_to_cpu(raw_super->meta_ino),
+			le32_to_cpu(raw_super->root_ino));
+		return 1;
+	}
+
+	/* check CP/SIT/NAT/SSA/MAIN_AREA area boundary */
+	if (sanity_check_area_boundary(sb, raw_super))
+		return 1;
+
 	return 0;
 }
 
diff -druNp --no-dereference linux-libre-3.18.51-gnu/fs/gfs2/acl.c linux-libre-3.18.52-gnu/fs/gfs2/acl.c
--- linux-libre-3.18.51-gnu/fs/gfs2/acl.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/fs/gfs2/acl.c	2017-05-08 01:44:29.000000000 -0400
@@ -79,17 +79,11 @@ int gfs2_set_acl(struct inode *inode, st
 	if (type == ACL_TYPE_ACCESS) {
 		umode_t mode = inode->i_mode;
 
-		error = posix_acl_equiv_mode(acl, &mode);
-		if (error < 0)
+		error = posix_acl_update_mode(inode, &inode->i_mode, &acl);
+		if (error)
 			return error;
-
-		if (error == 0)
-			acl = NULL;
-
-		if (mode != inode->i_mode) {
-			inode->i_mode = mode;
+		if (mode != inode->i_mode)
 			mark_inode_dirty(inode);
-		}
 	}
 
 	if (acl) {
diff -druNp --no-dereference linux-libre-3.18.51-gnu/fs/gfs2/dir.c linux-libre-3.18.52-gnu/fs/gfs2/dir.c
--- linux-libre-3.18.51-gnu/fs/gfs2/dir.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/fs/gfs2/dir.c	2017-05-08 01:44:29.000000000 -0400
@@ -749,12 +749,15 @@ static int get_leaf_nr(struct gfs2_inode
 		       u64 *leaf_out)
 {
 	__be64 *hash;
+	int error;
 
 	hash = gfs2_dir_get_hash_table(dip);
-	if (IS_ERR(hash))
-		return PTR_ERR(hash);
-	*leaf_out = be64_to_cpu(*(hash + index));
-	return 0;
+	error = PTR_ERR_OR_ZERO(hash);
+
+	if (!error)
+		*leaf_out = be64_to_cpu(*(hash + index));
+
+	return error;
 }
 
 static int get_first_leaf(struct gfs2_inode *dip, u32 index,
@@ -764,7 +767,7 @@ static int get_first_leaf(struct gfs2_in
 	int error;
 
 	error = get_leaf_nr(dip, index, &leaf_no);
-	if (!IS_ERR_VALUE(error))
+	if (!error)
 		error = get_leaf(dip, leaf_no, bh_out);
 
 	return error;
@@ -980,7 +983,7 @@ static int dir_split_leaf(struct inode *
 
 	index = name->hash >> (32 - dip->i_depth);
 	error = get_leaf_nr(dip, index, &leaf_no);
-	if (IS_ERR_VALUE(error))
+	if (error)
 		return error;
 
 	/*  Get the old leaf block  */
diff -druNp --no-dereference linux-libre-3.18.51-gnu/fs/hfsplus/posix_acl.c linux-libre-3.18.52-gnu/fs/hfsplus/posix_acl.c
--- linux-libre-3.18.51-gnu/fs/hfsplus/posix_acl.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/fs/hfsplus/posix_acl.c	2017-05-08 01:44:29.000000000 -0400
@@ -68,8 +68,8 @@ int hfsplus_set_posix_acl(struct inode *
 	case ACL_TYPE_ACCESS:
 		xattr_name = POSIX_ACL_XATTR_ACCESS;
 		if (acl) {
-			err = posix_acl_equiv_mode(acl, &inode->i_mode);
-			if (err < 0)
+			err = posix_acl_update_mode(inode, &inode->i_mode, &acl);
+			if (err)
 				return err;
 		}
 		err = 0;
diff -druNp --no-dereference linux-libre-3.18.51-gnu/fs/jffs2/acl.c linux-libre-3.18.52-gnu/fs/jffs2/acl.c
--- linux-libre-3.18.51-gnu/fs/jffs2/acl.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/fs/jffs2/acl.c	2017-05-08 01:44:29.000000000 -0400
@@ -235,9 +235,10 @@ int jffs2_set_acl(struct inode *inode, s
 	case ACL_TYPE_ACCESS:
 		xprefix = JFFS2_XPREFIX_ACL_ACCESS;
 		if (acl) {
-			umode_t mode = inode->i_mode;
-			rc = posix_acl_equiv_mode(acl, &mode);
-			if (rc < 0)
+			umode_t mode;
+
+			rc = posix_acl_update_mode(inode, &mode, &acl);
+			if (rc)
 				return rc;
 			if (inode->i_mode != mode) {
 				struct iattr attr;
@@ -249,8 +250,6 @@ int jffs2_set_acl(struct inode *inode, s
 				if (rc < 0)
 					return rc;
 			}
-			if (rc == 0)
-				acl = NULL;
 		}
 		break;
 	case ACL_TYPE_DEFAULT:
diff -druNp --no-dereference linux-libre-3.18.51-gnu/fs/jfs/acl.c linux-libre-3.18.52-gnu/fs/jfs/acl.c
--- linux-libre-3.18.51-gnu/fs/jfs/acl.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/fs/jfs/acl.c	2017-05-08 01:44:29.000000000 -0400
@@ -84,13 +84,11 @@ static int __jfs_set_acl(tid_t tid, stru
 	case ACL_TYPE_ACCESS:
 		ea_name = POSIX_ACL_XATTR_ACCESS;
 		if (acl) {
-			rc = posix_acl_equiv_mode(acl, &inode->i_mode);
-			if (rc < 0)
+			rc = posix_acl_update_mode(inode, &inode->i_mode, &acl);
+			if (rc)
 				return rc;
 			inode->i_ctime = CURRENT_TIME;
 			mark_inode_dirty(inode);
-			if (rc == 0)
-				acl = NULL;
 		}
 		break;
 	case ACL_TYPE_DEFAULT:
diff -druNp --no-dereference linux-libre-3.18.51-gnu/fs/nfsd/nfssvc.c linux-libre-3.18.52-gnu/fs/nfsd/nfssvc.c
--- linux-libre-3.18.51-gnu/fs/nfsd/nfssvc.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/fs/nfsd/nfssvc.c	2017-05-08 01:44:29.000000000 -0400
@@ -646,6 +646,37 @@ static __be32 map_new_errors(u32 vers, _
 	return nfserr;
 }
 
