diff -druNp --no-dereference linux-libre-3.18.84-gnu/arch/arm/mm/dump.c linux-libre-3.18.85-gnu/arch/arm/mm/dump.c
--- linux-libre-3.18.84-gnu/arch/arm/mm/dump.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/arch/arm/mm/dump.c	2017-11-30 03:35:56.000000000 -0500
@@ -126,8 +126,8 @@ static const struct prot_bits section_bi
 		.val	= PMD_SECT_USER,
 		.set	= "USR",
 	}, {
-		.mask	= L_PMD_SECT_RDONLY,
-		.val	= L_PMD_SECT_RDONLY,
+		.mask	= L_PMD_SECT_RDONLY | PMD_SECT_AP2,
+		.val	= L_PMD_SECT_RDONLY | PMD_SECT_AP2,
 		.set	= "ro",
 		.clear	= "RW",
 #elif __LINUX_ARM_ARCH__ >= 6
diff -druNp --no-dereference linux-libre-3.18.84-gnu/arch/mips/bcm47xx/leds.c linux-libre-3.18.85-gnu/arch/mips/bcm47xx/leds.c
--- linux-libre-3.18.84-gnu/arch/mips/bcm47xx/leds.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/arch/mips/bcm47xx/leds.c	2017-11-30 03:35:56.000000000 -0500
@@ -323,7 +323,7 @@ bcm47xx_leds_linksys_wrt54g3gv2[] __init
 /* Verified on: WRT54GS V1.0 */
 static const struct gpio_led
 bcm47xx_leds_linksys_wrt54g_type_0101[] __initconst = {
-	BCM47XX_GPIO_LED(0, "green", "wlan", 0, LEDS_GPIO_DEFSTATE_OFF),
+	BCM47XX_GPIO_LED(0, "green", "wlan", 1, LEDS_GPIO_DEFSTATE_OFF),
 	BCM47XX_GPIO_LED(1, "green", "power", 0, LEDS_GPIO_DEFSTATE_ON),
 	BCM47XX_GPIO_LED(7, "green", "dmz", 1, LEDS_GPIO_DEFSTATE_OFF),
 };
diff -druNp --no-dereference linux-libre-3.18.84-gnu/arch/mips/kernel/ptrace.c linux-libre-3.18.85-gnu/arch/mips/kernel/ptrace.c
--- linux-libre-3.18.84-gnu/arch/mips/kernel/ptrace.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/arch/mips/kernel/ptrace.c	2017-11-30 03:35:56.000000000 -0500
@@ -522,6 +522,19 @@ static const struct user_regset_view use
 	.n		= ARRAY_SIZE(mips64_regsets),
 };
 
+#ifdef CONFIG_MIPS32_N32
+
+static const struct user_regset_view user_mipsn32_view = {
+	.name		= "mipsn32",
+	.e_flags	= EF_MIPS_ABI2,
+	.e_machine	= ELF_ARCH,
+	.ei_osabi	= ELF_OSABI,
+	.regsets	= mips64_regsets,
+	.n		= ARRAY_SIZE(mips64_regsets),
+};
+
+#endif /* CONFIG_MIPS32_N32 */
+
 #endif /* CONFIG_64BIT */
 
 const struct user_regset_view *task_user_regset_view(struct task_struct *task)
@@ -533,6 +546,10 @@ const struct user_regset_view *task_user
 	if (test_tsk_thread_flag(task, TIF_32BIT_REGS))
 		return &user_mips_view;
 #endif
+#ifdef CONFIG_MIPS32_N32
+	if (test_tsk_thread_flag(task, TIF_32BIT_ADDR))
+		return &user_mipsn32_view;
+#endif
 	return &user_mips64_view;
 #endif
 }
diff -druNp --no-dereference linux-libre-3.18.84-gnu/arch/parisc/kernel/syscall.S linux-libre-3.18.85-gnu/arch/parisc/kernel/syscall.S
--- linux-libre-3.18.84-gnu/arch/parisc/kernel/syscall.S	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/arch/parisc/kernel/syscall.S	2017-11-30 03:35:56.000000000 -0500
@@ -688,15 +688,15 @@ cas_action:
 	/* ELF32 Process entry path */
 lws_compare_and_swap_2:
 #ifdef CONFIG_64BIT
-	/* Clip the input registers */
+	/* Clip the input registers. We don't need to clip %r23 as we
+	   only use it for word operations */
 	depdi	0, 31, 32, %r26
 	depdi	0, 31, 32, %r25
 	depdi	0, 31, 32, %r24
-	depdi	0, 31, 32, %r23
 #endif
 
 	/* Check the validity of the size pointer */
-	subi,>>= 4, %r23, %r0
+	subi,>>= 3, %r23, %r0
 	b,n	lws_exit_nosys
 
 	/* Jump to the functions which will load the old and new values into
diff -druNp --no-dereference linux-libre-3.18.84-gnu/arch/powerpc/kernel/signal.c linux-libre-3.18.85-gnu/arch/powerpc/kernel/signal.c
--- linux-libre-3.18.84-gnu/arch/powerpc/kernel/signal.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/arch/powerpc/kernel/signal.c	2017-11-30 03:35:56.000000000 -0500
@@ -102,7 +102,7 @@ static void check_syscall_restart(struct
 static void do_signal(struct pt_regs *regs)
 {
 	sigset_t *oldset = sigmask_to_save();
-	struct ksignal ksig;
+	struct ksignal ksig = { .sig = 0 };
 	int ret;
 	int is32 = is_32bit_task();
 
diff -druNp --no-dereference linux-libre-3.18.84-gnu/arch/s390/include/asm/asm-prototypes.h linux-libre-3.18.85-gnu/arch/s390/include/asm/asm-prototypes.h
--- linux-libre-3.18.84-gnu/arch/s390/include/asm/asm-prototypes.h	1969-12-31 19:00:00.000000000 -0500
+++ linux-libre-3.18.85-gnu/arch/s390/include/asm/asm-prototypes.h	2017-11-30 03:35:56.000000000 -0500
@@ -0,0 +1,8 @@
+#ifndef _ASM_S390_PROTOTYPES_H
+
+#include <linux/kvm_host.h>
+#include <linux/ftrace.h>
+#include <asm/fpu/api.h>
+#include <asm-generic/asm-prototypes.h>
+
+#endif /* _ASM_S390_PROTOTYPES_H */
diff -druNp --no-dereference linux-libre-3.18.84-gnu/arch/s390/kernel/dis.c linux-libre-3.18.85-gnu/arch/s390/kernel/dis.c
--- linux-libre-3.18.84-gnu/arch/s390/kernel/dis.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/arch/s390/kernel/dis.c	2017-11-30 03:35:56.000000000 -0500
@@ -1997,7 +1997,7 @@ void show_code(struct pt_regs *regs)
 {
 	char *mode = user_mode(regs) ? "User" : "Krnl";
 	unsigned char code[64];
-	char buffer[64], *ptr;
+	char buffer[128], *ptr;
 	mm_segment_t old_fs;
 	unsigned long addr;
 	int start, end, opsize, hops, i;
@@ -2060,7 +2060,7 @@ void show_code(struct pt_regs *regs)
 		start += opsize;
 		printk(buffer);
 		ptr = buffer;
-		ptr += sprintf(ptr, "\n          ");
+		ptr += sprintf(ptr, "\n\t  ");
 		hops++;
 	}
 	printk("\n");
diff -druNp --no-dereference linux-libre-3.18.84-gnu/arch/x86/kvm/svm.c linux-libre-3.18.85-gnu/arch/x86/kvm/svm.c
--- linux-libre-3.18.84-gnu/arch/x86/kvm/svm.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/arch/x86/kvm/svm.c	2017-11-30 03:35:56.000000000 -0500
@@ -3187,6 +3187,13 @@ static int svm_set_msr(struct kvm_vcpu *
 	u32 ecx = msr->index;
 	u64 data = msr->data;
 	switch (ecx) {
+	case MSR_IA32_CR_PAT:
+		if (!kvm_mtrr_valid(vcpu, MSR_IA32_CR_PAT, data))
+			return 1;
+		vcpu->arch.pat = data;
+		svm->vmcb->save.g_pat = data;
+		mark_dirty(svm->vmcb, VMCB_NPT);
+		break;
 	case MSR_IA32_TSC:
 		kvm_write_tsc(vcpu, msr);
 		break;
diff -druNp --no-dereference linux-libre-3.18.84-gnu/arch/x86/kvm/vmx.c linux-libre-3.18.85-gnu/arch/x86/kvm/vmx.c
--- linux-libre-3.18.84-gnu/arch/x86/kvm/vmx.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/arch/x86/kvm/vmx.c	2017-11-30 03:35:56.000000000 -0500
@@ -8929,6 +8929,8 @@ static void load_vmcs12_host_state(struc
 	vmcs_writel(GUEST_SYSENTER_EIP, vmcs12->host_ia32_sysenter_eip);
 	vmcs_writel(GUEST_IDTR_BASE, vmcs12->host_idtr_base);
 	vmcs_writel(GUEST_GDTR_BASE, vmcs12->host_gdtr_base);
+	vmcs_write32(GUEST_IDTR_LIMIT, 0xFFFF);
+	vmcs_write32(GUEST_GDTR_LIMIT, 0xFFFF);
 
 	/* If not VM_EXIT_CLEAR_BNDCFGS, the L2 value propagates to L1.  */
 	if (vmcs12->vm_exit_controls & VM_EXIT_CLEAR_BNDCFGS)
diff -druNp --no-dereference linux-libre-3.18.84-gnu/arch/x86/lib/x86-opcode-map.txt linux-libre-3.18.85-gnu/arch/x86/lib/x86-opcode-map.txt
--- linux-libre-3.18.84-gnu/arch/x86/lib/x86-opcode-map.txt	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/arch/x86/lib/x86-opcode-map.txt	2017-11-30 03:35:56.000000000 -0500
@@ -814,7 +814,7 @@ EndTable
 
 GrpTable: Grp3_1
 0: TEST Eb,Ib
-1:
+1: TEST Eb,Ib
 2: NOT Eb
 3: NEG Eb
 4: MUL AL,Eb
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/clk/ti/clk-dra7-atl.c linux-libre-3.18.85-gnu/drivers/clk/ti/clk-dra7-atl.c
--- linux-libre-3.18.84-gnu/drivers/clk/ti/clk-dra7-atl.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/clk/ti/clk-dra7-atl.c	2017-11-30 03:35:56.000000000 -0500
@@ -259,7 +259,7 @@ static int of_dra7_atl_clk_probe(struct
 
