diff -druNp --no-dereference linux-libre-3.18.85-gnu/arch/x86/kvm/svm.c linux-libre-3.18.86-gnu/arch/x86/kvm/svm.c
--- linux-libre-3.18.85-gnu/arch/x86/kvm/svm.c	2017-11-30 03:35:56.000000000 -0500
+++ linux-libre-3.18.86-gnu/arch/x86/kvm/svm.c	2017-12-05 05:20:47.000000000 -0500
@@ -1785,6 +1785,8 @@ static int ud_interception(struct vcpu_s
 	int er;
 
 	er = emulate_instruction(&svm->vcpu, EMULTYPE_TRAP_UD);
+	if (er == EMULATE_USER_EXIT)
+		return 0;
 	if (er != EMULATE_DONE)
 		kvm_queue_exception(&svm->vcpu, UD_VECTOR);
 	return 1;
diff -druNp --no-dereference linux-libre-3.18.85-gnu/arch/x86/kvm/vmx.c linux-libre-3.18.86-gnu/arch/x86/kvm/vmx.c
--- linux-libre-3.18.85-gnu/arch/x86/kvm/vmx.c	2017-11-30 03:35:56.000000000 -0500
+++ linux-libre-3.18.86-gnu/arch/x86/kvm/vmx.c	2017-12-05 05:20:47.000000000 -0500
@@ -4899,6 +4899,8 @@ static int handle_exception(struct kvm_v
 
 	if (is_invalid_opcode(intr_info)) {
 		er = emulate_instruction(vcpu, EMULTYPE_TRAP_UD);
+		if (er == EMULATE_USER_EXIT)
+			return 0;
 		if (er != EMULATE_DONE)
 			kvm_queue_exception(vcpu, UD_VECTOR);
 		return 1;
diff -druNp --no-dereference linux-libre-3.18.85-gnu/arch/x86/kvm/x86.c linux-libre-3.18.86-gnu/arch/x86/kvm/x86.c
--- linux-libre-3.18.85-gnu/arch/x86/kvm/x86.c	2017-11-30 03:35:56.000000000 -0500
+++ linux-libre-3.18.86-gnu/arch/x86/kvm/x86.c	2017-12-05 05:20:47.000000000 -0500
@@ -5372,6 +5372,8 @@ int x86_emulate_instruction(struct kvm_v
 			if (reexecute_instruction(vcpu, cr2, write_fault_to_spt,
 						emulation_type))
 				return EMULATE_DONE;
+			if (ctxt->have_exception && inject_emulated_exception(vcpu))
+				return EMULATE_DONE;
 			if (emulation_type & EMULTYPE_SKIP)
 				return EMULATE_FAIL;
 			return handle_emulation_failure(vcpu);
diff -druNp --no-dereference linux-libre-3.18.85-gnu/drivers/gpu/drm/i915/intel_i2c.c linux-libre-3.18.86-gnu/drivers/gpu/drm/i915/intel_i2c.c
--- linux-libre-3.18.85-gnu/drivers/gpu/drm/i915/intel_i2c.c	2017-11-30 03:35:56.000000000 -0500
+++ linux-libre-3.18.86-gnu/drivers/gpu/drm/i915/intel_i2c.c	2017-12-05 05:20:47.000000000 -0500
@@ -394,7 +394,9 @@ static bool
 gmbus_is_index_read(struct i2c_msg *msgs, int i, int num)
 {
 	return (i + 1 < num &&
-		!(msgs[i].flags & I2C_M_RD) && msgs[i].len <= 2 &&
+		msgs[i].addr == msgs[i + 1].addr &&
+		!(msgs[i].flags & I2C_M_RD) &&
+		(msgs[i].len == 1 || msgs[i].len == 2) &&
 		(msgs[i + 1].flags & I2C_M_RD));
 }
 
