diff -druNp --no-dereference linux-libre-4.16.8-gnu/arch/arm/boot/dts/imx35.dtsi linux-libre-4.16.9-gnu/arch/arm/boot/dts/imx35.dtsi
--- linux-libre-4.16.8-gnu/arch/arm/boot/dts/imx35.dtsi	2018-05-09 13:42:21.000000000 -0400
+++ linux-libre-4.16.9-gnu/arch/arm/boot/dts/imx35.dtsi	2018-05-16 09:54:14.000000000 -0400
@@ -303,7 +303,7 @@
 			};
 
 			can1: can@53fe4000 {
-				compatible = "fsl,imx35-flexcan";
+				compatible = "fsl,imx35-flexcan", "fsl,imx25-flexcan";
 				reg = <0x53fe4000 0x1000>;
 				clocks = <&clks 33>, <&clks 33>;
 				clock-names = "ipg", "per";
@@ -312,7 +312,7 @@
 			};
 
 			can2: can@53fe8000 {
-				compatible = "fsl,imx35-flexcan";
+				compatible = "fsl,imx35-flexcan", "fsl,imx25-flexcan";
 				reg = <0x53fe8000 0x1000>;
 				clocks = <&clks 34>, <&clks 34>;
 				clock-names = "ipg", "per";
diff -druNp --no-dereference linux-libre-4.16.8-gnu/arch/arm/boot/dts/imx53.dtsi linux-libre-4.16.9-gnu/arch/arm/boot/dts/imx53.dtsi
--- linux-libre-4.16.8-gnu/arch/arm/boot/dts/imx53.dtsi	2018-05-09 13:42:29.000000000 -0400
+++ linux-libre-4.16.9-gnu/arch/arm/boot/dts/imx53.dtsi	2018-05-16 09:54:34.000000000 -0400
@@ -551,7 +551,7 @@
 			};
 
 			can1: can@53fc8000 {
-				compatible = "fsl,imx53-flexcan";
+				compatible = "fsl,imx53-flexcan", "fsl,imx25-flexcan";
 				reg = <0x53fc8000 0x4000>;
 				interrupts = <82>;
 				clocks = <&clks IMX5_CLK_CAN1_IPG_GATE>,
@@ -561,7 +561,7 @@
 			};
 
 			can2: can@53fcc000 {
-				compatible = "fsl,imx53-flexcan";
+				compatible = "fsl,imx53-flexcan", "fsl,imx25-flexcan";
 				reg = <0x53fcc000 0x4000>;
 				interrupts = <83>;
 				clocks = <&clks IMX5_CLK_CAN2_IPG_GATE>,
diff -druNp --no-dereference linux-libre-4.16.8-gnu/arch/x86/events/core.c linux-libre-4.16.9-gnu/arch/x86/events/core.c
--- linux-libre-4.16.8-gnu/arch/x86/events/core.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/arch/x86/events/core.c	2018-05-16 04:12:36.000000000 -0400
@@ -27,6 +27,7 @@
 #include <linux/cpu.h>
 #include <linux/bitops.h>
 #include <linux/device.h>
+#include <linux/nospec.h>
 
 #include <asm/apic.h>
 #include <asm/stacktrace.h>
@@ -304,17 +305,20 @@ set_ext_hw_attr(struct hw_perf_event *hw
 
 	config = attr->config;
 
-	cache_type = (config >>  0) & 0xff;
+	cache_type = (config >> 0) & 0xff;
 	if (cache_type >= PERF_COUNT_HW_CACHE_MAX)
 		return -EINVAL;
+	cache_type = array_index_nospec(cache_type, PERF_COUNT_HW_CACHE_MAX);
 
 	cache_op = (config >>  8) & 0xff;
 	if (cache_op >= PERF_COUNT_HW_CACHE_OP_MAX)
 		return -EINVAL;
+	cache_op = array_index_nospec(cache_op, PERF_COUNT_HW_CACHE_OP_MAX);
 
 	cache_result = (config >> 16) & 0xff;
 	if (cache_result >= PERF_COUNT_HW_CACHE_RESULT_MAX)
 		return -EINVAL;
+	cache_result = array_index_nospec(cache_result, PERF_COUNT_HW_CACHE_RESULT_MAX);
 
 	val = hw_cache_event_ids[cache_type][cache_op][cache_result];
 
@@ -421,6 +425,8 @@ int x86_setup_perfctr(struct perf_event
 	if (attr->config >= x86_pmu.max_events)
 		return -EINVAL;
 
+	attr->config = array_index_nospec((unsigned long)attr->config, x86_pmu.max_events);
+
 	/*
 	 * The generic map:
 	 */
diff -druNp --no-dereference linux-libre-4.16.8-gnu/arch/x86/events/intel/cstate.c linux-libre-4.16.9-gnu/arch/x86/events/intel/cstate.c
--- linux-libre-4.16.8-gnu/arch/x86/events/intel/cstate.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/arch/x86/events/intel/cstate.c	2018-05-16 04:12:36.000000000 -0400
@@ -91,6 +91,7 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/perf_event.h>
+#include <linux/nospec.h>
 #include <asm/cpu_device_id.h>
 #include <asm/intel-family.h>
 #include "../perf_event.h"
@@ -301,6 +302,7 @@ static int cstate_pmu_event_init(struct
 	} else if (event->pmu == &cstate_pkg_pmu) {
 		if (cfg >= PERF_CSTATE_PKG_EVENT_MAX)
 			return -EINVAL;
+		cfg = array_index_nospec((unsigned long)cfg, PERF_CSTATE_PKG_EVENT_MAX);
 		if (!pkg_msr[cfg].attr)
 			return -EINVAL;
 		event->hw.event_base = pkg_msr[cfg].msr;
diff -druNp --no-dereference linux-libre-4.16.8-gnu/arch/x86/events/msr.c linux-libre-4.16.9-gnu/arch/x86/events/msr.c
--- linux-libre-4.16.8-gnu/arch/x86/events/msr.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/arch/x86/events/msr.c	2018-05-16 04:12:36.000000000 -0400
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 #include <linux/perf_event.h>
+#include <linux/nospec.h>
 #include <asm/intel-family.h>
 
 enum perf_msr_id {
@@ -158,9 +159,6 @@ static int msr_event_init(struct perf_ev
 	if (event->attr.type != event->pmu->type)
 		return -ENOENT;
 
-	if (cfg >= PERF_MSR_EVENT_MAX)
-		return -EINVAL;
-
 	/* unsupported modes and filters */
 	if (event->attr.exclude_user   ||
 	    event->attr.exclude_kernel ||
@@ -171,6 +169,11 @@ static int msr_event_init(struct perf_ev
 	    event->attr.sample_period) /* no sampling */
 		return -EINVAL;
 
+	if (cfg >= PERF_MSR_EVENT_MAX)
+		return -EINVAL;
+
+	cfg = array_index_nospec((unsigned long)cfg, PERF_MSR_EVENT_MAX);
+
 	if (!msr[cfg].attr)
 		return -EINVAL;
 
diff -druNp --no-dereference linux-libre-4.16.8-gnu/crypto/af_alg.c linux-libre-4.16.9-gnu/crypto/af_alg.c
--- linux-libre-4.16.8-gnu/crypto/af_alg.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/crypto/af_alg.c	2018-05-16 04:12:36.000000000 -0400
@@ -158,16 +158,16 @@ static int alg_bind(struct socket *sock,
 	void *private;
 	int err;
 
-	/* If caller uses non-allowed flag, return error. */
-	if ((sa->salg_feat & ~allowed) || (sa->salg_mask & ~allowed))
-		return -EINVAL;
-
 	if (sock->state == SS_CONNECTED)
 		return -EINVAL;
 
 	if (addr_len < sizeof(*sa))
 		return -EINVAL;
 
+	/* If caller uses non-allowed flag, return error. */
+	if ((sa->salg_feat & ~allowed) || (sa->salg_mask & ~allowed))
+		return -EINVAL;
+
 	sa->salg_type[sizeof(sa->salg_type) - 1] = 0;
 	sa->salg_name[sizeof(sa->salg_name) + addr_len - sizeof(*sa) - 1] = 0;
 
diff -druNp --no-dereference linux-libre-4.16.8-gnu/drivers/ata/libata-core.c linux-libre-4.16.9-gnu/drivers/ata/libata-core.c
--- linux-libre-4.16.8-gnu/drivers/ata/libata-core.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/drivers/ata/libata-core.c	2018-05-16 04:12:36.000000000 -0400
@@ -4549,6 +4549,9 @@ static const struct ata_blacklist_entry
 						ATA_HORKAGE_ZERO_AFTER_TRIM |
 						ATA_HORKAGE_NOLPM, },
 
+	/* Sandisk devices which are known to not handle LPM well */
+	{ "SanDisk SD7UB3Q*G1001",	NULL,	ATA_HORKAGE_NOLPM, },
+
 	/* devices that don't properly handle queued TRIM commands */
 	{ "Micron_M500_*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
 						ATA_HORKAGE_ZERO_AFTER_TRIM, },
diff -druNp --no-dereference linux-libre-4.16.8-gnu/drivers/atm/zatm.c linux-libre-4.16.9-gnu/drivers/atm/zatm.c
--- linux-libre-4.16.8-gnu/drivers/atm/zatm.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/drivers/atm/zatm.c	2018-05-16 04:12:36.000000000 -0400
@@ -28,6 +28,7 @@
 #include <asm/io.h>
 #include <linux/atomic.h>
 #include <linux/uaccess.h>
+#include <linux/nospec.h>
 
 #include "uPD98401.h"
 #include "uPD98402.h"
@@ -1458,6 +1459,8 @@ static int zatm_ioctl(struct atm_dev *de
 					return -EFAULT;
 				if (pool < 0 || pool > ZATM_LAST_POOL)
 					return -EINVAL;
+				pool = array_index_nospec(pool,
+							  ZATM_LAST_POOL + 1);
 				spin_lock_irqsave(&zatm_dev->lock, flags);
 				info = zatm_dev->pool_info[pool];
 				if (cmd == ZATM_GETPOOLZ) {
diff -druNp --no-dereference linux-libre-4.16.8-gnu/drivers/bluetooth/btusb.c linux-libre-4.16.9-gnu/drivers/bluetooth/btusb.c
--- linux-libre-4.16.8-gnu/drivers/bluetooth/btusb.c	2018-05-09 13:58:13.000000000 -0400
+++ linux-libre-4.16.9-gnu/drivers/bluetooth/btusb.c	2018-05-16 10:33:00.000000000 -0400
@@ -231,6 +231,7 @@ static const struct usb_device_id blackl
 	{ USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
+	{ USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
@@ -263,7 +264,6 @@ static const struct usb_device_id blackl
 	{ USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
 
 	/* QCA ROME chipset */
-	{ USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_QCA_ROME },
 	{ USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME },
 	{ USB_DEVICE(0x0cf3, 0xe009), .driver_info = BTUSB_QCA_ROME },
 	{ USB_DEVICE(0x0cf3, 0xe010), .driver_info = BTUSB_QCA_ROME },
@@ -392,6 +392,13 @@ static const struct dmi_system_id btusb_
 			DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 3060"),
 		},
 	},
+	{
+		/* Dell XPS 9360 (QCA ROME device 0cf3:e300) */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9360"),
+		},
+	},
 	{}
 };
 
@@ -2839,6 +2846,12 @@ static int btusb_config_oob_wake(struct
 }
 #endif
 
+static void btusb_check_needs_reset_resume(struct usb_interface *intf)
+{
+	if (dmi_check_system(btusb_needs_reset_resume_table))
+		interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME;
+}
+
 static int btusb_probe(struct usb_interface *intf,
 		       const struct usb_device_id *id)
 {
@@ -2961,9 +2974,6 @@ static int btusb_probe(struct usb_interf
 	hdev->send   = btusb_send_frame;
 	hdev->notify = btusb_notify;
 
-	if (dmi_check_system(btusb_needs_reset_resume_table))
-		interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME;
-
 #ifdef CONFIG_PM
 	err = btusb_config_oob_wake(hdev);
 	if (err)
@@ -3050,6 +3060,7 @@ static int btusb_probe(struct usb_interf
 	if (id->driver_info & BTUSB_QCA_ROME) {
 		data->setup_on_usb = btusb_setup_qca;
 		hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
+		btusb_check_needs_reset_resume(intf);
 	}
 
 #ifdef CONFIG_BT_HCIBTUSB_RTL
diff -druNp --no-dereference linux-libre-4.16.8-gnu/drivers/clk/ti/clock.h linux-libre-4.16.9-gnu/drivers/clk/ti/clock.h
--- linux-libre-4.16.8-gnu/drivers/clk/ti/clock.h	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/drivers/clk/ti/clock.h	2018-05-16 04:12:36.000000000 -0400
@@ -74,6 +74,11 @@ enum {
 #define CLKF_CORE			(1 << 9)
 #define CLKF_J_TYPE			(1 << 10)
 
+/* CLKCTRL flags */
+#define CLKF_SW_SUP			BIT(5)
+#define CLKF_HW_SUP			BIT(6)
+#define CLKF_NO_IDLEST			BIT(7)
+
 #define CLK(dev, con, ck)		\
 	{				\
 		.lk = {			\
@@ -183,10 +188,6 @@ extern const struct omap_clkctrl_data am
 extern const struct omap_clkctrl_data dm814_clkctrl_data[];
 extern const struct omap_clkctrl_data dm816_clkctrl_data[];
 