 		/* Get configuration for the ATL instances */
 		snprintf(prop, sizeof(prop), "atl%u", i);
-		cfg_node = of_find_node_by_name(node, prop);
+		cfg_node = of_get_child_by_name(node, prop);
 		if (cfg_node) {
 			ret = of_property_read_u32(cfg_node, "bws",
 						   &cdesc->bws);
@@ -272,6 +272,7 @@ static int of_dra7_atl_clk_probe(struct
 				atl_write(cinfo, DRA7_ATL_AWSMUX_REG(i),
 					  cdesc->aws);
 			}
+			of_node_put(cfg_node);
 		}
 
 		cdesc->probed = true;
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/gpu/drm/armada/Makefile linux-libre-3.18.85-gnu/drivers/gpu/drm/armada/Makefile
--- linux-libre-3.18.84-gnu/drivers/gpu/drm/armada/Makefile	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/gpu/drm/armada/Makefile	2017-11-30 03:35:56.000000000 -0500
@@ -5,3 +5,5 @@ armada-y	+= armada_510.o
 armada-$(CONFIG_DEBUG_FS) += armada_debugfs.o
 
 obj-$(CONFIG_DRM_ARMADA) := armada.o
+
+CFLAGS_armada_trace.o := -I$(src)
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/infiniband/ulp/srpt/ib_srpt.c linux-libre-3.18.85-gnu/drivers/infiniband/ulp/srpt/ib_srpt.c
--- linux-libre-3.18.84-gnu/drivers/infiniband/ulp/srpt/ib_srpt.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/infiniband/ulp/srpt/ib_srpt.c	2017-11-30 03:35:56.000000000 -0500
@@ -3522,7 +3522,7 @@ static int srpt_parse_i_port_id(u8 i_por
 {
 	const char *p;
 	unsigned len, count, leading_zero_bytes;
-	int ret, rc;
+	int ret;
 
 	p = name;
 	if (strncasecmp(p, "0x", 2) == 0)
@@ -3534,10 +3534,9 @@ static int srpt_parse_i_port_id(u8 i_por
 	count = min(len / 2, 16U);
 	leading_zero_bytes = 16 - count;
 	memset(i_port_id, 0, leading_zero_bytes);
-	rc = hex2bin(i_port_id + leading_zero_bytes, p, count);
-	if (rc < 0)
-		pr_debug("hex2bin failed for srpt_parse_i_port_id: %d\n", rc);
-	ret = 0;
+	ret = hex2bin(i_port_id + leading_zero_bytes, p, count);
+	if (ret < 0)
+		pr_debug("hex2bin failed for srpt_parse_i_port_id: %d\n", ret);
 out:
 	return ret;
 }
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/md/bcache/alloc.c linux-libre-3.18.85-gnu/drivers/md/bcache/alloc.c
--- linux-libre-3.18.84-gnu/drivers/md/bcache/alloc.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/md/bcache/alloc.c	2017-11-30 03:35:56.000000000 -0500
@@ -406,7 +406,8 @@ long bch_bucket_alloc(struct cache *ca,
 
 	finish_wait(&ca->set->bucket_wait, &w);
 out:
-	wake_up_process(ca->alloc_thread);
+	if (ca->alloc_thread)
+		wake_up_process(ca->alloc_thread);
 
 	trace_bcache_alloc(ca, reserve);
 
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/md/dm-bufio.c linux-libre-3.18.85-gnu/drivers/md/dm-bufio.c
--- linux-libre-3.18.84-gnu/drivers/md/dm-bufio.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/md/dm-bufio.c	2017-11-30 03:35:56.000000000 -0500
@@ -876,7 +876,8 @@ static void __get_memory_limit(struct dm
 		buffers = c->minimum_buffers;
 
 	*limit_buffers = buffers;
-	*threshold_buffers = buffers * DM_BUFIO_WRITEBACK_PERCENT / 100;
+	*threshold_buffers = mult_frac(buffers,
+				       DM_BUFIO_WRITEBACK_PERCENT, 100);
 }
 
 /*
@@ -1764,19 +1765,15 @@ static int __init dm_bufio_init(void)
 	memset(&dm_bufio_caches, 0, sizeof dm_bufio_caches);
 	memset(&dm_bufio_cache_names, 0, sizeof dm_bufio_cache_names);
 
-	mem = (__u64)((totalram_pages - totalhigh_pages) *
-		      DM_BUFIO_MEMORY_PERCENT / 100) << PAGE_SHIFT;
+	mem = (__u64)mult_frac(totalram_pages - totalhigh_pages,
+			       DM_BUFIO_MEMORY_PERCENT, 100) << PAGE_SHIFT;
 
 	if (mem > ULONG_MAX)
 		mem = ULONG_MAX;
 
 #ifdef CONFIG_MMU
-	/*
-	 * Get the size of vmalloc space the same way as VMALLOC_TOTAL
-	 * in fs/proc/internal.h
-	 */
-	if (mem > (VMALLOC_END - VMALLOC_START) * DM_BUFIO_VMALLOC_PERCENT / 100)
-		mem = (VMALLOC_END - VMALLOC_START) * DM_BUFIO_VMALLOC_PERCENT / 100;
+	if (mem > mult_frac(VMALLOC_TOTAL, DM_BUFIO_VMALLOC_PERCENT, 100))
+		mem = mult_frac(VMALLOC_TOTAL, DM_BUFIO_VMALLOC_PERCENT, 100);
 #endif
 
 	dm_bufio_default_cache_size = mem;
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/md/dm.c linux-libre-3.18.85-gnu/drivers/md/dm.c
--- linux-libre-3.18.84-gnu/drivers/md/dm.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/md/dm.c	2017-11-30 03:35:56.000000000 -0500
@@ -3033,11 +3033,15 @@ struct mapped_device *dm_get_from_kobjec
 
 	md = container_of(kobj, struct mapped_device, kobj_holder.kobj);
 
-	if (test_bit(DMF_FREEING, &md->flags) ||
-	    dm_deleting_md(md))
-		return NULL;
-
+	spin_lock(&_minor_lock);
+	if (test_bit(DMF_FREEING, &md->flags) || dm_deleting_md(md)) {
+		md = NULL;
+		goto out;
+	}
 	dm_get(md);
+out:
+	spin_unlock(&_minor_lock);
+
 	return md;
 }
 
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/media/rc/ir-lirc-codec.c linux-libre-3.18.85-gnu/drivers/media/rc/ir-lirc-codec.c
--- linux-libre-3.18.84-gnu/drivers/media/rc/ir-lirc-codec.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/media/rc/ir-lirc-codec.c	2017-11-30 03:35:56.000000000 -0500
@@ -289,11 +289,14 @@ static long ir_lirc_ioctl(struct file *f
 		if (!dev->max_timeout)
 			return -ENOSYS;
 
+		/* Check for multiply overflow */
+		if (val > U32_MAX / 1000)
+			return -EINVAL;
+
 		tmp = val * 1000;
 
-		if (tmp < dev->min_timeout ||
-		    tmp > dev->max_timeout)
-				return -EINVAL;
+		if (tmp < dev->min_timeout || tmp > dev->max_timeout)
+			return -EINVAL;
 
 		dev->timeout = tmp;
 		break;
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/media/usb/as102/as102_fw.c linux-libre-3.18.85-gnu/drivers/media/usb/as102/as102_fw.c
--- linux-libre-3.18.84-gnu/drivers/media/usb/as102/as102_fw.c	2017-11-24 06:10:04.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/media/usb/as102/as102_fw.c	2017-11-30 14:53:55.000000000 -0500
@@ -101,18 +101,23 @@ static int as102_firmware_upload(struct
 				 unsigned char *cmd,
 				 const struct firmware *firmware) {
 
-	struct as10x_fw_pkt_t fw_pkt;
+	struct as10x_fw_pkt_t *fw_pkt;
 	int total_read_bytes = 0, errno = 0;
 	unsigned char addr_has_changed = 0;
 
+	fw_pkt = kmalloc(sizeof(*fw_pkt), GFP_KERNEL);
+	if (!fw_pkt)
+		return -ENOMEM;
+
+
 	for (total_read_bytes = 0; total_read_bytes < firmware->size; ) {
 		int read_bytes = 0, data_len = 0;
 
 		/* parse intel hex line */
 		read_bytes = parse_hex_line(
 				(u8 *) (firmware->data + total_read_bytes),
-				fw_pkt.raw.address,
-				fw_pkt.raw.data,
+				fw_pkt->raw.address,
+				fw_pkt->raw.data,
 				&data_len,
 				&addr_has_changed);
 
@@ -122,28 +127,28 @@ static int as102_firmware_upload(struct
 		/* detect the end of file */
 		total_read_bytes += read_bytes;
 		if (total_read_bytes == firmware->size) {
-			fw_pkt.u.request[0] = 0x00;
-			fw_pkt.u.request[1] = 0x03;
+			fw_pkt->u.request[0] = 0x00;
+			fw_pkt->u.request[1] = 0x03;
 
 			/* send EOF command */
 			errno = bus_adap->ops->upload_fw_pkt(bus_adap,
 							     (uint8_t *)
-							     &fw_pkt, 2, 0);
+							     fw_pkt, 2, 0);
 			if (errno < 0)
 				goto error;
 		} else {
 			if (!addr_has_changed) {
 				/* prepare command to send */
-				fw_pkt.u.request[0] = 0x00;
-				fw_pkt.u.request[1] = 0x01;
+				fw_pkt->u.request[0] = 0x00;
+				fw_pkt->u.request[1] = 0x01;
 
-				data_len += sizeof(fw_pkt.u.request);
-				data_len += sizeof(fw_pkt.raw.address);
+				data_len += sizeof(fw_pkt->u.request);
+				data_len += sizeof(fw_pkt->raw.address);
 
 				/* send cmd to device */
 				errno = bus_adap->ops->upload_fw_pkt(bus_adap,
 								     (uint8_t *)
-								     &fw_pkt,
+								     fw_pkt,
 								     data_len,
 								     0);
 				if (errno < 0)
@@ -152,6 +157,7 @@ static int as102_firmware_upload(struct
 		}
 	}
 error:
+	kfree(fw_pkt);
 	return (errno == 0) ? total_read_bytes : errno;
 }
 
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/media/v4l2-core/v4l2-ctrls.c linux-libre-3.18.85-gnu/drivers/media/v4l2-core/v4l2-ctrls.c
--- linux-libre-3.18.84-gnu/drivers/media/v4l2-core/v4l2-ctrls.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/media/v4l2-core/v4l2-ctrls.c	2017-11-30 03:35:56.000000000 -0500
@@ -1196,6 +1196,16 @@ void v4l2_ctrl_fill(u32 id, const char *
 }
 EXPORT_SYMBOL(v4l2_ctrl_fill);
 
