diff -druNp --no-dereference linux-libre-3.18.66-gnu/drivers/irqchip/irq-atmel-aic-common.c linux-libre-3.18.67-gnu/drivers/irqchip/irq-atmel-aic-common.c
--- linux-libre-3.18.66-gnu/drivers/irqchip/irq-atmel-aic-common.c	2017-08-16 16:35:42.000000000 -0400
+++ linux-libre-3.18.67-gnu/drivers/irqchip/irq-atmel-aic-common.c	2017-08-24 20:00:20.000000000 -0400
@@ -148,9 +148,9 @@ void __init aic_common_rtc_irq_fixup(str
 	struct device_node *np;
 	void __iomem *regs;
 
-	np = of_find_compatible_node(root, NULL, "atmel,at91rm9200-rtc");
+	np = of_find_compatible_node(NULL, NULL, "atmel,at91rm9200-rtc");
 	if (!np)
-		np = of_find_compatible_node(root, NULL,
+		np = of_find_compatible_node(NULL, NULL,
 					     "atmel,at91sam9x5-rtc");
 
 	if (!np)
@@ -176,7 +176,6 @@ void __init aic_common_irq_fixup(const s
 		return;
 
 	match = of_match_node(matches, root);
-	of_node_put(root);
 
 	if (match) {
 		void (*fixup)(struct device_node *) = match->data;
diff -druNp --no-dereference linux-libre-3.18.66-gnu/drivers/net/usb/qmi_wwan.c linux-libre-3.18.67-gnu/drivers/net/usb/qmi_wwan.c
--- linux-libre-3.18.66-gnu/drivers/net/usb/qmi_wwan.c	2017-08-16 16:35:42.000000000 -0400
+++ linux-libre-3.18.67-gnu/drivers/net/usb/qmi_wwan.c	2017-08-24 20:00:20.000000000 -0400
@@ -749,6 +749,7 @@ static const struct usb_device_id produc
 	{QMI_FIXED_INTF(0x19d2, 0x1428, 2)},	/* Telewell TW-LTE 4G v2 */
 	{QMI_FIXED_INTF(0x19d2, 0x2002, 4)},	/* ZTE (Vodafone) K3765-Z */
 	{QMI_FIXED_INTF(0x2001, 0x7e19, 4)},	/* D-Link DWM-221 B1 */
+	{QMI_FIXED_INTF(0x2001, 0x7e35, 4)},	/* D-Link DWM-222 */
 	{QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)},    /* Sierra Wireless MC7700 */
 	{QMI_FIXED_INTF(0x114f, 0x68a2, 8)},    /* Sierra Wireless MC7750 */
 	{QMI_FIXED_INTF(0x1199, 0x68a2, 8)},	/* Sierra Wireless MC7710 in QMI mode */
diff -druNp --no-dereference linux-libre-3.18.66-gnu/drivers/parisc/dino.c linux-libre-3.18.67-gnu/drivers/parisc/dino.c
--- linux-libre-3.18.66-gnu/drivers/parisc/dino.c	2017-08-16 16:35:42.000000000 -0400
+++ linux-libre-3.18.67-gnu/drivers/parisc/dino.c	2017-08-24 20:00:20.000000000 -0400
@@ -954,7 +954,7 @@ static int __init dino_probe(struct pari
 
 	dino_dev->hba.dev = dev;
 	dino_dev->hba.base_addr = ioremap_nocache(hpa, 4096);
-	dino_dev->hba.lmmio_space_offset = 0;	/* CPU addrs == bus addrs */
+	dino_dev->hba.lmmio_space_offset = PCI_F_EXTEND;
 	spin_lock_init(&dino_dev->dinosaur_pen);
 	dino_dev->hba.iommu = ccio_get_iommu(dev);
 
diff -druNp --no-dereference linux-libre-3.18.66-gnu/include/linux/pid.h linux-libre-3.18.67-gnu/include/linux/pid.h
--- linux-libre-3.18.66-gnu/include/linux/pid.h	2017-08-16 16:35:42.000000000 -0400
+++ linux-libre-3.18.67-gnu/include/linux/pid.h	2017-08-24 20:00:20.000000000 -0400
@@ -8,7 +8,9 @@ enum pid_type
 	PIDTYPE_PID,
 	PIDTYPE_PGID,
 	PIDTYPE_SID,
-	PIDTYPE_MAX
+	PIDTYPE_MAX,
+	/* only valid to __task_pid_nr_ns() */
+	__PIDTYPE_TGID
 };
 