-#define CLKF_SW_SUP	BIT(0)
-#define CLKF_HW_SUP	BIT(1)
-#define CLKF_NO_IDLEST	BIT(2)
-
 typedef void (*ti_of_clk_init_cb_t)(void *, struct device_node *);
 
 struct clk *ti_clk_register(struct device *dev, struct clk_hw *hw,
diff -druNp --no-dereference linux-libre-4.16.8-gnu/drivers/gpio/gpio-aspeed.c linux-libre-4.16.9-gnu/drivers/gpio/gpio-aspeed.c
--- linux-libre-4.16.8-gnu/drivers/gpio/gpio-aspeed.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/drivers/gpio/gpio-aspeed.c	2018-05-16 04:12:36.000000000 -0400
@@ -384,7 +384,7 @@ static void aspeed_gpio_irq_set_mask(str
 	if (set)
 		reg |= bit;
 	else
-		reg &= bit;
+		reg &= ~bit;
 	iowrite32(reg, addr);
 
 	spin_unlock_irqrestore(&gpio->lock, flags);
diff -druNp --no-dereference linux-libre-4.16.8-gnu/drivers/gpio/gpiolib.c linux-libre-4.16.9-gnu/drivers/gpio/gpiolib.c
--- linux-libre-4.16.8-gnu/drivers/gpio/gpiolib.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/drivers/gpio/gpiolib.c	2018-05-16 04:12:36.000000000 -0400
@@ -446,7 +446,7 @@ static int linehandle_create(struct gpio
 	struct gpiohandle_request handlereq;
 	struct linehandle_state *lh;
 	struct file *file;
-	int fd, i, ret;
+	int fd, i, count = 0, ret;
 	u32 lflags;
 
 	if (copy_from_user(&handlereq, ip, sizeof(handlereq)))
@@ -507,6 +507,7 @@ static int linehandle_create(struct gpio
 		if (ret)
 			goto out_free_descs;
 		lh->descs[i] = desc;
+		count = i;
 
 		if (lflags & GPIOHANDLE_REQUEST_ACTIVE_LOW)
 			set_bit(FLAG_ACTIVE_LOW, &desc->flags);
@@ -577,7 +578,7 @@ static int linehandle_create(struct gpio
 out_put_unused_fd:
 	put_unused_fd(fd);
 out_free_descs:
-	for (; i >= 0; i--)
+	for (i = 0; i < count; i++)
 		gpiod_free(lh->descs[i]);
 	kfree(lh->label);
 out_free_lh:
@@ -851,7 +852,7 @@ static int lineevent_create(struct gpio_
 	desc = &gdev->descs[offset];
 	ret = gpiod_request(desc, le->label);
 	if (ret)
-		goto out_free_desc;
+		goto out_free_label;
 	le->desc = desc;
 	le->eflags = eflags;
 
diff -druNp --no-dereference linux-libre-4.16.8-gnu/drivers/gpu/drm/drm_atomic.c linux-libre-4.16.9-gnu/drivers/gpu/drm/drm_atomic.c
--- linux-libre-4.16.8-gnu/drivers/gpu/drm/drm_atomic.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/drivers/gpu/drm/drm_atomic.c	2018-05-16 04:12:36.000000000 -0400
@@ -155,6 +155,8 @@ void drm_atomic_state_default_clear(stru
 						       state->connectors[i].state);
 		state->connectors[i].ptr = NULL;
 		state->connectors[i].state = NULL;
+		state->connectors[i].old_state = NULL;
+		state->connectors[i].new_state = NULL;
 		drm_connector_put(connector);
 	}
 
@@ -169,6 +171,8 @@ void drm_atomic_state_default_clear(stru
 
 		state->crtcs[i].ptr = NULL;
 		state->crtcs[i].state = NULL;
+		state->crtcs[i].old_state = NULL;
+		state->crtcs[i].new_state = NULL;
 	}
 
 	for (i = 0; i < config->num_total_plane; i++) {
@@ -181,6 +185,8 @@ void drm_atomic_state_default_clear(stru
 						   state->planes[i].state);
 		state->planes[i].ptr = NULL;
 		state->planes[i].state = NULL;
+		state->planes[i].old_state = NULL;
+		state->planes[i].new_state = NULL;
 	}
 
 	for (i = 0; i < state->num_private_objs; i++) {
@@ -190,6 +196,8 @@ void drm_atomic_state_default_clear(stru
 						 state->private_objs[i].state);
 		state->private_objs[i].ptr = NULL;
 		state->private_objs[i].state = NULL;
+		state->private_objs[i].old_state = NULL;
+		state->private_objs[i].new_state = NULL;
 	}
 	state->num_private_objs = 0;
 
diff -druNp --no-dereference linux-libre-4.16.8-gnu/drivers/gpu/drm/i915/intel_cdclk.c linux-libre-4.16.9-gnu/drivers/gpu/drm/i915/intel_cdclk.c
--- linux-libre-4.16.8-gnu/drivers/gpu/drm/i915/intel_cdclk.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/drivers/gpu/drm/i915/intel_cdclk.c	2018-05-16 04:12:36.000000000 -0400
@@ -2108,9 +2108,44 @@ static int bdw_modeset_calc_cdclk(struct
 	return 0;
 }
 
+static int skl_dpll0_vco(struct intel_atomic_state *intel_state)
+{
+	struct drm_i915_private *dev_priv = to_i915(intel_state->base.dev);
+	struct intel_crtc *crtc;
+	struct intel_crtc_state *crtc_state;
+	int vco, i;
+
+	vco = intel_state->cdclk.logical.vco;
+	if (!vco)
+		vco = dev_priv->skl_preferred_vco_freq;
+
+	for_each_new_intel_crtc_in_state(intel_state, crtc, crtc_state, i) {
+		if (!crtc_state->base.enable)
+			continue;
+
+		if (!intel_crtc_has_type(crtc_state, INTEL_OUTPUT_EDP))
+			continue;
+
+		/*
+		 * DPLL0 VCO may need to be adjusted to get the correct
+		 * clock for eDP. This will affect cdclk as well.
+		 */
+		switch (crtc_state->port_clock / 2) {
+		case 108000:
+		case 216000:
+			vco = 8640000;
+			break;
+		default:
+			vco = 8100000;
+			break;
+		}
+	}
+
+	return vco;
+}
+
 static int skl_modeset_calc_cdclk(struct drm_atomic_state *state)
 {
-	struct drm_i915_private *dev_priv = to_i915(state->dev);
 	struct intel_atomic_state *intel_state = to_intel_atomic_state(state);
 	int min_cdclk, cdclk, vco;
 
@@ -2118,9 +2153,7 @@ static int skl_modeset_calc_cdclk(struct
 	if (min_cdclk < 0)
 		return min_cdclk;
 
-	vco = intel_state->cdclk.logical.vco;
-	if (!vco)
-		vco = dev_priv->skl_preferred_vco_freq;
+	vco = skl_dpll0_vco(intel_state);
 
 	/*
 	 * FIXME should also account for plane ratio
diff -druNp --no-dereference linux-libre-4.16.8-gnu/drivers/gpu/drm/i915/intel_dp.c linux-libre-4.16.9-gnu/drivers/gpu/drm/i915/intel_dp.c
--- linux-libre-4.16.8-gnu/drivers/gpu/drm/i915/intel_dp.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/drivers/gpu/drm/i915/intel_dp.c	2018-05-16 04:12:36.000000000 -0400
@@ -1794,26 +1794,6 @@ found:
 				reduce_m_n);
 	}
 
-	/*
-	 * DPLL0 VCO may need to be adjusted to get the correct
-	 * clock for eDP. This will affect cdclk as well.
-	 */
-	if (intel_dp_is_edp(intel_dp) && IS_GEN9_BC(dev_priv)) {
-		int vco;
-
-		switch (pipe_config->port_clock / 2) {
-		case 108000:
-		case 216000:
-			vco = 8640000;
-			break;
-		default:
-			vco = 8100000;
-			break;
-		}
-
-		to_intel_atomic_state(pipe_config->base.state)->cdclk.logical.vco = vco;
-	}
-
 	if (!HAS_DDI(dev_priv))
 		intel_dp_set_clock(encoder, pipe_config);
 
diff -druNp --no-dereference linux-libre-4.16.8-gnu/drivers/gpu/drm/i915/intel_lvds.c linux-libre-4.16.9-gnu/drivers/gpu/drm/i915/intel_lvds.c
--- linux-libre-4.16.8-gnu/drivers/gpu/drm/i915/intel_lvds.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/drivers/gpu/drm/i915/intel_lvds.c	2018-05-16 04:12:36.000000000 -0400
@@ -319,7 +319,8 @@ static void intel_enable_lvds(struct int
 
 	I915_WRITE(PP_CONTROL(0), I915_READ(PP_CONTROL(0)) | PANEL_POWER_ON);
 	POSTING_READ(lvds_encoder->reg);
-	if (intel_wait_for_register(dev_priv, PP_STATUS(0), PP_ON, PP_ON, 1000))
+
+	if (intel_wait_for_register(dev_priv, PP_STATUS(0), PP_ON, PP_ON, 5000))
 		DRM_ERROR("timed out waiting for panel to power on\n");
 
 	intel_panel_enable_backlight(pipe_config, conn_state);
diff -druNp --no-dereference linux-libre-4.16.8-gnu/drivers/gpu/drm/nouveau/nouveau_bo.c linux-libre-4.16.9-gnu/drivers/gpu/drm/nouveau/nouveau_bo.c
--- linux-libre-4.16.8-gnu/drivers/gpu/drm/nouveau/nouveau_bo.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/drivers/gpu/drm/nouveau/nouveau_bo.c	2018-05-16 04:12:36.000000000 -0400
@@ -214,7 +214,6 @@ nouveau_bo_new(struct nouveau_cli *cli,
 	INIT_LIST_HEAD(&nvbo->entry);
 	INIT_LIST_HEAD(&nvbo->vma_list);
 	nvbo->bo.bdev = &drm->ttm.bdev;
-	nvbo->cli = cli;
 
 	/* This is confusing, and doesn't actually mean we want an uncached
 	 * mapping, but is what NOUVEAU_GEM_DOMAIN_COHERENT gets translated
diff -druNp --no-dereference linux-libre-4.16.8-gnu/drivers/gpu/drm/nouveau/nouveau_bo.h linux-libre-4.16.9-gnu/drivers/gpu/drm/nouveau/nouveau_bo.h
--- linux-libre-4.16.8-gnu/drivers/gpu/drm/nouveau/nouveau_bo.h	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/drivers/gpu/drm/nouveau/nouveau_bo.h	2018-05-16 04:12:36.000000000 -0400
@@ -26,8 +26,6 @@ struct nouveau_bo {
 
 	struct list_head vma_list;
 
-	struct nouveau_cli *cli;
-
 	unsigned contig:1;
 	unsigned page:5;
 	unsigned kind:8;
diff -druNp --no-dereference linux-libre-4.16.8-gnu/drivers/gpu/drm/nouveau/nouveau_ttm.c linux-libre-4.16.9-gnu/drivers/gpu/drm/nouveau/nouveau_ttm.c
--- linux-libre-4.16.8-gnu/drivers/gpu/drm/nouveau/nouveau_ttm.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/drivers/gpu/drm/nouveau/nouveau_ttm.c	2018-05-16 04:12:36.000000000 -0400
@@ -63,7 +63,7 @@ nouveau_vram_manager_new(struct ttm_mem_
 			 struct ttm_mem_reg *reg)
 {
 	struct nouveau_bo *nvbo = nouveau_bo(bo);
-	struct nouveau_drm *drm = nvbo->cli->drm;
+	struct nouveau_drm *drm = nouveau_bdev(bo->bdev);
 	struct nouveau_mem *mem;
 	int ret;
 
@@ -103,7 +103,7 @@ nouveau_gart_manager_new(struct ttm_mem_
 			 struct ttm_mem_reg *reg)
 {
 	struct nouveau_bo *nvbo = nouveau_bo(bo);
-	struct nouveau_drm *drm = nvbo->cli->drm;
+	struct nouveau_drm *drm = nouveau_bdev(bo->bdev);
 	struct nouveau_mem *mem;
 	int ret;
 
@@ -131,7 +131,7 @@ nv04_gart_manager_new(struct ttm_mem_typ
 		      struct ttm_mem_reg *reg)
 {
 	struct nouveau_bo *nvbo = nouveau_bo(bo);
-	struct nouveau_drm *drm = nvbo->cli->drm;
+	struct nouveau_drm *drm = nouveau_bdev(bo->bdev);
 	struct nouveau_mem *mem;
 	int ret;
 
diff -druNp --no-dereference linux-libre-4.16.8-gnu/drivers/gpu/drm/nouveau/nv50_display.c linux-libre-4.16.9-gnu/drivers/gpu/drm/nouveau/nv50_display.c
--- linux-libre-4.16.8-gnu/drivers/gpu/drm/nouveau/nv50_display.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/drivers/gpu/drm/nouveau/nv50_display.c	2018-05-16 04:12:36.000000000 -0400
@@ -3272,10 +3272,11 @@ nv50_mstm_destroy_connector(struct drm_d
 
 	drm_connector_unregister(&mstc->connector);
 
-	drm_modeset_lock_all(drm->dev);
 	drm_fb_helper_remove_one_connector(&drm->fbcon->helper, &mstc->connector);
+
+	drm_modeset_lock(&drm->dev->mode_config.connection_mutex, NULL);
 	mstc->port = NULL;
-	drm_modeset_unlock_all(drm->dev);
+	drm_modeset_unlock(&drm->dev->mode_config.connection_mutex);
 
 	drm_connector_unreference(&mstc->connector);
 }
@@ -3285,9 +3286,7 @@ nv50_mstm_register_connector(struct drm_
 {
 	struct nouveau_drm *drm = nouveau_drm(connector->dev);
 
-	drm_modeset_lock_all(drm->dev);
 	drm_fb_helper_add_one_connector(&drm->fbcon->helper, connector);
-	drm_modeset_unlock_all(drm->dev);
 
 	drm_connector_register(connector);
 }
diff -druNp --no-dereference linux-libre-4.16.8-gnu/drivers/gpu/drm/ttm/ttm_page_alloc.c linux-libre-4.16.9-gnu/drivers/gpu/drm/ttm/ttm_page_alloc.c
--- linux-libre-4.16.8-gnu/drivers/gpu/drm/ttm/ttm_page_alloc.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/drivers/gpu/drm/ttm/ttm_page_alloc.c	2018-05-16 04:12:36.000000000 -0400
@@ -904,7 +904,8 @@ static int ttm_get_pages(struct page **p
 			while (npages >= HPAGE_PMD_NR) {
 				gfp_t huge_flags = gfp_flags;
 
-				huge_flags |= GFP_TRANSHUGE;
+				huge_flags |= GFP_TRANSHUGE_LIGHT | __GFP_NORETRY |
+					__GFP_KSWAPD_RECLAIM;
 				huge_flags &= ~__GFP_MOVABLE;
 				huge_flags &= ~__GFP_COMP;
 				p = alloc_pages(huge_flags, HPAGE_PMD_ORDER);
@@ -1021,11 +1022,15 @@ int ttm_page_alloc_init(struct ttm_mem_g
 				  GFP_USER | GFP_DMA32, "uc dma", 0);
 
 	ttm_page_pool_init_locked(&_manager->wc_pool_huge,
-				  GFP_TRANSHUGE	& ~(__GFP_MOVABLE | __GFP_COMP),
+				  (GFP_TRANSHUGE_LIGHT | __GFP_NORETRY |
+				   __GFP_KSWAPD_RECLAIM) &
+				  ~(__GFP_MOVABLE | __GFP_COMP),
 				  "wc huge", order);
 
 	ttm_page_pool_init_locked(&_manager->uc_pool_huge,
-				  GFP_TRANSHUGE	& ~(__GFP_MOVABLE | __GFP_COMP)
+				  (GFP_TRANSHUGE_LIGHT | __GFP_NORETRY |
+				   __GFP_KSWAPD_RECLAIM) &
+				  ~(__GFP_MOVABLE | __GFP_COMP)
 				  , "uc huge", order);
 