+/*
+ * A write procedure can have a large argument, and a read procedure can
+ * have a large reply, but no NFSv2 or NFSv3 procedure has argument and
+ * reply that can both be larger than a page.  The xdr code has taken
+ * advantage of this assumption to be a sloppy about bounds checking in
+ * some cases.  Pending a rewrite of the NFSv2/v3 xdr code to fix that
+ * problem, we enforce these assumptions here:
+ */
+static bool nfs_request_too_big(struct svc_rqst *rqstp,
+				struct svc_procedure *proc)
+{
+	/*
+	 * The ACL code has more careful bounds-checking and is not
+	 * susceptible to this problem:
+	 */
+	if (rqstp->rq_prog != NFS_PROGRAM)
+		return false;
+	/*
+	 * Ditto NFSv4 (which can in theory have argument and reply both
+	 * more than a page):
+	 */
+	if (rqstp->rq_vers >= 4)
+		return false;
+	/* The reply will be small, we're OK: */
+	if (proc->pc_xdrressize > 0 &&
+	    proc->pc_xdrressize < XDR_QUADLEN(PAGE_SIZE))
+		return false;
+
+	return rqstp->rq_arg.len > PAGE_SIZE;
+}
+
 int
 nfsd_dispatch(struct svc_rqst *rqstp, __be32 *statp)
 {
@@ -658,6 +689,11 @@ nfsd_dispatch(struct svc_rqst *rqstp, __
 				rqstp->rq_vers, rqstp->rq_proc);
 	proc = rqstp->rq_procinfo;
 
+	if (nfs_request_too_big(rqstp, proc)) {
+		dprintk("nfsd: NFSv%d argument too large\n", rqstp->rq_vers);
+		*statp = rpc_garbage_args;
+		return 1;
+	}
 	/*
 	 * Give the xdr decoder a chance to change this if it wants
 	 * (necessary in the NFSv4.0 compound case)
diff -druNp --no-dereference linux-libre-3.18.51-gnu/fs/ocfs2/acl.c linux-libre-3.18.52-gnu/fs/ocfs2/acl.c
--- linux-libre-3.18.51-gnu/fs/ocfs2/acl.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/fs/ocfs2/acl.c	2017-05-08 01:44:29.000000000 -0400
@@ -241,20 +241,16 @@ int ocfs2_set_acl(handle_t *handle,
 	case ACL_TYPE_ACCESS:
 		name_index = OCFS2_XATTR_INDEX_POSIX_ACL_ACCESS;
 		if (acl) {
-			umode_t mode = inode->i_mode;
-			ret = posix_acl_equiv_mode(acl, &mode);
-			if (ret < 0)
-				return ret;
-			else {
-				if (ret == 0)
-					acl = NULL;
+			umode_t mode;
 
-				ret = ocfs2_acl_set_mode(inode, di_bh,
-							 handle, mode);
-				if (ret)
-					return ret;
+			ret = posix_acl_update_mode(inode, &mode, &acl);
+			if (ret)
+				return ret;
 
-			}
+			ret = ocfs2_acl_set_mode(inode, di_bh,
+						 handle, mode);
+			if (ret)
+				return ret;
 		}
 		break;
 	case ACL_TYPE_DEFAULT:
diff -druNp --no-dereference linux-libre-3.18.51-gnu/fs/posix_acl.c linux-libre-3.18.52-gnu/fs/posix_acl.c
--- linux-libre-3.18.51-gnu/fs/posix_acl.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/fs/posix_acl.c	2017-05-08 01:44:29.000000000 -0400
@@ -594,6 +594,37 @@ no_acl:
 }
 EXPORT_SYMBOL_GPL(posix_acl_create);
 
+/**
+ * posix_acl_update_mode  -  update mode in set_acl
+ *
+ * Update the file mode when setting an ACL: compute the new file permission
+ * bits based on the ACL.  In addition, if the ACL is equivalent to the new
+ * file mode, set *acl to NULL to indicate that no ACL should be set.
+ *
+ * As with chmod, clear the setgit bit if the caller is not in the owning group
+ * or capable of CAP_FSETID (see inode_change_ok).
+ *
+ * Called from set_acl inode operations.
+ */
+int posix_acl_update_mode(struct inode *inode, umode_t *mode_p,
+			  struct posix_acl **acl)
+{
+	umode_t mode = inode->i_mode;
+	int error;
+
+	error = posix_acl_equiv_mode(*acl, &mode);
+	if (error < 0)
+		return error;
+	if (error == 0)
+		*acl = NULL;
+	if (!in_group_p(inode->i_gid) &&
+	    !capable_wrt_inode_uidgid(inode, CAP_FSETID))
+		mode &= ~S_ISGID;
+	*mode_p = mode;
+	return 0;
+}
+EXPORT_SYMBOL(posix_acl_update_mode);
+
 /*
  * Fix up the uids and gids in posix acl extended attributes in place.
  */
diff -druNp --no-dereference linux-libre-3.18.51-gnu/fs/reiserfs/xattr_acl.c linux-libre-3.18.52-gnu/fs/reiserfs/xattr_acl.c
--- linux-libre-3.18.51-gnu/fs/reiserfs/xattr_acl.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/fs/reiserfs/xattr_acl.c	2017-05-08 01:44:29.000000000 -0400
@@ -246,13 +246,9 @@ __reiserfs_set_acl(struct reiserfs_trans
 	case ACL_TYPE_ACCESS:
 		name = POSIX_ACL_XATTR_ACCESS;
 		if (acl) {
-			error = posix_acl_equiv_mode(acl, &inode->i_mode);
-			if (error < 0)
+			error = posix_acl_update_mode(inode, &inode->i_mode, &acl);
+			if (error)
 				return error;
-			else {
-				if (error == 0)
-					acl = NULL;
-			}
 		}
 		break;
 	case ACL_TYPE_DEFAULT:
diff -druNp --no-dereference linux-libre-3.18.51-gnu/fs/timerfd.c linux-libre-3.18.52-gnu/fs/timerfd.c
--- linux-libre-3.18.51-gnu/fs/timerfd.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/fs/timerfd.c	2017-05-08 01:44:29.000000000 -0400
@@ -40,6 +40,7 @@ struct timerfd_ctx {
 	short unsigned settime_flags;	/* to show in fdinfo */
 	struct rcu_head rcu;
 	struct list_head clist;
+	spinlock_t cancel_lock;
 	bool might_cancel;
 };
 