 /*
diff -druNp --no-dereference linux-libre-3.18.66-gnu/include/linux/sched.h linux-libre-3.18.67-gnu/include/linux/sched.h
--- linux-libre-3.18.66-gnu/include/linux/sched.h	2017-08-16 16:35:42.000000000 -0400
+++ linux-libre-3.18.67-gnu/include/linux/sched.h	2017-08-24 20:00:20.000000000 -0400
@@ -1777,31 +1777,8 @@ static inline pid_t task_tgid_nr(struct
 	return tsk->tgid;
 }
 
-pid_t task_tgid_nr_ns(struct task_struct *tsk, struct pid_namespace *ns);
-
-static inline pid_t task_tgid_vnr(struct task_struct *tsk)
-{
-	return pid_vnr(task_tgid(tsk));
-}
-
 
 static inline int pid_alive(const struct task_struct *p);
-static inline pid_t task_ppid_nr_ns(const struct task_struct *tsk, struct pid_namespace *ns)
-{
-	pid_t pid = 0;
-
-	rcu_read_lock();
-	if (pid_alive(tsk))
-		pid = task_tgid_nr_ns(rcu_dereference(tsk->real_parent), ns);
-	rcu_read_unlock();
-
-	return pid;
-}
-
-static inline pid_t task_ppid_nr(const struct task_struct *tsk)
-{
-	return task_ppid_nr_ns(tsk, &init_pid_ns);
-}
 
 static inline pid_t task_pgrp_nr_ns(struct task_struct *tsk,
 					struct pid_namespace *ns)
@@ -1826,6 +1803,33 @@ static inline pid_t task_session_vnr(str
 	return __task_pid_nr_ns(tsk, PIDTYPE_SID, NULL);
 }
 
+static inline pid_t task_tgid_nr_ns(struct task_struct *tsk, struct pid_namespace *ns)
+{
+	return __task_pid_nr_ns(tsk, __PIDTYPE_TGID, ns);
+}
+
+static inline pid_t task_tgid_vnr(struct task_struct *tsk)
+{
+	return __task_pid_nr_ns(tsk, __PIDTYPE_TGID, NULL);
+}
+
+static inline pid_t task_ppid_nr_ns(const struct task_struct *tsk, struct pid_namespace *ns)
+{
+	pid_t pid = 0;
+
+	rcu_read_lock();
+	if (pid_alive(tsk))
+		pid = task_tgid_nr_ns(rcu_dereference(tsk->real_parent), ns);
+	rcu_read_unlock();
+
+	return pid;
+}
+
+static inline pid_t task_ppid_nr(const struct task_struct *tsk)
+{
+	return task_ppid_nr_ns(tsk, &init_pid_ns);
+}
+
 /* obsolete, do not use */
 static inline pid_t task_pgrp_nr(struct task_struct *tsk)
 {
diff -druNp --no-dereference linux-libre-3.18.66-gnu/kernel/audit_watch.c linux-libre-3.18.67-gnu/kernel/audit_watch.c
--- linux-libre-3.18.66-gnu/kernel/audit_watch.c	2017-08-16 16:35:42.000000000 -0400
+++ linux-libre-3.18.67-gnu/kernel/audit_watch.c	2017-08-24 20:00:20.000000000 -0400
@@ -455,13 +455,15 @@ void audit_remove_watch_rule(struct audi
 	list_del(&krule->rlist);
 
