diff -druNp --no-dereference linux-libre-3.18.62-gnu/arch/mips/include/asm/branch.h linux-libre-3.18.63-gnu/arch/mips/include/asm/branch.h
--- linux-libre-3.18.62-gnu/arch/mips/include/asm/branch.h	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/arch/mips/include/asm/branch.h	2017-07-27 18:03:49.000000000 -0400
@@ -74,10 +74,7 @@ static inline int compute_return_epc(str
 			return __microMIPS_compute_return_epc(regs);
 		if (cpu_has_mips16)
 			return __MIPS16e_compute_return_epc(regs);
-		return regs->cp0_epc;
-	}
-
-	if (!delay_slot(regs)) {
+	} else if (!delay_slot(regs)) {
 		regs->cp0_epc += 4;
 		return 0;
 	}
diff -druNp --no-dereference linux-libre-3.18.62-gnu/arch/mips/kernel/branch.c linux-libre-3.18.63-gnu/arch/mips/kernel/branch.c
--- linux-libre-3.18.62-gnu/arch/mips/kernel/branch.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/arch/mips/kernel/branch.c	2017-07-27 18:03:49.000000000 -0400
@@ -396,7 +396,7 @@ int __MIPS16e_compute_return_epc(struct
  *
  * @regs:	Pointer to pt_regs
  * @insn:	branch instruction to decode
- * @returns:	-EFAULT on error and forces SIGBUS, and on success
+ * @returns:	-EFAULT on error and forces SIGILL, and on success
  *		returns 0 or BRANCH_LIKELY_TAKEN as appropriate after
  *		evaluating the branch.
  */
@@ -493,6 +493,7 @@ int __compute_return_epc_for_insn(struct
 	/*
 	 * These are unconditional and in j_format.
 	 */
+	case jalx_op:
 	case jal_op:
 		regs->regs[31] = regs->cp0_epc + 8;
 	case j_op:
@@ -632,8 +633,9 @@ int __compute_return_epc_for_insn(struct
 	return ret;
 
 sigill:
-	printk("%s: DSP branch but not DSP ASE - sending SIGBUS.\n", current->comm);
-	force_sig(SIGBUS, current);
+	pr_info("%s: DSP branch but not DSP ASE - sending SIGILL.\n",
+		current->comm);
+	force_sig(SIGILL, current);
 	return -EFAULT;
 }
 EXPORT_SYMBOL_GPL(__compute_return_epc_for_insn);
diff -druNp --no-dereference linux-libre-3.18.62-gnu/arch/mips/kernel/ptrace.c linux-libre-3.18.63-gnu/arch/mips/kernel/ptrace.c
--- linux-libre-3.18.62-gnu/arch/mips/kernel/ptrace.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/arch/mips/kernel/ptrace.c	2017-07-27 18:03:49.000000000 -0400
@@ -802,7 +802,7 @@ asmlinkage void syscall_trace_leave(stru
 	audit_syscall_exit(regs);
 
 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
-		trace_sys_exit(regs, regs->regs[2]);
+		trace_sys_exit(regs, regs_return_value(regs));
 
 	if (test_thread_flag(TIF_SYSCALL_TRACE))
 		tracehook_report_syscall_exit(regs, 0);
diff -druNp --no-dereference linux-libre-3.18.62-gnu/arch/mips/kernel/scall32-o32.S linux-libre-3.18.63-gnu/arch/mips/kernel/scall32-o32.S
--- linux-libre-3.18.62-gnu/arch/mips/kernel/scall32-o32.S	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/arch/mips/kernel/scall32-o32.S	2017-07-27 18:03:49.000000000 -0400
@@ -361,7 +361,7 @@ EXPORT(sys_call_table)
 	PTR	sys_writev
 	PTR	sys_cacheflush
 	PTR	sys_cachectl
-	PTR	sys_sysmips
+	PTR	__sys_sysmips
 	PTR	sys_ni_syscall			/* 4150 */
 	PTR	sys_getsid
 	PTR	sys_fdatasync
diff -druNp --no-dereference linux-libre-3.18.62-gnu/arch/mips/kernel/scall64-64.S linux-libre-3.18.63-gnu/arch/mips/kernel/scall64-64.S
--- linux-libre-3.18.62-gnu/arch/mips/kernel/scall64-64.S	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/arch/mips/kernel/scall64-64.S	2017-07-27 18:03:49.000000000 -0400
@@ -318,7 +318,7 @@ EXPORT(sys_call_table)
 	PTR	sys_sched_getaffinity
 	PTR	sys_cacheflush
 	PTR	sys_cachectl
-	PTR	sys_sysmips
+	PTR	__sys_sysmips
 	PTR	sys_io_setup			/* 5200 */
 	PTR	sys_io_destroy
 	PTR	sys_io_getevents
diff -druNp --no-dereference linux-libre-3.18.62-gnu/arch/mips/kernel/scall64-n32.S linux-libre-3.18.63-gnu/arch/mips/kernel/scall64-n32.S
--- linux-libre-3.18.62-gnu/arch/mips/kernel/scall64-n32.S	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/arch/mips/kernel/scall64-n32.S	2017-07-27 18:03:49.000000000 -0400
@@ -307,7 +307,7 @@ EXPORT(sysn32_call_table)
 	PTR	compat_sys_sched_getaffinity
 	PTR	sys_cacheflush
 	PTR	sys_cachectl
-	PTR	sys_sysmips
+	PTR	__sys_sysmips
 	PTR	compat_sys_io_setup			/* 6200 */
 	PTR	sys_io_destroy
 	PTR	compat_sys_io_getevents
diff -druNp --no-dereference linux-libre-3.18.62-gnu/arch/mips/kernel/scall64-o32.S linux-libre-3.18.63-gnu/arch/mips/kernel/scall64-o32.S
--- linux-libre-3.18.62-gnu/arch/mips/kernel/scall64-o32.S	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/arch/mips/kernel/scall64-o32.S	2017-07-27 18:03:49.000000000 -0400
@@ -358,7 +358,7 @@ EXPORT(sys32_call_table)
 	PTR	compat_sys_writev
 	PTR	sys_cacheflush
 	PTR	sys_cachectl
-	PTR	sys_sysmips
+	PTR	__sys_sysmips
 	PTR	sys_ni_syscall			/* 4150 */
 	PTR	sys_getsid
 	PTR	sys_fdatasync
diff -druNp --no-dereference linux-libre-3.18.62-gnu/arch/mips/kernel/syscall.c linux-libre-3.18.63-gnu/arch/mips/kernel/syscall.c
--- linux-libre-3.18.62-gnu/arch/mips/kernel/syscall.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/arch/mips/kernel/syscall.c	2017-07-27 18:03:49.000000000 -0400
@@ -28,6 +28,7 @@
 #include <linux/elf.h>
 
 #include <asm/asm.h>
+#include <asm/asm-eva.h>
 #include <asm/branch.h>
 #include <asm/cachectl.h>
 #include <asm/cacheflush.h>
@@ -137,10 +138,12 @@ static inline int mips_atomic_set(unsign
 		__asm__ __volatile__ (
 		"	.set	arch=r4000				\n"
 		"	li	%[err], 0				\n"
-		"1:	ll	%[old], (%[addr])			\n"
+		"1:							\n"
+		user_ll("%[old]", "(%[addr])")
 		"	move	%[tmp], %[new]				\n"
-		"2:	sc	%[tmp], (%[addr])			\n"
-		"	bnez	%[tmp], 4f				\n"
+		"2:							\n"
+		user_sc("%[tmp]", "(%[addr])")
+		"	beqz	%[tmp], 4f				\n"
 		"3:							\n"
 		"	.subsection 2					\n"
 		"4:	b	1b					\n"
@@ -197,6 +200,12 @@ static inline int mips_atomic_set(unsign
 	unreachable();
 }
 
+/*
+ * mips_atomic_set() normally returns directly via syscall_exit potentially
+ * clobbering static registers, so be sure to preserve them.
+ */
+save_static_function(sys_sysmips);
+
 SYSCALL_DEFINE3(sysmips, long, cmd, long, arg1, long, arg2)
 {
 	switch (cmd) {
diff -druNp --no-dereference linux-libre-3.18.62-gnu/arch/mips/math-emu/cp1emu.c linux-libre-3.18.63-gnu/arch/mips/math-emu/cp1emu.c
--- linux-libre-3.18.62-gnu/arch/mips/math-emu/cp1emu.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/arch/mips/math-emu/cp1emu.c	2017-07-27 18:03:49.000000000 -0400
@@ -1856,6 +1856,35 @@ dcopuop:
 	return 0;
 }
 