 	_manager->options.max_size = max_pages;
diff -druNp --no-dereference linux-libre-4.16.8-gnu/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c linux-libre-4.16.9-gnu/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
--- linux-libre-4.16.8-gnu/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c	2018-05-16 04:12:36.000000000 -0400
@@ -915,7 +915,8 @@ static gfp_t ttm_dma_pool_gfp_flags(stru
 		gfp_flags |= __GFP_ZERO;
 
 	if (huge) {
-		gfp_flags |= GFP_TRANSHUGE;
+		gfp_flags |= GFP_TRANSHUGE_LIGHT | __GFP_NORETRY |
+			__GFP_KSWAPD_RECLAIM;
 		gfp_flags &= ~__GFP_MOVABLE;
 		gfp_flags &= ~__GFP_COMP;
 	}
diff -druNp --no-dereference linux-libre-4.16.8-gnu/drivers/gpu/drm/vc4/vc4_plane.c linux-libre-4.16.9-gnu/drivers/gpu/drm/vc4/vc4_plane.c
--- linux-libre-4.16.8-gnu/drivers/gpu/drm/vc4/vc4_plane.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/drivers/gpu/drm/vc4/vc4_plane.c	2018-05-16 04:12:36.000000000 -0400
@@ -557,7 +557,7 @@ static int vc4_plane_mode_set(struct drm
 	 * the scl fields here.
 	 */
 	if (num_planes == 1) {
-		scl0 = vc4_get_scl_field(state, 1);
+		scl0 = vc4_get_scl_field(state, 0);
 		scl1 = scl0;
 	} else {
 		scl0 = vc4_get_scl_field(state, 1);
diff -druNp --no-dereference linux-libre-4.16.8-gnu/drivers/i2c/i2c-dev.c linux-libre-4.16.9-gnu/drivers/i2c/i2c-dev.c
--- linux-libre-4.16.8-gnu/drivers/i2c/i2c-dev.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/drivers/i2c/i2c-dev.c	2018-05-16 04:12:36.000000000 -0400
@@ -280,7 +280,7 @@ static noinline int i2cdev_ioctl_rdwr(st
 		 */
 		if (msgs[i].flags & I2C_M_RECV_LEN) {
 			if (!(msgs[i].flags & I2C_M_RD) ||
-			    msgs[i].buf[0] < 1 ||
+			    msgs[i].len < 1 || msgs[i].buf[0] < 1 ||
 			    msgs[i].len < msgs[i].buf[0] +
 					     I2C_SMBUS_BLOCK_MAX) {
 				res = -EINVAL;
diff -druNp --no-dereference linux-libre-4.16.8-gnu/drivers/md/dm-integrity.c linux-libre-4.16.9-gnu/drivers/md/dm-integrity.c
--- linux-libre-4.16.8-gnu/drivers/md/dm-integrity.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/drivers/md/dm-integrity.c	2018-05-16 04:12:36.000000000 -0400
@@ -2440,7 +2440,7 @@ static void dm_integrity_free_journal_sc
 	unsigned i;
 	for (i = 0; i < ic->journal_sections; i++)
 		kvfree(sl[i]);
-	kfree(sl);
+	kvfree(sl);
 }
 
 static struct scatterlist **dm_integrity_alloc_journal_scatterlist(struct dm_integrity_c *ic, struct page_list *pl)
diff -druNp --no-dereference linux-libre-4.16.8-gnu/drivers/mtd/nand/marvell_nand.c linux-libre-4.16.9-gnu/drivers/mtd/nand/marvell_nand.c
--- linux-libre-4.16.8-gnu/drivers/mtd/nand/marvell_nand.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/drivers/mtd/nand/marvell_nand.c	2018-05-16 04:12:36.000000000 -0400
@@ -1070,7 +1070,7 @@ static int marvell_nfc_hw_ecc_hmg_do_wri
 		return ret;
 
 	ret = marvell_nfc_wait_op(chip,
-				  chip->data_interface.timings.sdr.tPROG_max);
+				  PSEC_TO_MSEC(chip->data_interface.timings.sdr.tPROG_max));
 	return ret;
 }
 
@@ -1404,6 +1404,7 @@ marvell_nfc_hw_ecc_bch_write_chunk(struc
 	struct marvell_nand_chip *marvell_nand = to_marvell_nand(chip);
 	struct marvell_nfc *nfc = to_marvell_nfc(chip->controller);
 	const struct marvell_hw_ecc_layout *lt = to_marvell_nand(chip)->layout;
+	u32 xtype;
 	int ret;
 	struct marvell_nfc_op nfc_op = {
 		.ndcb[0] = NDCB0_CMD_TYPE(TYPE_WRITE) | NDCB0_LEN_OVRD,
@@ -1419,7 +1420,12 @@ marvell_nfc_hw_ecc_bch_write_chunk(struc
 	 * last naked write.
 	 */
 	if (chunk == 0) {
-		nfc_op.ndcb[0] |= NDCB0_CMD_XTYPE(XTYPE_WRITE_DISPATCH) |
+		if (lt->nchunks == 1)
+			xtype = XTYPE_MONOLITHIC_RW;
+		else
+			xtype = XTYPE_WRITE_DISPATCH;
+
+		nfc_op.ndcb[0] |= NDCB0_CMD_XTYPE(xtype) |
 				  NDCB0_ADDR_CYC(marvell_nand->addr_cyc) |
 				  NDCB0_CMD1(NAND_CMD_SEQIN);
 		nfc_op.ndcb[1] |= NDCB1_ADDRS_PAGE(page);
@@ -1490,7 +1496,7 @@ static int marvell_nfc_hw_ecc_bch_write_
 	}
 
 	ret = marvell_nfc_wait_op(chip,
-				  chip->data_interface.timings.sdr.tPROG_max);
+				  PSEC_TO_MSEC(chip->data_interface.timings.sdr.tPROG_max));
 
 	marvell_nfc_disable_hw_ecc(chip);
 
diff -druNp --no-dereference linux-libre-4.16.8-gnu/drivers/net/can/flexcan.c linux-libre-4.16.9-gnu/drivers/net/can/flexcan.c
--- linux-libre-4.16.8-gnu/drivers/net/can/flexcan.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/drivers/net/can/flexcan.c	2018-05-16 04:12:36.000000000 -0400
@@ -200,6 +200,7 @@
 #define FLEXCAN_QUIRK_DISABLE_MECR	BIT(4) /* Disable Memory error detection */
 #define FLEXCAN_QUIRK_USE_OFF_TIMESTAMP	BIT(5) /* Use timestamp based offloading */
 #define FLEXCAN_QUIRK_BROKEN_PERR_STATE	BIT(6) /* No interrupt for error passive */
+#define FLEXCAN_QUIRK_DEFAULT_BIG_ENDIAN	BIT(7) /* default to BE register access */
 
 /* Structure of the message buffer */
 struct flexcan_mb {
@@ -288,6 +289,12 @@ struct flexcan_priv {
 
 static const struct flexcan_devtype_data fsl_p1010_devtype_data = {
 	.quirks = FLEXCAN_QUIRK_BROKEN_WERR_STATE |
+		FLEXCAN_QUIRK_BROKEN_PERR_STATE |
+		FLEXCAN_QUIRK_DEFAULT_BIG_ENDIAN,
+};
+
+static const struct flexcan_devtype_data fsl_imx25_devtype_data = {
+	.quirks = FLEXCAN_QUIRK_BROKEN_WERR_STATE |
 		FLEXCAN_QUIRK_BROKEN_PERR_STATE,
 };
 
@@ -1251,9 +1258,9 @@ static void unregister_flexcandev(struct
 static const struct of_device_id flexcan_of_match[] = {
 	{ .compatible = "fsl,imx6q-flexcan", .data = &fsl_imx6q_devtype_data, },
 	{ .compatible = "fsl,imx28-flexcan", .data = &fsl_imx28_devtype_data, },
-	{ .compatible = "fsl,imx53-flexcan", .data = &fsl_p1010_devtype_data, },
-	{ .compatible = "fsl,imx35-flexcan", .data = &fsl_p1010_devtype_data, },
-	{ .compatible = "fsl,imx25-flexcan", .data = &fsl_p1010_devtype_data, },
+	{ .compatible = "fsl,imx53-flexcan", .data = &fsl_imx25_devtype_data, },
+	{ .compatible = "fsl,imx35-flexcan", .data = &fsl_imx25_devtype_data, },
+	{ .compatible = "fsl,imx25-flexcan", .data = &fsl_imx25_devtype_data, },
 	{ .compatible = "fsl,p1010-flexcan", .data = &fsl_p1010_devtype_data, },
 	{ .compatible = "fsl,vf610-flexcan", .data = &fsl_vf610_devtype_data, },
 	{ .compatible = "fsl,ls1021ar2-flexcan", .data = &fsl_ls1021a_r2_devtype_data, },
@@ -1337,18 +1344,13 @@ static int flexcan_probe(struct platform
 
 	priv = netdev_priv(dev);
 
-	if (of_property_read_bool(pdev->dev.of_node, "big-endian")) {
+	if (of_property_read_bool(pdev->dev.of_node, "big-endian") ||
+	    devtype_data->quirks & FLEXCAN_QUIRK_DEFAULT_BIG_ENDIAN) {
 		priv->read = flexcan_read_be;
 		priv->write = flexcan_write_be;
 	} else {
-		if (of_device_is_compatible(pdev->dev.of_node,
-					    "fsl,p1010-flexcan")) {
-			priv->read = flexcan_read_be;
-			priv->write = flexcan_write_be;
-		} else {
-			priv->read = flexcan_read_le;
-			priv->write = flexcan_write_le;
-		}
+		priv->read = flexcan_read_le;
+		priv->write = flexcan_write_le;
 	}
 
 	priv->can.clock.freq = clock_freq;
diff -druNp --no-dereference linux-libre-4.16.8-gnu/drivers/net/can/spi/hi311x.c linux-libre-4.16.9-gnu/drivers/net/can/spi/hi311x.c
--- linux-libre-4.16.8-gnu/drivers/net/can/spi/hi311x.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/drivers/net/can/spi/hi311x.c	2018-05-16 04:12:36.000000000 -0400
@@ -91,6 +91,7 @@
 #define HI3110_STAT_BUSOFF BIT(2)
 #define HI3110_STAT_ERRP BIT(3)
 #define HI3110_STAT_ERRW BIT(4)
+#define HI3110_STAT_TXMTY BIT(7)
 
 #define HI3110_BTR0_SJW_SHIFT 6
 #define HI3110_BTR0_BRP_SHIFT 0
@@ -427,8 +428,10 @@ static int hi3110_get_berr_counter(const
 	struct hi3110_priv *priv = netdev_priv(net);
 	struct spi_device *spi = priv->spi;
 
+	mutex_lock(&priv->hi3110_lock);
 	bec->txerr = hi3110_read(spi, HI3110_READ_TEC);
 	bec->rxerr = hi3110_read(spi, HI3110_READ_REC);
+	mutex_unlock(&priv->hi3110_lock);
 
 	return 0;
 }
@@ -735,10 +738,7 @@ static irqreturn_t hi3110_can_ist(int ir
 			}
 		}
 
-		if (intf == 0)
-			break;
-
-		if (intf & HI3110_INT_TXCPLT) {
+		if (priv->tx_len && statf & HI3110_STAT_TXMTY) {
 			net->stats.tx_packets++;
 			net->stats.tx_bytes += priv->tx_len - 1;
 			can_led_event(net, CAN_LED_EVENT_TX);
@@ -748,6 +748,9 @@ static irqreturn_t hi3110_can_ist(int ir
 			}
 			netif_wake_queue(net);
 		}
+
+		if (intf == 0)
+			break;
 	}
 	mutex_unlock(&priv->hi3110_lock);
 	return IRQ_HANDLED;
diff -druNp --no-dereference linux-libre-4.16.8-gnu/drivers/net/can/usb/kvaser_usb.c linux-libre-4.16.9-gnu/drivers/net/can/usb/kvaser_usb.c
--- linux-libre-4.16.8-gnu/drivers/net/can/usb/kvaser_usb.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/drivers/net/can/usb/kvaser_usb.c	2018-05-16 04:12:36.000000000 -0400
@@ -1179,7 +1179,7 @@ static void kvaser_usb_rx_can_msg(const
 
 	skb = alloc_can_skb(priv->netdev, &cf);
 	if (!skb) {
-		stats->tx_dropped++;
+		stats->rx_dropped++;
 		return;
 	}
 
diff -druNp --no-dereference linux-libre-4.16.8-gnu/drivers/nvme/host/core.c linux-libre-4.16.9-gnu/drivers/nvme/host/core.c
--- linux-libre-4.16.8-gnu/drivers/nvme/host/core.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/drivers/nvme/host/core.c	2018-05-16 04:12:36.000000000 -0400
@@ -122,7 +122,8 @@ int nvme_reset_ctrl_sync(struct nvme_ctr
 	ret = nvme_reset_ctrl(ctrl);
 	if (!ret) {
 		flush_work(&ctrl->reset_work);
-		if (ctrl->state != NVME_CTRL_LIVE)
+		if (ctrl->state != NVME_CTRL_LIVE &&
+		    ctrl->state != NVME_CTRL_ADMIN_ONLY)
 			ret = -ENETRESET;
 	}
 
diff -druNp --no-dereference linux-libre-4.16.8-gnu/drivers/nvme/host/nvme.h linux-libre-4.16.9-gnu/drivers/nvme/host/nvme.h
--- linux-libre-4.16.8-gnu/drivers/nvme/host/nvme.h	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/drivers/nvme/host/nvme.h	2018-05-16 04:12:36.000000000 -0400
@@ -83,6 +83,11 @@ enum nvme_quirks {
 	 * Supports the LighNVM command set if indicated in vs[1].
 	 */
 	NVME_QUIRK_LIGHTNVM			= (1 << 6),
+
+	/*
+	 * Set MEDIUM priority on SQ creation
+	 */
+	NVME_QUIRK_MEDIUM_PRIO_SQ		= (1 << 7),
 };
 
 /*
diff -druNp --no-dereference linux-libre-4.16.8-gnu/drivers/nvme/host/pci.c linux-libre-4.16.9-gnu/drivers/nvme/host/pci.c
--- linux-libre-4.16.8-gnu/drivers/nvme/host/pci.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/drivers/nvme/host/pci.c	2018-05-16 04:12:36.000000000 -0400
@@ -1091,10 +1091,19 @@ static int adapter_alloc_cq(struct nvme_
 static int adapter_alloc_sq(struct nvme_dev *dev, u16 qid,
 						struct nvme_queue *nvmeq)
 {
+	struct nvme_ctrl *ctrl = &dev->ctrl;
 	struct nvme_command c;
 	int flags = NVME_QUEUE_PHYS_CONTIG;
 
