diff -druNp --no-dereference linux-libre-4.4.187-gnu/arch/arm/boot/dts/rk3288.dtsi linux-libre-4.4.188-gnu/arch/arm/boot/dts/rk3288.dtsi
--- linux-libre-4.4.187-gnu/arch/arm/boot/dts/rk3288.dtsi	2019-08-04 03:35:02.000000000 -0400
+++ linux-libre-4.4.188-gnu/arch/arm/boot/dts/rk3288.dtsi	2019-08-06 12:28:29.000000000 -0400
@@ -205,6 +205,7 @@
 			     <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>,
 			     <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>;
 		clock-frequency = <24000000>;
+		arm,no-tick-in-suspend;
 	};
 
 	timer: timer@ff810000 {
diff -druNp --no-dereference linux-libre-4.4.187-gnu/arch/arm/mach-rpc/dma.c linux-libre-4.4.188-gnu/arch/arm/mach-rpc/dma.c
--- linux-libre-4.4.187-gnu/arch/arm/mach-rpc/dma.c	2019-08-04 03:35:02.000000000 -0400
+++ linux-libre-4.4.188-gnu/arch/arm/mach-rpc/dma.c	2019-08-06 12:28:29.000000000 -0400
@@ -131,7 +131,7 @@ static irqreturn_t iomd_dma_handle(int i
 	} while (1);
 
 	idma->state = ~DMA_ST_AB;
-	disable_irq(irq);
+	disable_irq_nosync(irq);
 
 	return IRQ_HANDLED;
 }
@@ -174,6 +174,9 @@ static void iomd_enable_dma(unsigned int
 				DMA_FROM_DEVICE : DMA_TO_DEVICE);
 		}
 
+		idma->dma_addr = idma->dma.sg->dma_address;
+		idma->dma_len = idma->dma.sg->length;
+
 		iomd_writeb(DMA_CR_C, dma_base + CR);
 		idma->state = DMA_ST_AB;
 	}
diff -druNp --no-dereference linux-libre-4.4.187-gnu/arch/mips/lantiq/irq.c linux-libre-4.4.188-gnu/arch/mips/lantiq/irq.c
--- linux-libre-4.4.187-gnu/arch/mips/lantiq/irq.c	2019-08-04 03:35:02.000000000 -0400
+++ linux-libre-4.4.188-gnu/arch/mips/lantiq/irq.c	2019-08-06 12:28:29.000000000 -0400
@@ -160,8 +160,9 @@ static int ltq_eiu_settype(struct irq_da
 			if (edge)
 				irq_set_handler(d->hwirq, handle_edge_irq);
 
-			ltq_eiu_w32(ltq_eiu_r32(LTQ_EIU_EXIN_C) |
-				(val << (i * 4)), LTQ_EIU_EXIN_C);
+			ltq_eiu_w32((ltq_eiu_r32(LTQ_EIU_EXIN_C) &
+				    (~(7 << (i * 4)))) | (val << (i * 4)),
+				    LTQ_EIU_EXIN_C);
 		}
 	}
 
diff -druNp --no-dereference linux-libre-4.4.187-gnu/arch/x86/include/asm/apic.h linux-libre-4.4.188-gnu/arch/x86/include/asm/apic.h
--- linux-libre-4.4.187-gnu/arch/x86/include/asm/apic.h	2019-08-04 03:35:02.000000000 -0400
+++ linux-libre-4.4.188-gnu/arch/x86/include/asm/apic.h	2019-08-06 12:28:29.000000000 -0400
@@ -44,7 +44,7 @@ static inline void generic_apic_probe(vo
 
 #ifdef CONFIG_X86_LOCAL_APIC
 
-extern unsigned int apic_verbosity;
+extern int apic_verbosity;
 extern int local_apic_timer_c2_ok;
 
 extern int disable_apic;
diff -druNp --no-dereference linux-libre-4.4.187-gnu/arch/x86/include/asm/kvm_host.h linux-libre-4.4.188-gnu/arch/x86/include/asm/kvm_host.h
--- linux-libre-4.4.187-gnu/arch/x86/include/asm/kvm_host.h	2019-08-04 03:35:02.000000000 -0400
+++ linux-libre-4.4.188-gnu/arch/x86/include/asm/kvm_host.h	2019-08-06 12:28:29.000000000 -0400
@@ -1184,25 +1184,29 @@ enum {
 #define kvm_arch_vcpu_memslots_id(vcpu) ((vcpu)->arch.hflags & HF_SMM_MASK ? 1 : 0)
 #define kvm_memslots_for_spte_role(kvm, role) __kvm_memslots(kvm, (role).smm)
 