+/*
+ * Emulate FPU instructions.
+ *
+ * If we use FPU hardware, then we have been typically called to handle
+ * an unimplemented operation, such as where an operand is a NaN or
+ * denormalized.  In that case exit the emulation loop after a single
+ * iteration so as to let hardware execute any subsequent instructions.
+ *
+ * If we have no FPU hardware or it has been disabled, then continue
+ * emulating floating-point instructions until one of these conditions
+ * has occurred:
+ *
+ * - a non-FPU instruction has been encountered,
+ *
+ * - an attempt to emulate has ended with a signal,
+ *
+ * - the ISA mode has been switched.
+ *
+ * We need to terminate the emulation loop if we got switched to the
+ * MIPS16 mode, whether supported or not, so that we do not attempt
+ * to emulate a MIPS16 instruction as a regular MIPS FPU instruction.
+ * Similarly if we got switched to the microMIPS mode and only the
+ * regular MIPS mode is supported, so that we do not attempt to emulate
+ * a microMIPS instruction as a regular MIPS FPU instruction.  Or if
+ * we got switched to the regular MIPS mode and only the microMIPS mode
+ * is supported, so that we do not attempt to emulate a regular MIPS
+ * instruction that should cause an Address Error exception instead.
+ * For simplicity we always terminate upon an ISA mode switch.
+ */
 int fpu_emulator_cop1Handler(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
 	int has_fpu, void *__user *fault_addr)
 {
@@ -1943,6 +1972,15 @@ int fpu_emulator_cop1Handler(struct pt_r
 			break;
 		if (sig)
 			break;
+		/*
+		 * We have to check for the ISA bit explicitly here,
+		 * because `get_isa16_mode' may return 0 if support
+		 * for code compression has been globally disabled,
+		 * or otherwise we may produce the wrong signal or
+		 * even proceed successfully where we must not.
+		 */
+		if ((xcp->cp0_epc ^ prevepc) & 0x1)
+			break;
 
 		cond_resched();
 	} while (xcp->cp0_epc > prevepc);
diff -druNp --no-dereference linux-libre-3.18.62-gnu/arch/powerpc/include/asm/atomic.h linux-libre-3.18.63-gnu/arch/powerpc/include/asm/atomic.h
--- linux-libre-3.18.62-gnu/arch/powerpc/include/asm/atomic.h	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/arch/powerpc/include/asm/atomic.h	2017-07-27 18:03:49.000000000 -0400
@@ -453,7 +453,7 @@ static __inline__ int atomic64_add_unles
  * Atomically increments @v by 1, so long as @v is non-zero.
  * Returns non-zero if @v was non-zero, and zero otherwise.
  */
-static __inline__ long atomic64_inc_not_zero(atomic64_t *v)
+static __inline__ int atomic64_inc_not_zero(atomic64_t *v)
 {
 	long t1, t2;
 
@@ -472,7 +472,7 @@ static __inline__ long atomic64_inc_not_
 	: "r" (&v->counter)
 	: "cc", "xer", "memory");
 
-	return t1;
+	return t1 != 0;
 }
 
 #endif /* __powerpc64__ */
diff -druNp --no-dereference linux-libre-3.18.62-gnu/arch/powerpc/include/asm/reg.h linux-libre-3.18.63-gnu/arch/powerpc/include/asm/reg.h
--- linux-libre-3.18.62-gnu/arch/powerpc/include/asm/reg.h	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/arch/powerpc/include/asm/reg.h	2017-07-27 18:03:49.000000000 -0400
@@ -1231,7 +1231,7 @@ static inline unsigned long mfvtb (void)
 				"	.llong 0\n"			\
 				".previous"				\
 			: "=r" (rval) \
-			: "i" (CPU_FTR_CELL_TB_BUG), "i" (SPRN_TBRL)); \
+			: "i" (CPU_FTR_CELL_TB_BUG), "i" (SPRN_TBRL) : "cr0"); \
 			rval;})
 #else
 #define mftb()		({unsigned long rval;	\
diff -druNp --no-dereference linux-libre-3.18.62-gnu/arch/powerpc/kvm/book3s_hv.c linux-libre-3.18.63-gnu/arch/powerpc/kvm/book3s_hv.c
--- linux-libre-3.18.62-gnu/arch/powerpc/kvm/book3s_hv.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/arch/powerpc/kvm/book3s_hv.c	2017-07-27 18:03:49.000000000 -0400
@@ -1950,6 +1950,7 @@ static int kvmppc_vcpu_run_hv(struct kvm
 {
 	int r;
 	int srcu_idx;
+	unsigned long ebb_regs[3] = {};	/* shut up GCC */
 
 	if (!vcpu->arch.sane) {
 		run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
@@ -1999,6 +2000,14 @@ static int kvmppc_vcpu_run_hv(struct kvm
 	flush_fp_to_thread(current);
 	flush_altivec_to_thread(current);
 	flush_vsx_to_thread(current);
+
+	/* Save userspace EBB register values */
+	if (cpu_has_feature(CPU_FTR_ARCH_207S)) {
+		ebb_regs[0] = mfspr(SPRN_EBBHR);
+		ebb_regs[1] = mfspr(SPRN_EBBRR);
+		ebb_regs[2] = mfspr(SPRN_BESCR);
+	}
+
 	vcpu->arch.wqp = &vcpu->arch.vcore->wq;
 	vcpu->arch.pgdir = current->mm->pgd;
 	vcpu->arch.state = KVMPPC_VCPU_BUSY_IN_HOST;
@@ -2018,6 +2027,13 @@ static int kvmppc_vcpu_run_hv(struct kvm
 		}
 	} while (is_kvmppc_resume_guest(r));
 
+	/* Restore userspace EBB register values */
+	if (cpu_has_feature(CPU_FTR_ARCH_207S)) {
+		mtspr(SPRN_EBBHR, ebb_regs[0]);
+		mtspr(SPRN_EBBRR, ebb_regs[1]);
+		mtspr(SPRN_BESCR, ebb_regs[2]);
+	}
+
  out:
 	vcpu->arch.state = KVMPPC_VCPU_NOTREADY;
 	atomic_dec(&vcpu->kvm->arch.vcpus_running);
diff -druNp --no-dereference linux-libre-3.18.62-gnu/arch/powerpc/lib/sstep.c linux-libre-3.18.63-gnu/arch/powerpc/lib/sstep.c
--- linux-libre-3.18.62-gnu/arch/powerpc/lib/sstep.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/arch/powerpc/lib/sstep.c	2017-07-27 18:03:49.000000000 -0400
@@ -687,8 +687,10 @@ int __kprobes analyse_instr(struct instr
 	case 19:
 		switch ((instr >> 1) & 0x3ff) {
 		case 0:		/* mcrf */
-			rd = (instr >> 21) & 0x1c;
-			ra = (instr >> 16) & 0x1c;
+			rd = 7 - ((instr >> 23) & 0x7);
+			ra = 7 - ((instr >> 18) & 0x7);
+			rd *= 4;
+			ra *= 4;
 			val = (regs->ccr >> ra) & 0xf;
 			regs->ccr = (regs->ccr & ~(0xfUL << rd)) | (val << rd);
 			goto instr_done;
@@ -967,6 +969,19 @@ int __kprobes analyse_instr(struct instr
 #endif
 
 		case 19:	/* mfcr */
+			if ((instr >> 20) & 1) {
+				imm = 0xf0000000UL;
+				for (sh = 0; sh < 8; ++sh) {
+					if (instr & (0x80000 >> sh)) {
+						regs->gpr[rd] = regs->ccr & imm;
+						break;
+					}
+					imm >>= 4;
+				}
+
+				goto instr_done;
+			}
+
 			regs->gpr[rd] = regs->ccr;
 			regs->gpr[rd] &= 0xffffffffUL;
 			goto instr_done;
diff -druNp --no-dereference linux-libre-3.18.62-gnu/arch/s390/include/asm/syscall.h linux-libre-3.18.63-gnu/arch/s390/include/asm/syscall.h
--- linux-libre-3.18.62-gnu/arch/s390/include/asm/syscall.h	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/arch/s390/include/asm/syscall.h	2017-07-27 18:03:49.000000000 -0400
@@ -64,6 +64,12 @@ static inline void syscall_get_arguments
 {
 	unsigned long mask = -1UL;
 
+	/*
+	 * No arguments for this syscall, there's nothing to do.
+	 */
+	if (!n)
+		return;
+
 	BUG_ON(i + n > 6);
 #ifdef CONFIG_COMPAT
 	if (test_tsk_thread_flag(task, TIF_31BIT))
diff -druNp --no-dereference linux-libre-3.18.62-gnu/arch/x86/kernel/acpi/boot.c linux-libre-3.18.63-gnu/arch/x86/kernel/acpi/boot.c
--- linux-libre-3.18.62-gnu/arch/x86/kernel/acpi/boot.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/arch/x86/kernel/acpi/boot.c	2017-07-27 18:03:49.000000000 -0400
@@ -316,6 +316,14 @@ static void __init mp_override_legacy_ir
 	struct mpc_intsrc mp_irq;
 
 	/*
+	 * Check bus_irq boundary.
+	 */
+	if (bus_irq >= NR_IRQS_LEGACY) {
+		pr_warn("Invalid bus_irq %u for legacy override\n", bus_irq);
+		return;
+	}
+
+	/*
 	 * Convert 'gsi' to 'ioapic.pin'.
 	 */
 	ioapic = mp_find_ioapic(gsi);
diff -druNp --no-dereference linux-libre-3.18.62-gnu/arch/x86/kernel/rtc.c linux-libre-3.18.63-gnu/arch/x86/kernel/rtc.c
--- linux-libre-3.18.62-gnu/arch/x86/kernel/rtc.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/arch/x86/kernel/rtc.c	2017-07-27 18:03:49.000000000 -0400
@@ -170,7 +170,7 @@ static struct platform_device rtc_device
 static __init int add_rtc_cmos(void)
 {
 #ifdef CONFIG_PNP
-	static const char * const  const ids[] __initconst =
+	static const char * const ids[] __initconst =
 	    { "PNP0b00", "PNP0b01", "PNP0b02", };
 	struct pnp_dev *dev;
 	struct pnp_id *id;
diff -druNp --no-dereference linux-libre-3.18.62-gnu/drivers/base/power/domain.c linux-libre-3.18.63-gnu/drivers/base/power/domain.c
--- linux-libre-3.18.62-gnu/drivers/base/power/domain.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/drivers/base/power/domain.c	2017-07-27 18:03:49.000000000 -0400
@@ -1673,7 +1673,7 @@ int pm_genpd_add_subdomain_names(const c
 int pm_genpd_remove_subdomain(struct generic_pm_domain *genpd,
 			      struct generic_pm_domain *subdomain)
 {
-	struct gpd_link *link;
+	struct gpd_link *l, *link;
 	int ret = -EINVAL;
 
 	if (IS_ERR_OR_NULL(genpd) || IS_ERR_OR_NULL(subdomain))
@@ -1682,7 +1682,7 @@ int pm_genpd_remove_subdomain(struct gen
  start:
 	genpd_acquire_lock(genpd);
 