 	if (list_empty(&watch->rules)) {
+		/*
+		 * audit_remove_watch() drops our reference to 'parent' which
+		 * can get freed. Grab our own reference to be safe.
+		 */
+		audit_get_parent(parent);
 		audit_remove_watch(watch);
-
-		if (list_empty(&parent->watches)) {
-			audit_get_parent(parent);
+		if (list_empty(&parent->watches))
 			fsnotify_destroy_mark(&parent->mark, audit_watch_group);
-			audit_put_parent(parent);
-		}
+		audit_put_parent(parent);
 	}
 }
 
diff -druNp --no-dereference linux-libre-3.18.66-gnu/kernel/pid.c linux-libre-3.18.67-gnu/kernel/pid.c
--- linux-libre-3.18.66-gnu/kernel/pid.c	2017-08-16 16:35:42.000000000 -0400
+++ linux-libre-3.18.67-gnu/kernel/pid.c	2017-08-24 20:00:20.000000000 -0400
@@ -523,8 +523,11 @@ pid_t __task_pid_nr_ns(struct task_struc
 	if (!ns)
 		ns = task_active_pid_ns(current);
 	if (likely(pid_alive(task))) {
-		if (type != PIDTYPE_PID)
+		if (type != PIDTYPE_PID) {
+			if (type == __PIDTYPE_TGID)
+				type = PIDTYPE_PID;
 			task = task->group_leader;
+		}
 		nr = pid_nr_ns(task->pids[type].pid, ns);
 	}
 	rcu_read_unlock();
@@ -533,12 +536,6 @@ pid_t __task_pid_nr_ns(struct task_struc
 }
 EXPORT_SYMBOL(__task_pid_nr_ns);
 
-pid_t task_tgid_nr_ns(struct task_struct *tsk, struct pid_namespace *ns)
-{
-	return pid_nr_ns(task_tgid(tsk), ns);
-}
-EXPORT_SYMBOL(task_tgid_nr_ns);
-
 struct pid_namespace *task_active_pid_ns(struct task_struct *tsk)
 {
 	return ns_of_pid(task_pid(tsk));
diff -druNp --no-dereference linux-libre-3.18.66-gnu/Makefile linux-libre-3.18.67-gnu/Makefile
--- linux-libre-3.18.66-gnu/Makefile	2017-08-16 18:35:26.000000000 -0400
+++ linux-libre-3.18.67-gnu/Makefile	2017-08-25 01:51:45.000000000 -0400
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 18
-SUBLEVEL = 66
+SUBLEVEL = 67
 EXTRAVERSION =-gnu
 NAME = Diseased Newt
 
diff -druNp --no-dereference linux-libre-3.18.66-gnu/mm/mempolicy.c linux-libre-3.18.67-gnu/mm/mempolicy.c
--- linux-libre-3.18.66-gnu/mm/mempolicy.c	2017-08-16 16:35:42.000000000 -0400
+++ linux-libre-3.18.67-gnu/mm/mempolicy.c	2017-08-24 20:00:20.000000000 -0400
@@ -944,11 +944,6 @@ static long do_get_mempolicy(int *policy
 		*policy |= (pol->flags & MPOL_MODE_FLAGS);
 	}
 
-	if (vma) {
-		up_read(&current->mm->mmap_sem);
-		vma = NULL;
-	}
-
 	err = 0;
 	if (nmask) {
 		if (mpol_store_user_nodemask(pol)) {
diff -druNp --no-dereference linux-libre-3.18.66-gnu/mm/migrate.c linux-libre-3.18.67-gnu/mm/migrate.c
--- linux-libre-3.18.66-gnu/mm/migrate.c	2017-08-16 16:35:42.000000000 -0400
+++ linux-libre-3.18.67-gnu/mm/migrate.c	2017-08-24 20:00:20.000000000 -0400
@@ -37,6 +37,7 @@
 #include <linux/gfp.h>
 #include <linux/balloon_compaction.h>
 #include <linux/mmu_notifier.h>
+#include <linux/ptrace.h>
 