 	/*
+	 * Some drives have a bug that auto-enables WRRU if MEDIUM isn't
+	 * set. Since URGENT priority is zeroes, it makes all queues
+	 * URGENT.
+	 */
+	if (ctrl->quirks & NVME_QUIRK_MEDIUM_PRIO_SQ)
+		flags |= NVME_SQ_PRIO_MEDIUM;
+
+	/*
 	 * Note: we (ab)use the fact that the prp fields survive if no data
 	 * is attached to the request.
 	 */
@@ -2684,7 +2693,8 @@ static const struct pci_device_id nvme_i
 		.driver_data = NVME_QUIRK_STRIPE_SIZE |
 				NVME_QUIRK_DEALLOCATE_ZEROES, },
 	{ PCI_VDEVICE(INTEL, 0xf1a5),	/* Intel 600P/P3100 */
-		.driver_data = NVME_QUIRK_NO_DEEPEST_PS },
+		.driver_data = NVME_QUIRK_NO_DEEPEST_PS |
+				NVME_QUIRK_MEDIUM_PRIO_SQ },
 	{ PCI_VDEVICE(INTEL, 0x5845),	/* Qemu emulated controller */
 		.driver_data = NVME_QUIRK_IDENTIFY_CNS, },
 	{ PCI_DEVICE(0x1c58, 0x0003),	/* HGST adapter */
diff -druNp --no-dereference linux-libre-4.16.8-gnu/drivers/pci/pci.c linux-libre-4.16.9-gnu/drivers/pci/pci.c
--- linux-libre-4.16.8-gnu/drivers/pci/pci.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/drivers/pci/pci.c	2018-05-16 04:12:36.000000000 -0400
@@ -1897,7 +1897,7 @@ void pci_pme_active(struct pci_dev *dev,
 EXPORT_SYMBOL(pci_pme_active);
 
 /**
- * pci_enable_wake - enable PCI device as wakeup event source
+ * __pci_enable_wake - enable PCI device as wakeup event source
  * @dev: PCI device affected
  * @state: PCI state from which device will issue wakeup events
  * @enable: True to enable event generation; false to disable
@@ -1915,7 +1915,7 @@ EXPORT_SYMBOL(pci_pme_active);
  * Error code depending on the platform is returned if both the platform and
  * the native mechanism fail to enable the generation of wake-up events
  */
-int pci_enable_wake(struct pci_dev *dev, pci_power_t state, bool enable)
+static int __pci_enable_wake(struct pci_dev *dev, pci_power_t state, bool enable)
 {
 	int ret = 0;
 
@@ -1956,6 +1956,23 @@ int pci_enable_wake(struct pci_dev *dev,
 
 	return ret;
 }
+
+/**
+ * pci_enable_wake - change wakeup settings for a PCI device
+ * @pci_dev: Target device
+ * @state: PCI state from which device will issue wakeup events
+ * @enable: Whether or not to enable event generation
+ *
+ * If @enable is set, check device_may_wakeup() for the device before calling
+ * __pci_enable_wake() for it.
+ */
+int pci_enable_wake(struct pci_dev *pci_dev, pci_power_t state, bool enable)
+{
+	if (enable && !device_may_wakeup(&pci_dev->dev))
+		return -EINVAL;
+
+	return __pci_enable_wake(pci_dev, state, enable);
+}
 EXPORT_SYMBOL(pci_enable_wake);
 
 /**
@@ -1968,9 +1985,9 @@ EXPORT_SYMBOL(pci_enable_wake);
  * should not be called twice in a row to enable wake-up due to PCI PM vs ACPI
  * ordering constraints.
  *
- * This function only returns error code if the device is not capable of
- * generating PME# from both D3_hot and D3_cold, and the platform is unable to
- * enable wake-up power for it.
+ * This function only returns error code if the device is not allowed to wake
+ * up the system from sleep or it is not capable of generating PME# from both
+ * D3_hot and D3_cold and the platform is unable to enable wake-up power for it.
  */
 int pci_wake_from_d3(struct pci_dev *dev, bool enable)
 {
@@ -2101,7 +2118,7 @@ int pci_finish_runtime_suspend(struct pc
 
 	dev->runtime_d3cold = target_state == PCI_D3cold;
 
-	pci_enable_wake(dev, target_state, pci_dev_run_wake(dev));
+	__pci_enable_wake(dev, target_state, pci_dev_run_wake(dev));
 
 	error = pci_set_power_state(dev, target_state);
 
@@ -2125,16 +2142,16 @@ bool pci_dev_run_wake(struct pci_dev *de
 {
 	struct pci_bus *bus = dev->bus;
 
-	if (device_can_wakeup(&dev->dev))
-		return true;
-
 	if (!dev->pme_support)
 		return false;
 
 	/* PME-capable in principle, but not from the target power state */
-	if (!pci_pme_capable(dev, pci_target_state(dev, false)))
+	if (!pci_pme_capable(dev, pci_target_state(dev, true)))
 		return false;
 
+	if (device_can_wakeup(&dev->dev))
+		return true;
+
 	while (bus->parent) {
 		struct pci_dev *bridge = bus->self;
 
diff -druNp --no-dereference linux-libre-4.16.8-gnu/drivers/thermal/samsung/exynos_tmu.c linux-libre-4.16.9-gnu/drivers/thermal/samsung/exynos_tmu.c
--- linux-libre-4.16.8-gnu/drivers/thermal/samsung/exynos_tmu.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/drivers/thermal/samsung/exynos_tmu.c	2018-05-16 04:12:36.000000000 -0400
@@ -185,6 +185,7 @@
  * @regulator: pointer to the TMU regulator structure.
  * @reg_conf: pointer to structure to register with core thermal.
  * @ntrip: number of supported trip points.
+ * @enabled: current status of TMU device
  * @tmu_initialize: SoC specific TMU initialization method
  * @tmu_control: SoC specific TMU control method
  * @tmu_read: SoC specific TMU temperature read method
@@ -205,6 +206,7 @@ struct exynos_tmu_data {
 	struct regulator *regulator;
 	struct thermal_zone_device *tzd;
 	unsigned int ntrip;
+	bool enabled;
 
 	int (*tmu_initialize)(struct platform_device *pdev);
 	void (*tmu_control)(struct platform_device *pdev, bool on);
@@ -398,6 +400,7 @@ static void exynos_tmu_control(struct pl
 	mutex_lock(&data->lock);
 	clk_enable(data->clk);
 	data->tmu_control(pdev, on);
+	data->enabled = on;
 	clk_disable(data->clk);
 	mutex_unlock(&data->lock);
 }
@@ -889,19 +892,24 @@ static void exynos7_tmu_control(struct p
 static int exynos_get_temp(void *p, int *temp)
 {
 	struct exynos_tmu_data *data = p;
+	int value, ret = 0;
 
-	if (!data || !data->tmu_read)
+	if (!data || !data->tmu_read || !data->enabled)
 		return -EINVAL;
 
 	mutex_lock(&data->lock);
 	clk_enable(data->clk);
 
-	*temp = code_to_temp(data, data->tmu_read(data)) * MCELSIUS;
+	value = data->tmu_read(data);
+	if (value < 0)
+		ret = value;
+	else
+		*temp = code_to_temp(data, value) * MCELSIUS;
 
 	clk_disable(data->clk);
 	mutex_unlock(&data->lock);
 
-	return 0;
+	return ret;
 }
 
 #ifdef CONFIG_THERMAL_EMULATION
diff -druNp --no-dereference linux-libre-4.16.8-gnu/fs/ceph/file.c linux-libre-4.16.9-gnu/fs/ceph/file.c
--- linux-libre-4.16.8-gnu/fs/ceph/file.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/fs/ceph/file.c	2018-05-16 04:12:36.000000000 -0400
@@ -878,6 +878,11 @@ ceph_direct_read_write(struct kiocb *ioc
 		size_t start = 0;
 		ssize_t len;
 
+		if (write)
+			size = min_t(u64, size, fsc->mount_options->wsize);
+		else
+			size = min_t(u64, size, fsc->mount_options->rsize);
+
 		vino = ceph_vino(inode);
 		req = ceph_osdc_new_request(&fsc->client->osdc, &ci->i_layout,
 					    vino, pos, &size, 0,
@@ -893,11 +898,6 @@ ceph_direct_read_write(struct kiocb *ioc
 			break;
 		}
 
-		if (write)
-			size = min_t(u64, size, fsc->mount_options->wsize);
-		else
-			size = min_t(u64, size, fsc->mount_options->rsize);
-
 		len = size;
 		pages = dio_get_pages_alloc(iter, len, &start, &num_pages);
 		if (IS_ERR(pages)) {
diff -druNp --no-dereference linux-libre-4.16.8-gnu/fs/cifs/cifsfs.c linux-libre-4.16.9-gnu/fs/cifs/cifsfs.c
--- linux-libre-4.16.8-gnu/fs/cifs/cifsfs.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/fs/cifs/cifsfs.c	2018-05-16 04:12:36.000000000 -0400
@@ -1047,6 +1047,18 @@ out:
 	return rc;
 }
 
+/*
+ * Directory operations under CIFS/SMB2/SMB3 are synchronous, so fsync()
+ * is a dummy operation.
+ */
+static int cifs_dir_fsync(struct file *file, loff_t start, loff_t end, int datasync)
+{
+	cifs_dbg(FYI, "Sync directory - name: %pD datasync: 0x%x\n",
+		 file, datasync);
+
+	return 0;
+}
+
 static ssize_t cifs_copy_file_range(struct file *src_file, loff_t off,
 				struct file *dst_file, loff_t destoff,
 				size_t len, unsigned int flags)
@@ -1181,6 +1193,7 @@ const struct file_operations cifs_dir_op
 	.copy_file_range = cifs_copy_file_range,
 	.clone_file_range = cifs_clone_file_range,
 	.llseek = generic_file_llseek,
+	.fsync = cifs_dir_fsync,
 };
 
 static void
diff -druNp --no-dereference linux-libre-4.16.8-gnu/fs/fs-writeback.c linux-libre-4.16.9-gnu/fs/fs-writeback.c
--- linux-libre-4.16.8-gnu/fs/fs-writeback.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/fs/fs-writeback.c	2018-05-16 04:12:36.000000000 -0400
@@ -1961,7 +1961,7 @@ void wb_workfn(struct work_struct *work)
 	}
 
 	if (!list_empty(&wb->work_list))
-		mod_delayed_work(bdi_wq, &wb->dwork, 0);
+		wb_wakeup(wb);
 	else if (wb_has_dirty_io(wb) && dirty_writeback_interval)
 		wb_wakeup_delayed(wb);
 
diff -druNp --no-dereference linux-libre-4.16.8-gnu/include/linux/bpf.h linux-libre-4.16.9-gnu/include/linux/bpf.h
--- linux-libre-4.16.8-gnu/include/linux/bpf.h	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/include/linux/bpf.h	2018-05-16 04:12:36.000000000 -0400
@@ -335,8 +335,8 @@ int bpf_prog_array_copy_to_user(struct b
 void bpf_prog_array_delete_safe(struct bpf_prog_array __rcu *progs,
 				struct bpf_prog *old_prog);
 int bpf_prog_array_copy_info(struct bpf_prog_array __rcu *array,
-			     __u32 __user *prog_ids, u32 request_cnt,
-			     __u32 __user *prog_cnt);
+			     u32 *prog_ids, u32 request_cnt,
+			     u32 *prog_cnt);
 int bpf_prog_array_copy(struct bpf_prog_array __rcu *old_array,
 			struct bpf_prog *exclude_prog,
 			struct bpf_prog *include_prog,
diff -druNp --no-dereference linux-libre-4.16.8-gnu/include/linux/oom.h linux-libre-4.16.9-gnu/include/linux/oom.h
--- linux-libre-4.16.8-gnu/include/linux/oom.h	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/include/linux/oom.h	2018-05-16 04:12:36.000000000 -0400
@@ -95,6 +95,8 @@ static inline int check_stable_address_s
 	return 0;
 }
 
+void __oom_reap_task_mm(struct mm_struct *mm);
+
 extern unsigned long oom_badness(struct task_struct *p,
 		struct mem_cgroup *memcg, const nodemask_t *nodemask,
 		unsigned long totalpages);
diff -druNp --no-dereference linux-libre-4.16.8-gnu/include/linux/wait_bit.h linux-libre-4.16.9-gnu/include/linux/wait_bit.h
--- linux-libre-4.16.8-gnu/include/linux/wait_bit.h	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/include/linux/wait_bit.h	2018-05-16 04:12:36.000000000 -0400
@@ -262,4 +262,21 @@ int wait_on_atomic_t(atomic_t *val, wait
 	return out_of_line_wait_on_atomic_t(val, action, mode);
 }
 
+/**
+ * clear_and_wake_up_bit - clear a bit and wake up anyone waiting on that bit
+ *
+ * @bit: the bit of the word being waited on
+ * @word: the word being waited on, a kernel virtual address
+ *
+ * You can use this helper if bitflags are manipulated atomically rather than
+ * non-atomically under a lock.
+ */
+static inline void clear_and_wake_up_bit(int bit, void *word)
+{
+	clear_bit_unlock(bit, word);
+	/* See wake_up_bit() for which memory barrier you need to use. */
+	smp_mb__after_atomic();
+	wake_up_bit(word, bit);
+}
+
 #endif /* _LINUX_WAIT_BIT_H */
diff -druNp --no-dereference linux-libre-4.16.8-gnu/include/net/inet_timewait_sock.h linux-libre-4.16.9-gnu/include/net/inet_timewait_sock.h
--- linux-libre-4.16.8-gnu/include/net/inet_timewait_sock.h	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/include/net/inet_timewait_sock.h	2018-05-16 04:12:36.000000000 -0400
@@ -43,6 +43,7 @@ struct inet_timewait_sock {
 #define tw_family		__tw_common.skc_family
 #define tw_state		__tw_common.skc_state
 #define tw_reuse		__tw_common.skc_reuse
+#define tw_reuseport		__tw_common.skc_reuseport
 #define tw_ipv6only		__tw_common.skc_ipv6only
 #define tw_bound_dev_if		__tw_common.skc_bound_dev_if
 #define tw_node			__tw_common.skc_nulls_node
diff -druNp --no-dereference linux-libre-4.16.8-gnu/include/net/nexthop.h linux-libre-4.16.9-gnu/include/net/nexthop.h
--- linux-libre-4.16.8-gnu/include/net/nexthop.h	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/include/net/nexthop.h	2018-05-16 04:12:36.000000000 -0400
@@ -7,7 +7,7 @@
 
 static inline int rtnh_ok(const struct rtnexthop *rtnh, int remaining)
 {
-	return remaining >= sizeof(*rtnh) &&
+	return remaining >= (int)sizeof(*rtnh) &&
 	       rtnh->rtnh_len >= sizeof(*rtnh) &&
 	       rtnh->rtnh_len <= remaining;
 }
diff -druNp --no-dereference linux-libre-4.16.8-gnu/kernel/bpf/core.c linux-libre-4.16.9-gnu/kernel/bpf/core.c
--- linux-libre-4.16.8-gnu/kernel/bpf/core.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/kernel/bpf/core.c	2018-05-16 04:12:36.000000000 -0400
@@ -1572,13 +1572,32 @@ int bpf_prog_array_length(struct bpf_pro
 	return cnt;
 }
 