+static u32 user_flags(const struct v4l2_ctrl *ctrl)
+{
+	u32 flags = ctrl->flags;
+
+	if (ctrl->is_ptr)
+		flags |= V4L2_CTRL_FLAG_HAS_PAYLOAD;
+
+	return flags;
+}
+
 static void fill_event(struct v4l2_event *ev, struct v4l2_ctrl *ctrl, u32 changes)
 {
 	memset(ev->reserved, 0, sizeof(ev->reserved));
@@ -1203,7 +1213,7 @@ static void fill_event(struct v4l2_event
 	ev->id = ctrl->id;
 	ev->u.ctrl.changes = changes;
 	ev->u.ctrl.type = ctrl->type;
-	ev->u.ctrl.flags = ctrl->flags;
+	ev->u.ctrl.flags = user_flags(ctrl);
 	if (ctrl->is_ptr)
 		ev->u.ctrl.value64 = 0;
 	else
@@ -2540,10 +2550,8 @@ int v4l2_query_ext_ctrl(struct v4l2_ctrl
 	else
 		qc->id = ctrl->id;
 	strlcpy(qc->name, ctrl->name, sizeof(qc->name));
-	qc->flags = ctrl->flags;
+	qc->flags = user_flags(ctrl);
 	qc->type = ctrl->type;
-	if (ctrl->is_ptr)
-		qc->flags |= V4L2_CTRL_FLAG_HAS_PAYLOAD;
 	qc->elem_size = ctrl->elem_size;
 	qc->elems = ctrl->elems;
 	qc->nr_of_dims = ctrl->nr_of_dims;
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/mtd/nand/nand_base.c linux-libre-3.18.85-gnu/drivers/mtd/nand/nand_base.c
--- linux-libre-3.18.84-gnu/drivers/mtd/nand/nand_base.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/mtd/nand/nand_base.c	2017-11-30 03:35:56.000000000 -0500
@@ -2501,15 +2501,18 @@ static int panic_nand_write(struct mtd_i
 			    size_t *retlen, const uint8_t *buf)
 {
 	struct nand_chip *chip = mtd->priv;
+	int chipnr = (int)(to >> chip->chip_shift);
 	struct mtd_oob_ops ops;
 	int ret;
 
-	/* Wait for the device to get ready */
-	panic_nand_wait(mtd, chip, 400);
-
 	/* Grab the device */
 	panic_nand_get_device(chip, mtd, FL_WRITING);
 
+	chip->select_chip(mtd, chipnr);
+
+	/* Wait for the device to get ready */
+	panic_nand_wait(mtd, chip, 400);
+
 	ops.len = len;
 	ops.datbuf = (uint8_t *)buf;
 	ops.oobbuf = NULL;
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/net/ethernet/3com/typhoon.c linux-libre-3.18.85-gnu/drivers/net/ethernet/3com/typhoon.c
--- linux-libre-3.18.84-gnu/drivers/net/ethernet/3com/typhoon.c	2017-11-24 06:22:55.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/net/ethernet/3com/typhoon.c	2017-11-30 15:01:22.000000000 -0500
@@ -2366,9 +2366,9 @@ typhoon_init_one(struct pci_dev *pdev, c
 	 * 4) Get the hardware address.
 	 * 5) Put the card to sleep.
 	 */
-	if (typhoon_reset(ioaddr, WaitSleep) < 0) {
+	err = typhoon_reset(ioaddr, WaitSleep);
+	if (err < 0) {
 		err_msg = "could not reset 3XP";
-		err = -EIO;
 		goto error_out_dma;
 	}
 
@@ -2382,24 +2382,25 @@ typhoon_init_one(struct pci_dev *pdev, c
 	typhoon_init_interface(tp);
 	typhoon_init_rings(tp);
 
-	if(typhoon_boot_3XP(tp, TYPHOON_STATUS_WAITING_FOR_HOST) < 0) {
+	err = typhoon_boot_3XP(tp, TYPHOON_STATUS_WAITING_FOR_HOST);
+	if (err < 0) {
 		err_msg = "cannot boot 3XP sleep image";
-		err = -EIO;
 		goto error_out_reset;
 	}
 
 	INIT_COMMAND_WITH_RESPONSE(&xp_cmd, TYPHOON_CMD_READ_MAC_ADDRESS);
-	if(typhoon_issue_command(tp, 1, &xp_cmd, 1, xp_resp) < 0) {
+	err = typhoon_issue_command(tp, 1, &xp_cmd, 1, xp_resp);
+	if (err < 0) {
 		err_msg = "cannot read MAC address";
-		err = -EIO;
 		goto error_out_reset;
 	}
 
 	*(__be16 *)&dev->dev_addr[0] = htons(le16_to_cpu(xp_resp[0].parm1));
 	*(__be32 *)&dev->dev_addr[2] = htonl(le32_to_cpu(xp_resp[0].parm2));
 
-	if(!is_valid_ether_addr(dev->dev_addr)) {
+	if (!is_valid_ether_addr(dev->dev_addr)) {
 		err_msg = "Could not obtain valid ethernet address, aborting";
+		err = -EIO;
 		goto error_out_reset;
 	}
 
@@ -2407,7 +2408,8 @@ typhoon_init_one(struct pci_dev *pdev, c
 	 * later when we print out the version reported.
 	 */
 	INIT_COMMAND_WITH_RESPONSE(&xp_cmd, TYPHOON_CMD_READ_VERSIONS);
-	if(typhoon_issue_command(tp, 1, &xp_cmd, 3, xp_resp) < 0) {
+	err = typhoon_issue_command(tp, 1, &xp_cmd, 3, xp_resp);
+	if (err < 0) {
 		err_msg = "Could not get Sleep Image version";
 		goto error_out_reset;
 	}
@@ -2424,9 +2426,9 @@ typhoon_init_one(struct pci_dev *pdev, c
 	if(xp_resp[0].numDesc != 0)
 		tp->capabilities |= TYPHOON_WAKEUP_NEEDS_RESET;
 
-	if(typhoon_sleep(tp, PCI_D3hot, 0) < 0) {
+	err = typhoon_sleep(tp, PCI_D3hot, 0);
+	if (err < 0) {
 		err_msg = "cannot put adapter to sleep";
-		err = -EIO;
 		goto error_out_reset;
 	}
 
@@ -2449,7 +2451,8 @@ typhoon_init_one(struct pci_dev *pdev, c
 	dev->features = dev->hw_features |
 		NETIF_F_HW_VLAN_CTAG_RX | NETIF_F_RXCSUM;
 
-	if(register_netdev(dev) < 0) {
+	err = register_netdev(dev);
+	if (err < 0) {
 		err_msg = "unable to register netdev";
 		goto error_out_reset;
 	}
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/net/ethernet/intel/e1000e/mac.c linux-libre-3.18.85-gnu/drivers/net/ethernet/intel/e1000e/mac.c
--- linux-libre-3.18.84-gnu/drivers/net/ethernet/intel/e1000e/mac.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/net/ethernet/intel/e1000e/mac.c	2017-11-30 03:35:56.000000000 -0500
@@ -410,6 +410,9 @@ void e1000e_clear_hw_cntrs_base(struct e
  *  Checks to see of the link status of the hardware has changed.  If a
  *  change in link status has been detected, then we read the PHY registers
  *  to get the current speed/duplex if link exists.
+ *
+ *  Returns a negative error code (-E1000_ERR_*) or 0 (link down) or 1 (link
+ *  up).
  **/
 s32 e1000e_check_for_copper_link(struct e1000_hw *hw)
 {
@@ -423,7 +426,7 @@ s32 e1000e_check_for_copper_link(struct
 	 * Change or Rx Sequence Error interrupt.
 	 */
 	if (!mac->get_link_status)
-		return 0;
+		return 1;
 
 	/* First we want to see if the MII Status Register reports
 	 * link.  If so, then we want to get the current speed/duplex
@@ -461,10 +464,12 @@ s32 e1000e_check_for_copper_link(struct
 	 * different link partner.
 	 */
 	ret_val = e1000e_config_fc_after_link_up(hw);
-	if (ret_val)
+	if (ret_val) {
 		e_dbg("Error configuring flow control\n");
+		return ret_val;
+	}
 
-	return ret_val;
+	return 1;
 }
 
 /**
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/net/ethernet/intel/e1000e/netdev.c linux-libre-3.18.85-gnu/drivers/net/ethernet/intel/e1000e/netdev.c
--- linux-libre-3.18.84-gnu/drivers/net/ethernet/intel/e1000e/netdev.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/net/ethernet/intel/e1000e/netdev.c	2017-11-30 03:35:56.000000000 -0500
@@ -4844,7 +4844,7 @@ static bool e1000e_has_link(struct e1000
 	case e1000_media_type_copper:
 		if (hw->mac.get_link_status) {
 			ret_val = hw->mac.ops.check_for_link(hw);
-			link_active = !hw->mac.get_link_status;
+			link_active = ret_val > 0;
 		} else {
 			link_active = true;
 		}
@@ -4862,7 +4862,7 @@ static bool e1000e_has_link(struct e1000
 		break;
 	}
 
-	if ((ret_val == E1000_ERR_PHY) && (hw->phy.type == e1000_phy_igp_3) &&
+	if ((ret_val == -E1000_ERR_PHY) && (hw->phy.type == e1000_phy_igp_3) &&
 	    (er32(CTRL) & E1000_PHY_CTRL_GBE_DISABLE)) {
 		/* See e1000_kmrn_lock_loss_workaround_ich8lan() */
 		e_info("Gigabit has been disabled, downgrading speed\n");
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/net/ethernet/intel/e1000e/phy.c linux-libre-3.18.85-gnu/drivers/net/ethernet/intel/e1000e/phy.c
--- linux-libre-3.18.84-gnu/drivers/net/ethernet/intel/e1000e/phy.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/net/ethernet/intel/e1000e/phy.c	2017-11-30 03:35:56.000000000 -0500
@@ -1744,6 +1744,7 @@ s32 e1000e_phy_has_link_generic(struct e
 	s32 ret_val = 0;
 	u16 i, phy_status;
 
+	*success = false;
 	for (i = 0; i < iterations; i++) {
 		/* Some PHYs require the MII_BMSR register to be read
 		 * twice due to the link bit being sticky.  No harm doing
@@ -1763,16 +1764,16 @@ s32 e1000e_phy_has_link_generic(struct e
 		ret_val = e1e_rphy(hw, MII_BMSR, &phy_status);
 		if (ret_val)
 			break;
-		if (phy_status & BMSR_LSTATUS)
+		if (phy_status & BMSR_LSTATUS) {
+			*success = true;
 			break;
+		}
 		if (usec_interval >= 1000)
 			msleep(usec_interval / 1000);
 		else
 			udelay(usec_interval);
 	}
 
-	*success = (i < iterations);
-
 	return ret_val;
 }
 
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/net/ethernet/intel/fm10k/fm10k_main.c linux-libre-3.18.85-gnu/drivers/net/ethernet/intel/fm10k/fm10k_main.c
--- linux-libre-3.18.84-gnu/drivers/net/ethernet/intel/fm10k/fm10k_main.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/net/ethernet/intel/fm10k/fm10k_main.c	2017-11-30 03:35:56.000000000 -0500
@@ -1218,7 +1218,7 @@ static bool fm10k_clean_tx_irq(struct fm
 			break;
 
 		/* prevent any other reads prior to eop_desc */
-		read_barrier_depends();
+		smp_rmb();
 
 		/* if DD is not set pending work has not been completed */
 		if (!(eop_desc->flags & FM10K_TXD_FLAG_DONE))
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/net/ethernet/intel/i40e/i40e_main.c linux-libre-3.18.85-gnu/drivers/net/ethernet/intel/i40e/i40e_main.c
--- linux-libre-3.18.84-gnu/drivers/net/ethernet/intel/i40e/i40e_main.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/net/ethernet/intel/i40e/i40e_main.c	2017-11-30 03:35:56.000000000 -0500
@@ -3214,7 +3214,7 @@ static bool i40e_clean_fdir_tx_irq(struc
 			break;
 