@@ -112,7 +113,7 @@ void timerfd_clock_was_set(void)
 	rcu_read_unlock();
 }
 
-static void timerfd_remove_cancel(struct timerfd_ctx *ctx)
+static void __timerfd_remove_cancel(struct timerfd_ctx *ctx)
 {
 	if (ctx->might_cancel) {
 		ctx->might_cancel = false;
@@ -122,6 +123,13 @@ static void timerfd_remove_cancel(struct
 	}
 }
 
+static void timerfd_remove_cancel(struct timerfd_ctx *ctx)
+{
+	spin_lock(&ctx->cancel_lock);
+	__timerfd_remove_cancel(ctx);
+	spin_unlock(&ctx->cancel_lock);
+}
+
 static bool timerfd_canceled(struct timerfd_ctx *ctx)
 {
 	if (!ctx->might_cancel || ctx->moffs.tv64 != KTIME_MAX)
@@ -132,6 +140,7 @@ static bool timerfd_canceled(struct time
 
 static void timerfd_setup_cancel(struct timerfd_ctx *ctx, int flags)
 {
+	spin_lock(&ctx->cancel_lock);
 	if ((ctx->clockid == CLOCK_REALTIME ||
 	     ctx->clockid == CLOCK_REALTIME_ALARM) &&
 	    (flags & TFD_TIMER_ABSTIME) && (flags & TFD_TIMER_CANCEL_ON_SET)) {
@@ -141,9 +150,10 @@ static void timerfd_setup_cancel(struct
 			list_add_rcu(&ctx->clist, &cancel_list);
 			spin_unlock(&cancel_lock);
 		}
-	} else if (ctx->might_cancel) {
-		timerfd_remove_cancel(ctx);
+	} else {
+		__timerfd_remove_cancel(ctx);
 	}
+	spin_unlock(&ctx->cancel_lock);
 }
 
 static ktime_t timerfd_get_remaining(struct timerfd_ctx *ctx)
@@ -394,6 +404,7 @@ SYSCALL_DEFINE2(timerfd_create, int, clo
 		return -ENOMEM;
 
 	init_waitqueue_head(&ctx->wqh);
+	spin_lock_init(&ctx->cancel_lock);
 	ctx->clockid = clockid;
 
 	if (isalarm(ctx))
diff -druNp --no-dereference linux-libre-3.18.51-gnu/fs/xfs/xfs_acl.c linux-libre-3.18.52-gnu/fs/xfs/xfs_acl.c
--- linux-libre-3.18.51-gnu/fs/xfs/xfs_acl.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/fs/xfs/xfs_acl.c	2017-05-08 01:44:29.000000000 -0400
@@ -286,16 +286,11 @@ xfs_set_acl(struct inode *inode, struct
 		return error;
 
 	if (type == ACL_TYPE_ACCESS) {
-		umode_t mode = inode->i_mode;
-		error = posix_acl_equiv_mode(acl, &mode);
-
-		if (error <= 0) {
-			acl = NULL;
-
-			if (error < 0)
-				return error;
-		}
+		umode_t mode;
 
+		error = posix_acl_update_mode(inode, &mode, &acl);
+		if (error)
+			return error;
 		error = xfs_set_mode(inode, mode);
 		if (error)
 			return error;
diff -druNp --no-dereference linux-libre-3.18.51-gnu/include/linux/capability.h linux-libre-3.18.52-gnu/include/linux/capability.h
--- linux-libre-3.18.51-gnu/include/linux/capability.h	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/include/linux/capability.h	2017-05-08 01:44:29.000000000 -0400
@@ -40,8 +40,6 @@ struct inode;
 struct dentry;
 struct user_namespace;
 
-struct user_namespace *current_user_ns(void);
-
 extern const kernel_cap_t __cap_empty_set;
 extern const kernel_cap_t __cap_init_eff_set;
 
diff -druNp --no-dereference linux-libre-3.18.51-gnu/include/linux/cpumask.h linux-libre-3.18.52-gnu/include/linux/cpumask.h
--- linux-libre-3.18.51-gnu/include/linux/cpumask.h	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/include/linux/cpumask.h	2017-05-08 01:44:29.000000000 -0400
@@ -142,10 +142,8 @@ static inline unsigned int cpumask_any_b
 	return 1;
 }
 
-static inline int cpumask_set_cpu_local_first(int i, int numa_node, cpumask_t *dstp)
+static inline unsigned int cpumask_local_spread(unsigned int i, int node)
 {
-	set_bit(0, cpumask_bits(dstp));
-
 	return 0;
 }
 
@@ -199,7 +197,7 @@ static inline unsigned int cpumask_next_
 
 int cpumask_next_and(int n, const struct cpumask *, const struct cpumask *);
 int cpumask_any_but(const struct cpumask *mask, unsigned int cpu);
-int cpumask_set_cpu_local_first(int i, int numa_node, cpumask_t *dstp);
+unsigned int cpumask_local_spread(unsigned int i, int node);
 
 /**
  * for_each_cpu - iterate over every cpu in a mask
diff -druNp --no-dereference linux-libre-3.18.51-gnu/include/linux/cred.h linux-libre-3.18.52-gnu/include/linux/cred.h
--- linux-libre-3.18.51-gnu/include/linux/cred.h	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/include/linux/cred.h	2017-05-08 01:44:29.000000000 -0400
@@ -354,7 +354,10 @@ extern struct user_namespace init_user_n
 #ifdef CONFIG_USER_NS
 #define current_user_ns()	(current_cred_xxx(user_ns))
 #else
-#define current_user_ns()	(&init_user_ns)
+static inline struct user_namespace *current_user_ns(void)
+{
+	return &init_user_ns;
+}
 #endif
 
 
diff -druNp --no-dereference linux-libre-3.18.51-gnu/include/linux/mtd/map.h linux-libre-3.18.52-gnu/include/linux/mtd/map.h
--- linux-libre-3.18.51-gnu/include/linux/mtd/map.h	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/include/linux/mtd/map.h	2017-05-08 01:44:29.000000000 -0400
@@ -122,18 +122,13 @@
 #endif
 
