diff -druNp --no-dereference linux-libre-3.18.69-gnu/drivers/gpu/drm/ttm/ttm_page_alloc.c linux-libre-3.18.70-gnu/drivers/gpu/drm/ttm/ttm_page_alloc.c
--- linux-libre-3.18.69-gnu/drivers/gpu/drm/ttm/ttm_page_alloc.c	2017-09-02 01:06:04.000000000 -0400
+++ linux-libre-3.18.70-gnu/drivers/gpu/drm/ttm/ttm_page_alloc.c	2017-09-07 02:32:43.000000000 -0400
@@ -612,7 +612,7 @@ static void ttm_page_pool_fill_locked(st
 		} else {
 			pr_err("Failed to fill pool (%p)\n", pool);
 			/* If we have any pages left put them to the pool. */
-			list_for_each_entry(p, &pool->list, lru) {
+			list_for_each_entry(p, &new_pages, lru) {
 				++cpages;
 			}
 			list_splice(&new_pages, &pool->list);
diff -druNp --no-dereference linux-libre-3.18.69-gnu/drivers/i2c/busses/i2c-ismt.c linux-libre-3.18.70-gnu/drivers/i2c/busses/i2c-ismt.c
--- linux-libre-3.18.69-gnu/drivers/i2c/busses/i2c-ismt.c	2017-09-02 01:06:04.000000000 -0400
+++ linux-libre-3.18.70-gnu/drivers/i2c/busses/i2c-ismt.c	2017-09-07 02:32:43.000000000 -0400
@@ -340,8 +340,10 @@ static int ismt_process_desc(const struc
 			break;
 		case I2C_SMBUS_BLOCK_DATA:
 		case I2C_SMBUS_I2C_BLOCK_DATA:
-			memcpy(&data->block[1], dma_buffer, desc->rxbytes);
-			data->block[0] = desc->rxbytes;
+			if (desc->rxbytes != dma_buffer[0] + 1)
+				return -EMSGSIZE;
+
+			memcpy(data->block, dma_buffer, desc->rxbytes);
 			break;
 		}
 		return 0;
diff -druNp --no-dereference linux-libre-3.18.69-gnu/drivers/net/wireless/ti/wl1251/main.c linux-libre-3.18.70-gnu/drivers/net/wireless/ti/wl1251/main.c
--- linux-libre-3.18.69-gnu/drivers/net/wireless/ti/wl1251/main.c	2017-09-02 07:52:35.000000000 -0400
+++ linux-libre-3.18.70-gnu/drivers/net/wireless/ti/wl1251/main.c	2017-09-07 06:10:32.000000000 -0400
@@ -1572,6 +1572,7 @@ struct ieee80211_hw *wl1251_alloc_hw(voi
 
 	wl->state = WL1251_STATE_OFF;
 	mutex_init(&wl->mutex);
+	spin_lock_init(&wl->wl_lock);
 
 	wl->tx_mgmt_frm_rate = DEFAULT_HW_GEN_TX_RATE;
 	wl->tx_mgmt_frm_mod = DEFAULT_HW_GEN_MODULATION_TYPE;
diff -druNp --no-dereference linux-libre-3.18.69-gnu/fs/cifs/dir.c linux-libre-3.18.70-gnu/fs/cifs/dir.c
--- linux-libre-3.18.69-gnu/fs/cifs/dir.c	2017-09-02 01:06:04.000000000 -0400
+++ linux-libre-3.18.70-gnu/fs/cifs/dir.c	2017-09-07 02:32:43.000000000 -0400
@@ -194,7 +194,7 @@ check_name(struct dentry *direntry, stru
 	int i;
 
 	if (unlikely(direntry->d_name.len >
-		     tcon->fsAttrInfo.MaxPathNameComponentLength))
+		     le32_to_cpu(tcon->fsAttrInfo.MaxPathNameComponentLength)))
 		return -ENAMETOOLONG;
 
 	if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS)) {
diff -druNp --no-dereference linux-libre-3.18.69-gnu/fs/cifs/smb2pdu.h linux-libre-3.18.70-gnu/fs/cifs/smb2pdu.h
--- linux-libre-3.18.69-gnu/fs/cifs/smb2pdu.h	2017-09-02 01:06:04.000000000 -0400
+++ linux-libre-3.18.70-gnu/fs/cifs/smb2pdu.h	2017-09-07 02:32:43.000000000 -0400
@@ -82,8 +82,8 @@
 
 #define NUMBER_OF_SMB2_COMMANDS	0x0013
 
-/* BB FIXME - analyze following length BB */
-#define MAX_SMB2_HDR_SIZE 0x78 /* 4 len + 64 hdr + (2*24 wct) + 2 bct + 2 pad */
+/* 4 len + 52 transform hdr + 64 hdr + 56 create rsp */
+#define MAX_SMB2_HDR_SIZE 0x00b0
 