+asmlinkage void __noreturn kvm_spurious_fault(void);
+
 /*
  * Hardware virtualization extension instructions may fault if a
  * reboot turns off virtualization while processes are running.
- * Trap the fault and ignore the instruction if that happens.
+ * Usually after catching the fault we just panic; during reboot
+ * instead the instruction is ignored.
  */
-asmlinkage void kvm_spurious_fault(void);
-
-#define ____kvm_handle_fault_on_reboot(insn, cleanup_insn)	\
-	"666: " insn "\n\t" \
-	"668: \n\t"                           \
-	".pushsection .fixup, \"ax\" \n" \
-	"667: \n\t" \
-	cleanup_insn "\n\t"		      \
-	"cmpb $0, kvm_rebooting \n\t"	      \
-	"jne 668b \n\t"      		      \
-	__ASM_SIZE(push) " $666b \n\t"	      \
-	"jmp kvm_spurious_fault \n\t"	      \
-	".popsection \n\t" \
-	_ASM_EXTABLE(666b, 667b)
+#define ____kvm_handle_fault_on_reboot(insn, cleanup_insn)		\
+	"666: \n\t"							\
+	insn "\n\t"							\
+	"jmp	668f \n\t"						\
+	"667: \n\t"							\
+	"call	kvm_spurious_fault \n\t"				\
+	"668: \n\t"							\
+	".pushsection .fixup, \"ax\" \n\t"				\
+	"700: \n\t"							\
+	cleanup_insn "\n\t"						\
+	"cmpb	$0, kvm_rebooting\n\t"					\
+	"je	667b \n\t"						\
+	"jmp	668b \n\t"						\
+	".popsection \n\t"						\
+	_ASM_EXTABLE(666b, 700b)
 
 #define __kvm_handle_fault_on_reboot(insn)		\
 	____kvm_handle_fault_on_reboot(insn, "")
diff -druNp --no-dereference linux-libre-4.4.187-gnu/arch/x86/kernel/apic/apic.c linux-libre-4.4.188-gnu/arch/x86/kernel/apic/apic.c
--- linux-libre-4.4.187-gnu/arch/x86/kernel/apic/apic.c	2019-08-04 03:35:02.000000000 -0400
+++ linux-libre-4.4.188-gnu/arch/x86/kernel/apic/apic.c	2019-08-06 12:28:29.000000000 -0400
@@ -171,7 +171,7 @@ int first_system_vector = FIRST_SYSTEM_V
 /*
  * Debug level, exported for io_apic.c
  */
-unsigned int apic_verbosity;
+int apic_verbosity;
 
 int pic_mode;
 
diff -druNp --no-dereference linux-libre-4.4.187-gnu/arch/x86/math-emu/fpu_emu.h linux-libre-4.4.188-gnu/arch/x86/math-emu/fpu_emu.h
--- linux-libre-4.4.187-gnu/arch/x86/math-emu/fpu_emu.h	2019-08-04 03:35:02.000000000 -0400
+++ linux-libre-4.4.188-gnu/arch/x86/math-emu/fpu_emu.h	2019-08-06 12:28:29.000000000 -0400
@@ -176,7 +176,7 @@ static inline void reg_copy(FPU_REG cons
 #define setexponentpos(x,y) { (*(short *)&((x)->exp)) = \
   ((y) + EXTENDED_Ebias) & 0x7fff; }
 #define exponent16(x)         (*(short *)&((x)->exp))
-#define setexponent16(x,y)  { (*(short *)&((x)->exp)) = (y); }
+#define setexponent16(x,y)  { (*(short *)&((x)->exp)) = (u16)(y); }
 #define addexponent(x,y)    { (*(short *)&((x)->exp)) += (y); }
 #define stdexp(x)           { (*(short *)&((x)->exp)) += EXTENDED_Ebias; }
 
diff -druNp --no-dereference linux-libre-4.4.187-gnu/arch/x86/math-emu/reg_constant.c linux-libre-4.4.188-gnu/arch/x86/math-emu/reg_constant.c
--- linux-libre-4.4.187-gnu/arch/x86/math-emu/reg_constant.c	2019-08-04 03:35:02.000000000 -0400
+++ linux-libre-4.4.188-gnu/arch/x86/math-emu/reg_constant.c	2019-08-06 12:28:29.000000000 -0400
@@ -17,7 +17,7 @@
 #include "control_w.h"
 
 #define MAKE_REG(s, e, l, h) { l, h, \
-		((EXTENDED_Ebias+(e)) | ((SIGN_##s != 0)*0x8000)) }
+		(u16)((EXTENDED_Ebias+(e)) | ((SIGN_##s != 0)*0x8000)) }
 