 #ifdef CONFIG_MTD_MAP_BANK_WIDTH_32
-# ifdef map_bankwidth
-#  undef map_bankwidth
-#  define map_bankwidth(map) ((map)->bankwidth)
-#  undef map_bankwidth_is_large
-#  define map_bankwidth_is_large(map) (map_bankwidth(map) > BITS_PER_LONG/8)
-#  undef map_words
-#  define map_words(map) map_calc_words(map)
-# else
-#  define map_bankwidth(map) 32
-#  define map_bankwidth_is_large(map) (1)
-#  define map_words(map) map_calc_words(map)
-# endif
+/* always use indirect access for 256-bit to preserve kernel stack */
+# undef map_bankwidth
+# define map_bankwidth(map) ((map)->bankwidth)
+# undef map_bankwidth_is_large
+# define map_bankwidth_is_large(map) (map_bankwidth(map) > BITS_PER_LONG/8)
+# undef map_words
+# define map_words(map) map_calc_words(map)
 #define map_bankwidth_is_32(map) (map_bankwidth(map) == 32)
 #undef MAX_MAP_BANKWIDTH
 #define MAX_MAP_BANKWIDTH 32
diff -druNp --no-dereference linux-libre-3.18.51-gnu/include/linux/perf_event.h linux-libre-3.18.52-gnu/include/linux/perf_event.h
--- linux-libre-3.18.51-gnu/include/linux/perf_event.h	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/include/linux/perf_event.h	2017-05-08 01:44:29.000000000 -0400
@@ -455,11 +455,6 @@ struct perf_event {
 #endif /* CONFIG_PERF_EVENTS */
 };
 
-enum perf_event_context_type {
-	task_context,
-	cpu_context,
-};
-
 /**
  * struct perf_event_context - event context structure
  *
@@ -467,7 +462,6 @@ enum perf_event_context_type {
  */
 struct perf_event_context {
 	struct pmu			*pmu;
-	enum perf_event_context_type	type;
 	/*
 	 * Protect the states of the events in the list,
 	 * nr_active, and the list:
diff -druNp --no-dereference linux-libre-3.18.51-gnu/include/linux/posix_acl.h linux-libre-3.18.52-gnu/include/linux/posix_acl.h
--- linux-libre-3.18.51-gnu/include/linux/posix_acl.h	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/include/linux/posix_acl.h	2017-05-08 01:44:29.000000000 -0400
@@ -95,6 +95,7 @@ extern int set_posix_acl(struct inode *,
 extern int posix_acl_chmod(struct inode *, umode_t);
 extern int posix_acl_create(struct inode *, umode_t *, struct posix_acl **,
 		struct posix_acl **);
+extern int posix_acl_update_mode(struct inode *, umode_t *, struct posix_acl **);
 
 extern int simple_set_acl(struct inode *, struct posix_acl *, int);
 extern int simple_acl_create(struct inode *, struct inode *);
diff -druNp --no-dereference linux-libre-3.18.51-gnu/kernel/events/core.c linux-libre-3.18.52-gnu/kernel/events/core.c
--- linux-libre-3.18.51-gnu/kernel/events/core.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/kernel/events/core.c	2017-05-08 01:44:29.000000000 -0400
@@ -6803,7 +6803,6 @@ skip_type:
 		__perf_event_init_context(&cpuctx->ctx);
 		lockdep_set_class(&cpuctx->ctx.mutex, &cpuctx_mutex);
 		lockdep_set_class(&cpuctx->ctx.lock, &cpuctx_lock);
-		cpuctx->ctx.type = cpu_context;
 		cpuctx->ctx.pmu = pmu;
 
 		__perf_cpu_hrtimer_init(cpuctx, cpu);
@@ -7445,7 +7444,19 @@ SYSCALL_DEFINE5(perf_event_open,
 		 * task or CPU context:
 		 */
 		if (move_group) {
-			if (group_leader->ctx->type != ctx->type)
+			/*
+			 * Make sure we're both on the same task, or both
+			 * per-cpu events.
+			 */
+			if (group_leader->ctx->task != ctx->task)
+				goto err_context;
+
+			/*
+			 * Make sure we're both events for the same CPU;
+			 * grouping events for different CPUs is broken; since
+			 * you can never concurrently schedule them anyhow.
+			 */
+			if (group_leader->cpu != event->cpu)
 				goto err_context;
 		} else {
 			if (group_leader->ctx != ctx)
diff -druNp --no-dereference linux-libre-3.18.51-gnu/lib/cpumask.c linux-libre-3.18.52-gnu/lib/cpumask.c
--- linux-libre-3.18.51-gnu/lib/cpumask.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/lib/cpumask.c	2017-05-08 01:44:29.000000000 -0400
@@ -166,64 +166,42 @@ void __init free_bootmem_cpumask_var(cpu
 #endif
 
 /**
- * cpumask_set_cpu_local_first - set i'th cpu with local numa cpu's first
- *
+ * cpumask_local_spread - select the i'th cpu with local numa cpu's first
  * @i: index number
- * @numa_node: local numa_node
- * @dstp: cpumask with the relevant cpu bit set according to the policy
+ * @node: local numa_node
  *
- * This function sets the cpumask according to a numa aware policy.
- * cpumask could be used as an affinity hint for the IRQ related to a
- * queue. When the policy is to spread queues across cores - local cores
- * first.
+ * This function selects an online CPU according to a numa aware policy;
+ * local cpus are returned first, followed by non-local ones, then it
+ * wraps around.
  *
- * Returns 0 on success, -ENOMEM for no memory, and -EAGAIN when failed to set
- * the cpu bit and need to re-call the function.
+ * It's not very efficient, but useful for setup.
  */
-int cpumask_set_cpu_local_first(int i, int numa_node, cpumask_t *dstp)
+unsigned int cpumask_local_spread(unsigned int i, int node)
 {
-	cpumask_var_t mask;
 	int cpu;
-	int ret = 0;
-
-	if (!zalloc_cpumask_var(&mask, GFP_KERNEL))
-		return -ENOMEM;
 
+	/* Wrap: we always want a cpu. */
 	i %= num_online_cpus();
 
-	if (numa_node == -1 || !cpumask_of_node(numa_node)) {
-		/* Use all online cpu's for non numa aware system */
-		cpumask_copy(mask, cpu_online_mask);
+	if (node == -1) {
+		for_each_cpu(cpu, cpu_online_mask)
+			if (i-- == 0)
+				return cpu;
 	} else {
-		int n;
-
-		cpumask_and(mask,
-			    cpumask_of_node(numa_node), cpu_online_mask);
+		/* NUMA first. */
+		for_each_cpu_and(cpu, cpumask_of_node(node), cpu_online_mask)
+			if (i-- == 0)
+				return cpu;
 