-	list_for_each_entry(link, &genpd->master_links, master_node) {
+	list_for_each_entry_safe(link, l, &genpd->master_links, master_node) {
 		if (link->slave != subdomain)
 			continue;
 
@@ -2056,10 +2056,10 @@ EXPORT_SYMBOL_GPL(__of_genpd_add_provide
  */
 void of_genpd_del_provider(struct device_node *np)
 {
-	struct of_genpd_provider *cp;
+	struct of_genpd_provider *cp, *tmp;
 
 	mutex_lock(&of_genpd_mutex);
-	list_for_each_entry(cp, &of_genpd_providers, link) {
+	list_for_each_entry_safe(cp, tmp, &of_genpd_providers, link) {
 		if (cp->node == np) {
 			list_del(&cp->link);
 			of_node_put(cp->node);
diff -druNp --no-dereference linux-libre-3.18.62-gnu/drivers/gpu/drm/drm_dp_mst_topology.c linux-libre-3.18.63-gnu/drivers/gpu/drm/drm_dp_mst_topology.c
--- linux-libre-3.18.62-gnu/drivers/gpu/drm/drm_dp_mst_topology.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/drivers/gpu/drm/drm_dp_mst_topology.c	2017-07-27 18:03:49.000000000 -0400
@@ -330,6 +330,13 @@ static bool drm_dp_sideband_msg_build(st
 			return false;
 		}
 
+		/*
+		 * ignore out-of-order messages or messages that are part of a
+		 * failed transaction
+		 */
+		if (!recv_hdr.somt && !msg->have_somt)
+			return false;
+
 		/* get length contained in this portion */
 		msg->curchunk_len = recv_hdr.msg_len;
 		msg->curchunk_hdrlen = hdrlen;
@@ -2049,7 +2056,7 @@ out_unlock:
 }
 EXPORT_SYMBOL(drm_dp_mst_topology_mgr_resume);
 
-static void drm_dp_get_one_sb_msg(struct drm_dp_mst_topology_mgr *mgr, bool up)
+static bool drm_dp_get_one_sb_msg(struct drm_dp_mst_topology_mgr *mgr, bool up)
 {
 	int len;
 	u8 replyblock[32];
@@ -2064,12 +2071,12 @@ static void drm_dp_get_one_sb_msg(struct
 			       replyblock, len);
 	if (ret != len) {
 		DRM_DEBUG_KMS("failed to read DPCD down rep %d %d\n", len, ret);
-		return;
+		return false;
 	}
 	ret = drm_dp_sideband_msg_build(msg, replyblock, len, true);
 	if (!ret) {
 		DRM_DEBUG_KMS("sideband msg build failed %d\n", replyblock[0]);
-		return;
+		return false;
 	}
 	replylen = msg->curchunk_len + msg->curchunk_hdrlen;
 
@@ -2081,21 +2088,32 @@ static void drm_dp_get_one_sb_msg(struct
 		ret = drm_dp_dpcd_read(mgr->aux, basereg + curreply,
 				    replyblock, len);
 		if (ret != len) {
-			DRM_DEBUG_KMS("failed to read a chunk\n");
+			DRM_DEBUG_KMS("failed to read a chunk (len %d, ret %d)\n",
+				      len, ret);
+			return false;
 		}
+
 		ret = drm_dp_sideband_msg_build(msg, replyblock, len, false);
-		if (ret == false)
+		if (!ret) {
 			DRM_DEBUG_KMS("failed to build sideband msg\n");
+			return false;
+		}
+
 		curreply += len;
 		replylen -= len;
 	}
+	return true;
 }
 
 static int drm_dp_mst_handle_down_rep(struct drm_dp_mst_topology_mgr *mgr)
 {
 	int ret = 0;
 
-	drm_dp_get_one_sb_msg(mgr, false);
+	if (!drm_dp_get_one_sb_msg(mgr, false)) {
+		memset(&mgr->down_rep_recv, 0,
+		       sizeof(struct drm_dp_sideband_msg_rx));
+		return 0;
+	}
 
 	if (mgr->down_rep_recv.have_eomt) {
 		struct drm_dp_sideband_msg_tx *txmsg;
@@ -2151,7 +2169,12 @@ static int drm_dp_mst_handle_down_rep(st
 static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr)
 {
 	int ret = 0;
-	drm_dp_get_one_sb_msg(mgr, true);
+
+	if (!drm_dp_get_one_sb_msg(mgr, true)) {
+		memset(&mgr->up_req_recv, 0,
+		       sizeof(struct drm_dp_sideband_msg_rx));
+		return 0;
+	}
 
 	if (mgr->up_req_recv.have_eomt) {
 		struct drm_dp_sideband_msg_req_body msg;
@@ -2203,7 +2226,9 @@ static int drm_dp_mst_handle_up_req(stru
 			DRM_DEBUG_KMS("Got RSN: pn: %d avail_pbn %d\n", msg.u.resource_stat.port_number, msg.u.resource_stat.available_pbn);
 		}
 
-		drm_dp_put_mst_branch_device(mstb);
+		if (mstb)
+			drm_dp_put_mst_branch_device(mstb);
+
 		memset(&mgr->up_req_recv, 0, sizeof(struct drm_dp_sideband_msg_rx));
 	}
 	return ret;
diff -druNp --no-dereference linux-libre-3.18.62-gnu/drivers/gpu/drm/radeon/ci_dpm.c linux-libre-3.18.63-gnu/drivers/gpu/drm/radeon/ci_dpm.c
--- linux-libre-3.18.62-gnu/drivers/gpu/drm/radeon/ci_dpm.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/drivers/gpu/drm/radeon/ci_dpm.c	2017-07-27 18:03:49.000000000 -0400
@@ -738,6 +738,12 @@ bool ci_dpm_vblank_too_short(struct rade
 	if (r600_dpm_get_vrefresh(rdev) > 120)
 		return true;
 
+	/* disable mclk switching if the refresh is >120Hz, even if the
+        * blanking period would allow it
+        */
+	if (r600_dpm_get_vrefresh(rdev) > 120)
+		return true;
+
 	if (vblank_time < switch_limit)
 		return true;
 	else
diff -druNp --no-dereference linux-libre-3.18.62-gnu/drivers/input/serio/i8042.c linux-libre-3.18.63-gnu/drivers/input/serio/i8042.c
--- linux-libre-3.18.62-gnu/drivers/input/serio/i8042.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/drivers/input/serio/i8042.c	2017-07-27 18:03:49.000000000 -0400
@@ -397,8 +397,10 @@ static int i8042_start(struct serio *ser
 {
 	struct i8042_port *port = serio->port_data;
 
+	spin_lock_irq(&i8042_lock);
 	port->exists = true;
-	mb();
+	spin_unlock_irq(&i8042_lock);
+
 	return 0;
 }
 
@@ -411,16 +413,20 @@ static void i8042_stop(struct serio *ser
 {
 	struct i8042_port *port = serio->port_data;
 
+	spin_lock_irq(&i8042_lock);
 	port->exists = false;
+	port->serio = NULL;
+	spin_unlock_irq(&i8042_lock);
 
 	/*
+	 * We need to make sure that interrupt handler finishes using
+	 * our serio port before we return from this function.
 	 * We synchronize with both AUX and KBD IRQs because there is
 	 * a (very unlikely) chance that AUX IRQ is raised for KBD port
 	 * and vice versa.
 	 */
 	synchronize_irq(I8042_AUX_IRQ);
 	synchronize_irq(I8042_KBD_IRQ);
-	port->serio = NULL;
 }
 
 /*
@@ -537,7 +543,7 @@ static irqreturn_t i8042_interrupt(int i
 
 	spin_unlock_irqrestore(&i8042_lock, flags);
 
-	if (likely(port->exists && !filtered))
+	if (likely(serio && !filtered))
 		serio_interrupt(serio, data, dfl);
 
  out:
diff -druNp --no-dereference linux-libre-3.18.62-gnu/drivers/md/raid1.c linux-libre-3.18.63-gnu/drivers/md/raid1.c
--- linux-libre-3.18.62-gnu/drivers/md/raid1.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/drivers/md/raid1.c	2017-07-27 18:03:49.000000000 -0400
@@ -1120,13 +1120,16 @@ static void make_request(struct mddev *m
 		 */
 		DEFINE_WAIT(w);
 		for (;;) {
-			flush_signals(current);
+			sigset_t full, old;
 			prepare_to_wait(&conf->wait_barrier,
 					&w, TASK_INTERRUPTIBLE);
 			if (bio_end_sector(bio) <= mddev->suspend_lo ||
 			    bio->bi_iter.bi_sector >= mddev->suspend_hi)
 				break;
+			sigfillset(&full);
+			sigprocmask(SIG_BLOCK, &full, &old);
 			schedule();
+			sigprocmask(SIG_SETMASK, &old, NULL);
 		}
 		finish_wait(&conf->wait_barrier, &w);
 	}
diff -druNp --no-dereference linux-libre-3.18.62-gnu/drivers/md/raid5.c linux-libre-3.18.63-gnu/drivers/md/raid5.c
--- linux-libre-3.18.62-gnu/drivers/md/raid5.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/drivers/md/raid5.c	2017-07-27 18:03:49.000000000 -0400
@@ -4705,12 +4705,15 @@ static void make_request(struct mddev *m
 				 * userspace, we want an interruptible
 				 * wait.
 				 */
-				flush_signals(current);
 				prepare_to_wait(&conf->wait_for_overlap,
 						&w, TASK_INTERRUPTIBLE);
 				if (logical_sector >= mddev->suspend_lo &&
 				    logical_sector < mddev->suspend_hi) {
+					sigset_t full, old;
+					sigfillset(&full);
+					sigprocmask(SIG_BLOCK, &full, &old);
 					schedule();
+					sigprocmask(SIG_SETMASK, &old, NULL);
 					do_prepare = true;
 				}
 				goto retry;
@@ -6719,12 +6722,10 @@ static void end_reshape(struct r5conf *c
 {
 