diff -druNp --no-dereference linux-libre-3.18.85-gnu/drivers/gpu/drm/panel/panel-simple.c linux-libre-3.18.86-gnu/drivers/gpu/drm/panel/panel-simple.c
--- linux-libre-3.18.85-gnu/drivers/gpu/drm/panel/panel-simple.c	2017-11-30 03:35:56.000000000 -0500
+++ linux-libre-3.18.86-gnu/drivers/gpu/drm/panel/panel-simple.c	2017-12-05 05:20:47.000000000 -0500
@@ -312,6 +312,7 @@ static int panel_simple_remove(struct de
 	drm_panel_remove(&panel->base);
 
 	panel_simple_disable(&panel->base);
+	panel_simple_unprepare(&panel->base);
 
 	if (panel->ddc)
 		put_device(&panel->ddc->dev);
@@ -327,6 +328,7 @@ static void panel_simple_shutdown(struct
 	struct panel_simple *panel = dev_get_drvdata(dev);
 
 	panel_simple_disable(&panel->base);
+	panel_simple_unprepare(&panel->base);
 }
 
 static const struct drm_display_mode auo_b101aw03_mode = {
diff -druNp --no-dereference linux-libre-3.18.85-gnu/drivers/misc/eeprom/at24.c linux-libre-3.18.86-gnu/drivers/misc/eeprom/at24.c
--- linux-libre-3.18.85-gnu/drivers/misc/eeprom/at24.c	2017-11-30 03:35:56.000000000 -0500
+++ linux-libre-3.18.86-gnu/drivers/misc/eeprom/at24.c	2017-12-05 05:20:47.000000000 -0500
@@ -274,6 +274,9 @@ static ssize_t at24_read(struct at24_dat
 	if (unlikely(!count))
 		return count;
 
+	if (off + count > at24->chip.byte_len)
+		return -EINVAL;
+
 	/*
 	 * Read data from chip, protecting against concurrent updates
 	 * from this host, but not from other I2C masters.
@@ -328,6 +331,9 @@ static ssize_t at24_eeprom_write(struct
 	unsigned long timeout, write_time;
 	unsigned next_page;
 
+	if (offset + count > at24->chip.byte_len)
+		return -EINVAL;
+
 	/* Get corresponding I2C address and adjust offset */
 	client = at24_translate_offset(at24, &offset);
 
diff -druNp --no-dereference linux-libre-3.18.85-gnu/fs/btrfs/extent-tree.c linux-libre-3.18.86-gnu/fs/btrfs/extent-tree.c
--- linux-libre-3.18.85-gnu/fs/btrfs/extent-tree.c	2017-11-30 03:35:56.000000000 -0500
+++ linux-libre-3.18.86-gnu/fs/btrfs/extent-tree.c	2017-12-05 05:20:47.000000000 -0500
@@ -3219,13 +3219,6 @@ again:
 		goto again;
 	}
 
-	/* We've already setup this transaction, go ahead and exit */
-	if (block_group->cache_generation == trans->transid &&
-	    i_size_read(inode)) {
-		dcs = BTRFS_DC_SETUP;
-		goto out_put;
-	}
-
 	/*
 	 * We want to set the generation to 0, that way if anything goes wrong
 	 * from here on out we know not to trust this cache when we load up next
@@ -3235,6 +3228,13 @@ again:
 	ret = btrfs_update_inode(trans, root, inode);
 	WARN_ON(ret);
 
+	/* We've already setup this transaction, go ahead and exit */
+	if (block_group->cache_generation == trans->transid &&
+	    i_size_read(inode)) {
+		dcs = BTRFS_DC_SETUP;
+		goto out_put;
+	}
+
 	if (i_size_read(inode) > 0) {
 		ret = btrfs_check_trunc_cache_free_space(root,
 					&root->fs_info->global_block_rsv);
diff -druNp --no-dereference linux-libre-3.18.85-gnu/fs/nfs/dir.c linux-libre-3.18.86-gnu/fs/nfs/dir.c
--- linux-libre-3.18.85-gnu/fs/nfs/dir.c	2017-11-30 03:35:56.000000000 -0500
+++ linux-libre-3.18.86-gnu/fs/nfs/dir.c	2017-12-05 05:20:47.000000000 -0500
@@ -1266,7 +1266,7 @@ static int nfs_weak_revalidate(struct de
 		return 0;
 	}
 