 		/* prevent any other reads prior to eop_desc */
-		read_barrier_depends();
+		smp_rmb();
 
 		/* if the descriptor isn't done, no work yet to do */
 		if (!(eop_desc->cmd_type_offset_bsz &
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/net/ethernet/intel/i40e/i40e_txrx.c linux-libre-3.18.85-gnu/drivers/net/ethernet/intel/i40e/i40e_txrx.c
--- linux-libre-3.18.84-gnu/drivers/net/ethernet/intel/i40e/i40e_txrx.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/net/ethernet/intel/i40e/i40e_txrx.c	2017-11-30 03:35:56.000000000 -0500
@@ -688,7 +688,7 @@ static bool i40e_clean_tx_irq(struct i40
 			break;
 
 		/* prevent any other reads prior to eop_desc */
-		read_barrier_depends();
+		smp_rmb();
 
 		/* we have caught up to head, no work left to do */
 		if (tx_head == tx_desc)
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/net/ethernet/intel/i40evf/i40e_txrx.c linux-libre-3.18.85-gnu/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
--- linux-libre-3.18.84-gnu/drivers/net/ethernet/intel/i40evf/i40e_txrx.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/net/ethernet/intel/i40evf/i40e_txrx.c	2017-11-30 03:35:56.000000000 -0500
@@ -222,7 +222,7 @@ static bool i40e_clean_tx_irq(struct i40
 			break;
 
 		/* prevent any other reads prior to eop_desc */
-		read_barrier_depends();
+		smp_rmb();
 
 		/* we have caught up to head, no work left to do */
 		if (tx_head == tx_desc)
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/net/ethernet/intel/igb/igb_main.c linux-libre-3.18.85-gnu/drivers/net/ethernet/intel/igb/igb_main.c
--- linux-libre-3.18.84-gnu/drivers/net/ethernet/intel/igb/igb_main.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/net/ethernet/intel/igb/igb_main.c	2017-11-30 03:35:56.000000000 -0500
@@ -6383,7 +6383,7 @@ static bool igb_clean_tx_irq(struct igb_
 			break;
 
 		/* prevent any other reads prior to eop_desc */
-		read_barrier_depends();
+		smp_rmb();
 
 		/* if DD is not set pending work has not been completed */
 		if (!(eop_desc->wb.status & cpu_to_le32(E1000_TXD_STAT_DD)))
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/net/ethernet/intel/igbvf/netdev.c linux-libre-3.18.85-gnu/drivers/net/ethernet/intel/igbvf/netdev.c
--- linux-libre-3.18.84-gnu/drivers/net/ethernet/intel/igbvf/netdev.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/net/ethernet/intel/igbvf/netdev.c	2017-11-30 03:35:56.000000000 -0500
@@ -808,7 +808,7 @@ static bool igbvf_clean_tx_irq(struct ig
 			break;
 
 		/* prevent any other reads prior to eop_desc */
-		read_barrier_depends();
+		smp_rmb();
 
 		/* if DD is not set pending work has not been completed */
 		if (!(eop_desc->wb.status & cpu_to_le32(E1000_TXD_STAT_DD)))
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c linux-libre-3.18.85-gnu/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
--- linux-libre-3.18.84-gnu/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c	2017-11-30 03:35:56.000000000 -0500
@@ -1080,7 +1080,7 @@ static bool ixgbe_clean_tx_irq(struct ix
 			break;
 
 		/* prevent any other reads prior to eop_desc */
-		read_barrier_depends();
+		smp_rmb();
 
 		/* if DD is not set pending work has not been completed */
 		if (!(eop_desc->wb.status & cpu_to_le32(IXGBE_TXD_STAT_DD)))
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c linux-libre-3.18.85-gnu/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
--- linux-libre-3.18.84-gnu/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c	2017-11-30 03:35:56.000000000 -0500
@@ -249,7 +249,7 @@ static bool ixgbevf_clean_tx_irq(struct
 			break;
 
 		/* prevent any other reads prior to eop_desc */
-		read_barrier_depends();
+		smp_rmb();
 
 		/* if DD is not set pending work has not been completed */
 		if (!(eop_desc->wb.status & cpu_to_le32(IXGBE_TXD_STAT_DD)))
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/net/usb/cdc_ether.c linux-libre-3.18.85-gnu/drivers/net/usb/cdc_ether.c
--- linux-libre-3.18.84-gnu/drivers/net/usb/cdc_ether.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/net/usb/cdc_ether.c	2017-11-30 03:35:56.000000000 -0500
@@ -171,6 +171,8 @@ int usbnet_generic_cdc_bind(struct usbne
 				dev_dbg(&intf->dev, "extra CDC header\n");
 				goto bad_desc;
 			}
+			if (len < sizeof(struct usb_cdc_header_desc))
+				break;
 			info->header = (void *) buf;
 			if (info->header->bLength != sizeof(*info->header)) {
 				dev_dbg(&intf->dev, "CDC header len %u\n",
@@ -184,6 +186,8 @@ int usbnet_generic_cdc_bind(struct usbne
 			 */
 			if (rndis) {
 				struct usb_cdc_acm_descriptor *acm;
+				if (len < sizeof(struct usb_cdc_acm_descriptor))
+					break;
 
 				acm = (void *) buf;
 				if (acm->bmCapabilities) {
@@ -200,6 +204,8 @@ int usbnet_generic_cdc_bind(struct usbne
 				dev_dbg(&intf->dev, "extra CDC union\n");
 				goto bad_desc;
 			}
+			if (len < sizeof(struct usb_cdc_union_desc))
+				break;
 			info->u = (void *) buf;
 			if (info->u->bLength != sizeof(*info->u)) {
 				dev_dbg(&intf->dev, "CDC union len %u\n",
@@ -258,6 +264,8 @@ int usbnet_generic_cdc_bind(struct usbne
 				dev_dbg(&intf->dev, "extra CDC ether\n");
 				goto bad_desc;
 			}
+			if (len < sizeof(struct usb_cdc_ether_desc))
+				break;
 			info->ether = (void *) buf;
 			if (info->ether->bLength != sizeof(*info->ether)) {
 				dev_dbg(&intf->dev, "CDC ether len %u\n",
@@ -275,7 +283,6 @@ int usbnet_generic_cdc_bind(struct usbne
 				dev_dbg(&intf->dev, "extra MDLM descriptor\n");
 				goto bad_desc;
 			}
-
 			desc = (void *)buf;
 
 			if (desc->bLength != sizeof(*desc))
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/pci/probe.c linux-libre-3.18.85-gnu/drivers/pci/probe.c
--- linux-libre-3.18.84-gnu/drivers/pci/probe.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/pci/probe.c	2017-11-30 03:35:56.000000000 -0500
@@ -1329,8 +1329,16 @@ static void program_hpp_type0(struct pci
 
 static void program_hpp_type1(struct pci_dev *dev, struct hpp_type1 *hpp)
 {
-	if (hpp)
-		dev_warn(&dev->dev, "PCI-X settings not supported\n");
+	int pos;
+
+	if (!hpp)
+		return;
+
+	pos = pci_find_capability(dev, PCI_CAP_ID_PCIX);
+	if (!pos)
+		return;
+
+	dev_warn(&dev->dev, "PCI-X settings not supported\n");
 }
 
 static void program_hpp_type2(struct pci_dev *dev, struct hpp_type2 *hpp)
@@ -1341,6 +1349,9 @@ static void program_hpp_type2(struct pci
 	if (!hpp)
 		return;
 
+	if (!pci_is_pcie(dev))
+		return;
+
 	if (hpp->revision > 1) {
 		dev_warn(&dev->dev, "PCIe settings rev %d not supported\n",
 			 hpp->revision);
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/staging/iio/cdc/ad7150.c linux-libre-3.18.85-gnu/drivers/staging/iio/cdc/ad7150.c
--- linux-libre-3.18.84-gnu/drivers/staging/iio/cdc/ad7150.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/staging/iio/cdc/ad7150.c	2017-11-30 03:35:56.000000000 -0500
@@ -275,7 +275,7 @@ static int ad7150_write_event_config(str
 error_ret:
 	mutex_unlock(&chip->state_lock);
 
-	return 0;
+	return ret;
 }
 
 static int ad7150_read_event_value(struct iio_dev *indio_dev,
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/staging/iio/trigger/iio-trig-periodic-rtc.c linux-libre-3.18.85-gnu/drivers/staging/iio/trigger/iio-trig-periodic-rtc.c
--- linux-libre-3.18.84-gnu/drivers/staging/iio/trigger/iio-trig-periodic-rtc.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/staging/iio/trigger/iio-trig-periodic-rtc.c	2017-11-30 03:35:56.000000000 -0500
@@ -137,7 +137,7 @@ static int iio_trig_periodic_rtc_probe(s
 		trig_info = kzalloc(sizeof(*trig_info), GFP_KERNEL);
 		if (!trig_info) {
 			ret = -ENOMEM;
-			goto error_put_trigger_and_remove_from_list;
+			goto error_free_trigger_and_remove_from_list;
 		}
 		iio_trigger_set_drvdata(trig, trig_info);
 		trig->ops = &iio_prtc_trigger_ops;
@@ -164,9 +164,9 @@ error_close_rtc:
 	rtc_class_close(trig_info->rtc);
 error_free_trig_info:
 	kfree(trig_info);
-error_put_trigger_and_remove_from_list:
+error_free_trigger_and_remove_from_list:
 	list_del(&trig->alloc_list);
-	iio_trigger_put(trig);
+	iio_trigger_free(trig);
 error_free_completed_registrations:
 	list_for_each_entry_safe(trig,
 				 trig2,
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/target/iscsi/iscsi_target.c linux-libre-3.18.85-gnu/drivers/target/iscsi/iscsi_target.c
--- linux-libre-3.18.84-gnu/drivers/target/iscsi/iscsi_target.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/target/iscsi/iscsi_target.c	2017-11-30 03:35:56.000000000 -0500
@@ -1915,12 +1915,14 @@ attach:
 
 	if (!(hdr->opcode & ISCSI_OP_IMMEDIATE)) {
 		int cmdsn_ret = iscsit_sequence_cmd(conn, cmd, buf, hdr->cmdsn);
-		if (cmdsn_ret == CMDSN_HIGHER_THAN_EXP)
+		if (cmdsn_ret == CMDSN_HIGHER_THAN_EXP) {
 			out_of_order_cmdsn = 1;
-		else if (cmdsn_ret == CMDSN_LOWER_THAN_EXP)
+		} else if (cmdsn_ret == CMDSN_LOWER_THAN_EXP) {
+			target_put_sess_cmd(&cmd->se_cmd);
 			return 0;
-		else if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER)
+		} else if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER) {
 			return -1;
+		}
 	}
 	iscsit_ack_from_expstatsn(conn, be32_to_cpu(hdr->exp_statsn));
 