 	if (!test_bit(MD_RECOVERY_INTR, &conf->mddev->recovery)) {
-		struct md_rdev *rdev;
 
 		spin_lock_irq(&conf->device_lock);
 		conf->previous_raid_disks = conf->raid_disks;
-		rdev_for_each(rdev, conf->mddev)
-			rdev->data_offset = rdev->new_data_offset;
+		md_finish_reshape(conf->mddev);
 		smp_wmb();
 		conf->reshape_progress = MaxSector;
 		spin_unlock_irq(&conf->device_lock);
diff -druNp --no-dereference linux-libre-3.18.62-gnu/drivers/media/rc/imon.c linux-libre-3.18.63-gnu/drivers/media/rc/imon.c
--- linux-libre-3.18.62-gnu/drivers/media/rc/imon.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/drivers/media/rc/imon.c	2017-07-27 18:03:49.000000000 -0400
@@ -1629,7 +1629,7 @@ static void imon_incoming_packet(struct
 	if (kc == KEY_KEYBOARD && !ictx->release_code) {
 		ictx->last_keycode = kc;
 		if (!nomouse) {
-			ictx->pad_mouse = ~(ictx->pad_mouse) & 0x1;
+			ictx->pad_mouse = !ictx->pad_mouse;
 			dev_dbg(dev, "toggling to %s mode\n",
 				ictx->pad_mouse ? "mouse" : "keyboard");
 			spin_unlock_irqrestore(&ictx->kc_lock, flags);
diff -druNp --no-dereference linux-libre-3.18.62-gnu/drivers/misc/enclosure.c linux-libre-3.18.63-gnu/drivers/misc/enclosure.c
--- linux-libre-3.18.62-gnu/drivers/misc/enclosure.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/drivers/misc/enclosure.c	2017-07-27 18:03:49.000000000 -0400
@@ -320,6 +320,7 @@ int enclosure_add_device(struct enclosur
 			 struct device *dev)
 {
 	struct enclosure_component *cdev;
+	int err;
 
 	if (!edev || component >= edev->components)
 		return -EINVAL;
@@ -329,12 +330,17 @@ int enclosure_add_device(struct enclosur
 	if (cdev->dev == dev)
 		return -EEXIST;
 
-	if (cdev->dev)
+	if (cdev->dev) {
 		enclosure_remove_links(cdev);
-
-	put_device(cdev->dev);
+		put_device(cdev->dev);
+	}
 	cdev->dev = get_device(dev);
-	return enclosure_add_links(cdev);
+	err = enclosure_add_links(cdev);
+	if (err) {
+		put_device(cdev->dev);
+		cdev->dev = NULL;
+	}
+	return err;
 }
 EXPORT_SYMBOL_GPL(enclosure_add_device);
 
diff -druNp --no-dereference linux-libre-3.18.62-gnu/drivers/net/wireless/ath/ath9k/ar9003_phy.c linux-libre-3.18.63-gnu/drivers/net/wireless/ath/ath9k/ar9003_phy.c
--- linux-libre-3.18.62-gnu/drivers/net/wireless/ath/ath9k/ar9003_phy.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/drivers/net/wireless/ath/ath9k/ar9003_phy.c	2017-07-27 18:03:49.000000000 -0400
@@ -1707,8 +1707,6 @@ static void ar9003_hw_spectral_scan_wait
 static void ar9003_hw_tx99_start(struct ath_hw *ah, u32 qnum)
 {
 	REG_SET_BIT(ah, AR_PHY_TEST, PHY_AGC_CLR);
-	REG_SET_BIT(ah, 0x9864, 0x7f000);
-	REG_SET_BIT(ah, 0x9924, 0x7f00fe);
 	REG_CLR_BIT(ah, AR_DIAG_SW, AR_DIAG_RX_DIS);
 	REG_WRITE(ah, AR_CR, AR_CR_RXD);
 	REG_WRITE(ah, AR_DLCL_IFS(qnum), 0);
diff -druNp --no-dereference linux-libre-3.18.62-gnu/drivers/net/wireless/ath/ath9k/tx99.c linux-libre-3.18.63-gnu/drivers/net/wireless/ath/ath9k/tx99.c
--- linux-libre-3.18.62-gnu/drivers/net/wireless/ath/ath9k/tx99.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/drivers/net/wireless/ath/ath9k/tx99.c	2017-07-27 18:03:49.000000000 -0400
@@ -190,22 +190,27 @@ static ssize_t write_file_tx99(struct fi
 	if (strtobool(buf, &start))
 		return -EINVAL;
 
+	mutex_lock(&sc->mutex);
+
 	if (start == sc->tx99_state) {
 		if (!start)
-			return count;
+			goto out;
 		ath_dbg(common, XMIT, "Resetting TX99\n");
 		ath9k_tx99_deinit(sc);
 	}
 
 	if (!start) {
 		ath9k_tx99_deinit(sc);
-		return count;
+		goto out;
 	}
 
 	r = ath9k_tx99_init(sc);
-	if (r)
+	if (r) {
+		mutex_unlock(&sc->mutex);
 		return r;
-
+	}
+out:
+	mutex_unlock(&sc->mutex);
 	return count;
 }
 
diff -druNp --no-dereference linux-libre-3.18.62-gnu/drivers/of/device.c linux-libre-3.18.63-gnu/drivers/of/device.c
--- linux-libre-3.18.62-gnu/drivers/of/device.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/drivers/of/device.c	2017-07-27 18:03:49.000000000 -0400
@@ -128,6 +128,7 @@ ssize_t of_device_get_modalias(struct de
 
 	return tsize;
 }
+EXPORT_SYMBOL_GPL(of_device_get_modalias);
 
 /**
  * of_device_uevent - Display OF related uevent information
@@ -190,3 +191,4 @@ int of_device_uevent_modalias(struct dev
 
 	return 0;
 }
+EXPORT_SYMBOL_GPL(of_device_uevent_modalias);
diff -druNp --no-dereference linux-libre-3.18.62-gnu/drivers/pci/pci-driver.c linux-libre-3.18.63-gnu/drivers/pci/pci-driver.c
--- linux-libre-3.18.62-gnu/drivers/pci/pci-driver.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/drivers/pci/pci-driver.c	2017-07-27 18:03:49.000000000 -0400
@@ -925,6 +925,7 @@ static int pci_pm_thaw_noirq(struct devi
 		return pci_legacy_resume_early(dev);
 
 	pci_update_current_state(pci_dev, PCI_D0);
+	pci_restore_state(pci_dev);
 
 	if (drv && drv->pm && drv->pm->thaw_noirq)
 		error = drv->pm->thaw_noirq(dev);
diff -druNp --no-dereference linux-libre-3.18.62-gnu/drivers/spmi/spmi.c linux-libre-3.18.63-gnu/drivers/spmi/spmi.c
--- linux-libre-3.18.62-gnu/drivers/spmi/spmi.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/drivers/spmi/spmi.c	2017-07-27 18:03:49.000000000 -0400
@@ -353,11 +353,23 @@ static int spmi_drv_remove(struct device
 	return 0;
 }
 
+static int spmi_drv_uevent(struct device *dev, struct kobj_uevent_env *env)
+{
+	int ret;
+
+	ret = of_device_uevent_modalias(dev, env);
+	if (ret != -ENODEV)
+		return ret;
+
+	return 0;
+}
+
 static struct bus_type spmi_bus_type = {
 	.name		= "spmi",
 	.match		= spmi_device_match,
 	.probe		= spmi_drv_probe,
 	.remove		= spmi_drv_remove,
+	.uevent		= spmi_drv_uevent,
 };
 
 /**
diff -druNp --no-dereference linux-libre-3.18.62-gnu/drivers/staging/rtl8188eu/os_dep/usb_intf.c linux-libre-3.18.63-gnu/drivers/staging/rtl8188eu/os_dep/usb_intf.c
--- linux-libre-3.18.62-gnu/drivers/staging/rtl8188eu/os_dep/usb_intf.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/drivers/staging/rtl8188eu/os_dep/usb_intf.c	2017-07-27 18:03:49.000000000 -0400
@@ -48,6 +48,7 @@ static struct usb_device_id rtw_usb_id_t
 	{USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */
 	{USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */
 	{USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */
+	{USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */
 	{USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */
 	{}	/* Terminating entry */
 };
diff -druNp --no-dereference linux-libre-3.18.62-gnu/drivers/target/target_core_transport.c linux-libre-3.18.63-gnu/drivers/target/target_core_transport.c
--- linux-libre-3.18.62-gnu/drivers/target/target_core_transport.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/drivers/target/target_core_transport.c	2017-07-27 18:03:49.000000000 -0400
@@ -693,6 +693,15 @@ void target_complete_cmd(struct se_cmd *
 	if (cmd->transport_state & CMD_T_ABORTED ||
 	    cmd->transport_state & CMD_T_STOP) {
 		spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+		/*
+		 * If COMPARE_AND_WRITE was stopped by __transport_wait_for_tasks(),
+		 * release se_device->caw_sem obtained by sbc_compare_and_write()
+		 * since target_complete_ok_work() or target_complete_failure_work()
+		 * won't be called to invoke the normal CAW completion callbacks.
+		 */
+		if (cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) {
+			up(&dev->caw_sem);
+		}
 		complete_all(&cmd->t_transport_stop_comp);
 		return;
 	} else if (!success) {
diff -druNp --no-dereference linux-libre-3.18.62-gnu/drivers/usb/class/cdc-acm.c linux-libre-3.18.63-gnu/drivers/usb/class/cdc-acm.c
--- linux-libre-3.18.62-gnu/drivers/usb/class/cdc-acm.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/drivers/usb/class/cdc-acm.c	2017-07-27 18:03:49.000000000 -0400
@@ -1776,6 +1776,9 @@ static const struct usb_device_id acm_id
 	{ USB_DEVICE(0x1576, 0x03b1), /* Maretron USB100 */
 	.driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
 	},
+	{ USB_DEVICE(0xfff0, 0x0100), /* DATECS FP-2000 */
+	.driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
+	},
 