-	error = nfs_revalidate_inode(NFS_SERVER(inode), inode);
+	error = nfs_lookup_verify_inode(inode, flags);
 	dfprintk(LOOKUPCACHE, "NFS: %s: inode %lu is %s\n",
 			__func__, inode->i_ino, error ? "invalid" : "valid");
 	return !error;
@@ -1426,6 +1426,7 @@ static int nfs4_lookup_revalidate(struct
 
 const struct dentry_operations nfs4_dentry_operations = {
 	.d_revalidate	= nfs4_lookup_revalidate,
+	.d_weak_revalidate	= nfs_weak_revalidate,
 	.d_delete	= nfs_dentry_delete,
 	.d_iput		= nfs_dentry_iput,
 	.d_automount	= nfs_d_automount,
diff -druNp --no-dereference linux-libre-3.18.85-gnu/include/linux/netlink.h linux-libre-3.18.86-gnu/include/linux/netlink.h
--- linux-libre-3.18.85-gnu/include/linux/netlink.h	2017-11-30 03:35:56.000000000 -0500
+++ linux-libre-3.18.86-gnu/include/linux/netlink.h	2017-12-05 05:20:47.000000000 -0500
@@ -120,6 +120,7 @@ netlink_skb_clone(struct sk_buff *skb, g
 struct netlink_callback {
 	struct sk_buff		*skb;
 	const struct nlmsghdr	*nlh;
+	int			(*start)(struct netlink_callback *);
 	int			(*dump)(struct sk_buff * skb,
 					struct netlink_callback *cb);
 	int			(*done)(struct netlink_callback *cb);
@@ -142,6 +143,7 @@ struct nlmsghdr *
 __nlmsg_put(struct sk_buff *skb, u32 portid, u32 seq, int type, int len, int flags);
 
 struct netlink_dump_control {
+	int (*start)(struct netlink_callback *);
 	int (*dump)(struct sk_buff *skb, struct netlink_callback *);
 	int (*done)(struct netlink_callback *);
 	void *data;
diff -druNp --no-dereference linux-libre-3.18.85-gnu/include/net/genetlink.h linux-libre-3.18.86-gnu/include/net/genetlink.h
--- linux-libre-3.18.85-gnu/include/net/genetlink.h	2017-11-30 03:35:56.000000000 -0500
+++ linux-libre-3.18.86-gnu/include/net/genetlink.h	2017-12-05 05:20:47.000000000 -0500
@@ -106,6 +106,7 @@ static inline void genl_info_net_set(str
  * @flags: flags
  * @policy: attribute validation policy
  * @doit: standard command callback
+ * @start: start callback for dumps
  * @dumpit: callback for dumpers
  * @done: completion callback for dumps
  * @ops_list: operations list
@@ -114,6 +115,7 @@ struct genl_ops {
 	const struct nla_policy	*policy;
 	int		       (*doit)(struct sk_buff *skb,
 				       struct genl_info *info);
+	int		       (*start)(struct netlink_callback *cb);
 	int		       (*dumpit)(struct sk_buff *skb,
 					 struct netlink_callback *cb);
 	int		       (*done)(struct netlink_callback *cb);
diff -druNp --no-dereference linux-libre-3.18.85-gnu/Makefile linux-libre-3.18.86-gnu/Makefile
--- linux-libre-3.18.85-gnu/Makefile	2017-11-30 14:38:51.000000000 -0500
+++ linux-libre-3.18.86-gnu/Makefile	2017-12-05 23:44:53.000000000 -0500
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 18
-SUBLEVEL = 85
+SUBLEVEL = 86
 EXTRAVERSION =-gnu
 NAME = Diseased Newt
 