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/usb/class/cdc-acm.c linux-libre-3.18.85-gnu/drivers/usb/class/cdc-acm.c
--- linux-libre-3.18.84-gnu/drivers/usb/class/cdc-acm.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/usb/class/cdc-acm.c	2017-11-30 03:35:56.000000000 -0500
@@ -1139,7 +1139,7 @@ static int acm_probe(struct usb_interfac
 		}
 	}
 
-	while (buflen > 0) {
+	while (buflen >= 3) { /* minimum length making sense */
 		elength = buffer[0];
 		if (!elength) {
 			dev_err(&intf->dev, "skipping garbage byte\n");
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/usb/class/cdc-wdm.c linux-libre-3.18.85-gnu/drivers/usb/class/cdc-wdm.c
--- linux-libre-3.18.84-gnu/drivers/usb/class/cdc-wdm.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/usb/class/cdc-wdm.c	2017-11-30 03:35:56.000000000 -0500
@@ -891,6 +891,8 @@ static int wdm_probe(struct usb_interfac
 		case USB_CDC_HEADER_TYPE:
 			break;
 		case USB_CDC_DMM_TYPE:
+			if (buflen < sizeof(struct usb_cdc_dmm_desc))
+				break;
 			dmhd = (struct usb_cdc_dmm_desc *)buffer;
 			maxcom = le16_to_cpu(dmhd->wMaxCommand);
 			dev_dbg(&intf->dev,
diff -druNp --no-dereference linux-libre-3.18.84-gnu/drivers/xen/xenbus/xenbus_dev_frontend.c linux-libre-3.18.85-gnu/drivers/xen/xenbus/xenbus_dev_frontend.c
--- linux-libre-3.18.84-gnu/drivers/xen/xenbus/xenbus_dev_frontend.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/drivers/xen/xenbus/xenbus_dev_frontend.c	2017-11-30 03:35:56.000000000 -0500
@@ -316,7 +316,7 @@ static int xenbus_write_transaction(unsi
 			rc = -ENOMEM;
 			goto out;
 		}
-	} else if (msg_type == XS_TRANSACTION_END) {
+	} else if (u->u.msg.tx_id != 0) {
 		list_for_each_entry(trans, &u->transactions, list)
 			if (trans->handle.id == u->u.msg.tx_id)
 				break;
diff -druNp --no-dereference linux-libre-3.18.84-gnu/fs/9p/vfs_inode.c linux-libre-3.18.85-gnu/fs/9p/vfs_inode.c
--- linux-libre-3.18.84-gnu/fs/9p/vfs_inode.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/fs/9p/vfs_inode.c	2017-11-30 03:35:56.000000000 -0500
@@ -483,6 +483,9 @@ static int v9fs_test_inode(struct inode
 
 	if (v9inode->qid.type != st->qid.type)
 		return 0;
+
+	if (v9inode->qid.path != st->qid.path)
+		return 0;
 	return 1;
 }
 
diff -druNp --no-dereference linux-libre-3.18.84-gnu/fs/9p/vfs_inode_dotl.c linux-libre-3.18.85-gnu/fs/9p/vfs_inode_dotl.c
--- linux-libre-3.18.84-gnu/fs/9p/vfs_inode_dotl.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/fs/9p/vfs_inode_dotl.c	2017-11-30 03:35:56.000000000 -0500
@@ -87,6 +87,9 @@ static int v9fs_test_inode_dotl(struct i
 
 	if (v9inode->qid.type != st->qid.type)
 		return 0;
+
+	if (v9inode->qid.path != st->qid.path)
+		return 0;
 	return 1;
 }
 
diff -druNp --no-dereference linux-libre-3.18.84-gnu/fs/autofs4/waitq.c linux-libre-3.18.85-gnu/fs/autofs4/waitq.c
--- linux-libre-3.18.84-gnu/fs/autofs4/waitq.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/fs/autofs4/waitq.c	2017-11-30 03:35:56.000000000 -0500
@@ -87,7 +87,8 @@ static int autofs4_write(struct autofs_s
 		spin_unlock_irqrestore(&current->sighand->siglock, flags);
 	}
 
-	return (bytes > 0);
+	/* if 'wr' returned 0 (impossible) we assume -EIO (safe) */
+	return bytes == 0 ? 0 : wr < 0 ? wr : -EIO;
 }
 	
 static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
@@ -101,6 +102,7 @@ static void autofs4_notify_daemon(struct
 	} pkt;
 	struct file *pipe = NULL;
 	size_t pktsz;
+	int ret;
 
 	DPRINTK("wait id = 0x%08lx, name = %.*s, type=%d",
 		(unsigned long) wq->wait_queue_token, wq->name.len, wq->name.name, type);
@@ -173,7 +175,18 @@ static void autofs4_notify_daemon(struct
 	mutex_unlock(&sbi->wq_mutex);
 
 	if (autofs4_write(sbi, pipe, &pkt, pktsz))
+	switch (ret = autofs4_write(sbi, pipe, &pkt, pktsz)) {
+	case 0:
+		break;
+	case -ENOMEM:
+	case -ERESTARTSYS:
+		/* Just fail this one */
+		autofs4_wait_release(sbi, wq->wait_queue_token, ret);
+		break;
+	default:
 		autofs4_catatonic_mode(sbi);
+		break;
+	}
 	fput(pipe);
 }
 
diff -druNp --no-dereference linux-libre-3.18.84-gnu/fs/btrfs/uuid-tree.c linux-libre-3.18.85-gnu/fs/btrfs/uuid-tree.c
--- linux-libre-3.18.84-gnu/fs/btrfs/uuid-tree.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/fs/btrfs/uuid-tree.c	2017-11-30 03:35:56.000000000 -0500
@@ -348,7 +348,5 @@ skip:
 
 out:
 	btrfs_free_path(path);
-	if (ret)
-		btrfs_warn(fs_info, "btrfs_uuid_tree_iterate failed %d", ret);
-	return 0;
+	return ret;
 }
diff -druNp --no-dereference linux-libre-3.18.84-gnu/fs/ecryptfs/messaging.c linux-libre-3.18.85-gnu/fs/ecryptfs/messaging.c
--- linux-libre-3.18.84-gnu/fs/ecryptfs/messaging.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/fs/ecryptfs/messaging.c	2017-11-30 03:35:56.000000000 -0500
@@ -442,15 +442,16 @@ void ecryptfs_release_messaging(void)
 	}
 	if (ecryptfs_daemon_hash) {
 		struct ecryptfs_daemon *daemon;
+		struct hlist_node *n;
 		int i;
 
 		mutex_lock(&ecryptfs_daemon_hash_mux);
 		for (i = 0; i < (1 << ecryptfs_hash_bits); i++) {
 			int rc;
 
-			hlist_for_each_entry(daemon,
-					     &ecryptfs_daemon_hash[i],
-					     euid_chain) {
+			hlist_for_each_entry_safe(daemon, n,
+						  &ecryptfs_daemon_hash[i],
+						  euid_chain) {
 				rc = ecryptfs_exorcise_daemon(daemon);
 				if (rc)
 					printk(KERN_ERR "%s: Error whilst "
diff -druNp --no-dereference linux-libre-3.18.84-gnu/fs/ext4/extents.c linux-libre-3.18.85-gnu/fs/ext4/extents.c
--- linux-libre-3.18.84-gnu/fs/ext4/extents.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/fs/ext4/extents.c	2017-11-30 03:35:56.000000000 -0500
@@ -4807,7 +4807,8 @@ static long ext4_zero_range(struct file
 	}
 
 	if (!(mode & FALLOC_FL_KEEP_SIZE) &&
-	     offset + len > i_size_read(inode)) {
+	    (offset + len > i_size_read(inode) ||
+	     offset + len > EXT4_I(inode)->i_disksize)) {
 		new_size = offset + len;
 		ret = inode_newsize_ok(inode, new_size);
 		if (ret)
@@ -4951,7 +4952,8 @@ long ext4_fallocate(struct file *file, i
 	}
 
 	if (!(mode & FALLOC_FL_KEEP_SIZE) &&
-	     offset + len > i_size_read(inode)) {
+	    (offset + len > i_size_read(inode) ||
+	     offset + len > EXT4_I(inode)->i_disksize)) {
 		new_size = offset + len;
 		ret = inode_newsize_ok(inode, new_size);
 		if (ret)
diff -druNp --no-dereference linux-libre-3.18.84-gnu/fs/isofs/isofs.h linux-libre-3.18.85-gnu/fs/isofs/isofs.h
--- linux-libre-3.18.84-gnu/fs/isofs/isofs.h	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/fs/isofs/isofs.h	2017-11-30 03:35:56.000000000 -0500
@@ -103,7 +103,7 @@ static inline unsigned int isonum_733(ch
 	/* Ignore bigendian datum due to broken mastering programs */
 	return get_unaligned_le32(p);
 }
-extern int iso_date(char *, int);
+extern int iso_date(u8 *, int);
 
 struct inode;		/* To make gcc happy */
 
diff -druNp --no-dereference linux-libre-3.18.84-gnu/fs/isofs/rock.h linux-libre-3.18.85-gnu/fs/isofs/rock.h
--- linux-libre-3.18.84-gnu/fs/isofs/rock.h	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/fs/isofs/rock.h	2017-11-30 03:35:56.000000000 -0500
@@ -65,7 +65,7 @@ struct RR_PL_s {
 };
 
 struct stamp {
-	char time[7];
+	__u8 time[7];		/* actually 6 unsigned, 1 signed */
 } __attribute__ ((packed));
 
 struct RR_TF_s {
diff -druNp --no-dereference linux-libre-3.18.84-gnu/fs/isofs/util.c linux-libre-3.18.85-gnu/fs/isofs/util.c
--- linux-libre-3.18.84-gnu/fs/isofs/util.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/fs/isofs/util.c	2017-11-30 03:35:56.000000000 -0500
@@ -14,7 +14,7 @@
  * to GMT.  Thus  we should always be correct.
  */
 
-int iso_date(char * p, int flag)
+int iso_date(u8 *p, int flag)
 {
 	int year, month, day, hour, minute, second, tz;
 	int crtime, days, i;
diff -druNp --no-dereference linux-libre-3.18.84-gnu/fs/nfs/nfs4proc.c linux-libre-3.18.85-gnu/fs/nfs/nfs4proc.c
--- linux-libre-3.18.84-gnu/fs/nfs/nfs4proc.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/fs/nfs/nfs4proc.c	2017-11-30 03:35:56.000000000 -0500
@@ -243,15 +243,12 @@ const u32 nfs4_fsinfo_bitmap[3] = { FATT
 };
 
 const u32 nfs4_fs_locations_bitmap[3] = {
-	FATTR4_WORD0_TYPE
-	| FATTR4_WORD0_CHANGE
+	FATTR4_WORD0_CHANGE
 	| FATTR4_WORD0_SIZE
 	| FATTR4_WORD0_FSID
 	| FATTR4_WORD0_FILEID
 	| FATTR4_WORD0_FS_LOCATIONS,
-	FATTR4_WORD1_MODE
-	| FATTR4_WORD1_NUMLINKS
-	| FATTR4_WORD1_OWNER
+	FATTR4_WORD1_OWNER
 	| FATTR4_WORD1_OWNER_GROUP
 	| FATTR4_WORD1_RAWDEV
 	| FATTR4_WORD1_SPACE_USED
@@ -6143,9 +6140,7 @@ static int _nfs4_proc_fs_locations(struc
 				   struct page *page)
 {
 	struct nfs_server *server = NFS_SERVER(dir);
-	u32 bitmask[3] = {
-		[0] = FATTR4_WORD0_FSID | FATTR4_WORD0_FS_LOCATIONS,
-	};
+	u32 bitmask[3];
 	struct nfs4_fs_locations_arg args = {
 		.dir_fh = NFS_FH(dir),
 		.name = name,
@@ -6164,12 +6159,15 @@ static int _nfs4_proc_fs_locations(struc
 
 	dprintk("%s: start\n", __func__);
 