 	{ USB_DEVICE(0x2912, 0x0001), /* ATOL FPrint */
 	.driver_info = CLEAR_HALT_CONDITIONS,
diff -druNp --no-dereference linux-libre-3.18.62-gnu/drivers/usb/host/xhci-hub.c linux-libre-3.18.63-gnu/drivers/usb/host/xhci-hub.c
--- linux-libre-3.18.62-gnu/drivers/usb/host/xhci-hub.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/drivers/usb/host/xhci-hub.c	2017-07-27 18:03:49.000000000 -0400
@@ -651,6 +651,9 @@ static u32 xhci_get_port_status(struct u
 			clear_bit(wIndex, &bus_state->resuming_ports);
 
 			set_bit(wIndex, &bus_state->rexit_ports);
+
+			xhci_test_and_clear_bit(xhci, port_array, wIndex,
+						PORT_PLC);
 			xhci_set_link_state(xhci, port_array, wIndex,
 					XDEV_U0);
 
diff -druNp --no-dereference linux-libre-3.18.62-gnu/drivers/usb/host/xhci-ring.c linux-libre-3.18.63-gnu/drivers/usb/host/xhci-ring.c
--- linux-libre-3.18.62-gnu/drivers/usb/host/xhci-ring.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/drivers/usb/host/xhci-ring.c	2017-07-27 18:03:49.000000000 -0400
@@ -782,13 +782,16 @@ static void xhci_kill_endpoint_urbs(stru
 			(ep->ep_state & EP_GETTING_NO_STREAMS)) {
 		int stream_id;
 
-		for (stream_id = 0; stream_id < ep->stream_info->num_streams;
+		for (stream_id = 1; stream_id < ep->stream_info->num_streams;
 				stream_id++) {
+			ring = ep->stream_info->stream_rings[stream_id];
+			if (!ring)
+				continue;
+
 			xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
 					"Killing URBs for slot ID %u, ep index %u, stream %u",
-					slot_id, ep_index, stream_id + 1);
-			xhci_kill_ring_urbs(xhci,
-					ep->stream_info->stream_rings[stream_id]);
+					slot_id, ep_index, stream_id);
+			xhci_kill_ring_urbs(xhci, ring);
 		}
 	} else {
 		ring = ep->ring;
diff -druNp --no-dereference linux-libre-3.18.62-gnu/drivers/usb/renesas_usbhs/common.c linux-libre-3.18.63-gnu/drivers/usb/renesas_usbhs/common.c
--- linux-libre-3.18.62-gnu/drivers/usb/renesas_usbhs/common.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/drivers/usb/renesas_usbhs/common.c	2017-07-27 18:03:49.000000000 -0400
@@ -699,8 +699,10 @@ static int usbhsc_resume(struct device *
 	struct usbhs_priv *priv = dev_get_drvdata(dev);
 	struct platform_device *pdev = usbhs_priv_to_pdev(priv);
 
-	if (!usbhsc_flags_has(priv, USBHSF_RUNTIME_PWCTRL))
+	if (!usbhsc_flags_has(priv, USBHSF_RUNTIME_PWCTRL)) {
 		usbhsc_power_ctrl(priv, 1);
+		usbhs_mod_autonomy_mode(priv);
+	}
 
 	usbhs_platform_call(priv, phy_reset, pdev);
 
diff -druNp --no-dereference linux-libre-3.18.62-gnu/drivers/usb/storage/isd200.c linux-libre-3.18.63-gnu/drivers/usb/storage/isd200.c
--- linux-libre-3.18.62-gnu/drivers/usb/storage/isd200.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/drivers/usb/storage/isd200.c	2017-07-27 18:03:49.000000000 -0400
@@ -1522,8 +1522,11 @@ static void isd200_ata_command(struct sc
 
 	/* Make sure driver was initialized */
 
-	if (us->extra == NULL)
+	if (us->extra == NULL) {
 		usb_stor_dbg(us, "ERROR Driver not initialized\n");
+		srb->result = DID_ERROR << 16;
+		return;
+	}
 
 	scsi_set_resid(srb, 0);
 	/* scsi_bufflen might change in protocol translation to ata */
diff -druNp --no-dereference linux-libre-3.18.62-gnu/drivers/vfio/vfio.c linux-libre-3.18.63-gnu/drivers/vfio/vfio.c
--- linux-libre-3.18.62-gnu/drivers/vfio/vfio.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/drivers/vfio/vfio.c	2017-07-27 18:03:49.000000000 -0400
@@ -278,6 +278,34 @@ static void vfio_group_put(struct vfio_g
 	kref_put_mutex(&group->kref, vfio_group_release, &vfio.group_lock);
 }
 
+struct vfio_group_put_work {
+	struct work_struct work;
+	struct vfio_group *group;
+};
+
+static void vfio_group_put_bg(struct work_struct *work)
+{
+	struct vfio_group_put_work *do_work;
+
+	do_work = container_of(work, struct vfio_group_put_work, work);
+
+	vfio_group_put(do_work->group);
+	kfree(do_work);
+}
+
+static void vfio_group_schedule_put(struct vfio_group *group)
+{
+	struct vfio_group_put_work *do_work;
+
+	do_work = kmalloc(sizeof(*do_work), GFP_KERNEL);
+	if (WARN_ON(!do_work))
+		return;
+
+	INIT_WORK(&do_work->work, vfio_group_put_bg);
+	do_work->group = group;
+	schedule_work(&do_work->work);
+}
+
 /* Assume group_lock or group reference is held */
 static void vfio_group_get(struct vfio_group *group)
 {
@@ -553,7 +581,14 @@ static int vfio_iommu_group_notifier(str
 		break;
 	}
 
-	vfio_group_put(group);
+	/*
+	 * If we're the last reference to the group, the group will be
+	 * released, which includes unregistering the iommu group notifier.
+	 * We hold a read-lock on that notifier list, unregistering needs
+	 * a write-lock... deadlock.  Release our reference asynchronously
+	 * to avoid that situation.
+	 */
+	vfio_group_schedule_put(group);
 	return NOTIFY_OK;
 }
 
@@ -1401,6 +1436,15 @@ void vfio_group_put_external_user(struct
 }
 EXPORT_SYMBOL_GPL(vfio_group_put_external_user);
 