+static bool bpf_prog_array_copy_core(struct bpf_prog **prog,
+				     u32 *prog_ids,
+				     u32 request_cnt)
+{
+	int i = 0;
+
+	for (; *prog; prog++) {
+		if (*prog == &dummy_bpf_prog.prog)
+			continue;
+		prog_ids[i] = (*prog)->aux->id;
+		if (++i == request_cnt) {
+			prog++;
+			break;
+		}
+	}
+
+	return !!(*prog);
+}
+
 int bpf_prog_array_copy_to_user(struct bpf_prog_array __rcu *progs,
 				__u32 __user *prog_ids, u32 cnt)
 {
 	struct bpf_prog **prog;
 	unsigned long err = 0;
-	u32 i = 0, *ids;
 	bool nospc;
+	u32 *ids;
 
 	/* users of this function are doing:
 	 * cnt = bpf_prog_array_length();
@@ -1595,16 +1614,7 @@ int bpf_prog_array_copy_to_user(struct b
 		return -ENOMEM;
 	rcu_read_lock();
 	prog = rcu_dereference(progs)->progs;
-	for (; *prog; prog++) {
-		if (*prog == &dummy_bpf_prog.prog)
-			continue;
-		ids[i] = (*prog)->aux->id;
-		if (++i == cnt) {
-			prog++;
-			break;
-		}
-	}
-	nospc = !!(*prog);
+	nospc = bpf_prog_array_copy_core(prog, ids, cnt);
 	rcu_read_unlock();
 	err = copy_to_user(prog_ids, ids, cnt * sizeof(u32));
 	kfree(ids);
@@ -1683,22 +1693,25 @@ int bpf_prog_array_copy(struct bpf_prog_
 }
 
 int bpf_prog_array_copy_info(struct bpf_prog_array __rcu *array,
-			     __u32 __user *prog_ids, u32 request_cnt,
-			     __u32 __user *prog_cnt)
+			     u32 *prog_ids, u32 request_cnt,
+			     u32 *prog_cnt)
 {
+	struct bpf_prog **prog;
 	u32 cnt = 0;
 
 	if (array)
 		cnt = bpf_prog_array_length(array);
 
-	if (copy_to_user(prog_cnt, &cnt, sizeof(cnt)))
-		return -EFAULT;
+	*prog_cnt = cnt;
 
 	/* return early if user requested only program count or nothing to copy */
 	if (!request_cnt || !cnt)
 		return 0;
 
-	return bpf_prog_array_copy_to_user(array, prog_ids, request_cnt);
+	/* this function is called under trace/bpf_trace.c: bpf_event_mutex */
+	prog = rcu_dereference_check(array, 1)->progs;
+	return bpf_prog_array_copy_core(prog, prog_ids, request_cnt) ? -ENOSPC
+								     : 0;
 }
 
 static void bpf_prog_free_deferred(struct work_struct *work)
diff -druNp --no-dereference linux-libre-4.16.8-gnu/kernel/compat.c linux-libre-4.16.9-gnu/kernel/compat.c
--- linux-libre-4.16.8-gnu/kernel/compat.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/kernel/compat.c	2018-05-16 04:12:36.000000000 -0400
@@ -34,6 +34,7 @@ int compat_get_timex(struct timex *txc,
 {
 	struct compat_timex tx32;
 
+	memset(txc, 0, sizeof(struct timex));
 	if (copy_from_user(&tx32, utp, sizeof(struct compat_timex)))
 		return -EFAULT;
 
diff -druNp --no-dereference linux-libre-4.16.8-gnu/kernel/events/callchain.c linux-libre-4.16.9-gnu/kernel/events/callchain.c
--- linux-libre-4.16.8-gnu/kernel/events/callchain.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/kernel/events/callchain.c	2018-05-16 04:12:36.000000000 -0400
@@ -131,14 +131,8 @@ int get_callchain_buffers(int event_max_
 		goto exit;
 	}
 
-	if (count > 1) {
-		/* If the allocation failed, give up */
-		if (!callchain_cpus_entries)
-			err = -ENOMEM;
-		goto exit;
-	}
-
-	err = alloc_callchain_buffers();
+	if (count == 1)
+		err = alloc_callchain_buffers();
 exit:
 	if (err)
 		atomic_dec(&nr_callchain_events);
diff -druNp --no-dereference linux-libre-4.16.8-gnu/kernel/events/ring_buffer.c linux-libre-4.16.9-gnu/kernel/events/ring_buffer.c
--- linux-libre-4.16.8-gnu/kernel/events/ring_buffer.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/kernel/events/ring_buffer.c	2018-05-16 04:12:36.000000000 -0400
@@ -14,6 +14,7 @@
 #include <linux/slab.h>
 #include <linux/circ_buf.h>
 #include <linux/poll.h>
+#include <linux/nospec.h>
 
 #include "internal.h"
 
@@ -867,8 +868,10 @@ perf_mmap_to_page(struct ring_buffer *rb
 			return NULL;
 
 		/* AUX space */
-		if (pgoff >= rb->aux_pgoff)
-			return virt_to_page(rb->aux_pages[pgoff - rb->aux_pgoff]);
+		if (pgoff >= rb->aux_pgoff) {
+			int aux_pgoff = array_index_nospec(pgoff - rb->aux_pgoff, rb->aux_nr_pages);
+			return virt_to_page(rb->aux_pages[aux_pgoff]);
+		}
 	}
 
 	return __perf_mmap_to_page(rb, pgoff);
diff -druNp --no-dereference linux-libre-4.16.8-gnu/kernel/sched/autogroup.c linux-libre-4.16.9-gnu/kernel/sched/autogroup.c
--- linux-libre-4.16.8-gnu/kernel/sched/autogroup.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/kernel/sched/autogroup.c	2018-05-16 04:12:36.000000000 -0400
@@ -4,6 +4,7 @@
 #include <linux/utsname.h>
 #include <linux/security.h>
 #include <linux/export.h>
+#include <linux/nospec.h>
 
 #include "sched.h"
 
@@ -212,7 +213,7 @@ int proc_sched_autogroup_set_nice(struct
 	static unsigned long next = INITIAL_JIFFIES;
 	struct autogroup *ag;
 	unsigned long shares;
-	int err;
+	int err, idx;
 
 	if (nice < MIN_NICE || nice > MAX_NICE)
 		return -EINVAL;
@@ -230,7 +231,9 @@ int proc_sched_autogroup_set_nice(struct
 
 	next = HZ / 10 + jiffies;
 	ag = autogroup_task_get(p);
-	shares = scale_load(sched_prio_to_weight[nice + 20]);
+
+	idx = array_index_nospec(nice + 20, 40);
+	shares = scale_load(sched_prio_to_weight[idx]);
 
 	down_write(&ag->lock);
 	err = sched_group_set_shares(ag->tg, shares);
diff -druNp --no-dereference linux-libre-4.16.8-gnu/kernel/sched/core.c linux-libre-4.16.9-gnu/kernel/sched/core.c
--- linux-libre-4.16.8-gnu/kernel/sched/core.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/kernel/sched/core.c	2018-05-16 04:12:36.000000000 -0400
@@ -23,6 +23,7 @@
 #include <linux/mmu_context.h>
 #include <linux/module.h>
 #include <linux/nmi.h>
+#include <linux/nospec.h>
 #include <linux/prefetch.h>
 #include <linux/profile.h>
 #include <linux/security.h>
@@ -6873,11 +6874,15 @@ static int cpu_weight_nice_write_s64(str
 				     struct cftype *cft, s64 nice)
 {
 	unsigned long weight;
+	int idx;
 
 	if (nice < MIN_NICE || nice > MAX_NICE)
 		return -ERANGE;
 
-	weight = sched_prio_to_weight[NICE_TO_PRIO(nice) - MAX_RT_PRIO];
+	idx = NICE_TO_PRIO(nice) - MAX_RT_PRIO;
+	idx = array_index_nospec(idx, 40);
+	weight = sched_prio_to_weight[idx];
+
 	return sched_group_set_shares(css_tg(css), scale_load(weight));
 }
 #endif
diff -druNp --no-dereference linux-libre-4.16.8-gnu/kernel/sched/cpufreq_schedutil.c linux-libre-4.16.9-gnu/kernel/sched/cpufreq_schedutil.c
--- linux-libre-4.16.8-gnu/kernel/sched/cpufreq_schedutil.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/kernel/sched/cpufreq_schedutil.c	2018-05-16 04:12:36.000000000 -0400
@@ -290,7 +290,8 @@ static void sugov_update_single(struct u
 		 * Do not reduce the frequency if the CPU has not been idle
 		 * recently, as the reduction is likely to be premature then.
 		 */
-		if (busy && next_f < sg_policy->next_freq) {
+		if (busy && next_f < sg_policy->next_freq &&
+		    sg_policy->next_freq != UINT_MAX) {
 			next_f = sg_policy->next_freq;
 
 			/* Reset cached freq as next_freq has changed */
diff -druNp --no-dereference linux-libre-4.16.8-gnu/kernel/trace/bpf_trace.c linux-libre-4.16.9-gnu/kernel/trace/bpf_trace.c
--- linux-libre-4.16.8-gnu/kernel/trace/bpf_trace.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/kernel/trace/bpf_trace.c	2018-05-16 04:12:36.000000000 -0400
@@ -876,6 +876,7 @@ int perf_event_query_prog_array(struct p
 {
 	struct perf_event_query_bpf __user *uquery = info;
 	struct perf_event_query_bpf query = {};
+	u32 *ids, prog_cnt, ids_len;
 	int ret;
 
 	if (!capable(CAP_SYS_ADMIN))
@@ -884,15 +885,31 @@ int perf_event_query_prog_array(struct p
 		return -EINVAL;
 	if (copy_from_user(&query, uquery, sizeof(query)))
 		return -EFAULT;
-	if (query.ids_len > BPF_TRACE_MAX_PROGS)
+
+	ids_len = query.ids_len;
+	if (ids_len > BPF_TRACE_MAX_PROGS)
 		return -E2BIG;
+	ids = kcalloc(ids_len, sizeof(u32), GFP_USER | __GFP_NOWARN);
+	if (!ids)
+		return -ENOMEM;
+	/*
+	 * The above kcalloc returns ZERO_SIZE_PTR when ids_len = 0, which
+	 * is required when user only wants to check for uquery->prog_cnt.
+	 * There is no need to check for it since the case is handled
+	 * gracefully in bpf_prog_array_copy_info.
+	 */
 
 	mutex_lock(&bpf_event_mutex);
 	ret = bpf_prog_array_copy_info(event->tp_event->prog_array,
-				       uquery->ids,
-				       query.ids_len,
-				       &uquery->prog_cnt);
+				       ids,
+				       ids_len,
+				       &prog_cnt);
 	mutex_unlock(&bpf_event_mutex);
 
+	if (copy_to_user(&uquery->prog_cnt, &prog_cnt, sizeof(prog_cnt)) ||
+	    copy_to_user(uquery->ids, ids, ids_len * sizeof(u32)))
+		ret = -EFAULT;
+
+	kfree(ids);
 	return ret;
 }
diff -druNp --no-dereference linux-libre-4.16.8-gnu/kernel/trace/trace_events_filter.c linux-libre-4.16.9-gnu/kernel/trace/trace_events_filter.c
--- linux-libre-4.16.8-gnu/kernel/trace/trace_events_filter.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/kernel/trace/trace_events_filter.c	2018-05-16 04:12:36.000000000 -0400
@@ -338,6 +338,9 @@ static int regex_match_full(char *str, s
 
 static int regex_match_front(char *str, struct regex *r, int len)
 {
+	if (len < r->len)
+		return 0;
+
 	if (strncmp(str, r->pattern, r->len) == 0)
 		return 1;
 	return 0;
diff -druNp --no-dereference linux-libre-4.16.8-gnu/kernel/trace/trace_uprobe.c linux-libre-4.16.9-gnu/kernel/trace/trace_uprobe.c
--- linux-libre-4.16.8-gnu/kernel/trace/trace_uprobe.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/kernel/trace/trace_uprobe.c	2018-05-16 04:12:36.000000000 -0400
@@ -152,6 +152,8 @@ static void FETCH_FUNC_NAME(memory, stri
 		return;
 
 	ret = strncpy_from_user(dst, src, maxlen);
+	if (ret == maxlen)
+		dst[--ret] = '\0';
 
 	if (ret < 0) {	/* Failed to fetch string */
 		((u8 *)get_rloc_data(dest))[0] = '\0';
diff -druNp --no-dereference linux-libre-4.16.8-gnu/lib/swiotlb.c linux-libre-4.16.9-gnu/lib/swiotlb.c
--- linux-libre-4.16.8-gnu/lib/swiotlb.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/lib/swiotlb.c	2018-05-16 04:12:36.000000000 -0400
@@ -727,7 +727,7 @@ swiotlb_alloc_buffer(struct device *dev,
 
 	phys_addr = swiotlb_tbl_map_single(dev,
 			swiotlb_phys_to_dma(dev, io_tlb_start),
-			0, size, DMA_FROM_DEVICE, 0);
+			0, size, DMA_FROM_DEVICE, attrs);
 	if (phys_addr == SWIOTLB_MAP_ERROR)
 		goto out_warn;
 
diff -druNp --no-dereference linux-libre-4.16.8-gnu/Makefile linux-libre-4.16.9-gnu/Makefile
--- linux-libre-4.16.8-gnu/Makefile	2018-05-09 13:36:42.000000000 -0400
+++ linux-libre-4.16.9-gnu/Makefile	2018-05-16 09:42:02.000000000 -0400
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 16
-SUBLEVEL = 8
+SUBLEVEL = 9
 EXTRAVERSION = -gnu
 NAME = Fearless Coyote
 
diff -druNp --no-dereference linux-libre-4.16.8-gnu/mm/backing-dev.c linux-libre-4.16.9-gnu/mm/backing-dev.c
--- linux-libre-4.16.8-gnu/mm/backing-dev.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/mm/backing-dev.c	2018-05-16 04:12:36.000000000 -0400
@@ -126,6 +126,7 @@ static int bdi_debug_register(struct bac
 					       bdi, &bdi_debug_stats_fops);
 	if (!bdi->debug_stats) {
 		debugfs_remove(bdi->debug_dir);
+		bdi->debug_dir = NULL;
 		return -ENOMEM;
 	}
 