+	bitmask[0] = nfs4_fattr_bitmap[0] | FATTR4_WORD0_FS_LOCATIONS;
+	bitmask[1] = nfs4_fattr_bitmap[1];
+
 	/* Ask for the fileid of the absent filesystem if mounted_on_fileid
 	 * is not supported */
 	if (NFS_SERVER(dir)->attr_bitmask[1] & FATTR4_WORD1_MOUNTED_ON_FILEID)
-		bitmask[1] |= FATTR4_WORD1_MOUNTED_ON_FILEID;
+		bitmask[0] &= ~FATTR4_WORD0_FILEID;
 	else
-		bitmask[0] |= FATTR4_WORD0_FILEID;
+		bitmask[1] &= ~FATTR4_WORD1_MOUNTED_ON_FILEID;
 
 	nfs_fattr_init(&fs_locations->fattr);
 	fs_locations->server = server;
diff -druNp --no-dereference linux-libre-3.18.84-gnu/fs/nfs/super.c linux-libre-3.18.85-gnu/fs/nfs/super.c
--- linux-libre-3.18.84-gnu/fs/nfs/super.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/fs/nfs/super.c	2017-11-30 03:35:56.000000000 -0500
@@ -1321,7 +1321,7 @@ static int nfs_parse_mount_options(char
 			mnt->options |= NFS_OPTION_MIGRATION;
 			break;
 		case Opt_nomigration:
-			mnt->options &= NFS_OPTION_MIGRATION;
+			mnt->options &= ~NFS_OPTION_MIGRATION;
 			break;
 
 		/*
diff -druNp --no-dereference linux-libre-3.18.84-gnu/fs/nfsd/nfs4state.c linux-libre-3.18.85-gnu/fs/nfsd/nfs4state.c
--- linux-libre-3.18.84-gnu/fs/nfsd/nfs4state.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/fs/nfsd/nfs4state.c	2017-11-30 03:35:56.000000000 -0500
@@ -3602,7 +3602,8 @@ static struct nfs4_delegation *find_dele
 {
 	struct nfs4_stid *ret;
 
-	ret = find_stateid_by_type(cl, s, NFS4_DELEG_STID);
+	ret = find_stateid_by_type(cl, s,
+				NFS4_DELEG_STID|NFS4_REVOKED_DELEG_STID);
 	if (!ret)
 		return NULL;
 	return delegstateid(ret);
@@ -3625,6 +3626,12 @@ nfs4_check_deleg(struct nfs4_client *cl,
 	deleg = find_deleg_stateid(cl, &open->op_delegate_stateid);
 	if (deleg == NULL)
 		goto out;
+	if (deleg->dl_stid.sc_type == NFS4_REVOKED_DELEG_STID) {
+		nfs4_put_stid(&deleg->dl_stid);
+		if (cl->cl_minorversion)
+			status = nfserr_deleg_revoked;
+		goto out;
+	}
 	flags = share_access_to_flags(open->op_share_access);
 	status = nfs4_check_delegmode(deleg, flags);
 	if (status) {
@@ -4451,6 +4458,16 @@ nfsd4_lookup_stateid(struct nfsd4_compou
 		     struct nfs4_stid **s, struct nfsd_net *nn)
 {
 	__be32 status;
+	bool return_revoked = false;
+
+	/*
+	 *  only return revoked delegations if explicitly asked.
+	 *  otherwise we report revoked or bad_stateid status.
+	 */
+	if (typemask & NFS4_REVOKED_DELEG_STID)
+		return_revoked = true;
+	else if (typemask & NFS4_DELEG_STID)
+		typemask |= NFS4_REVOKED_DELEG_STID;
 
 	if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
 		return nfserr_bad_stateid;
@@ -4465,6 +4482,12 @@ nfsd4_lookup_stateid(struct nfsd4_compou
 	*s = find_stateid_by_type(cstate->clp, stateid, typemask);
 	if (!*s)
 		return nfserr_bad_stateid;
+	if (((*s)->sc_type == NFS4_REVOKED_DELEG_STID) && !return_revoked) {
+		nfs4_put_stid(*s);
+		if (cstate->minorversion)
+			return nfserr_deleg_revoked;
+		return nfserr_bad_stateid;
+	}
 	return nfs_ok;
 }
 
diff -druNp --no-dereference linux-libre-3.18.84-gnu/fs/nilfs2/segment.c linux-libre-3.18.85-gnu/fs/nilfs2/segment.c
--- linux-libre-3.18.84-gnu/fs/nilfs2/segment.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/fs/nilfs2/segment.c	2017-11-30 03:35:56.000000000 -0500
@@ -1884,8 +1884,6 @@ static int nilfs_segctor_collect_dirty_f
 					      "failed to get inode block.\n");
 				return err;
 			}
-			mark_buffer_dirty(ibh);
-			nilfs_mdt_mark_dirty(ifile);
 			spin_lock(&nilfs->ns_inode_lock);
 			if (likely(!ii->i_bh))
 				ii->i_bh = ibh;
@@ -1894,6 +1892,10 @@ static int nilfs_segctor_collect_dirty_f
 			goto retry;
 		}
 
+		// Always redirty the buffer to avoid race condition
+		mark_buffer_dirty(ii->i_bh);
+		nilfs_mdt_mark_dirty(ifile);
+
 		clear_bit(NILFS_I_QUEUED, &ii->i_state);
 		set_bit(NILFS_I_BUSY, &ii->i_state);
 		list_move_tail(&ii->i_dirty, &sci->sc_dirty_files);
diff -druNp --no-dereference linux-libre-3.18.84-gnu/kernel/sched/core.c linux-libre-3.18.85-gnu/kernel/sched/core.c
--- linux-libre-3.18.84-gnu/kernel/sched/core.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/kernel/sched/core.c	2017-11-30 03:35:56.000000000 -0500
@@ -632,8 +632,7 @@ void resched_cpu(int cpu)
 	struct rq *rq = cpu_rq(cpu);
 	unsigned long flags;
 
-	if (!raw_spin_trylock_irqsave(&rq->lock, flags))
-		return;
+	raw_spin_lock_irqsave(&rq->lock, flags);
 	resched_curr(rq);
 	raw_spin_unlock_irqrestore(&rq->lock, flags);
 }
diff -druNp --no-dereference linux-libre-3.18.84-gnu/kernel/time/timekeeping.c linux-libre-3.18.85-gnu/kernel/time/timekeeping.c
--- linux-libre-3.18.84-gnu/kernel/time/timekeeping.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/kernel/time/timekeeping.c	2017-11-30 03:35:56.000000000 -0500
@@ -712,6 +712,7 @@ int do_settimeofday(const struct timespe
 	struct timekeeper *tk = &tk_core.timekeeper;
 	struct timespec64 ts_delta, xt, tmp;
 	unsigned long flags;
+	int ret = 0;
 
 	if (!timespec_valid_strict(tv))
 		return -EINVAL;
@@ -725,11 +726,16 @@ int do_settimeofday(const struct timespe
 	ts_delta.tv_sec = tv->tv_sec - xt.tv_sec;
 	ts_delta.tv_nsec = tv->tv_nsec - xt.tv_nsec;
 
+	if (timespec64_compare(&tk->wall_to_monotonic, &ts_delta) > 0) {
+		ret = -EINVAL;
+		goto out;
+	}
+
 	tk_set_wall_to_mono(tk, timespec64_sub(tk->wall_to_monotonic, ts_delta));
 
 	tmp = timespec_to_timespec64(*tv);
 	tk_set_xtime(tk, &tmp);
-
+out:
 	timekeeping_update(tk, TK_CLEAR_NTP | TK_MIRROR | TK_CLOCK_WAS_SET);
 
 	write_seqcount_end(&tk_core.seq);
@@ -738,7 +744,7 @@ int do_settimeofday(const struct timespe
 	/* signal hrtimers about time change */
 	clock_was_set();
 
-	return 0;
+	return ret;
 }
 EXPORT_SYMBOL(do_settimeofday);
 
@@ -767,7 +773,8 @@ int timekeeping_inject_offset(struct tim
 
 	/* Make sure the proposed value is valid */
 	tmp = timespec64_add(tk_xtime(tk),  ts64);
-	if (!timespec64_valid_strict(&tmp)) {
+	if (timespec64_compare(&tk->wall_to_monotonic, &ts64) > 0 ||
+		!timespec64_valid_strict(&tmp)) {
 		ret = -EINVAL;
 		goto error;
 	}
diff -druNp --no-dereference linux-libre-3.18.84-gnu/lib/mpi/mpi-pow.c linux-libre-3.18.85-gnu/lib/mpi/mpi-pow.c
--- linux-libre-3.18.84-gnu/lib/mpi/mpi-pow.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/lib/mpi/mpi-pow.c	2017-11-30 03:35:56.000000000 -0500
@@ -26,6 +26,7 @@
  *	 however I decided to publish this code under the plain GPL.
  */
 
+#include <linux/sched.h>
 #include <linux/string.h>
 #include "mpi-internal.h"
 #include "longlong.h"
@@ -256,6 +257,7 @@ int mpi_powm(MPI res, MPI base, MPI exp,
 				}
 				e <<= 1;
 				c--;
+				cond_resched();
 			}
 
 			i--;
diff -druNp --no-dereference linux-libre-3.18.84-gnu/Makefile linux-libre-3.18.85-gnu/Makefile
--- linux-libre-3.18.84-gnu/Makefile	2017-11-24 05:54:57.000000000 -0500
+++ linux-libre-3.18.85-gnu/Makefile	2017-11-30 14:38:51.000000000 -0500
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 18
-SUBLEVEL = 84
+SUBLEVEL = 85
 EXTRAVERSION =-gnu
 NAME = Diseased Newt
 
diff -druNp --no-dereference linux-libre-3.18.84-gnu/net/9p/client.c linux-libre-3.18.85-gnu/net/9p/client.c
--- linux-libre-3.18.84-gnu/net/9p/client.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/net/9p/client.c	2017-11-30 03:35:56.000000000 -0500
@@ -753,8 +753,7 @@ p9_client_rpc(struct p9_client *c, int8_
 	}
 again:
 	/* Wait for the response */
-	err = wait_event_interruptible(*req->wq,
-				       req->status >= REQ_STATUS_RCVD);
+	err = wait_event_killable(*req->wq, req->status >= REQ_STATUS_RCVD);
 