 #define SMB2_PROTO_NUMBER __constant_cpu_to_le32(0x424d53fe)
 
diff -druNp --no-dereference linux-libre-3.18.69-gnu/fs/eventpoll.c linux-libre-3.18.70-gnu/fs/eventpoll.c
--- linux-libre-3.18.69-gnu/fs/eventpoll.c	2017-09-02 01:06:04.000000000 -0400
+++ linux-libre-3.18.70-gnu/fs/eventpoll.c	2017-09-07 02:32:43.000000000 -0400
@@ -518,8 +518,13 @@ static void ep_remove_wait_queue(struct
 	wait_queue_head_t *whead;
 
 	rcu_read_lock();
-	/* If it is cleared by POLLFREE, it should be rcu-safe */
-	whead = rcu_dereference(pwq->whead);
+	/*
+	 * If it is cleared by POLLFREE, it should be rcu-safe.
+	 * If we read NULL we need a barrier paired with
+	 * smp_store_release() in ep_poll_callback(), otherwise
+	 * we rely on whead->lock.
+	 */
+	whead = smp_load_acquire(&pwq->whead);
 	if (whead)
 		remove_wait_queue(whead, &pwq->wait);
 	rcu_read_unlock();
@@ -1006,17 +1011,6 @@ static int ep_poll_callback(wait_queue_t
 	struct epitem *epi = ep_item_from_wait(wait);
 	struct eventpoll *ep = epi->ep;
 
-	if ((unsigned long)key & POLLFREE) {
-		ep_pwq_from_wait(wait)->whead = NULL;
-		/*
-		 * whead = NULL above can race with ep_remove_wait_queue()
-		 * which can do another remove_wait_queue() after us, so we
-		 * can't use __remove_wait_queue(). whead->lock is held by
-		 * the caller.
-		 */
-		list_del_init(&wait->task_list);
-	}
-
 	spin_lock_irqsave(&ep->lock, flags);
 
 	/*
@@ -1081,6 +1075,23 @@ out_unlock:
 	if (pwake)
 		ep_poll_safewake(&ep->poll_wait);
 
+
+	if ((unsigned long)key & POLLFREE) {
+		/*
+		 * If we race with ep_remove_wait_queue() it can miss
+		 * ->whead = NULL and do another remove_wait_queue() after
+		 * us, so we can't use __remove_wait_queue().
+		 */
+		list_del_init(&wait->task_list);
+		/*
+		 * ->whead != NULL protects us from the race with ep_free()
+		 * or ep_remove(), ep_remove_wait_queue() takes whead->lock
+		 * held by the caller. Once we nullify it, nothing protects
+		 * ep/epi or even wait.
+		 */
+		smp_store_release(&ep_pwq_from_wait(wait)->whead, NULL);
+	}
+
 	return 1;
 }
 
diff -druNp --no-dereference linux-libre-3.18.69-gnu/include/asm-generic/topology.h linux-libre-3.18.70-gnu/include/asm-generic/topology.h
--- linux-libre-3.18.69-gnu/include/asm-generic/topology.h	2017-09-02 01:06:04.000000000 -0400
+++ linux-libre-3.18.70-gnu/include/asm-generic/topology.h	2017-09-07 02:32:43.000000000 -0400
@@ -48,7 +48,11 @@
 #define parent_node(node)	((void)(node),0)
 #endif
 #ifndef cpumask_of_node
-#define cpumask_of_node(node)	((void)node, cpu_online_mask)
+  #ifdef CONFIG_NEED_MULTIPLE_NODES
+    #define cpumask_of_node(node)	((node) == 0 ? cpu_online_mask : cpu_none_mask)
+  #else
+    #define cpumask_of_node(node)	((void)node, cpu_online_mask)
+  #endif
 #endif
 #ifndef pcibus_to_node
 #define pcibus_to_node(bus)	((void)(bus), -1)
diff -druNp --no-dereference linux-libre-3.18.69-gnu/Makefile linux-libre-3.18.70-gnu/Makefile
--- linux-libre-3.18.69-gnu/Makefile	2017-09-02 07:33:15.000000000 -0400
+++ linux-libre-3.18.70-gnu/Makefile	2017-09-07 05:44:30.000000000 -0400
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 18
-SUBLEVEL = 69
+SUBLEVEL = 70
 EXTRAVERSION =-gnu
 NAME = Diseased Newt
 
diff -druNp --no-dereference linux-libre-3.18.69-gnu/net/xfrm/xfrm_policy.c linux-libre-3.18.70-gnu/net/xfrm/xfrm_policy.c
--- linux-libre-3.18.69-gnu/net/xfrm/xfrm_policy.c	2017-09-02 01:06:04.000000000 -0400
+++ linux-libre-3.18.70-gnu/net/xfrm/xfrm_policy.c	2017-09-07 02:32:43.000000000 -0400
@@ -3248,9 +3248,15 @@ int xfrm_migrate(const struct xfrm_selec
 	struct xfrm_state *x_new[XFRM_MAX_DEPTH];
 	struct xfrm_migrate *mp;
 
+	/* Stage 0 - sanity checks */
 	if ((err = xfrm_migrate_check(m, num_migrate)) < 0)
 		goto out;
 
+	if (dir >= XFRM_POLICY_MAX) {
+		err = -EINVAL;
+		goto out;
+	}
+
 	/* Stage 1 - find policy */
 	if ((pol = xfrm_migrate_policy_find(sel, dir, type, net)) == NULL) {
 		err = -ENOENT;