@@ -394,7 +395,7 @@ static void wb_shutdown(struct bdi_write
 	 * the barrier provided by test_and_clear_bit() above.
 	 */
 	smp_wmb();
-	clear_bit(WB_shutting_down, &wb->state);
+	clear_and_wake_up_bit(WB_shutting_down, &wb->state);
 }
 
 static void wb_exit(struct bdi_writeback *wb)
diff -druNp --no-dereference linux-libre-4.16.8-gnu/mm/memcontrol.c linux-libre-4.16.9-gnu/mm/memcontrol.c
--- linux-libre-4.16.8-gnu/mm/memcontrol.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/mm/memcontrol.c	2018-05-16 04:12:36.000000000 -0400
@@ -4108,6 +4108,9 @@ static void free_mem_cgroup_per_node_inf
 {
 	struct mem_cgroup_per_node *pn = memcg->nodeinfo[node];
 
+	if (!pn)
+		return;
+
 	free_percpu(pn->lruvec_stat_cpu);
 	kfree(pn);
 }
diff -druNp --no-dereference linux-libre-4.16.8-gnu/mm/mmap.c linux-libre-4.16.9-gnu/mm/mmap.c
--- linux-libre-4.16.8-gnu/mm/mmap.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/mm/mmap.c	2018-05-16 04:12:36.000000000 -0400
@@ -2997,6 +2997,32 @@ void exit_mmap(struct mm_struct *mm)
 	/* mm's last user has gone, and its about to be pulled down */
 	mmu_notifier_release(mm);
 
+	if (unlikely(mm_is_oom_victim(mm))) {
+		/*
+		 * Manually reap the mm to free as much memory as possible.
+		 * Then, as the oom reaper does, set MMF_OOM_SKIP to disregard
+		 * this mm from further consideration.  Taking mm->mmap_sem for
+		 * write after setting MMF_OOM_SKIP will guarantee that the oom
+		 * reaper will not run on this mm again after mmap_sem is
+		 * dropped.
+		 *
+		 * Nothing can be holding mm->mmap_sem here and the above call
+		 * to mmu_notifier_release(mm) ensures mmu notifier callbacks in
+		 * __oom_reap_task_mm() will not block.
+		 *
+		 * This needs to be done before calling munlock_vma_pages_all(),
+		 * which clears VM_LOCKED, otherwise the oom reaper cannot
+		 * reliably test it.
+		 */
+		mutex_lock(&oom_lock);
+		__oom_reap_task_mm(mm);
+		mutex_unlock(&oom_lock);
+
+		set_bit(MMF_OOM_SKIP, &mm->flags);
+		down_write(&mm->mmap_sem);
+		up_write(&mm->mmap_sem);
+	}
+
 	if (mm->locked_vm) {
 		vma = mm->mmap;
 		while (vma) {
@@ -3018,24 +3044,6 @@ void exit_mmap(struct mm_struct *mm)
 	/* update_hiwater_rss(mm) here? but nobody should be looking */
 	/* Use -1 here to ensure all VMAs in the mm are unmapped */
 	unmap_vmas(&tlb, vma, 0, -1);
-
-	if (unlikely(mm_is_oom_victim(mm))) {
-		/*
-		 * Wait for oom_reap_task() to stop working on this
-		 * mm. Because MMF_OOM_SKIP is already set before
-		 * calling down_read(), oom_reap_task() will not run
-		 * on this "mm" post up_write().
-		 *
-		 * mm_is_oom_victim() cannot be set from under us
-		 * either because victim->mm is already set to NULL
-		 * under task_lock before calling mmput and oom_mm is
-		 * set not NULL by the OOM killer only if victim->mm
-		 * is found not NULL while holding the task_lock.
-		 */
-		set_bit(MMF_OOM_SKIP, &mm->flags);
-		down_write(&mm->mmap_sem);
-		up_write(&mm->mmap_sem);
-	}
 	free_pgtables(&tlb, vma, FIRST_USER_ADDRESS, USER_PGTABLES_CEILING);
 	tlb_finish_mmu(&tlb, 0, -1);
 
diff -druNp --no-dereference linux-libre-4.16.8-gnu/mm/oom_kill.c linux-libre-4.16.9-gnu/mm/oom_kill.c
--- linux-libre-4.16.8-gnu/mm/oom_kill.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/mm/oom_kill.c	2018-05-16 04:12:36.000000000 -0400
@@ -474,7 +474,6 @@ bool process_shares_mm(struct task_struc
 	return false;
 }
 
-
 #ifdef CONFIG_MMU
 /*
  * OOM Reaper kernel thread which tries to reap the memory used by the OOM
@@ -485,16 +484,54 @@ static DECLARE_WAIT_QUEUE_HEAD(oom_reape
 static struct task_struct *oom_reaper_list;
 static DEFINE_SPINLOCK(oom_reaper_lock);
 
-static bool __oom_reap_task_mm(struct task_struct *tsk, struct mm_struct *mm)
+void __oom_reap_task_mm(struct mm_struct *mm)
 {
-	struct mmu_gather tlb;
 	struct vm_area_struct *vma;
+
+	/*
+	 * Tell all users of get_user/copy_from_user etc... that the content
+	 * is no longer stable. No barriers really needed because unmapping
+	 * should imply barriers already and the reader would hit a page fault
+	 * if it stumbled over a reaped memory.
+	 */
+	set_bit(MMF_UNSTABLE, &mm->flags);
+
+	for (vma = mm->mmap ; vma; vma = vma->vm_next) {
+		if (!can_madv_dontneed_vma(vma))
+			continue;
+
+		/*
+		 * Only anonymous pages have a good chance to be dropped
+		 * without additional steps which we cannot afford as we
+		 * are OOM already.
+		 *
+		 * We do not even care about fs backed pages because all
+		 * which are reclaimable have already been reclaimed and
+		 * we do not want to block exit_mmap by keeping mm ref
+		 * count elevated without a good reason.
+		 */
+		if (vma_is_anonymous(vma) || !(vma->vm_flags & VM_SHARED)) {
+			const unsigned long start = vma->vm_start;
+			const unsigned long end = vma->vm_end;
+			struct mmu_gather tlb;
+
+			tlb_gather_mmu(&tlb, mm, start, end);
+			mmu_notifier_invalidate_range_start(mm, start, end);
+			unmap_page_range(&tlb, vma, start, end, NULL);
+			mmu_notifier_invalidate_range_end(mm, start, end);
+			tlb_finish_mmu(&tlb, start, end);
+		}
+	}
+}
+
+static bool oom_reap_task_mm(struct task_struct *tsk, struct mm_struct *mm)
+{
 	bool ret = true;
 
 	/*
 	 * We have to make sure to not race with the victim exit path
 	 * and cause premature new oom victim selection:
-	 * __oom_reap_task_mm		exit_mm
+	 * oom_reap_task_mm		exit_mm
 	 *   mmget_not_zero
 	 *				  mmput
 	 *				    atomic_dec_and_test
@@ -539,39 +576,8 @@ static bool __oom_reap_task_mm(struct ta
 
 	trace_start_task_reaping(tsk->pid);
 
-	/*
-	 * Tell all users of get_user/copy_from_user etc... that the content
-	 * is no longer stable. No barriers really needed because unmapping
-	 * should imply barriers already and the reader would hit a page fault
-	 * if it stumbled over a reaped memory.
-	 */
-	set_bit(MMF_UNSTABLE, &mm->flags);
-
-	for (vma = mm->mmap ; vma; vma = vma->vm_next) {
-		if (!can_madv_dontneed_vma(vma))
-			continue;
-
-		/*
-		 * Only anonymous pages have a good chance to be dropped
-		 * without additional steps which we cannot afford as we
-		 * are OOM already.
-		 *
-		 * We do not even care about fs backed pages because all
-		 * which are reclaimable have already been reclaimed and
-		 * we do not want to block exit_mmap by keeping mm ref
-		 * count elevated without a good reason.
-		 */
-		if (vma_is_anonymous(vma) || !(vma->vm_flags & VM_SHARED)) {
-			const unsigned long start = vma->vm_start;
-			const unsigned long end = vma->vm_end;
+	__oom_reap_task_mm(mm);
 
-			tlb_gather_mmu(&tlb, mm, start, end);
-			mmu_notifier_invalidate_range_start(mm, start, end);
-			unmap_page_range(&tlb, vma, start, end, NULL);
-			mmu_notifier_invalidate_range_end(mm, start, end);
-			tlb_finish_mmu(&tlb, start, end);
-		}
-	}
 	pr_info("oom_reaper: reaped process %d (%s), now anon-rss:%lukB, file-rss:%lukB, shmem-rss:%lukB\n",
 			task_pid_nr(tsk), tsk->comm,
 			K(get_mm_counter(mm, MM_ANONPAGES)),
@@ -592,13 +598,12 @@ static void oom_reap_task(struct task_st
 	struct mm_struct *mm = tsk->signal->oom_mm;
 
 	/* Retry the down_read_trylock(mmap_sem) a few times */
-	while (attempts++ < MAX_OOM_REAP_RETRIES && !__oom_reap_task_mm(tsk, mm))
+	while (attempts++ < MAX_OOM_REAP_RETRIES && !oom_reap_task_mm(tsk, mm))
 		schedule_timeout_idle(HZ/10);
 
 	if (attempts <= MAX_OOM_REAP_RETRIES)
 		goto done;
 
-
 	pr_info("oom_reaper: unable to reap pid:%d (%s)\n",
 		task_pid_nr(tsk), tsk->comm);
 	debug_show_all_locks();
diff -druNp --no-dereference linux-libre-4.16.8-gnu/mm/sparse.c linux-libre-4.16.9-gnu/mm/sparse.c
--- linux-libre-4.16.8-gnu/mm/sparse.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/mm/sparse.c	2018-05-16 04:12:36.000000000 -0400
@@ -666,7 +666,7 @@ void offline_mem_sections(unsigned long
 	unsigned long pfn;
 
 	for (pfn = start_pfn; pfn < end_pfn; pfn += PAGES_PER_SECTION) {
-		unsigned long section_nr = pfn_to_section_nr(start_pfn);
+		unsigned long section_nr = pfn_to_section_nr(pfn);
 		struct mem_section *ms;
 
 		/*
diff -druNp --no-dereference linux-libre-4.16.8-gnu/mm/z3fold.c linux-libre-4.16.9-gnu/mm/z3fold.c
--- linux-libre-4.16.8-gnu/mm/z3fold.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/mm/z3fold.c	2018-05-16 04:12:36.000000000 -0400
@@ -144,7 +144,8 @@ enum z3fold_page_flags {
 	PAGE_HEADLESS = 0,
 	MIDDLE_CHUNK_MAPPED,
 	NEEDS_COMPACTING,
-	PAGE_STALE
+	PAGE_STALE,
+	UNDER_RECLAIM
 };
 
 /*****************
@@ -173,6 +174,7 @@ static struct z3fold_header *init_z3fold
 	clear_bit(MIDDLE_CHUNK_MAPPED, &page->private);
 	clear_bit(NEEDS_COMPACTING, &page->private);
 	clear_bit(PAGE_STALE, &page->private);
+	clear_bit(UNDER_RECLAIM, &page->private);
 
 	spin_lock_init(&zhdr->page_lock);
 	kref_init(&zhdr->refcount);
@@ -748,6 +750,10 @@ static void z3fold_free(struct z3fold_po
 		atomic64_dec(&pool->pages_nr);
 		return;
 	}
+	if (test_bit(UNDER_RECLAIM, &page->private)) {
+		z3fold_page_unlock(zhdr);
+		return;
+	}
 	if (test_and_set_bit(NEEDS_COMPACTING, &page->private)) {
 		z3fold_page_unlock(zhdr);
 		return;
@@ -832,6 +838,8 @@ static int z3fold_reclaim_page(struct z3
 			kref_get(&zhdr->refcount);
 			list_del_init(&zhdr->buddy);
 			zhdr->cpu = -1;
+			set_bit(UNDER_RECLAIM, &page->private);
+			break;
 		}
 
 		list_del_init(&page->lru);
@@ -879,25 +887,35 @@ static int z3fold_reclaim_page(struct z3
 				goto next;
 		}
 next:
-		spin_lock(&pool->lock);
 		if (test_bit(PAGE_HEADLESS, &page->private)) {
 			if (ret == 0) {
-				spin_unlock(&pool->lock);
 				free_z3fold_page(page);
 				return 0;
 			}
-		} else if (kref_put(&zhdr->refcount, release_z3fold_page)) {
-			atomic64_dec(&pool->pages_nr);
+			spin_lock(&pool->lock);
+			list_add(&page->lru, &pool->lru);
 			spin_unlock(&pool->lock);
-			return 0;
+		} else {
+			z3fold_page_lock(zhdr);
+			clear_bit(UNDER_RECLAIM, &page->private);
+			if (kref_put(&zhdr->refcount,
+					release_z3fold_page_locked)) {
+				atomic64_dec(&pool->pages_nr);
+				return 0;
+			}
+			/*
+			 * if we are here, the page is still not completely
+			 * free. Take the global pool lock then to be able
+			 * to add it back to the lru list
+			 */
+			spin_lock(&pool->lock);
+			list_add(&page->lru, &pool->lru);
+			spin_unlock(&pool->lock);
+			z3fold_page_unlock(zhdr);
 		}
 
-		/*
-		 * Add to the beginning of LRU.
-		 * Pool lock has to be kept here to ensure the page has
-		 * not already been released
-		 */
-		list_add(&page->lru, &pool->lru);
+		/* We started off locked to we need to lock the pool back */
+		spin_lock(&pool->lock);
 	}
 	spin_unlock(&pool->lock);
 	return -EAGAIN;
diff -druNp --no-dereference linux-libre-4.16.8-gnu/net/atm/lec.c linux-libre-4.16.9-gnu/net/atm/lec.c
--- linux-libre-4.16.8-gnu/net/atm/lec.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/net/atm/lec.c	2018-05-16 04:12:36.000000000 -0400
@@ -41,6 +41,9 @@ static unsigned char bridge_ula_lec[] =
 #include <linux/module.h>
 #include <linux/init.h>
 