+bool vfio_external_group_match_file(struct vfio_group *test_group,
+				    struct file *filep)
+{
+	struct vfio_group *group = filep->private_data;
+
+	return (filep->f_op == &vfio_group_fops) && (group == test_group);
+}
+EXPORT_SYMBOL_GPL(vfio_external_group_match_file);
+
 int vfio_external_user_iommu_id(struct vfio_group *group)
 {
 	return iommu_group_id(group->iommu_group);
diff -druNp --no-dereference linux-libre-3.18.62-gnu/fs/cifs/smb2ops.c linux-libre-3.18.63-gnu/fs/cifs/smb2ops.c
--- linux-libre-3.18.62-gnu/fs/cifs/smb2ops.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/fs/cifs/smb2ops.c	2017-07-27 18:03:49.000000000 -0400
@@ -1383,6 +1383,7 @@ struct smb_version_operations smb20_oper
 	.clear_stats = smb2_clear_stats,
 	.print_stats = smb2_print_stats,
 	.is_oplock_break = smb2_is_valid_oplock_break,
+	.handle_cancelled_mid = smb2_handle_cancelled_mid,
 	.downgrade_oplock = smb2_downgrade_oplock,
 	.need_neg = smb2_need_neg,
 	.negotiate = smb2_negotiate,
@@ -1462,7 +1463,6 @@ struct smb_version_operations smb21_oper
 	.print_stats = smb2_print_stats,
 	.is_oplock_break = smb2_is_valid_oplock_break,
 	.handle_cancelled_mid = smb2_handle_cancelled_mid,
-	.handle_cancelled_mid = smb2_handle_cancelled_mid,
 	.downgrade_oplock = smb2_downgrade_oplock,
 	.need_neg = smb2_need_neg,
 	.negotiate = smb2_negotiate,
@@ -1545,7 +1545,6 @@ struct smb_version_operations smb30_oper
 	.dump_share_caps = smb2_dump_share_caps,
 	.is_oplock_break = smb2_is_valid_oplock_break,
 	.handle_cancelled_mid = smb2_handle_cancelled_mid,
-	.handle_cancelled_mid = smb2_handle_cancelled_mid,
 	.downgrade_oplock = smb2_downgrade_oplock,
 	.need_neg = smb2_need_neg,
 	.negotiate = smb2_negotiate,
diff -druNp --no-dereference linux-libre-3.18.62-gnu/fs/f2fs/acl.c linux-libre-3.18.63-gnu/fs/f2fs/acl.c
--- linux-libre-3.18.62-gnu/fs/f2fs/acl.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/fs/f2fs/acl.c	2017-07-27 18:03:49.000000000 -0400
@@ -206,7 +206,7 @@ static int __f2fs_set_acl(struct inode *
 	switch (type) {
 	case ACL_TYPE_ACCESS:
 		name_index = F2FS_XATTR_INDEX_POSIX_ACL_ACCESS;
-		if (acl) {
+		if (acl && !ipage) {
 			error = posix_acl_update_mode(inode, &inode->i_mode, &acl);
 			if (error)
 				return error;
diff -druNp --no-dereference linux-libre-3.18.62-gnu/fs/nfs/dir.c linux-libre-3.18.63-gnu/fs/nfs/dir.c
--- linux-libre-3.18.62-gnu/fs/nfs/dir.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/fs/nfs/dir.c	2017-07-27 18:03:49.000000000 -0400
@@ -1141,11 +1141,13 @@ static int nfs_lookup_revalidate(struct
 	/* Force a full look up iff the parent directory has changed */
 	if (!nfs_is_exclusive_create(dir, flags) &&
 	    nfs_check_verifier(dir, dentry, flags & LOOKUP_RCU)) {
-
-		if (nfs_lookup_verify_inode(inode, flags)) {
+		error = nfs_lookup_verify_inode(inode, flags);
+		if (error) {
 			if (flags & LOOKUP_RCU)
 				return -ECHILD;
-			goto out_zap_parent;
+			if (error == -ESTALE)
+				goto out_zap_parent;
+			goto out_error;
 		}
 		goto out_valid;
 	}
@@ -1169,8 +1171,10 @@ static int nfs_lookup_revalidate(struct
 	trace_nfs_lookup_revalidate_enter(dir, dentry, flags);
 	error = NFS_PROTO(dir)->lookup(dir, &dentry->d_name, fhandle, fattr, label);
 	trace_nfs_lookup_revalidate_exit(dir, dentry, flags, error);
-	if (error)
+	if (error == -ESTALE || error == -ENOENT)
 		goto out_bad;
+	if (error)
+		goto out_error;
 	if (nfs_compare_fh(NFS_FH(inode), fhandle))
 		goto out_bad;
 	if ((error = nfs_refresh_inode(inode, fattr)) != 0)
diff -druNp --no-dereference linux-libre-3.18.62-gnu/fs/nfs/inode.c linux-libre-3.18.63-gnu/fs/nfs/inode.c
--- linux-libre-3.18.62-gnu/fs/nfs/inode.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/fs/nfs/inode.c	2017-07-27 18:03:49.000000000 -0400
@@ -1177,9 +1177,9 @@ static int nfs_check_inode_attributes(st
 		return 0;
 	/* Has the inode gone and changed behind our back? */
 	if ((fattr->valid & NFS_ATTR_FATTR_FILEID) && nfsi->fileid != fattr->fileid)
-		return -EIO;
+		return -ESTALE;
 	if ((fattr->valid & NFS_ATTR_FATTR_TYPE) && (inode->i_mode & S_IFMT) != (fattr->mode & S_IFMT))
-		return -EIO;
+		return -ESTALE;
 
 	if ((fattr->valid & NFS_ATTR_FATTR_CHANGE) != 0 &&
 			inode->i_version != fattr->change_attr)
diff -druNp --no-dereference linux-libre-3.18.62-gnu/fs/udf/inode.c linux-libre-3.18.63-gnu/fs/udf/inode.c
--- linux-libre-3.18.62-gnu/fs/udf/inode.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/fs/udf/inode.c	2017-07-27 18:03:49.000000000 -0400
@@ -1237,8 +1237,8 @@ int udf_setsize(struct inode *inode, lof
 			return err;
 		}
 set_size:
-		truncate_setsize(inode, newsize);
 		up_write(&iinfo->i_data_sem);
+		truncate_setsize(inode, newsize);
 	} else {
 		if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
 			down_write(&iinfo->i_data_sem);
@@ -1255,9 +1255,9 @@ set_size:
 					  udf_get_block);
 		if (err)
 			return err;
+		truncate_setsize(inode, newsize);
 		down_write(&iinfo->i_data_sem);
 		udf_clear_extent_cache(inode);
-		truncate_setsize(inode, newsize);
 		udf_truncate_extents(inode);
 		up_write(&iinfo->i_data_sem);
 	}
diff -druNp --no-dereference linux-libre-3.18.62-gnu/include/linux/stddef.h linux-libre-3.18.63-gnu/include/linux/stddef.h
--- linux-libre-3.18.62-gnu/include/linux/stddef.h	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/include/linux/stddef.h	2017-07-27 18:03:49.000000000 -0400
@@ -3,7 +3,6 @@
 
 #include <uapi/linux/stddef.h>
 
-
 #undef NULL
 #define NULL ((void *)0)
 
@@ -14,8 +13,18 @@ enum {
 
 #undef offsetof
 #ifdef __compiler_offsetof
-#define offsetof(TYPE,MEMBER) __compiler_offsetof(TYPE,MEMBER)
+#define offsetof(TYPE, MEMBER)	__compiler_offsetof(TYPE, MEMBER)
 #else
-#define offsetof(TYPE, MEMBER) ((size_t) &((TYPE *)0)->MEMBER)
+#define offsetof(TYPE, MEMBER)	((size_t)&((TYPE *)0)->MEMBER)
 #endif
+
+/**
+ * offsetofend(TYPE, MEMBER)
+ *
+ * @TYPE: The type of the structure
+ * @MEMBER: The member within the structure to get the end offset of
+ */
+#define offsetofend(TYPE, MEMBER) \
+	(offsetof(TYPE, MEMBER)	+ sizeof(((TYPE *)0)->MEMBER))
+
 #endif
diff -druNp --no-dereference linux-libre-3.18.62-gnu/include/linux/vfio.h linux-libre-3.18.63-gnu/include/linux/vfio.h
--- linux-libre-3.18.62-gnu/include/linux/vfio.h	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/include/linux/vfio.h	2017-07-27 18:03:49.000000000 -0400
@@ -76,24 +76,13 @@ extern int vfio_register_iommu_driver(co
 extern void vfio_unregister_iommu_driver(
 				const struct vfio_iommu_driver_ops *ops);
 
-/**
- * offsetofend(TYPE, MEMBER)
- *
- * @TYPE: The type of the structure
- * @MEMBER: The member within the structure to get the end offset of
- *
- * Simple helper macro for dealing with variable sized structures passed
- * from user space.  This allows us to easily determine if the provided
- * structure is sized to include various fields.
- */
-#define offsetofend(TYPE, MEMBER) \
-	(offsetof(TYPE, MEMBER)	+ sizeof(((TYPE *)0)->MEMBER))
-
 /*
  * External user API
  */
 extern struct vfio_group *vfio_group_get_external_user(struct file *filep);
 extern void vfio_group_put_external_user(struct vfio_group *group);
+extern bool vfio_external_group_match_file(struct vfio_group *group,
+					   struct file *filep);
 extern int vfio_external_user_iommu_id(struct vfio_group *group);
 extern long vfio_external_check_extension(struct vfio_group *group,
 					  unsigned long arg);
diff -druNp --no-dereference linux-libre-3.18.62-gnu/kernel/events/core.c linux-libre-3.18.63-gnu/kernel/events/core.c
--- linux-libre-3.18.62-gnu/kernel/events/core.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/kernel/events/core.c	2017-07-27 18:03:49.000000000 -0400
@@ -5761,21 +5761,6 @@ static void perf_log_throttle(struct per
 	perf_output_end(&handle);
 }
 
-static bool sample_is_allowed(struct perf_event *event, struct pt_regs *regs)
-{
-	/*
-	 * Due to interrupt latency (AKA "skid"), we may enter the
-	 * kernel before taking an overflow, even if the PMU is only
-	 * counting user events.
-	 * To avoid leaking information to userspace, we must always
-	 * reject kernel samples when exclude_kernel is set.
-	 */
-	if (event->attr.exclude_kernel && !user_mode(regs))
-		return false;
-
-	return true;
-}
-
 /*
  * Generic event overflow handling, sampling.
  */
@@ -5823,12 +5808,6 @@ static int __perf_event_overflow(struct
 	}
 
 	/*
-	 * For security, drop the skid kernel samples if necessary.
-	 */
-	if (!sample_is_allowed(event, regs))
-		return ret;
-
-	/*
 	 * XXX event_limit might not quite work as expected on inherited
 	 * events
 	 */
diff -druNp --no-dereference linux-libre-3.18.62-gnu/kernel/time/alarmtimer.c linux-libre-3.18.63-gnu/kernel/time/alarmtimer.c
--- linux-libre-3.18.62-gnu/kernel/time/alarmtimer.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/kernel/time/alarmtimer.c	2017-07-27 18:03:49.000000000 -0400
@@ -619,7 +619,8 @@ static int alarm_timer_set(struct k_itim
 	 * Rate limit to the tick as a hot fix to prevent DOS. Will be
 	 * mopped up later.
 	 */
-	if (ktime_to_ns(timr->it.alarm.interval) < TICK_NSEC)
+	if (timr->it.alarm.interval.tv64 &&
+			ktime_to_ns(timr->it.alarm.interval) < TICK_NSEC)
 		timr->it.alarm.interval = ktime_set(0, TICK_NSEC);
 
 	exp = timespec_to_ktime(new_setting->it_value);
diff -druNp --no-dereference linux-libre-3.18.62-gnu/kernel/trace/trace.c linux-libre-3.18.63-gnu/kernel/trace/trace.c
--- linux-libre-3.18.62-gnu/kernel/trace/trace.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/kernel/trace/trace.c	2017-07-27 18:03:49.000000000 -0400
@@ -6405,6 +6405,7 @@ static int instance_delete(const char *n
 	debugfs_remove_recursive(tr->dir);
 	free_trace_buffers(tr);
 