 	/*
 	 * Make sure our req is coherent with regard to updates in other
diff -druNp --no-dereference linux-libre-3.18.84-gnu/net/9p/trans_virtio.c linux-libre-3.18.85-gnu/net/9p/trans_virtio.c
--- linux-libre-3.18.84-gnu/net/9p/trans_virtio.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/net/9p/trans_virtio.c	2017-11-30 03:35:56.000000000 -0500
@@ -292,8 +292,8 @@ req_retry:
 		if (err == -ENOSPC) {
 			chan->ring_bufs_avail = 0;
 			spin_unlock_irqrestore(&chan->lock, flags);
-			err = wait_event_interruptible(*chan->vc_wq,
-							chan->ring_bufs_avail);
+			err = wait_event_killable(*chan->vc_wq,
+						  chan->ring_bufs_avail);
 			if (err  == -ERESTARTSYS)
 				return err;
 
@@ -324,7 +324,7 @@ static int p9_get_mapped_pages(struct vi
 		 * Other zc request to finish here
 		 */
 		if (atomic_read(&vp_pinned) >= chan->p9_max_pages) {
-			err = wait_event_interruptible(vp_wq,
+			err = wait_event_killable(vp_wq,
 			      (atomic_read(&vp_pinned) < chan->p9_max_pages));
 			if (err == -ERESTARTSYS)
 				return err;
@@ -454,8 +454,8 @@ req_retry_pinned:
 		if (err == -ENOSPC) {
 			chan->ring_bufs_avail = 0;
 			spin_unlock_irqrestore(&chan->lock, flags);
-			err = wait_event_interruptible(*chan->vc_wq,
-						       chan->ring_bufs_avail);
+			err = wait_event_killable(*chan->vc_wq,
+						  chan->ring_bufs_avail);
 			if (err  == -ERESTARTSYS)
 				goto err_out;
 
@@ -472,8 +472,7 @@ req_retry_pinned:
 	virtqueue_kick(chan->vq);
 	spin_unlock_irqrestore(&chan->lock, flags);
 	p9_debug(P9_DEBUG_TRANS, "virtio request kicked\n");
-	err = wait_event_interruptible(*req->wq,
-				       req->status >= REQ_STATUS_RCVD);
+	err = wait_event_killable(*req->wq, req->status >= REQ_STATUS_RCVD);
 	/*
 	 * Non kernel buffers are pinned, unpin them
 	 */
diff -druNp --no-dereference linux-libre-3.18.84-gnu/net/ipv6/route.c linux-libre-3.18.85-gnu/net/ipv6/route.c
--- linux-libre-3.18.84-gnu/net/ipv6/route.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/net/ipv6/route.c	2017-11-30 03:35:56.000000000 -0500
@@ -2827,7 +2827,11 @@ static int ip6_route_dev_notify(struct n
 		net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
 		net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
 #endif
-	 } else if (event == NETDEV_UNREGISTER) {
+	 } else if (event == NETDEV_UNREGISTER &&
+		    dev->reg_state != NETREG_UNREGISTERED) {
+		/* NETDEV_UNREGISTER could be fired for multiple times by
+		 * netdev_wait_allrefs(). Make sure we only call this once.
+		 */
 		in6_dev_put(net->ipv6.ip6_null_entry->rt6i_idev);
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
 		in6_dev_put(net->ipv6.ip6_prohibit_entry->rt6i_idev);
diff -druNp --no-dereference linux-libre-3.18.84-gnu/net/mac80211/ieee80211_i.h linux-libre-3.18.85-gnu/net/mac80211/ieee80211_i.h
--- linux-libre-3.18.84-gnu/net/mac80211/ieee80211_i.h	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/net/mac80211/ieee80211_i.h	2017-11-30 03:35:56.000000000 -0500
@@ -640,7 +640,6 @@ struct ieee80211_if_mesh {
 	const struct ieee80211_mesh_sync_ops *sync_ops;
 	s64 sync_offset_clockdrift_max;
 	spinlock_t sync_offset_lock;
-	bool adjusting_tbtt;
 	/* mesh power save */
 	enum nl80211_mesh_power_mode nonpeer_pm;
 	int ps_peers_light_sleep;
diff -druNp --no-dereference linux-libre-3.18.84-gnu/net/mac80211/mesh.c linux-libre-3.18.85-gnu/net/mac80211/mesh.c
--- linux-libre-3.18.84-gnu/net/mac80211/mesh.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/net/mac80211/mesh.c	2017-11-30 03:35:56.000000000 -0500
@@ -289,8 +289,6 @@ int mesh_add_meshconf_ie(struct ieee8021
 	/* Mesh PS mode. See IEEE802.11-2012 8.4.2.100.8 */
 	*pos |= ifmsh->ps_peers_deep_sleep ?
 			IEEE80211_MESHCONF_CAPAB_POWER_SAVE_LEVEL : 0x00;
-	*pos++ |= ifmsh->adjusting_tbtt ?
-			IEEE80211_MESHCONF_CAPAB_TBTT_ADJUSTING : 0x00;
 	*pos++ = 0x00;
 
 	return 0;
@@ -790,7 +788,6 @@ int ieee80211_start_mesh(struct ieee8021
 	ifmsh->mesh_cc_id = 0;	/* Disabled */
 	/* register sync ops from extensible synchronization framework */
 	ifmsh->sync_ops = ieee80211_mesh_sync_ops_get(ifmsh->mesh_sp_id);
-	ifmsh->adjusting_tbtt = false;
 	ifmsh->sync_offset_clockdrift_max = 0;
 	set_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags);
 	ieee80211_mesh_root_setup(ifmsh);
diff -druNp --no-dereference linux-libre-3.18.84-gnu/net/mac80211/mesh_plink.c linux-libre-3.18.85-gnu/net/mac80211/mesh_plink.c
--- linux-libre-3.18.84-gnu/net/mac80211/mesh_plink.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/net/mac80211/mesh_plink.c	2017-11-30 03:35:56.000000000 -0500
@@ -448,12 +448,14 @@ mesh_sta_info_alloc(struct ieee80211_sub
 
 	/* Userspace handles station allocation */
 	if (sdata->u.mesh.user_mpm ||
-	    sdata->u.mesh.security & IEEE80211_MESH_SEC_AUTHED)
-		cfg80211_notify_new_peer_candidate(sdata->dev, addr,
-						   elems->ie_start,
-						   elems->total_len,
-						   GFP_KERNEL);
-	else
+	    sdata->u.mesh.security & IEEE80211_MESH_SEC_AUTHED) {
+		if (mesh_peer_accepts_plinks(elems) &&
+		    mesh_plink_availables(sdata))
+			cfg80211_notify_new_peer_candidate(sdata->dev, addr,
+							   elems->ie_start,
+							   elems->total_len,
+							   GFP_KERNEL);
+	} else
 		sta = __mesh_sta_info_alloc(sdata, addr);
 
 	return sta;
diff -druNp --no-dereference linux-libre-3.18.84-gnu/net/mac80211/mesh_sync.c linux-libre-3.18.85-gnu/net/mac80211/mesh_sync.c
--- linux-libre-3.18.84-gnu/net/mac80211/mesh_sync.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/net/mac80211/mesh_sync.c	2017-11-30 03:35:56.000000000 -0500
@@ -119,7 +119,6 @@ static void mesh_sync_offset_rx_bcn_pres
 	 */
 
 	if (elems->mesh_config && mesh_peer_tbtt_adjusting(elems)) {
-		clear_sta_flag(sta, WLAN_STA_TOFFSET_KNOWN);
 		msync_dbg(sdata, "STA %pM : is adjusting TBTT\n",
 			  sta->sta.addr);
 		goto no_sync;
@@ -168,11 +167,9 @@ static void mesh_sync_offset_adjust_tbtt
 					 struct beacon_data *beacon)
 {
 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
-	u8 cap;
 
 	WARN_ON(ifmsh->mesh_sp_id != IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET);
 	WARN_ON(!rcu_read_lock_held());
-	cap = beacon->meshconf->meshconf_cap;
 
 	spin_lock_bh(&ifmsh->sync_offset_lock);
 
@@ -186,21 +183,13 @@ static void mesh_sync_offset_adjust_tbtt
 			  "TBTT : kicking off TBTT adjustment with clockdrift_max=%lld\n",
 			  ifmsh->sync_offset_clockdrift_max);
 		set_bit(MESH_WORK_DRIFT_ADJUST, &ifmsh->wrkq_flags);
-
-		ifmsh->adjusting_tbtt = true;
 	} else {
 		msync_dbg(sdata,
 			  "TBTT : max clockdrift=%lld; too small to adjust\n",
 			  (long long)ifmsh->sync_offset_clockdrift_max);
 		ifmsh->sync_offset_clockdrift_max = 0;
-
-		ifmsh->adjusting_tbtt = false;
 	}
 	spin_unlock_bh(&ifmsh->sync_offset_lock);
-
-	beacon->meshconf->meshconf_cap = ifmsh->adjusting_tbtt ?
-			IEEE80211_MESHCONF_CAPAB_TBTT_ADJUSTING | cap :
-			~IEEE80211_MESHCONF_CAPAB_TBTT_ADJUSTING & cap;
 }
 
 static const struct sync_method sync_methods[] = {
diff -druNp --no-dereference linux-libre-3.18.84-gnu/net/netfilter/nf_tables_api.c linux-libre-3.18.85-gnu/net/netfilter/nf_tables_api.c
--- linux-libre-3.18.84-gnu/net/netfilter/nf_tables_api.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/net/netfilter/nf_tables_api.c	2017-11-30 03:35:56.000000000 -0500
@@ -1869,7 +1869,7 @@ static void nf_tables_rule_destroy(const
 	 * is called on error from nf_tables_newrule().
 	 */
 	expr = nft_expr_first(rule);
-	while (expr->ops && expr != nft_expr_last(rule)) {
+	while (expr != nft_expr_last(rule) && expr->ops) {
 		nf_tables_expr_destroy(ctx, expr);
 		expr = nft_expr_next(expr);
 	}
diff -druNp --no-dereference linux-libre-3.18.84-gnu/net/netfilter/nft_queue.c linux-libre-3.18.85-gnu/net/netfilter/nft_queue.c
--- linux-libre-3.18.84-gnu/net/netfilter/nft_queue.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/net/netfilter/nft_queue.c	2017-11-30 03:35:56.000000000 -0500
@@ -37,7 +37,7 @@ static void nft_queue_eval(const struct
 
 	if (priv->queues_total > 1) {
 		if (priv->flags & NFT_QUEUE_FLAG_CPU_FANOUT) {
-			int cpu = smp_processor_id();
+			int cpu = raw_smp_processor_id();
 
 			queue = priv->queuenum + cpu % priv->queues_total;
 		} else {
diff -druNp --no-dereference linux-libre-3.18.84-gnu/net/nfc/core.c linux-libre-3.18.85-gnu/net/nfc/core.c
--- linux-libre-3.18.84-gnu/net/nfc/core.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/net/nfc/core.c	2017-11-30 03:35:56.000000000 -0500
@@ -1074,7 +1074,7 @@ struct nfc_dev *nfc_allocate_device(stru
 err_free_dev:
 	kfree(dev);
 