diff -druNp --no-dereference linux-libre-3.18.85-gnu/mm/huge_memory.c linux-libre-3.18.86-gnu/mm/huge_memory.c
--- linux-libre-3.18.85-gnu/mm/huge_memory.c	2017-11-30 03:35:56.000000000 -0500
+++ linux-libre-3.18.86-gnu/mm/huge_memory.c	2017-12-05 05:20:47.000000000 -0500
@@ -1240,17 +1240,11 @@ struct page *follow_trans_huge_pmd(struc
 	VM_BUG_ON_PAGE(!PageHead(page), page);
 	if (flags & FOLL_TOUCH) {
 		pmd_t _pmd;
-		/*
-		 * We should set the dirty bit only for FOLL_WRITE but
-		 * for now the dirty bit in the pmd is meaningless.
-		 * And if the dirty bit will become meaningful and
-		 * we'll only set it with FOLL_WRITE, an atomic
-		 * set_bit will be required on the pmd to set the
-		 * young bit, instead of the current set_pmd_at.
-		 */
-		_pmd = pmd_mkyoung(pmd_mkdirty(*pmd));
+		_pmd = pmd_mkyoung(*pmd);
+		if (flags & FOLL_WRITE)
+			_pmd = pmd_mkdirty(_pmd);
 		if (pmdp_set_access_flags(vma, addr & HPAGE_PMD_MASK,
-					  pmd, _pmd,  1))
+					  pmd, _pmd, flags & FOLL_WRITE))
 			update_mmu_cache_pmd(vma, addr, pmd);
 	}
 	if ((flags & FOLL_MLOCK) && (vma->vm_flags & VM_LOCKED)) {
diff -druNp --no-dereference linux-libre-3.18.85-gnu/mm/madvise.c linux-libre-3.18.86-gnu/mm/madvise.c
--- linux-libre-3.18.85-gnu/mm/madvise.c	2017-11-30 03:35:56.000000000 -0500
+++ linux-libre-3.18.86-gnu/mm/madvise.c	2017-12-05 05:20:47.000000000 -0500
@@ -221,9 +221,9 @@ static long madvise_willneed(struct vm_a
 {
 	struct file *file = vma->vm_file;
 
+	*prev = vma;
 #ifdef CONFIG_SWAP
 	if (!file || mapping_cap_swap_backed(file->f_mapping)) {
-		*prev = vma;
 		if (!file)
 			force_swapin_readahead(vma, start, end);
 		else
@@ -241,7 +241,6 @@ static long madvise_willneed(struct vm_a
 		return 0;
 	}
 
-	*prev = vma;
 	start = ((start - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff;
 	if (end > vma->vm_end)
 		end = vma->vm_end;
diff -druNp --no-dereference linux-libre-3.18.85-gnu/net/netlink/af_netlink.c linux-libre-3.18.86-gnu/net/netlink/af_netlink.c
--- linux-libre-3.18.85-gnu/net/netlink/af_netlink.c	2017-11-30 03:35:56.000000000 -0500
+++ linux-libre-3.18.86-gnu/net/netlink/af_netlink.c	2017-12-05 05:20:47.000000000 -0500
@@ -2043,6 +2043,7 @@ int __netlink_dump_start(struct sock *ss
 
 	cb = &nlk->cb;
 	memset(cb, 0, sizeof(*cb));
+	cb->start = control->start;
 	cb->dump = control->dump;
 	cb->done = control->done;
 	cb->nlh = nlh;
@@ -2056,6 +2057,9 @@ int __netlink_dump_start(struct sock *ss
 
 	mutex_unlock(nlk->cb_mutex);
 
+	if (cb->start)
+		cb->start(cb);
+
 	ret = netlink_dump(sk);
 	sock_put(sk);
 
diff -druNp --no-dereference linux-libre-3.18.85-gnu/net/netlink/genetlink.c linux-libre-3.18.86-gnu/net/netlink/genetlink.c
--- linux-libre-3.18.85-gnu/net/netlink/genetlink.c	2017-11-30 03:35:56.000000000 -0500
+++ linux-libre-3.18.86-gnu/net/netlink/genetlink.c	2017-12-05 05:20:47.000000000 -0500
@@ -507,6 +507,20 @@ void *genlmsg_put(struct sk_buff *skb, u
 }
 EXPORT_SYMBOL(genlmsg_put);
 