-		n = cpumask_weight(mask);
-		if (i >= n) {
-			i -= n;
+		for_each_cpu(cpu, cpu_online_mask) {
+			/* Skip NUMA nodes, done above. */
+			if (cpumask_test_cpu(cpu, cpumask_of_node(node)))
+				continue;
 
-			/* If index > number of local cpu's, mask out local
-			 * cpu's
-			 */
-			cpumask_andnot(mask, cpu_online_mask, mask);
+			if (i-- == 0)
+				return cpu;
 		}
 	}
-
-	for_each_cpu(cpu, mask) {
-		if (--i < 0)
-			goto out;
-	}
-
-	ret = -EAGAIN;
-
-out:
-	free_cpumask_var(mask);
-
-	if (!ret)
-		cpumask_set_cpu(cpu, dstp);
-
-	return ret;
+	BUG();
 }
-EXPORT_SYMBOL(cpumask_set_cpu_local_first);
+EXPORT_SYMBOL(cpumask_local_spread);
diff -druNp --no-dereference linux-libre-3.18.51-gnu/Makefile linux-libre-3.18.52-gnu/Makefile
--- linux-libre-3.18.51-gnu/Makefile	2017-04-30 00:51:45.000000000 -0400
+++ linux-libre-3.18.52-gnu/Makefile	2017-05-08 02:47:54.000000000 -0400
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 18
-SUBLEVEL = 51
+SUBLEVEL = 52
 EXTRAVERSION =-gnu
 NAME = Diseased Newt
 
diff -druNp --no-dereference linux-libre-3.18.51-gnu/mm/cma.c linux-libre-3.18.52-gnu/mm/cma.c
--- linux-libre-3.18.51-gnu/mm/cma.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/mm/cma.c	2017-05-08 01:44:29.000000000 -0400
@@ -168,7 +168,8 @@ int __init cma_init_reserved_mem(phys_ad
 		return -EINVAL;
 
 	/* ensure minimal alignment requied by mm core */
-	alignment = PAGE_SIZE << max(MAX_ORDER - 1, pageblock_order);
+	alignment = PAGE_SIZE <<
+			max_t(unsigned long, MAX_ORDER - 1, pageblock_order);
 
 	/* alignment should be aligned with order_per_bit */
 	if (!IS_ALIGNED(alignment >> PAGE_SHIFT, 1 << order_per_bit))
@@ -250,8 +251,8 @@ int __init cma_declare_contiguous(phys_a
 	 * migratetype page by page allocator's buddy algorithm. In the case,
 	 * you couldn't get a contiguous memory, which is not what we want.
 	 */
-	alignment = max(alignment,
-		(phys_addr_t)PAGE_SIZE << max(MAX_ORDER - 1, pageblock_order));
+	alignment = max(alignment,  (phys_addr_t)PAGE_SIZE <<
+			  max_t(unsigned long, MAX_ORDER - 1, pageblock_order));
 	base = ALIGN(base, alignment);
 	size = ALIGN(size, alignment);
 	limit &= ~(alignment - 1);
diff -druNp --no-dereference linux-libre-3.18.51-gnu/mm/memory.c linux-libre-3.18.52-gnu/mm/memory.c
--- linux-libre-3.18.51-gnu/mm/memory.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/mm/memory.c	2017-05-08 01:44:29.000000000 -0400
@@ -2629,6 +2629,10 @@ static int do_anonymous_page(struct mm_s
 
 	pte_unmap(page_table);
 
+	/* File mapping without ->vm_ops ? */
+	if (vma->vm_flags & VM_SHARED)
+		return VM_FAULT_SIGBUS;
+
 	/* Check if we need to add a guard page to the stack */
 	if (check_stack_guard_page(vma, address) < 0)
 		return VM_FAULT_SIGSEGV;
@@ -3033,6 +3037,9 @@ static int do_linear_fault(struct mm_str
 			- vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff;
 
 	pte_unmap(page_table);
+	/* The VMA was not fully populated on mmap() or missing VM_DONTEXPAND */
+	if (!vma->vm_ops->fault)
+		return VM_FAULT_SIGBUS;
 	if (!(flags & FAULT_FLAG_WRITE))
 		return do_read_fault(mm, vma, address, pmd, pgoff, flags,
 				orig_pte);
@@ -3198,11 +3205,9 @@ static int handle_pte_fault(struct mm_st
 	entry = ACCESS_ONCE(*pte);
 	if (!pte_present(entry)) {
 		if (pte_none(entry)) {
-			if (vma->vm_ops) {
-				if (likely(vma->vm_ops->fault))
-					return do_linear_fault(mm, vma, address,
+			if (vma->vm_ops)
+				return do_linear_fault(mm, vma, address,
 						pte, pmd, flags, entry);
-			}
 			return do_anonymous_page(mm, vma, address,
 						 pte, pmd, flags);
 		}
diff -druNp --no-dereference linux-libre-3.18.51-gnu/net/9p/client.c linux-libre-3.18.52-gnu/net/9p/client.c
--- linux-libre-3.18.51-gnu/net/9p/client.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/net/9p/client.c	2017-05-08 01:44:29.000000000 -0400
@@ -2106,6 +2106,10 @@ int p9_client_readdir(struct p9_fid *fid
 		trace_9p_protocol_dump(clnt, req->rc);
 		goto free_and_error;
 	}
+	if (rsize < count) {
+		pr_err("bogus RREADDIR count (%d > %d)\n", count, rsize);
+		count = rsize;
+	}
 
 	p9_debug(P9_DEBUG_9P, "<<< RREADDIR count %d\n", count);
 
diff -druNp --no-dereference linux-libre-3.18.51-gnu/net/core/neighbour.c linux-libre-3.18.52-gnu/net/core/neighbour.c
--- linux-libre-3.18.51-gnu/net/core/neighbour.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/net/core/neighbour.c	2017-05-08 01:44:29.000000000 -0400
@@ -875,7 +875,8 @@ static void neigh_probe(struct neighbour
 	if (skb)
 		skb = skb_copy(skb, GFP_ATOMIC);
 	write_unlock(&neigh->lock);
-	neigh->ops->solicit(neigh, skb);
+	if (neigh->ops->solicit)
+		neigh->ops->solicit(neigh, skb);
 	atomic_inc(&neigh->probes);
 	kfree_skb(skb);
 }
diff -druNp --no-dereference linux-libre-3.18.51-gnu/net/core/netpoll.c linux-libre-3.18.52-gnu/net/core/netpoll.c
--- linux-libre-3.18.51-gnu/net/core/netpoll.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/net/core/netpoll.c	2017-05-08 01:44:29.000000000 -0400
@@ -105,15 +105,21 @@ static void queue_process(struct work_st
 	while ((skb = skb_dequeue(&npinfo->txq))) {
 		struct net_device *dev = skb->dev;
 		struct netdev_queue *txq;
+		unsigned int q_index;
 
 		if (!netif_device_present(dev) || !netif_running(dev)) {
 			kfree_skb(skb);
 			continue;
 		}
 