-	return ERR_PTR(rc);
+	return NULL;
 }
 EXPORT_SYMBOL(nfc_allocate_device);
 
diff -druNp --no-dereference linux-libre-3.18.84-gnu/net/rds/send.c linux-libre-3.18.85-gnu/net/rds/send.c
--- linux-libre-3.18.84-gnu/net/rds/send.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/net/rds/send.c	2017-11-30 03:35:56.000000000 -0500
@@ -903,6 +903,11 @@ static int rds_cmsg_send(struct rds_sock
 			ret = rds_cmsg_rdma_map(rs, rm, cmsg);
 			if (!ret)
 				*allocated_mr = 1;
+			else if (ret == -ENODEV)
+				/* Accommodate the get_mr() case which can fail
+				 * if connection isn't established yet.
+				 */
+				ret = -EAGAIN;
 			break;
 		case RDS_CMSG_ATOMIC_CSWP:
 		case RDS_CMSG_ATOMIC_FADD:
@@ -1011,8 +1016,12 @@ int rds_sendmsg(struct kiocb *iocb, stru
 
 	/* Parse any control messages the user may have included. */
 	ret = rds_cmsg_send(rs, rm, msg, &allocated_mr);
-	if (ret)
+	if (ret) {
+		/* Trigger connection so that its ready for the next retry */
+		if (ret ==  -EAGAIN)
+			rds_conn_connect_if_down(conn);
 		goto out;
+	}
 
 	if (rm->rdma.op_active && !conn->c_trans->xmit_rdma) {
 		printk_ratelimited(KERN_NOTICE "rdma_op %p conn xmit_rdma %p\n",
diff -druNp --no-dereference linux-libre-3.18.84-gnu/sound/core/timer_compat.c linux-libre-3.18.85-gnu/sound/core/timer_compat.c
--- linux-libre-3.18.84-gnu/sound/core/timer_compat.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/sound/core/timer_compat.c	2017-11-30 03:35:56.000000000 -0500
@@ -40,11 +40,11 @@ static int snd_timer_user_info_compat(st
 	struct snd_timer *t;
 
 	tu = file->private_data;
-	if (snd_BUG_ON(!tu->timeri))
-		return -ENXIO;
+	if (!tu->timeri)
+		return -EBADFD;
 	t = tu->timeri->timer;
-	if (snd_BUG_ON(!t))
-		return -ENXIO;
+	if (!t)
+		return -EBADFD;
 	memset(&info, 0, sizeof(info));
 	info.card = t->card ? t->card->number : -1;
 	if (t->hw.flags & SNDRV_TIMER_HW_SLAVE)
@@ -73,8 +73,8 @@ static int snd_timer_user_status_compat(
 	struct snd_timer_status32 status;
 	
 	tu = file->private_data;
-	if (snd_BUG_ON(!tu->timeri))
-		return -ENXIO;
+	if (!tu->timeri)
+		return -EBADFD;
 	memset(&status, 0, sizeof(status));
 	status.tstamp.tv_sec = tu->tstamp.tv_sec;
 	status.tstamp.tv_nsec = tu->tstamp.tv_nsec;
diff -druNp --no-dereference linux-libre-3.18.84-gnu/sound/pci/hda/hda_intel.c linux-libre-3.18.85-gnu/sound/pci/hda/hda_intel.c
--- linux-libre-3.18.84-gnu/sound/pci/hda/hda_intel.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/sound/pci/hda/hda_intel.c	2017-11-30 03:35:56.000000000 -0500
@@ -2092,6 +2092,9 @@ static const struct pci_device_id azx_id
 	/* AMD Hudson */
 	{ PCI_DEVICE(0x1022, 0x780d),
 	  .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
+	/* AMD Raven */
+	{ PCI_DEVICE(0x1022, 0x15e3),
+	  .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
 	/* ATI HDMI */
 	{ PCI_DEVICE(0x1002, 0x0002),
 	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
diff -druNp --no-dereference linux-libre-3.18.84-gnu/sound/pci/hda/patch_realtek.c linux-libre-3.18.85-gnu/sound/pci/hda/patch_realtek.c
--- linux-libre-3.18.84-gnu/sound/pci/hda/patch_realtek.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/sound/pci/hda/patch_realtek.c	2017-11-30 03:35:56.000000000 -0500
@@ -4289,7 +4289,7 @@ static void alc_no_shutup(struct hda_cod
 static void alc_fixup_no_shutup(struct hda_codec *codec,
 				const struct hda_fixup *fix, int action)
 {
-	if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+	if (action == HDA_FIXUP_ACT_PROBE) {
 		struct alc_spec *spec = codec->spec;
 		spec->shutup = alc_no_shutup;
 	}
diff -druNp --no-dereference linux-libre-3.18.84-gnu/sound/soc/codecs/wm_adsp.c linux-libre-3.18.85-gnu/sound/soc/codecs/wm_adsp.c
--- linux-libre-3.18.84-gnu/sound/soc/codecs/wm_adsp.c	2017-11-24 06:47:54.000000000 -0500
+++ linux-libre-3.18.85-gnu/sound/soc/codecs/wm_adsp.c	2017-11-30 15:20:47.000000000 -0500
@@ -532,7 +532,7 @@ static int wm_adsp_load(struct wm_adsp *
 	const struct wmfw_region *region;
 	const struct wm_adsp_region *mem;
 	const char *region_name;
-	char *file, *text;
+	char *file, *text = NULL;
 	struct wm_adsp_buf *buf;
 	unsigned int reg;
 	int regions = 0;
@@ -677,10 +677,21 @@ static int wm_adsp_load(struct wm_adsp *
 			 regions, le32_to_cpu(region->len), offset,
 			 region_name);
 
+		if ((pos + le32_to_cpu(region->len) + sizeof(*region)) >
+		    firmware->size) {
+			adsp_err(dsp,
+				 "%s.%d: %s region len %d bytes exceeds file length %zu\n",
+				 file, regions, region_name,
+				 le32_to_cpu(region->len), firmware->size);
+			ret = -EINVAL;
+			goto out_fw;
+		}
+
 		if (text) {
 			memcpy(text, region->data, le32_to_cpu(region->len));
 			adsp_info(dsp, "%s: %s\n", file, text);
 			kfree(text);
+			text = NULL;
 		}
 
 		if (reg) {
@@ -737,6 +748,7 @@ out_fw:
 	regmap_async_complete(regmap);
 	wm_adsp_buf_free(&buf_list);
 	release_firmware(firmware);
+	kfree(text);
 out:
 	kfree(file);
 
@@ -1316,6 +1328,17 @@ static int wm_adsp_load_coeff(struct wm_
 		}
 
 		if (reg) {
+			if ((pos + le32_to_cpu(blk->len) + sizeof(*blk)) >
+			    firmware->size) {
+				adsp_err(dsp,
+					 "%s.%d: %s region len %d bytes exceeds file length %zu\n",
+					 file, blocks, region_name,
+					 le32_to_cpu(blk->len),
+					 firmware->size);
+				ret = -EINVAL;
+				goto out_fw;
+			}
+
 			buf = wm_adsp_buf_alloc(blk->data,
 						le32_to_cpu(blk->len),
 						&buf_list);
diff -druNp --no-dereference linux-libre-3.18.84-gnu/sound/usb/clock.c linux-libre-3.18.85-gnu/sound/usb/clock.c
--- linux-libre-3.18.84-gnu/sound/usb/clock.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/sound/usb/clock.c	2017-11-30 03:35:56.000000000 -0500
@@ -43,7 +43,7 @@ static struct uac_clock_source_descripto
 	while ((cs = snd_usb_find_csint_desc(ctrl_iface->extra,
 					     ctrl_iface->extralen,
 					     cs, UAC2_CLOCK_SOURCE))) {
-		if (cs->bClockID == clock_id)
+		if (cs->bLength >= sizeof(*cs) && cs->bClockID == clock_id)
 			return cs;
 	}
 
@@ -59,8 +59,11 @@ static struct uac_clock_selector_descrip
 	while ((cs = snd_usb_find_csint_desc(ctrl_iface->extra,
 					     ctrl_iface->extralen,
 					     cs, UAC2_CLOCK_SELECTOR))) {
-		if (cs->bClockID == clock_id)
+		if (cs->bLength >= sizeof(*cs) && cs->bClockID == clock_id) {
+			if (cs->bLength < 5 + cs->bNrInPins)
+				return NULL;
 			return cs;
+		}
 	}
 
 	return NULL;
@@ -75,7 +78,7 @@ static struct uac_clock_multiplier_descr
 	while ((cs = snd_usb_find_csint_desc(ctrl_iface->extra,
 					     ctrl_iface->extralen,
 					     cs, UAC2_CLOCK_MULTIPLIER))) {
-		if (cs->bClockID == clock_id)
+		if (cs->bLength >= sizeof(*cs) && cs->bClockID == clock_id)
 			return cs;
 	}
 
diff -druNp --no-dereference linux-libre-3.18.84-gnu/sound/usb/mixer.c linux-libre-3.18.85-gnu/sound/usb/mixer.c
--- linux-libre-3.18.84-gnu/sound/usb/mixer.c	2017-11-24 02:30:05.000000000 -0500
+++ linux-libre-3.18.85-gnu/sound/usb/mixer.c	2017-11-30 03:35:56.000000000 -0500
@@ -1373,6 +1373,12 @@ static int parse_audio_feature_unit(stru
 	__u8 *bmaControls;
 
 	if (state->mixer->protocol == UAC_VERSION_1) {
+		if (hdr->bLength < 7) {
+			usb_audio_err(state->chip,
+				      "unit %u: invalid UAC_FEATURE_UNIT descriptor\n",
+				      unitid);
+			return -EINVAL;
+		}
 		csize = hdr->bControlSize;
 		if (!csize) {
 			usb_audio_dbg(state->chip,
@@ -1390,6 +1396,12 @@ static int parse_audio_feature_unit(stru
 		}
 	} else {
 		struct uac2_feature_unit_descriptor *ftr = _ftr;
+		if (hdr->bLength < 6) {
+			usb_audio_err(state->chip,
+				      "unit %u: invalid UAC_FEATURE_UNIT descriptor\n",
+				      unitid);
+			return -EINVAL;
+		}
 		csize = 4;
 		channels = (hdr->bLength - 6) / 4 - 1;
 		bmaControls = ftr->bmaControls;
@@ -2006,7 +2018,8 @@ static int parse_audio_selector_unit(str
 	const struct usbmix_name_map *map;
 	char **namelist;
 
-	if (!desc->bNrInPins || desc->bLength < 5 + desc->bNrInPins) {
+	if (desc->bLength < 5 || !desc->bNrInPins ||
+	    desc->bLength < 5 + desc->bNrInPins) {
 		usb_audio_err(state->chip,
 			"invalid SELECTOR UNIT descriptor %d\n", unitid);
 		return -EINVAL;