+	free_cpumask_var(tr->tracing_cpumask);
 	kfree(tr->name);
 	kfree(tr);
 
diff -druNp --no-dereference linux-libre-3.18.62-gnu/Makefile linux-libre-3.18.63-gnu/Makefile
--- linux-libre-3.18.62-gnu/Makefile	2017-07-21 04:53:48.000000000 -0400
+++ linux-libre-3.18.63-gnu/Makefile	2017-07-27 21:23:45.000000000 -0400
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 18
-SUBLEVEL = 62
+SUBLEVEL = 63
 EXTRAVERSION =-gnu
 NAME = Diseased Newt
 
@@ -611,6 +611,9 @@ include $(srctree)/arch/$(SRCARCH)/Makef
 
 KBUILD_CFLAGS	+= $(call cc-option,-fno-delete-null-pointer-checks,)
 KBUILD_CFLAGS	+= $(call cc-disable-warning,frame-address,)
+KBUILD_CFLAGS	+= $(call cc-disable-warning, format-truncation)
+KBUILD_CFLAGS	+= $(call cc-disable-warning, format-overflow)
+KBUILD_CFLAGS	+= $(call cc-disable-warning, int-in-bool-context)
 KBUILD_CFLAGS	+= $(call cc-option,-fno-PIE)
 KBUILD_AFLAGS	+= $(call cc-option,-fno-PIE)
 
diff -druNp --no-dereference linux-libre-3.18.62-gnu/net/bluetooth/smp.c linux-libre-3.18.63-gnu/net/bluetooth/smp.c
--- linux-libre-3.18.62-gnu/net/bluetooth/smp.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/net/bluetooth/smp.c	2017-07-27 18:03:49.000000000 -0400
@@ -22,6 +22,7 @@
 
 #include <linux/crypto.h>
 #include <linux/scatterlist.h>
+#include <crypto/algapi.h>
 #include <crypto/b128ops.h>
 
 #include <net/bluetooth/bluetooth.h>
@@ -163,7 +164,7 @@ bool smp_irk_matches(struct hci_dev *hde
 	if (err)
 		return false;
 
-	return !memcmp(bdaddr->b, hash, 3);
+	return !crypto_memneq(bdaddr->b, hash, 3);
 }
 
 int smp_generate_rpa(struct hci_dev *hdev, u8 irk[16], bdaddr_t *rpa)
@@ -584,7 +585,7 @@ static u8 smp_random(struct smp_chan *sm
 	if (ret)
 		return SMP_UNSPECIFIED;
 
-	if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
+	if (crypto_memneq(smp->pcnf, confirm, sizeof(smp->pcnf))) {
 		BT_ERR("Pairing failed (confirmation values mismatch)");
 		return SMP_CONFIRM_FAILED;
 	}
diff -druNp --no-dereference linux-libre-3.18.62-gnu/net/key/af_key.c linux-libre-3.18.63-gnu/net/key/af_key.c
--- linux-libre-3.18.62-gnu/net/key/af_key.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/net/key/af_key.c	2017-07-27 18:03:49.000000000 -0400
@@ -65,6 +65,10 @@ struct pfkey_sock {
 	} dump;
 };
 
+static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len,
+			       xfrm_address_t *saddr, xfrm_address_t *daddr,
+			       u16 *family);
+
 static inline struct pfkey_sock *pfkey_sk(struct sock *sk)
 {
 	return (struct pfkey_sock *)sk;
@@ -1921,19 +1925,14 @@ parse_ipsecrequest(struct xfrm_policy *x
 
 	/* addresses present only in tunnel mode */
 	if (t->mode == XFRM_MODE_TUNNEL) {
-		u8 *sa = (u8 *) (rq + 1);
-		int family, socklen;
-
-		family = pfkey_sockaddr_extract((struct sockaddr *)sa,
-						&t->saddr);
-		if (!family)
-			return -EINVAL;
+		int err;
 
-		socklen = pfkey_sockaddr_len(family);
-		if (pfkey_sockaddr_extract((struct sockaddr *)(sa + socklen),
-					   &t->id.daddr) != family)
-			return -EINVAL;
-		t->encap_family = family;
+		err = parse_sockaddr_pair(
+			(struct sockaddr *)(rq + 1),
+			rq->sadb_x_ipsecrequest_len - sizeof(*rq),
+			&t->saddr, &t->id.daddr, &t->encap_family);
+		if (err)
+			return err;
 	} else
 		t->encap_family = xp->family;
 
@@ -1953,7 +1952,11 @@ parse_ipsecrequests(struct xfrm_policy *
 	if (pol->sadb_x_policy_len * 8 < sizeof(struct sadb_x_policy))
 		return -EINVAL;
 
-	while (len >= sizeof(struct sadb_x_ipsecrequest)) {
+	while (len >= sizeof(*rq)) {
+		if (len < rq->sadb_x_ipsecrequest_len ||
+		    rq->sadb_x_ipsecrequest_len < sizeof(*rq))
+			return -EINVAL;
+
 		if ((err = parse_ipsecrequest(xp, rq)) < 0)
 			return err;
 		len -= rq->sadb_x_ipsecrequest_len;
@@ -2416,7 +2419,6 @@ out:
 	return err;
 }
 
-#ifdef CONFIG_NET_KEY_MIGRATE
 static int pfkey_sockaddr_pair_size(sa_family_t family)
 {
 	return PFKEY_ALIGN8(pfkey_sockaddr_len(family) * 2);
@@ -2428,7 +2430,7 @@ static int parse_sockaddr_pair(struct so
 {
 	int af, socklen;
 
-	if (ext_len < pfkey_sockaddr_pair_size(sa->sa_family))
+	if (ext_len < 2 || ext_len < pfkey_sockaddr_pair_size(sa->sa_family))
 		return -EINVAL;
 
 	af = pfkey_sockaddr_extract(sa, saddr);
@@ -2444,6 +2446,7 @@ static int parse_sockaddr_pair(struct so
 	return 0;
 }
 
+#ifdef CONFIG_NET_KEY_MIGRATE
 static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len,
 				    struct xfrm_migrate *m)
 {
@@ -2451,13 +2454,14 @@ static int ipsecrequests_to_migrate(stru
 	struct sadb_x_ipsecrequest *rq2;
 	int mode;
 
-	if (len <= sizeof(struct sadb_x_ipsecrequest) ||
-	    len < rq1->sadb_x_ipsecrequest_len)
+	if (len < sizeof(*rq1) ||
+	    len < rq1->sadb_x_ipsecrequest_len ||
+	    rq1->sadb_x_ipsecrequest_len < sizeof(*rq1))
 		return -EINVAL;
 
 	/* old endoints */
 	err = parse_sockaddr_pair((struct sockaddr *)(rq1 + 1),
-				  rq1->sadb_x_ipsecrequest_len,
+				  rq1->sadb_x_ipsecrequest_len - sizeof(*rq1),
 				  &m->old_saddr, &m->old_daddr,
 				  &m->old_family);
 	if (err)
@@ -2466,13 +2470,14 @@ static int ipsecrequests_to_migrate(stru
 	rq2 = (struct sadb_x_ipsecrequest *)((u8 *)rq1 + rq1->sadb_x_ipsecrequest_len);
 	len -= rq1->sadb_x_ipsecrequest_len;
 
-	if (len <= sizeof(struct sadb_x_ipsecrequest) ||
-	    len < rq2->sadb_x_ipsecrequest_len)
+	if (len <= sizeof(*rq2) ||
+	    len < rq2->sadb_x_ipsecrequest_len ||
+	    rq2->sadb_x_ipsecrequest_len < sizeof(*rq2))
 		return -EINVAL;
 
 	/* new endpoints */
 	err = parse_sockaddr_pair((struct sockaddr *)(rq2 + 1),
-				  rq2->sadb_x_ipsecrequest_len,
+				  rq2->sadb_x_ipsecrequest_len - sizeof(*rq2),
 				  &m->new_saddr, &m->new_daddr,
 				  &m->new_family);
 	if (err)
diff -druNp --no-dereference linux-libre-3.18.62-gnu/net/nfc/core.c linux-libre-3.18.63-gnu/net/nfc/core.c
--- linux-libre-3.18.62-gnu/net/nfc/core.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/net/nfc/core.c	2017-07-27 18:03:49.000000000 -0400
@@ -950,6 +950,8 @@ static void nfc_release(struct device *d
 			kfree(se);
 	}
 
+	ida_simple_remove(&nfc_index_ida, dev->idx);
+
 	kfree(dev);
 }
 
@@ -1024,6 +1026,7 @@ struct nfc_dev *nfc_allocate_device(stru
 				    int tx_headroom, int tx_tailroom)
 {
 	struct nfc_dev *dev;
+	int rc;
 
 	if (!ops->start_poll || !ops->stop_poll || !ops->activate_target ||
 	    !ops->deactivate_target || !ops->im_transceive)
@@ -1036,6 +1039,15 @@ struct nfc_dev *nfc_allocate_device(stru
 	if (!dev)
 		return NULL;
 