+/* Hardening for Spectre-v1 */
+#include <linux/nospec.h>
+
 #include "lec.h"
 #include "lec_arpc.h"
 #include "resources.h"
@@ -687,8 +690,10 @@ static int lec_vcc_attach(struct atm_vcc
 	bytes_left = copy_from_user(&ioc_data, arg, sizeof(struct atmlec_ioc));
 	if (bytes_left != 0)
 		pr_info("copy from user failed for %d bytes\n", bytes_left);
-	if (ioc_data.dev_num < 0 || ioc_data.dev_num >= MAX_LEC_ITF ||
-	    !dev_lec[ioc_data.dev_num])
+	if (ioc_data.dev_num < 0 || ioc_data.dev_num >= MAX_LEC_ITF)
+		return -EINVAL;
+	ioc_data.dev_num = array_index_nospec(ioc_data.dev_num, MAX_LEC_ITF);
+	if (!dev_lec[ioc_data.dev_num])
 		return -EINVAL;
 	vpriv = kmalloc(sizeof(struct lec_vcc_priv), GFP_KERNEL);
 	if (!vpriv)
diff -druNp --no-dereference linux-libre-4.16.8-gnu/net/bridge/netfilter/ebtables.c linux-libre-4.16.9-gnu/net/bridge/netfilter/ebtables.c
--- linux-libre-4.16.8-gnu/net/bridge/netfilter/ebtables.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/net/bridge/netfilter/ebtables.c	2018-05-16 04:12:36.000000000 -0400
@@ -1821,13 +1821,14 @@ static int compat_table_info(const struc
 {
 	unsigned int size = info->entries_size;
 	const void *entries = info->entries;
-	int ret;
 
 	newinfo->entries_size = size;
-
-	ret = xt_compat_init_offsets(NFPROTO_BRIDGE, info->nentries);
-	if (ret)
-		return ret;
+	if (info->nentries) {
+		int ret = xt_compat_init_offsets(NFPROTO_BRIDGE,
+						 info->nentries);
+		if (ret)
+			return ret;
+	}
 
 	return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
 							entries, newinfo);
diff -druNp --no-dereference linux-libre-4.16.8-gnu/net/core/dev_addr_lists.c linux-libre-4.16.9-gnu/net/core/dev_addr_lists.c
--- linux-libre-4.16.8-gnu/net/core/dev_addr_lists.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/net/core/dev_addr_lists.c	2018-05-16 04:12:36.000000000 -0400
@@ -57,8 +57,8 @@ static int __hw_addr_add_ex(struct netde
 		return -EINVAL;
 
 	list_for_each_entry(ha, &list->list, list) {
-		if (!memcmp(ha->addr, addr, addr_len) &&
-		    ha->type == addr_type) {
+		if (ha->type == addr_type &&
+		    !memcmp(ha->addr, addr, addr_len)) {
 			if (global) {
 				/* check if addr is already used as global */
 				if (ha->global_use)
diff -druNp --no-dereference linux-libre-4.16.8-gnu/net/core/skbuff.c linux-libre-4.16.9-gnu/net/core/skbuff.c
--- linux-libre-4.16.8-gnu/net/core/skbuff.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/net/core/skbuff.c	2018-05-16 04:12:36.000000000 -0400
@@ -857,6 +857,7 @@ static struct sk_buff *__skb_clone(struc
 	n->hdr_len = skb->nohdr ? skb_headroom(skb) : skb->hdr_len;
 	n->cloned = 1;
 	n->nohdr = 0;
+	n->peeked = 0;
 	n->destructor = NULL;
 	C(tail);
 	C(end);
diff -druNp --no-dereference linux-libre-4.16.8-gnu/net/dccp/ipv4.c linux-libre-4.16.9-gnu/net/dccp/ipv4.c
--- linux-libre-4.16.8-gnu/net/dccp/ipv4.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/net/dccp/ipv4.c	2018-05-16 04:12:36.000000000 -0400
@@ -614,6 +614,7 @@ int dccp_v4_conn_request(struct sock *sk
 	ireq = inet_rsk(req);
 	sk_rcv_saddr_set(req_to_sk(req), ip_hdr(skb)->daddr);
 	sk_daddr_set(req_to_sk(req), ip_hdr(skb)->saddr);
+	ireq->ir_mark = inet_request_mark(sk, skb);
 	ireq->ireq_family = AF_INET;
 	ireq->ir_iif = sk->sk_bound_dev_if;
 
diff -druNp --no-dereference linux-libre-4.16.8-gnu/net/dccp/ipv6.c linux-libre-4.16.9-gnu/net/dccp/ipv6.c
--- linux-libre-4.16.8-gnu/net/dccp/ipv6.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/net/dccp/ipv6.c	2018-05-16 04:12:36.000000000 -0400
@@ -351,6 +351,7 @@ static int dccp_v6_conn_request(struct s
 	ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
 	ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
 	ireq->ireq_family = AF_INET6;
+	ireq->ir_mark = inet_request_mark(sk, skb);
 
 	if (ipv6_opt_accepted(sk, skb, IP6CB(skb)) ||
 	    np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
diff -druNp --no-dereference linux-libre-4.16.8-gnu/net/ipv4/inetpeer.c linux-libre-4.16.9-gnu/net/ipv4/inetpeer.c
--- linux-libre-4.16.8-gnu/net/ipv4/inetpeer.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/net/ipv4/inetpeer.c	2018-05-16 04:12:36.000000000 -0400
@@ -210,6 +210,7 @@ struct inet_peer *inet_getpeer(struct in
 		p = kmem_cache_alloc(peer_cachep, GFP_ATOMIC);
 		if (p) {
 			p->daddr = *daddr;
+			p->dtime = (__u32)jiffies;
 			refcount_set(&p->refcnt, 2);
 			atomic_set(&p->rid, 0);
 			p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW;
diff -druNp --no-dereference linux-libre-4.16.8-gnu/net/ipv4/inet_timewait_sock.c linux-libre-4.16.9-gnu/net/ipv4/inet_timewait_sock.c
--- linux-libre-4.16.8-gnu/net/ipv4/inet_timewait_sock.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/net/ipv4/inet_timewait_sock.c	2018-05-16 04:12:36.000000000 -0400
@@ -178,6 +178,7 @@ struct inet_timewait_sock *inet_twsk_all
 		tw->tw_dport	    = inet->inet_dport;
 		tw->tw_family	    = sk->sk_family;
 		tw->tw_reuse	    = sk->sk_reuse;
+		tw->tw_reuseport    = sk->sk_reuseport;
 		tw->tw_hash	    = sk->sk_hash;
 		tw->tw_ipv6only	    = 0;
 		tw->tw_transparent  = inet->transparent;
diff -druNp --no-dereference linux-libre-4.16.8-gnu/net/ipv4/route.c linux-libre-4.16.9-gnu/net/ipv4/route.c
--- linux-libre-4.16.8-gnu/net/ipv4/route.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/net/ipv4/route.c	2018-05-16 04:12:36.000000000 -0400
@@ -2306,13 +2306,14 @@ struct rtable *ip_route_output_key_hash(
 					const struct sk_buff *skb)
 {
 	__u8 tos = RT_FL_TOS(fl4);
-	struct fib_result res;
+	struct fib_result res = {
+		.type		= RTN_UNSPEC,
+		.fi		= NULL,
+		.table		= NULL,
+		.tclassid	= 0,
+	};
 	struct rtable *rth;
 
-	res.tclassid	= 0;
-	res.fi		= NULL;
-	res.table	= NULL;
-
 	fl4->flowi4_iif = LOOPBACK_IFINDEX;
 	fl4->flowi4_tos = tos & IPTOS_RT_MASK;
 	fl4->flowi4_scope = ((tos & RTO_ONLINK) ?
diff -druNp --no-dereference linux-libre-4.16.8-gnu/net/ipv4/tcp.c linux-libre-4.16.9-gnu/net/ipv4/tcp.c
--- linux-libre-4.16.8-gnu/net/ipv4/tcp.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/net/ipv4/tcp.c	2018-05-16 04:12:36.000000000 -0400
@@ -2690,7 +2690,7 @@ static int do_tcp_setsockopt(struct sock
 	case TCP_REPAIR_QUEUE:
 		if (!tp->repair)
 			err = -EPERM;
-		else if (val < TCP_QUEUES_NR)
+		else if ((unsigned int)val < TCP_QUEUES_NR)
 			tp->repair_queue = val;
 		else
 			err = -EINVAL;
diff -druNp --no-dereference linux-libre-4.16.8-gnu/net/kcm/kcmsock.c linux-libre-4.16.9-gnu/net/kcm/kcmsock.c
--- linux-libre-4.16.8-gnu/net/kcm/kcmsock.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/net/kcm/kcmsock.c	2018-05-16 04:12:36.000000000 -0400
@@ -1425,6 +1425,7 @@ static int kcm_attach(struct socket *soc
 	 */
 	if (csk->sk_user_data) {
 		write_unlock_bh(&csk->sk_callback_lock);
+		strp_stop(&psock->strp);
 		strp_done(&psock->strp);
 		kmem_cache_free(kcm_psockp, psock);
 		err = -EALREADY;
diff -druNp --no-dereference linux-libre-4.16.8-gnu/net/netfilter/ipvs/ip_vs_ctl.c linux-libre-4.16.9-gnu/net/netfilter/ipvs/ip_vs_ctl.c
--- linux-libre-4.16.8-gnu/net/netfilter/ipvs/ip_vs_ctl.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/net/netfilter/ipvs/ip_vs_ctl.c	2018-05-16 04:12:36.000000000 -0400
@@ -2384,11 +2384,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cm
 			strlcpy(cfg.mcast_ifn, dm->mcast_ifn,
 				sizeof(cfg.mcast_ifn));
 			cfg.syncid = dm->syncid;
-			rtnl_lock();
-			mutex_lock(&ipvs->sync_mutex);
 			ret = start_sync_thread(ipvs, &cfg, dm->state);
-			mutex_unlock(&ipvs->sync_mutex);
-			rtnl_unlock();
 		} else {
 			mutex_lock(&ipvs->sync_mutex);
 			ret = stop_sync_thread(ipvs, dm->state);
@@ -3481,12 +3477,8 @@ static int ip_vs_genl_new_daemon(struct
 	if (ipvs->mixed_address_family_dests > 0)
 		return -EINVAL;
 
-	rtnl_lock();
-	mutex_lock(&ipvs->sync_mutex);
 	ret = start_sync_thread(ipvs, &c,
 				nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]));
-	mutex_unlock(&ipvs->sync_mutex);
-	rtnl_unlock();
 	return ret;
 }
 
diff -druNp --no-dereference linux-libre-4.16.8-gnu/net/netfilter/ipvs/ip_vs_sync.c linux-libre-4.16.9-gnu/net/netfilter/ipvs/ip_vs_sync.c
--- linux-libre-4.16.8-gnu/net/netfilter/ipvs/ip_vs_sync.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/net/netfilter/ipvs/ip_vs_sync.c	2018-05-16 04:12:36.000000000 -0400
@@ -49,6 +49,7 @@
 #include <linux/kthread.h>
 #include <linux/wait.h>
 #include <linux/kernel.h>
+#include <linux/sched/signal.h>
 
 #include <asm/unaligned.h>		/* Used for ntoh_seq and hton_seq */
 
@@ -1360,15 +1361,9 @@ static void set_mcast_pmtudisc(struct so
 /*
  *      Specifiy default interface for outgoing multicasts
  */
-static int set_mcast_if(struct sock *sk, char *ifname)
+static int set_mcast_if(struct sock *sk, struct net_device *dev)
 {
-	struct net_device *dev;
 	struct inet_sock *inet = inet_sk(sk);
-	struct net *net = sock_net(sk);
-
-	dev = __dev_get_by_name(net, ifname);
-	if (!dev)
-		return -ENODEV;
 
 	if (sk->sk_bound_dev_if && dev->ifindex != sk->sk_bound_dev_if)
 		return -EINVAL;
@@ -1396,19 +1391,14 @@ static int set_mcast_if(struct sock *sk,
  *      in the in_addr structure passed in as a parameter.
  */
 static int
-join_mcast_group(struct sock *sk, struct in_addr *addr, char *ifname)
+join_mcast_group(struct sock *sk, struct in_addr *addr, struct net_device *dev)
 {
-	struct net *net = sock_net(sk);
 	struct ip_mreqn mreq;
-	struct net_device *dev;
 	int ret;
 
 	memset(&mreq, 0, sizeof(mreq));
 	memcpy(&mreq.imr_multiaddr, addr, sizeof(struct in_addr));
 
-	dev = __dev_get_by_name(net, ifname);
-	if (!dev)
-		return -ENODEV;
 	if (sk->sk_bound_dev_if && dev->ifindex != sk->sk_bound_dev_if)
 		return -EINVAL;
 
@@ -1423,15 +1413,10 @@ join_mcast_group(struct sock *sk, struct
 
 #ifdef CONFIG_IP_VS_IPV6
 static int join_mcast_group6(struct sock *sk, struct in6_addr *addr,
-			     char *ifname)
+			     struct net_device *dev)
 {
-	struct net *net = sock_net(sk);
-	struct net_device *dev;
 	int ret;
 
-	dev = __dev_get_by_name(net, ifname);
-	if (!dev)
-		return -ENODEV;
 	if (sk->sk_bound_dev_if && dev->ifindex != sk->sk_bound_dev_if)
 		return -EINVAL;
 
@@ -1443,24 +1428,18 @@ static int join_mcast_group6(struct sock
 }
 #endif
 
-static int bind_mcastif_addr(struct socket *sock, char *ifname)
+static int bind_mcastif_addr(struct socket *sock, struct net_device *dev)
 {
-	struct net *net = sock_net(sock->sk);
-	struct net_device *dev;
 	__be32 addr;
 	struct sockaddr_in sin;
 
-	dev = __dev_get_by_name(net, ifname);
-	if (!dev)
-		return -ENODEV;
-
 	addr = inet_select_addr(dev, 0, RT_SCOPE_UNIVERSE);
 	if (!addr)
 		pr_err("You probably need to specify IP address on "
 		       "multicast interface.\n");
 
 	IP_VS_DBG(7, "binding socket with (%s) %pI4\n",
-		  ifname, &addr);
+		  dev->name, &addr);
 
 	/* Now bind the socket with the address of multicast interface */
 	sin.sin_family	     = AF_INET;
@@ -1493,7 +1472,8 @@ static void get_mcast_sockaddr(union ipv
 /*
  *      Set up sending multicast socket over UDP
  */
-static struct socket *make_send_sock(struct netns_ipvs *ipvs, int id)
+static int make_send_sock(struct netns_ipvs *ipvs, int id,
+			  struct net_device *dev, struct socket **sock_ret)
 {
 	/* multicast addr */
 	union ipvs_sockaddr mcast_addr;
@@ -1505,9 +1485,10 @@ static struct socket *make_send_sock(str
 				  IPPROTO_UDP, &sock);
 	if (result < 0) {
 		pr_err("Error during creation of socket; terminating\n");
-		return ERR_PTR(result);
+		goto error;
 	}
-	result = set_mcast_if(sock->sk, ipvs->mcfg.mcast_ifn);
+	*sock_ret = sock;
+	result = set_mcast_if(sock->sk, dev);
 	if (result < 0) {
 		pr_err("Error setting outbound mcast interface\n");
 		goto error;
@@ -1522,7 +1503,7 @@ static struct socket *make_send_sock(str
 		set_sock_size(sock->sk, 1, result);
 
 	if (AF_INET == ipvs->mcfg.mcast_af)
-		result = bind_mcastif_addr(sock, ipvs->mcfg.mcast_ifn);
+		result = bind_mcastif_addr(sock, dev);
 	else
 		result = 0;
 	if (result < 0) {
@@ -1538,19 +1519,18 @@ static struct socket *make_send_sock(str
 		goto error;
 	}
 