-		txq = skb_get_tx_queue(dev, skb);
-
 		local_irq_save(flags);
+		/* check if skb->queue_mapping is still valid */
+		q_index = skb_get_queue_mapping(skb);
+		if (unlikely(q_index >= dev->real_num_tx_queues)) {
+			q_index = q_index % dev->real_num_tx_queues;
+			skb_set_queue_mapping(skb, q_index);
+		}
+		txq = netdev_get_tx_queue(dev, q_index);
 		HARD_TX_LOCK(dev, txq, smp_processor_id());
 		if (netif_xmit_frozen_or_stopped(txq) ||
 		    netpoll_start_xmit(skb, dev, txq) != NETDEV_TX_OK) {
diff -druNp --no-dereference linux-libre-3.18.51-gnu/net/core/sock.c linux-libre-3.18.52-gnu/net/core/sock.c
--- linux-libre-3.18.51-gnu/net/core/sock.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/net/core/sock.c	2017-05-08 01:44:29.000000000 -0400
@@ -733,7 +733,7 @@ int sock_setsockopt(struct socket *sock,
 		val = min_t(u32, val, sysctl_wmem_max);
 set_sndbuf:
 		sk->sk_userlocks |= SOCK_SNDBUF_LOCK;
-		sk->sk_sndbuf = max_t(u32, val * 2, SOCK_MIN_SNDBUF);
+		sk->sk_sndbuf = max_t(int, val * 2, SOCK_MIN_SNDBUF);
 		/* Wake up sending tasks if we upped the value. */
 		sk->sk_write_space(sk);
 		break;
@@ -769,7 +769,7 @@ set_rcvbuf:
 		 * returning the value we actually used in getsockopt
 		 * is the most desirable behavior.
 		 */
-		sk->sk_rcvbuf = max_t(u32, val * 2, SOCK_MIN_RCVBUF);
+		sk->sk_rcvbuf = max_t(int, val * 2, SOCK_MIN_RCVBUF);
 		break;
 
 	case SO_RCVBUFFORCE:
diff -druNp --no-dereference linux-libre-3.18.51-gnu/net/ipv6/ip6mr.c linux-libre-3.18.52-gnu/net/ipv6/ip6mr.c
--- linux-libre-3.18.51-gnu/net/ipv6/ip6mr.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/net/ipv6/ip6mr.c	2017-05-08 01:44:29.000000000 -0400
@@ -776,7 +776,8 @@ failure:
  *	Delete a VIF entry
  */
 
-static int mif6_delete(struct mr6_table *mrt, int vifi, struct list_head *head)
+static int mif6_delete(struct mr6_table *mrt, int vifi, int notify,
+		       struct list_head *head)
 {
 	struct mif_device *v;
 	struct net_device *dev;
@@ -822,7 +823,7 @@ static int mif6_delete(struct mr6_table
 					     dev->ifindex, &in6_dev->cnf);
 	}
 
-	if (v->flags & MIFF_REGISTER)
+	if ((v->flags & MIFF_REGISTER) && !notify)
 		unregister_netdevice_queue(dev, head);
 
 	dev_put(dev);
@@ -1331,7 +1332,6 @@ static int ip6mr_device_event(struct not
 	struct mr6_table *mrt;
 	struct mif_device *v;
 	int ct;
-	LIST_HEAD(list);
 
 	if (event != NETDEV_UNREGISTER)
 		return NOTIFY_DONE;
@@ -1340,10 +1340,9 @@ static int ip6mr_device_event(struct not
 		v = &mrt->vif6_table[0];
 		for (ct = 0; ct < mrt->maxvif; ct++, v++) {
 			if (v->dev == dev)
-				mif6_delete(mrt, ct, &list);
+				mif6_delete(mrt, ct, 1, NULL);
 		}
 	}
-	unregister_netdevice_many(&list);
 
 	return NOTIFY_DONE;
 }
@@ -1552,7 +1551,7 @@ static void mroute_clean_tables(struct m
 	for (i = 0; i < mrt->maxvif; i++) {
 		if (!all && (mrt->vif6_table[i].flags & VIFF_STATIC))
 			continue;
-		mif6_delete(mrt, i, &list);
+		mif6_delete(mrt, i, 0, &list);
 	}
 	unregister_netdevice_many(&list);
 
@@ -1705,7 +1704,7 @@ int ip6_mroute_setsockopt(struct sock *s
 		if (copy_from_user(&mifi, optval, sizeof(mifi_t)))
 			return -EFAULT;
 		rtnl_lock();
-		ret = mif6_delete(mrt, mifi, NULL);
+		ret = mif6_delete(mrt, mifi, 0, NULL);
 		rtnl_unlock();
 		return ret;
 
diff -druNp --no-dereference linux-libre-3.18.51-gnu/net/l2tp/l2tp_ip6.c linux-libre-3.18.52-gnu/net/l2tp/l2tp_ip6.c
--- linux-libre-3.18.51-gnu/net/l2tp/l2tp_ip6.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/net/l2tp/l2tp_ip6.c	2017-05-08 01:44:29.000000000 -0400
@@ -266,8 +266,6 @@ static int l2tp_ip6_bind(struct sock *sk
 	int addr_type;
 	int err;
 
-	if (!sock_flag(sk, SOCK_ZAPPED))
-		return -EINVAL;
 	if (addr->l2tp_family != AF_INET6)
 		return -EINVAL;
 	if (addr_len < sizeof(*addr))
@@ -293,6 +291,9 @@ static int l2tp_ip6_bind(struct sock *sk
 	lock_sock(sk);
 
 	err = -EINVAL;
+	if (!sock_flag(sk, SOCK_ZAPPED))
+		goto out_unlock;
+
 	if (sk->sk_state != TCP_CLOSE)
 		goto out_unlock;
 
diff -druNp --no-dereference linux-libre-3.18.51-gnu/net/l2tp/l2tp_ip.c linux-libre-3.18.52-gnu/net/l2tp/l2tp_ip.c
--- linux-libre-3.18.51-gnu/net/l2tp/l2tp_ip.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/net/l2tp/l2tp_ip.c	2017-05-08 01:44:29.000000000 -0400
@@ -252,8 +252,6 @@ static int l2tp_ip_bind(struct sock *sk,
 	int ret;
 	int chk_addr_ret;
 