+	rc = ida_simple_get(&nfc_index_ida, 0, 0, GFP_KERNEL);
+	if (rc < 0)
+		goto err_free_dev;
+	dev->idx = rc;
+
+	dev->dev.class = &nfc_class;
+	dev_set_name(&dev->dev, "nfc%d", dev->idx);
+	device_initialize(&dev->dev);
+
 	dev->ops = ops;
 	dev->supported_protocols = supported_protocols;
 	dev->tx_headroom = tx_headroom;
@@ -1058,6 +1070,11 @@ struct nfc_dev *nfc_allocate_device(stru
 	}
 
 	return dev;
+
+err_free_dev:
+	kfree(dev);
+
+	return ERR_PTR(rc);
 }
 EXPORT_SYMBOL(nfc_allocate_device);
 
@@ -1072,14 +1089,6 @@ int nfc_register_device(struct nfc_dev *
 
 	pr_debug("dev_name=%s\n", dev_name(&dev->dev));
 
-	dev->idx = ida_simple_get(&nfc_index_ida, 0, 0, GFP_KERNEL);
-	if (dev->idx < 0)
-		return dev->idx;
-
-	dev->dev.class = &nfc_class;
-	dev_set_name(&dev->dev, "nfc%d", dev->idx);
-	device_initialize(&dev->dev);
-
 	mutex_lock(&nfc_devlist_mutex);
 	nfc_devlist_generation++;
 	rc = device_add(&dev->dev);
@@ -1117,12 +1126,10 @@ EXPORT_SYMBOL(nfc_register_device);
  */
 void nfc_unregister_device(struct nfc_dev *dev)
 {
-	int rc, id;
+	int rc;
 
 	pr_debug("dev_name=%s\n", dev_name(&dev->dev));
 
-	id = dev->idx;
-
 	if (dev->rfkill) {
 		rfkill_unregister(dev->rfkill);
 		rfkill_destroy(dev->rfkill);
@@ -1147,8 +1154,6 @@ void nfc_unregister_device(struct nfc_de
 	nfc_devlist_generation++;
 	device_del(&dev->dev);
 	mutex_unlock(&nfc_devlist_mutex);
-
-	ida_simple_remove(&nfc_index_ida, id);
 }
 EXPORT_SYMBOL(nfc_unregister_device);
 
diff -druNp --no-dereference linux-libre-3.18.62-gnu/net/nfc/llcp_sock.c linux-libre-3.18.63-gnu/net/nfc/llcp_sock.c
--- linux-libre-3.18.62-gnu/net/nfc/llcp_sock.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/net/nfc/llcp_sock.c	2017-07-27 18:03:49.000000000 -0400
@@ -76,7 +76,8 @@ static int llcp_sock_bind(struct socket
 	struct sockaddr_nfc_llcp llcp_addr;
 	int len, ret = 0;
 
-	if (!addr || addr->sa_family != AF_NFC)
+	if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
+	    addr->sa_family != AF_NFC)
 		return -EINVAL;
 
 	pr_debug("sk %p addr %p family %d\n", sk, addr, addr->sa_family);
@@ -150,7 +151,8 @@ static int llcp_raw_sock_bind(struct soc
 	struct sockaddr_nfc_llcp llcp_addr;
 	int len, ret = 0;
 
-	if (!addr || addr->sa_family != AF_NFC)
+	if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
+	    addr->sa_family != AF_NFC)
 		return -EINVAL;
 
 	pr_debug("sk %p addr %p family %d\n", sk, addr, addr->sa_family);
@@ -655,8 +657,7 @@ static int llcp_sock_connect(struct sock
 
 	pr_debug("sock %p sk %p flags 0x%x\n", sock, sk, flags);
 
-	if (!addr || len < sizeof(struct sockaddr_nfc) ||
-	    addr->sa_family != AF_NFC)
+	if (!addr || len < sizeof(*addr) || addr->sa_family != AF_NFC)
 		return -EINVAL;
 
 	if (addr->service_name_len == 0 && addr->dsap == 0)
diff -druNp --no-dereference linux-libre-3.18.62-gnu/net/nfc/netlink.c linux-libre-3.18.63-gnu/net/nfc/netlink.c
--- linux-libre-3.18.62-gnu/net/nfc/netlink.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/net/nfc/netlink.c	2017-07-27 18:03:49.000000000 -0400
@@ -899,7 +899,9 @@ static int nfc_genl_llc_get_params(struc
 	struct sk_buff *msg = NULL;
 	u32 idx;
 
-	if (!info->attrs[NFC_ATTR_DEVICE_INDEX])
+	if (!info->attrs[NFC_ATTR_DEVICE_INDEX] ||
+	    !info->attrs[NFC_ATTR_TARGET_INDEX] ||
+	    !info->attrs[NFC_ATTR_PROTOCOLS])
 		return -EINVAL;
 
 	idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]);
diff -druNp --no-dereference linux-libre-3.18.62-gnu/sound/soc/soc-compress.c linux-libre-3.18.63-gnu/sound/soc/soc-compress.c
--- linux-libre-3.18.62-gnu/sound/soc/soc-compress.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/sound/soc/soc-compress.c	2017-07-27 18:03:49.000000000 -0400
@@ -68,7 +68,8 @@ out:
 static int soc_compr_open_fe(struct snd_compr_stream *cstream)
 {
 	struct snd_soc_pcm_runtime *fe = cstream->private_data;
-	struct snd_pcm_substream *fe_substream = fe->pcm->streams[0].substream;
+	struct snd_pcm_substream *fe_substream =
+		 fe->pcm->streams[cstream->direction].substream;
 	struct snd_soc_platform *platform = fe->platform;
 	struct snd_soc_dpcm *dpcm;
 	struct snd_soc_dapm_widget_list *list;
@@ -415,7 +416,8 @@ static int soc_compr_set_params_fe(struc
 					struct snd_compr_params *params)
 {
 	struct snd_soc_pcm_runtime *fe = cstream->private_data;
-	struct snd_pcm_substream *fe_substream = fe->pcm->streams[0].substream;
+	struct snd_pcm_substream *fe_substream =
+		 fe->pcm->streams[cstream->direction].substream;
 	struct snd_soc_platform *platform = fe->platform;
 	int ret = 0, stream;
 
diff -druNp --no-dereference linux-libre-3.18.62-gnu/tools/perf/ui/browser.c linux-libre-3.18.63-gnu/tools/perf/ui/browser.c
--- linux-libre-3.18.62-gnu/tools/perf/ui/browser.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/tools/perf/ui/browser.c	2017-07-27 18:03:49.000000000 -0400
@@ -673,7 +673,7 @@ static void __ui_browser__line_arrow_dow
 		ui_browser__gotorc(browser, row, column + 1);
 		SLsmg_draw_hline(2);
 
-		if (row++ == 0)
+		if (++row == 0)
 			goto out;
 	} else
 		row = 0;
diff -druNp --no-dereference linux-libre-3.18.62-gnu/virt/kvm/ioapic.c linux-libre-3.18.63-gnu/virt/kvm/ioapic.c
--- linux-libre-3.18.62-gnu/virt/kvm/ioapic.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/virt/kvm/ioapic.c	2017-07-27 18:03:49.000000000 -0400
@@ -610,7 +610,7 @@ static void kvm_ioapic_reset(struct kvm_
 	ioapic->ioregsel = 0;
 	ioapic->irr = 0;
 	ioapic->id = 0;
-	memset(ioapic->irq_eoi, 0x00, IOAPIC_NUM_PINS);
+	memset(ioapic->irq_eoi, 0x00, sizeof(ioapic->irq_eoi));
 	rtc_irq_eoi_tracking_reset(ioapic);
 	update_handled_vectors(ioapic);
 }
diff -druNp --no-dereference linux-libre-3.18.62-gnu/virt/kvm/vfio.c linux-libre-3.18.63-gnu/virt/kvm/vfio.c
--- linux-libre-3.18.62-gnu/virt/kvm/vfio.c	2017-07-21 02:12:37.000000000 -0400
+++ linux-libre-3.18.63-gnu/virt/kvm/vfio.c	2017-07-27 18:03:49.000000000 -0400
@@ -47,6 +47,22 @@ static struct vfio_group *kvm_vfio_group
 	return vfio_group;
 }
 
+static bool kvm_vfio_external_group_match_file(struct vfio_group *group,
+					       struct file *filep)
+{
+	bool ret, (*fn)(struct vfio_group *, struct file *);
+
+	fn = symbol_get(vfio_external_group_match_file);
+	if (!fn)
+		return false;
+
+	ret = fn(group, filep);
+
+	symbol_put(vfio_external_group_match_file);
+
+	return ret;
+}
+
 static void kvm_vfio_group_put_external_user(struct vfio_group *vfio_group)
 {
 	void (*fn)(struct vfio_group *);
@@ -169,18 +185,13 @@ static int kvm_vfio_set_group(struct kvm
 		if (!f.file)
 			return -EBADF;
 
-		vfio_group = kvm_vfio_group_get_external_user(f.file);
-		fdput(f);
-
-		if (IS_ERR(vfio_group))
-			return PTR_ERR(vfio_group);
-
 		ret = -ENOENT;
 
 		mutex_lock(&kv->lock);
 
 		list_for_each_entry(kvg, &kv->group_list, node) {
-			if (kvg->vfio_group != vfio_group)
+			if (!kvm_vfio_external_group_match_file(kvg->vfio_group,
+								f.file))
 				continue;
 
 			list_del(&kvg->node);
@@ -192,7 +203,7 @@ static int kvm_vfio_set_group(struct kvm
 
 		mutex_unlock(&kv->lock);
 
-		kvm_vfio_group_put_external_user(vfio_group);
+		fdput(f);
 
 		kvm_vfio_update_coherency(dev);
 