 #include <asm/tlbflush.h>
 
@@ -1468,7 +1469,6 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
 		const int __user *, nodes,
 		int __user *, status, int, flags)
 {
-	const struct cred *cred = current_cred(), *tcred;
 	struct task_struct *task;
 	struct mm_struct *mm;
 	int err;
@@ -1492,14 +1492,9 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
 
 	/*
 	 * Check if this process has the right to modify the specified
-	 * process. The right exists if the process has administrative
-	 * capabilities, superuser privileges or the same
-	 * userid as the target process.
+	 * process. Use the regular "ptrace_may_access()" checks.
 	 */
-	tcred = __task_cred(task);
-	if (!uid_eq(cred->euid, tcred->suid) && !uid_eq(cred->euid, tcred->uid) &&
-	    !uid_eq(cred->uid,  tcred->suid) && !uid_eq(cred->uid,  tcred->uid) &&
-	    !capable(CAP_SYS_NICE)) {
+	if (!ptrace_may_access(task, PTRACE_MODE_READ_REALCREDS)) {
 		rcu_read_unlock();
 		err = -EPERM;
 		goto out;
diff -druNp --no-dereference linux-libre-3.18.66-gnu/net/netfilter/nf_conntrack_extend.c linux-libre-3.18.67-gnu/net/netfilter/nf_conntrack_extend.c
--- linux-libre-3.18.66-gnu/net/netfilter/nf_conntrack_extend.c	2017-08-16 16:35:42.000000000 -0400
+++ linux-libre-3.18.67-gnu/net/netfilter/nf_conntrack_extend.c	2017-08-24 20:00:20.000000000 -0400
@@ -53,7 +53,11 @@ nf_ct_ext_create(struct nf_ct_ext **ext,
 
 	rcu_read_lock();
 	t = rcu_dereference(nf_ct_ext_types[id]);
-	BUG_ON(t == NULL);
+	if (!t) {
+		rcu_read_unlock();
+		return NULL;
+	}
+
 	off = ALIGN(sizeof(struct nf_ct_ext), t->align);
 	len = off + t->len + var_alloc_len;
 	alloc_size = t->alloc_size + var_alloc_len;
@@ -88,7 +92,10 @@ void *__nf_ct_ext_add_length(struct nf_c
 
 	rcu_read_lock();
 	t = rcu_dereference(nf_ct_ext_types[id]);
-	BUG_ON(t == NULL);
+	if (!t) {
+		rcu_read_unlock();
+		return NULL;
+	}
 
 	newoff = ALIGN(old->len, t->align);
 	newlen = newoff + t->len + var_alloc_len;
@@ -186,6 +193,6 @@ void nf_ct_extend_unregister(struct nf_c
 	RCU_INIT_POINTER(nf_ct_ext_types[type->id], NULL);
 	update_alloc_size(type);
 	mutex_unlock(&nf_ct_ext_type_mutex);
-	rcu_barrier(); /* Wait for completion of call_rcu()'s */
+	synchronize_rcu();
 }
 EXPORT_SYMBOL_GPL(nf_ct_extend_unregister);
diff -druNp --no-dereference linux-libre-3.18.66-gnu/sound/usb/quirks.c linux-libre-3.18.67-gnu/sound/usb/quirks.c
--- linux-libre-3.18.66-gnu/sound/usb/quirks.c	2017-08-16 16:35:42.000000000 -0400
+++ linux-libre-3.18.67-gnu/sound/usb/quirks.c	2017-08-24 20:00:20.000000000 -0400
@@ -1127,6 +1127,7 @@ bool snd_usb_get_sample_rate_quirk(struc
 	case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
 	case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */
 	case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */
+	case USB_ID(0x1395, 0x740a): /* Sennheiser DECT */
 	case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */
 	case USB_ID(0x1de7, 0x0013): /* Phoenix Audio MT202exe */
 	case USB_ID(0x1de7, 0x0014): /* Phoenix Audio TMX320 */