-	if (!sock_flag(sk, SOCK_ZAPPED))
-		return -EINVAL;
 	if (addr_len < sizeof(struct sockaddr_l2tpip))
 		return -EINVAL;
 	if (addr->l2tp_family != AF_INET)
@@ -268,6 +266,9 @@ static int l2tp_ip_bind(struct sock *sk,
 	read_unlock_bh(&l2tp_ip_lock);
 
 	lock_sock(sk);
+	if (!sock_flag(sk, SOCK_ZAPPED))
+		goto out;
+
 	if (sk->sk_state != TCP_CLOSE || addr_len < sizeof(struct sockaddr_l2tpip))
 		goto out;
 
diff -druNp --no-dereference linux-libre-3.18.51-gnu/net/l2tp/l2tp_ppp.c linux-libre-3.18.52-gnu/net/l2tp/l2tp_ppp.c
--- linux-libre-3.18.51-gnu/net/l2tp/l2tp_ppp.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/net/l2tp/l2tp_ppp.c	2017-05-08 01:44:29.000000000 -0400
@@ -469,6 +469,10 @@ static void pppol2tp_session_close(struc
 static void pppol2tp_session_destruct(struct sock *sk)
 {
 	struct l2tp_session *session = sk->sk_user_data;
+
+	skb_queue_purge(&sk->sk_receive_queue);
+	skb_queue_purge(&sk->sk_write_queue);
+
 	if (session) {
 		sk->sk_user_data = NULL;
 		BUG_ON(session->magic != L2TP_SESSION_MAGIC);
@@ -507,9 +511,6 @@ static int pppol2tp_release(struct socke
 		l2tp_session_queue_purge(session);
 		sock_put(sk);
 	}
-	skb_queue_purge(&sk->sk_receive_queue);
-	skb_queue_purge(&sk->sk_write_queue);
-
 	release_sock(sk);
 
 	/* This will delete the session context via
diff -druNp --no-dereference linux-libre-3.18.51-gnu/net/packet/af_packet.c linux-libre-3.18.52-gnu/net/packet/af_packet.c
--- linux-libre-3.18.51-gnu/net/packet/af_packet.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/net/packet/af_packet.c	2017-05-08 01:44:29.000000000 -0400
@@ -3314,6 +3314,8 @@ packet_setsockopt(struct socket *sock, i
 			return -EBUSY;
 		if (copy_from_user(&val, optval, sizeof(val)))
 			return -EFAULT;
+		if (val > INT_MAX)
+			return -EINVAL;
 		po->tp_reserve = val;
 		return 0;
 	}
@@ -3820,6 +3822,8 @@ static int packet_set_ring(struct sock *
 		rb->frames_per_block = req->tp_block_size/req->tp_frame_size;
 		if (unlikely(rb->frames_per_block <= 0))
 			goto out;
+		if (unlikely(req->tp_block_size > UINT_MAX / req->tp_block_nr))
+			goto out;
 		if (unlikely((rb->frames_per_block * req->tp_block_nr) !=
 					req->tp_frame_nr))
 			goto out;
diff -druNp --no-dereference linux-libre-3.18.51-gnu/net/rds/cong.c linux-libre-3.18.52-gnu/net/rds/cong.c
--- linux-libre-3.18.51-gnu/net/rds/cong.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/net/rds/cong.c	2017-05-08 01:44:29.000000000 -0400
@@ -285,7 +285,7 @@ void rds_cong_set_bit(struct rds_cong_ma
 	i = be16_to_cpu(port) / RDS_CONG_MAP_PAGE_BITS;
 	off = be16_to_cpu(port) % RDS_CONG_MAP_PAGE_BITS;
 
-	__set_bit_le(off, (void *)map->m_page_addrs[i]);
+	set_bit_le(off, (void *)map->m_page_addrs[i]);
 }
 
 void rds_cong_clear_bit(struct rds_cong_map *map, __be16 port)
@@ -299,7 +299,7 @@ void rds_cong_clear_bit(struct rds_cong_
 	i = be16_to_cpu(port) / RDS_CONG_MAP_PAGE_BITS;
 	off = be16_to_cpu(port) % RDS_CONG_MAP_PAGE_BITS;
 
-	__clear_bit_le(off, (void *)map->m_page_addrs[i]);
+	clear_bit_le(off, (void *)map->m_page_addrs[i]);
 }
 
 static int rds_cong_test_bit(struct rds_cong_map *map, __be16 port)
diff -druNp --no-dereference linux-libre-3.18.51-gnu/net/sctp/socket.c linux-libre-3.18.52-gnu/net/sctp/socket.c
--- linux-libre-3.18.51-gnu/net/sctp/socket.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/net/sctp/socket.c	2017-05-08 01:44:29.000000000 -0400
@@ -6400,6 +6400,9 @@ int sctp_inet_listen(struct socket *sock
 	if (sock->state != SS_UNCONNECTED)
 		goto out;
 
+	if (!sctp_sstate(sk, LISTENING) && !sctp_sstate(sk, CLOSED))
+		goto out;
+
 	/* If backlog is zero, disable listening. */
 	if (!backlog) {
 		if (sctp_sstate(sk, CLOSED))
diff -druNp --no-dereference linux-libre-3.18.51-gnu/scripts/kconfig/Makefile linux-libre-3.18.52-gnu/scripts/kconfig/Makefile
--- linux-libre-3.18.51-gnu/scripts/kconfig/Makefile	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/scripts/kconfig/Makefile	2017-05-08 01:44:29.000000000 -0400
@@ -110,7 +110,7 @@ define mergeconfig
 $(if $(wildcard $(objtree)/.config),, $(error You need an existing .config for this target))
 $(if $(call configfiles,$(1)),, $(error No configuration exists for this target on this architecture))
 $(Q)$(CONFIG_SHELL) $(srctree)/scripts/kconfig/merge_config.sh -m -O $(objtree) $(objtree)/.config $(call configfiles,$(1))
-$(Q)yes "" | $(MAKE) -f $(srctree)/Makefile oldconfig
++$(Q)yes "" | $(MAKE) -f $(srctree)/Makefile oldconfig
 endef
 