-	return sock;
+	return 0;
 
 error:
-	sock_release(sock);
-	return ERR_PTR(result);
+	return result;
 }
 
 
 /*
  *      Set up receiving multicast socket over UDP
  */
-static struct socket *make_receive_sock(struct netns_ipvs *ipvs, int id,
-					int ifindex)
+static int make_receive_sock(struct netns_ipvs *ipvs, int id,
+			     struct net_device *dev, struct socket **sock_ret)
 {
 	/* multicast addr */
 	union ipvs_sockaddr mcast_addr;
@@ -1562,8 +1542,9 @@ static struct socket *make_receive_sock(
 				  IPPROTO_UDP, &sock);
 	if (result < 0) {
 		pr_err("Error during creation of socket; terminating\n");
-		return ERR_PTR(result);
+		goto error;
 	}
+	*sock_ret = sock;
 	/* it is equivalent to the REUSEADDR option in user-space */
 	sock->sk->sk_reuse = SK_CAN_REUSE;
 	result = sysctl_sync_sock_size(ipvs);
@@ -1571,7 +1552,7 @@ static struct socket *make_receive_sock(
 		set_sock_size(sock->sk, 0, result);
 
 	get_mcast_sockaddr(&mcast_addr, &salen, &ipvs->bcfg, id);
-	sock->sk->sk_bound_dev_if = ifindex;
+	sock->sk->sk_bound_dev_if = dev->ifindex;
 	result = sock->ops->bind(sock, (struct sockaddr *)&mcast_addr, salen);
 	if (result < 0) {
 		pr_err("Error binding to the multicast addr\n");
@@ -1582,21 +1563,20 @@ static struct socket *make_receive_sock(
 #ifdef CONFIG_IP_VS_IPV6
 	if (ipvs->bcfg.mcast_af == AF_INET6)
 		result = join_mcast_group6(sock->sk, &mcast_addr.in6.sin6_addr,
-					   ipvs->bcfg.mcast_ifn);
+					   dev);
 	else
 #endif
 		result = join_mcast_group(sock->sk, &mcast_addr.in.sin_addr,
-					  ipvs->bcfg.mcast_ifn);
+					  dev);
 	if (result < 0) {
 		pr_err("Error joining to the multicast group\n");
 		goto error;
 	}
 
-	return sock;
+	return 0;
 
 error:
-	sock_release(sock);
-	return ERR_PTR(result);
+	return result;
 }
 
 
@@ -1778,13 +1758,12 @@ static int sync_thread_backup(void *data
 int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
 		      int state)
 {
-	struct ip_vs_sync_thread_data *tinfo;
+	struct ip_vs_sync_thread_data *tinfo = NULL;
 	struct task_struct **array = NULL, *task;
-	struct socket *sock;
 	struct net_device *dev;
 	char *name;
 	int (*threadfn)(void *data);
-	int id, count, hlen;
+	int id = 0, count, hlen;
 	int result = -ENOMEM;
 	u16 mtu, min_mtu;
 
@@ -1792,6 +1771,18 @@ int start_sync_thread(struct netns_ipvs
 	IP_VS_DBG(7, "Each ip_vs_sync_conn entry needs %zd bytes\n",
 		  sizeof(struct ip_vs_sync_conn_v0));
 
+	/* Do not hold one mutex and then to block on another */
+	for (;;) {
+		rtnl_lock();
+		if (mutex_trylock(&ipvs->sync_mutex))
+			break;
+		rtnl_unlock();
+		mutex_lock(&ipvs->sync_mutex);
+		if (rtnl_trylock())
+			break;
+		mutex_unlock(&ipvs->sync_mutex);
+	}
+
 	if (!ipvs->sync_state) {
 		count = clamp(sysctl_sync_ports(ipvs), 1, IPVS_SYNC_PORTS_MAX);
 		ipvs->threads_mask = count - 1;
@@ -1810,7 +1801,8 @@ int start_sync_thread(struct netns_ipvs
 	dev = __dev_get_by_name(ipvs->net, c->mcast_ifn);
 	if (!dev) {
 		pr_err("Unknown mcast interface: %s\n", c->mcast_ifn);
-		return -ENODEV;
+		result = -ENODEV;
+		goto out_early;
 	}
 	hlen = (AF_INET6 == c->mcast_af) ?
 	       sizeof(struct ipv6hdr) + sizeof(struct udphdr) :
@@ -1827,26 +1819,30 @@ int start_sync_thread(struct netns_ipvs
 		c->sync_maxlen = mtu - hlen;
 
 	if (state == IP_VS_STATE_MASTER) {
+		result = -EEXIST;
 		if (ipvs->ms)
-			return -EEXIST;
+			goto out_early;
 
 		ipvs->mcfg = *c;
 		name = "ipvs-m:%d:%d";
 		threadfn = sync_thread_master;
 	} else if (state == IP_VS_STATE_BACKUP) {
+		result = -EEXIST;
 		if (ipvs->backup_threads)
-			return -EEXIST;
+			goto out_early;
 
 		ipvs->bcfg = *c;
 		name = "ipvs-b:%d:%d";
 		threadfn = sync_thread_backup;
 	} else {
-		return -EINVAL;
+		result = -EINVAL;
+		goto out_early;
 	}
 
 	if (state == IP_VS_STATE_MASTER) {
 		struct ipvs_master_sync_state *ms;
 
+		result = -ENOMEM;
 		ipvs->ms = kcalloc(count, sizeof(ipvs->ms[0]), GFP_KERNEL);
 		if (!ipvs->ms)
 			goto out;
@@ -1862,39 +1858,38 @@ int start_sync_thread(struct netns_ipvs
 	} else {
 		array = kcalloc(count, sizeof(struct task_struct *),
 				GFP_KERNEL);
+		result = -ENOMEM;
 		if (!array)
 			goto out;
 	}
 
-	tinfo = NULL;
 	for (id = 0; id < count; id++) {
-		if (state == IP_VS_STATE_MASTER)
-			sock = make_send_sock(ipvs, id);
-		else
-			sock = make_receive_sock(ipvs, id, dev->ifindex);
-		if (IS_ERR(sock)) {
-			result = PTR_ERR(sock);
-			goto outtinfo;
-		}
+		result = -ENOMEM;
 		tinfo = kmalloc(sizeof(*tinfo), GFP_KERNEL);
 		if (!tinfo)
-			goto outsocket;
+			goto out;
 		tinfo->ipvs = ipvs;
-		tinfo->sock = sock;
+		tinfo->sock = NULL;
 		if (state == IP_VS_STATE_BACKUP) {
 			tinfo->buf = kmalloc(ipvs->bcfg.sync_maxlen,
 					     GFP_KERNEL);
 			if (!tinfo->buf)
-				goto outtinfo;
+				goto out;
 		} else {
 			tinfo->buf = NULL;
 		}
 		tinfo->id = id;
+		if (state == IP_VS_STATE_MASTER)
+			result = make_send_sock(ipvs, id, dev, &tinfo->sock);
+		else
+			result = make_receive_sock(ipvs, id, dev, &tinfo->sock);
+		if (result < 0)
+			goto out;
 
 		task = kthread_run(threadfn, tinfo, name, ipvs->gen, id);
 		if (IS_ERR(task)) {
 			result = PTR_ERR(task);
-			goto outtinfo;
+			goto out;
 		}
 		tinfo = NULL;
 		if (state == IP_VS_STATE_MASTER)
@@ -1911,20 +1906,20 @@ int start_sync_thread(struct netns_ipvs
 	ipvs->sync_state |= state;
 	spin_unlock_bh(&ipvs->sync_buff_lock);
 
+	mutex_unlock(&ipvs->sync_mutex);
+	rtnl_unlock();
+
 	/* increase the module use count */
 	ip_vs_use_count_inc();
 
 	return 0;
 
-outsocket:
-	sock_release(sock);
-
-outtinfo:
-	if (tinfo) {
-		sock_release(tinfo->sock);
-		kfree(tinfo->buf);
-		kfree(tinfo);
-	}
+out:
+	/* We do not need RTNL lock anymore, release it here so that
+	 * sock_release below and in the kthreads can use rtnl_lock
+	 * to leave the mcast group.
+	 */
+	rtnl_unlock();
 	count = id;
 	while (count-- > 0) {
 		if (state == IP_VS_STATE_MASTER)
@@ -1932,13 +1927,23 @@ outtinfo:
 		else
 			kthread_stop(array[count]);
 	}
-	kfree(array);
-
-out:
 	if (!(ipvs->sync_state & IP_VS_STATE_MASTER)) {
 		kfree(ipvs->ms);
 		ipvs->ms = NULL;
 	}
+	mutex_unlock(&ipvs->sync_mutex);
+	if (tinfo) {
+		if (tinfo->sock)
+			sock_release(tinfo->sock);
+		kfree(tinfo->buf);
+		kfree(tinfo);
+	}
+	kfree(array);
+	return result;
+
+out_early:
+	mutex_unlock(&ipvs->sync_mutex);
+	rtnl_unlock();
 	return result;
 }
 
diff -druNp --no-dereference linux-libre-4.16.8-gnu/net/netlink/af_netlink.c linux-libre-4.16.9-gnu/net/netlink/af_netlink.c
--- linux-libre-4.16.8-gnu/net/netlink/af_netlink.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/net/netlink/af_netlink.c	2018-05-16 04:12:36.000000000 -0400
@@ -1845,6 +1845,8 @@ static int netlink_sendmsg(struct socket
 
 	if (msg->msg_namelen) {
 		err = -EINVAL;
+		if (msg->msg_namelen < sizeof(struct sockaddr_nl))
+			goto out;
 		if (addr->nl_family != AF_NETLINK)
 			goto out;
 		dst_portid = addr->nl_pid;
diff -druNp --no-dereference linux-libre-4.16.8-gnu/net/rds/tcp.c linux-libre-4.16.9-gnu/net/rds/tcp.c
--- linux-libre-4.16.8-gnu/net/rds/tcp.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/net/rds/tcp.c	2018-05-16 04:12:36.000000000 -0400
@@ -275,13 +275,14 @@ static int rds_tcp_laddr_check(struct ne
 static void rds_tcp_conn_free(void *arg)
 {
 	struct rds_tcp_connection *tc = arg;
+	unsigned long flags;
 
 	rdsdebug("freeing tc %p\n", tc);
 
-	spin_lock_bh(&rds_tcp_conn_lock);
+	spin_lock_irqsave(&rds_tcp_conn_lock, flags);
 	if (!tc->t_tcp_node_detached)
 		list_del(&tc->t_tcp_node);
-	spin_unlock_bh(&rds_tcp_conn_lock);
+	spin_unlock_irqrestore(&rds_tcp_conn_lock, flags);
 
 	kmem_cache_free(rds_tcp_conn_slab, tc);
 }
@@ -311,13 +312,13 @@ static int rds_tcp_conn_alloc(struct rds
 		rdsdebug("rds_conn_path [%d] tc %p\n", i,
 			 conn->c_path[i].cp_transport_data);
 	}
-	spin_lock_bh(&rds_tcp_conn_lock);
+	spin_lock_irq(&rds_tcp_conn_lock);
 	for (i = 0; i < RDS_MPATH_WORKERS; i++) {
 		tc = conn->c_path[i].cp_transport_data;
 		tc->t_tcp_node_detached = false;
 		list_add_tail(&tc->t_tcp_node, &rds_tcp_conn_list);
 	}
-	spin_unlock_bh(&rds_tcp_conn_lock);
+	spin_unlock_irq(&rds_tcp_conn_lock);
 fail:
 	if (ret) {
 		for (j = 0; j < i; j++)
@@ -529,7 +530,7 @@ static void rds_tcp_kill_sock(struct net
 
 	rtn->rds_tcp_listen_sock = NULL;
 	rds_tcp_listen_stop(lsock, &rtn->rds_tcp_accept_w);
-	spin_lock_bh(&rds_tcp_conn_lock);
+	spin_lock_irq(&rds_tcp_conn_lock);
 	list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) {
 		struct net *c_net = read_pnet(&tc->t_cpath->cp_conn->c_net);
 
@@ -542,7 +543,7 @@ static void rds_tcp_kill_sock(struct net
 			tc->t_tcp_node_detached = true;
 		}
 	}
-	spin_unlock_bh(&rds_tcp_conn_lock);
+	spin_unlock_irq(&rds_tcp_conn_lock);
 	list_for_each_entry_safe(tc, _tc, &tmp_list, t_tcp_node)
 		rds_conn_destroy(tc->t_cpath->cp_conn);
 }
@@ -590,7 +591,7 @@ static void rds_tcp_sysctl_reset(struct
 {
 	struct rds_tcp_connection *tc, *_tc;
 
-	spin_lock_bh(&rds_tcp_conn_lock);
+	spin_lock_irq(&rds_tcp_conn_lock);
 	list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) {
 		struct net *c_net = read_pnet(&tc->t_cpath->cp_conn->c_net);
 
@@ -600,7 +601,7 @@ static void rds_tcp_sysctl_reset(struct
 		/* reconnect with new parameters */
 		rds_conn_path_drop(tc->t_cpath, false);
 	}
-	spin_unlock_bh(&rds_tcp_conn_lock);
+	spin_unlock_irq(&rds_tcp_conn_lock);
 }
 
 static int rds_tcp_skbuf_handler(struct ctl_table *ctl, int write,
diff -druNp --no-dereference linux-libre-4.16.8-gnu/net/rfkill/rfkill-gpio.c linux-libre-4.16.9-gnu/net/rfkill/rfkill-gpio.c
--- linux-libre-4.16.8-gnu/net/rfkill/rfkill-gpio.c	2018-05-09 03:53:14.000000000 -0400
+++ linux-libre-4.16.9-gnu/net/rfkill/rfkill-gpio.c	2018-05-16 04:12:36.000000000 -0400
@@ -137,13 +137,18 @@ static int rfkill_gpio_probe(struct plat
 
 	ret = rfkill_register(rfkill->rfkill_dev);
 	if (ret < 0)
-		return ret;
+		goto err_destroy;
 
 	platform_set_drvdata(pdev, rfkill);
 
 	dev_info(&pdev->dev, "%s device registered.\n", rfkill->name);
 
 	return 0;
+
+err_destroy:
+	rfkill_destroy(rfkill->rfkill_dev);
+
+	return ret;
 }
 
 static int rfkill_gpio_remove(struct platform_device *pdev)