+static int genl_lock_start(struct netlink_callback *cb)
+{
+	/* our ops are always const - netlink API doesn't propagate that */
+	const struct genl_ops *ops = cb->data;
+	int rc = 0;
+
+	if (ops->start) {
+		genl_lock();
+		rc = ops->start(cb);
+		genl_unlock();
+	}
+	return rc;
+}
+
 static int genl_lock_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
 {
 	/* our ops are always const - netlink API doesn't propagate that */
@@ -571,6 +585,7 @@ static int genl_family_rcv_msg(struct ge
 				.module = family->module,
 				/* we have const, but the netlink API doesn't */
 				.data = (void *)ops,
+				.start = genl_lock_start,
 				.dump = genl_lock_dumpit,
 				.done = genl_lock_done,
 			};
@@ -582,6 +597,7 @@ static int genl_family_rcv_msg(struct ge
 		} else {
 			struct netlink_dump_control c = {
 				.module = family->module,
+				.start = ops->start,
 				.dump = ops->dumpit,
 				.done = ops->done,
 			};
diff -druNp --no-dereference linux-libre-3.18.85-gnu/net/xfrm/xfrm_user.c linux-libre-3.18.86-gnu/net/xfrm/xfrm_user.c
--- linux-libre-3.18.85-gnu/net/xfrm/xfrm_user.c	2017-11-30 03:35:56.000000000 -0500
+++ linux-libre-3.18.86-gnu/net/xfrm/xfrm_user.c	2017-12-05 05:20:47.000000000 -0500
@@ -1625,32 +1625,34 @@ static int dump_one_policy(struct xfrm_p
 
 static int xfrm_dump_policy_done(struct netlink_callback *cb)
 {
-	struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1];
+	struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args;
 	struct net *net = sock_net(cb->skb->sk);
 
 	xfrm_policy_walk_done(walk, net);
 	return 0;
 }
 
+static int xfrm_dump_policy_start(struct netlink_callback *cb)
+{
+	struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args;
+
+	BUILD_BUG_ON(sizeof(*walk) > sizeof(cb->args));
+
+	xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY);
+	return 0;
+}
+
 static int xfrm_dump_policy(struct sk_buff *skb, struct netlink_callback *cb)
 {
 	struct net *net = sock_net(skb->sk);
-	struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1];
+	struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args;
 	struct xfrm_dump_info info;
 
-	BUILD_BUG_ON(sizeof(struct xfrm_policy_walk) >
-		     sizeof(cb->args) - sizeof(cb->args[0]));
-
 	info.in_skb = cb->skb;
 	info.out_skb = skb;
 	info.nlmsg_seq = cb->nlh->nlmsg_seq;
 	info.nlmsg_flags = NLM_F_MULTI;
 
-	if (!cb->args[0]) {
-		cb->args[0] = 1;
-		xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY);
-	}
-
 	(void) xfrm_policy_walk(net, walk, dump_one_policy, &info);
 
 	return skb->len;
@@ -2384,6 +2386,7 @@ static const struct nla_policy xfrma_spd
 
 static const struct xfrm_link {
 	int (*doit)(struct sk_buff *, struct nlmsghdr *, struct nlattr **);
+	int (*start)(struct netlink_callback *);
 	int (*dump)(struct sk_buff *, struct netlink_callback *);
 	int (*done)(struct netlink_callback *);
 	const struct nla_policy *nla_pol;
@@ -2397,6 +2400,7 @@ static const struct xfrm_link {
 	[XFRM_MSG_NEWPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_add_policy    },
 	[XFRM_MSG_DELPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_get_policy    },
 	[XFRM_MSG_GETPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_get_policy,
+						   .start = xfrm_dump_policy_start,
 						   .dump = xfrm_dump_policy,
 						   .done = xfrm_dump_policy_done },
 	[XFRM_MSG_ALLOCSPI    - XFRM_MSG_BASE] = { .doit = xfrm_alloc_userspi },
@@ -2443,6 +2447,7 @@ static int xfrm_user_rcv_msg(struct sk_b
 
 		{
 			struct netlink_dump_control c = {
+				.start = link->start,
 				.dump = link->dump,
 				.done = link->done,
 			};