 PHONY += kvmconfig
diff -druNp --no-dereference linux-libre-3.18.51-gnu/scripts/mod/modpost.c linux-libre-3.18.52-gnu/scripts/mod/modpost.c
--- linux-libre-3.18.51-gnu/scripts/mod/modpost.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/scripts/mod/modpost.c	2017-05-08 01:44:29.000000000 -0400
@@ -776,6 +776,7 @@ static const char *sech_name(struct elf_
  * "foo" will match an exact string equal to "foo"
  * "*foo" will match a string that ends with "foo"
  * "foo*" will match a string that begins with "foo"
+ * "*foo*" will match a string that contains "foo"
  */
 static int match(const char *sym, const char * const pat[])
 {
@@ -784,8 +785,17 @@ static int match(const char *sym, const
 		p = *pat++;
 		const char *endp = p + strlen(p) - 1;
 
+		/* "*foo*" */
+		if (*p == '*' && *endp == '*') {
+			char *here, *bare = strndup(p + 1, strlen(p) - 2);
+
+			here = strstr(sym, bare);
+			free(bare);
+			if (here != NULL)
+				return 1;
+		}
 		/* "*foo" */
-		if (*p == '*') {
+		else if (*p == '*') {
 			if (strrcmp(sym, p + 1) == 0)
 				return 1;
 		}
@@ -892,6 +902,10 @@ static const char *const init_sections[]
 static const char *const init_exit_sections[] =
 	{ALL_INIT_SECTIONS, ALL_EXIT_SECTIONS, NULL };
 
+/* all text sections */
+static const char *const text_sections[] = { ALL_INIT_TEXT_SECTIONS,
+				ALL_EXIT_TEXT_SECTIONS, TEXT_SECTIONS, NULL };
+
 /* data section */
 static const char *const data_sections[] = { DATA_SECTIONS, NULL };
 
@@ -910,6 +924,7 @@ static const char *const data_sections[]
 static const char *const head_sections[] = { ".head.text*", NULL };
 static const char *const linker_symbols[] =
 	{ "__init_begin", "_sinittext", "_einittext", NULL };
+static const char *const optim_symbols[] = { "*.constprop.*", NULL };
 
 enum mismatch {
 	TEXT_TO_ANY_INIT,
@@ -1067,6 +1082,17 @@ static const struct sectioncheck *sectio
  *   This pattern is identified by
  *   refsymname = __init_begin, _sinittext, _einittext
  *
+ * Pattern 5:
+ *   GCC may optimize static inlines when fed constant arg(s) resulting
+ *   in functions like cpumask_empty() -- generating an associated symbol
+ *   cpumask_empty.constprop.3 that appears in the audit.  If the const that
+ *   is passed in comes from __init, like say nmi_ipi_mask, we get a
+ *   meaningless section warning.  May need to add isra symbols too...
+ *   This pattern is identified by
+ *   tosec   = init section
+ *   fromsec = text section
+ *   refsymname = *.constprop.*
+ *
  **/
 static int secref_whitelist(const struct sectioncheck *mismatch,
 			    const char *fromsec, const char *fromsym,
@@ -1099,6 +1125,12 @@ static int secref_whitelist(const struct
 	if (match(tosym, linker_symbols))
 		return 0;
 
+	/* Check for pattern 5 */
+	if (match(fromsec, text_sections) &&
+	    match(tosec, init_sections) &&
+	    match(fromsym, optim_symbols))
+		return 0;
+
 	return 1;
 }
 
diff -druNp --no-dereference linux-libre-3.18.51-gnu/sound/core/pcm_lib.c linux-libre-3.18.52-gnu/sound/core/pcm_lib.c
--- linux-libre-3.18.51-gnu/sound/core/pcm_lib.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/sound/core/pcm_lib.c	2017-05-08 01:44:29.000000000 -0400
@@ -1858,10 +1858,10 @@ void snd_pcm_period_elapsed(struct snd_p
 	if (substream->timer_running)
 		snd_timer_interrupt(substream->timer, 1);
  _end:
+	kill_fasync(&runtime->fasync, SIGIO, POLL_IN);
 	snd_pcm_stream_unlock_irqrestore(substream, flags);
 	if (runtime->transfer_ack_end)
 		runtime->transfer_ack_end(substream);
-	kill_fasync(&runtime->fasync, SIGIO, POLL_IN);
 }
 
 EXPORT_SYMBOL(snd_pcm_period_elapsed);
diff -druNp --no-dereference linux-libre-3.18.51-gnu/sound/core/seq/seq_lock.c linux-libre-3.18.52-gnu/sound/core/seq/seq_lock.c
--- linux-libre-3.18.51-gnu/sound/core/seq/seq_lock.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/sound/core/seq/seq_lock.c	2017-05-08 01:44:29.000000000 -0400
@@ -28,19 +28,16 @@
 /* wait until all locks are released */
 void snd_use_lock_sync_helper(snd_use_lock_t *lockp, const char *file, int line)
 {
-	int max_count = 5 * HZ;
+	int warn_count = 5 * HZ;
 
 	if (atomic_read(lockp) < 0) {
 		pr_warn("ALSA: seq_lock: lock trouble [counter = %d] in %s:%d\n", atomic_read(lockp), file, line);
 		return;
 	}
 	while (atomic_read(lockp) > 0) {
-		if (max_count == 0) {
-			pr_warn("ALSA: seq_lock: timeout [%d left] in %s:%d\n", atomic_read(lockp), file, line);
-			break;
-		}
+		if (warn_count-- == 0)
+			pr_warn("ALSA: seq_lock: waiting [%d left] in %s:%d\n", atomic_read(lockp), file, line);
 		schedule_timeout_uninterruptible(1);
-		max_count--;
 	}
 }
 
diff -druNp --no-dereference linux-libre-3.18.51-gnu/sound/ppc/awacs.c linux-libre-3.18.52-gnu/sound/ppc/awacs.c
--- linux-libre-3.18.51-gnu/sound/ppc/awacs.c	2017-04-29 23:49:46.000000000 -0400
+++ linux-libre-3.18.52-gnu/sound/ppc/awacs.c	2017-05-08 01:44:29.000000000 -0400
@@ -991,6 +991,7 @@ snd_pmac_awacs_init(struct snd_pmac *chi
 		if (err < 0)
 			return err;
 	}
+	master_vol = NULL;
 	if (pm7500)
 		err = build_mixers(chip,
 				   ARRAY_SIZE(snd_pmac_awacs_mixers_pmac7500),