 FPU_REG const CONST_1 = MAKE_REG(POS, 0, 0x00000000, 0x80000000);
 #if 0
diff -druNp --no-dereference linux-libre-4.4.187-gnu/drivers/dma/sh/rcar-dmac.c linux-libre-4.4.188-gnu/drivers/dma/sh/rcar-dmac.c
--- linux-libre-4.4.187-gnu/drivers/dma/sh/rcar-dmac.c	2019-08-04 03:35:02.000000000 -0400
+++ linux-libre-4.4.188-gnu/drivers/dma/sh/rcar-dmac.c	2019-08-06 12:28:29.000000000 -0400
@@ -1030,7 +1030,7 @@ rcar_dmac_prep_slave_sg(struct dma_chan
 	dma_addr_t dev_addr;
 
 	/* Someone calling slave DMA on a generic channel? */
-	if (rchan->mid_rid < 0 || !sg_len) {
+	if (rchan->mid_rid < 0 || !sg_len || !sg_dma_len(sgl)) {
 		dev_warn(chan->device->dev,
 			 "%s: bad parameter: len=%d, id=%d\n",
 			 __func__, sg_len, rchan->mid_rid);
diff -druNp --no-dereference linux-libre-4.4.187-gnu/drivers/net/ethernet/emulex/benet/be_main.c linux-libre-4.4.188-gnu/drivers/net/ethernet/emulex/benet/be_main.c
--- linux-libre-4.4.187-gnu/drivers/net/ethernet/emulex/benet/be_main.c	2019-08-04 03:35:02.000000000 -0400
+++ linux-libre-4.4.188-gnu/drivers/net/ethernet/emulex/benet/be_main.c	2019-08-06 12:28:29.000000000 -0400
@@ -4307,8 +4307,12 @@ int be_update_queues(struct be_adapter *
 	struct net_device *netdev = adapter->netdev;
 	int status;
 
-	if (netif_running(netdev))
+	if (netif_running(netdev)) {
+		/* device cannot transmit now, avoid dev_watchdog timeouts */
+		netif_carrier_off(netdev);
+
 		be_close(netdev);
+	}
 
 	be_cancel_worker(adapter);
 
diff -druNp --no-dereference linux-libre-4.4.187-gnu/drivers/s390/block/dasd_alias.c linux-libre-4.4.188-gnu/drivers/s390/block/dasd_alias.c
--- linux-libre-4.4.187-gnu/drivers/s390/block/dasd_alias.c	2019-08-04 03:35:02.000000000 -0400
+++ linux-libre-4.4.188-gnu/drivers/s390/block/dasd_alias.c	2019-08-06 12:28:29.000000000 -0400
@@ -396,6 +396,20 @@ suborder_not_supported(struct dasd_ccw_r
 	char msg_format;
 	char msg_no;
 
+	/*
+	 * intrc values ENODEV, ENOLINK and EPERM
+	 * will be optained from sleep_on to indicate that no
+	 * IO operation can be started
+	 */
+	if (cqr->intrc == -ENODEV)
+		return 1;
+
+	if (cqr->intrc == -ENOLINK)
+		return 1;
+
+	if (cqr->intrc == -EPERM)
+		return 1;
+
 	sense = dasd_get_sense(&cqr->irb);
 	if (!sense)
 		return 0;
@@ -460,12 +474,8 @@ static int read_unit_address_configurati
 	lcu->flags &= ~NEED_UAC_UPDATE;
 	spin_unlock_irqrestore(&lcu->lock, flags);
 
-	do {
-		rc = dasd_sleep_on(cqr);
-		if (rc && suborder_not_supported(cqr))
-			return -EOPNOTSUPP;
-	} while (rc && (cqr->retries > 0));
-	if (rc) {
+	rc = dasd_sleep_on(cqr);
+	if (rc && !suborder_not_supported(cqr)) {
 		spin_lock_irqsave(&lcu->lock, flags);
 		lcu->flags |= NEED_UAC_UPDATE;
 		spin_unlock_irqrestore(&lcu->lock, flags);
diff -druNp --no-dereference linux-libre-4.4.187-gnu/drivers/s390/scsi/zfcp_erp.c linux-libre-4.4.188-gnu/drivers/s390/scsi/zfcp_erp.c
--- linux-libre-4.4.187-gnu/drivers/s390/scsi/zfcp_erp.c	2019-08-04 03:35:02.000000000 -0400
+++ linux-libre-4.4.188-gnu/drivers/s390/scsi/zfcp_erp.c	2019-08-06 12:28:29.000000000 -0400
@@ -10,6 +10,7 @@
 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
 
 #include <linux/kthread.h>
+#include <linux/bug.h>
 #include "zfcp_ext.h"
 #include "zfcp_reqlist.h"
 
@@ -244,6 +245,12 @@ static struct zfcp_erp_action *zfcp_erp_
 	struct zfcp_erp_action *erp_action;
 	struct zfcp_scsi_dev *zfcp_sdev;
 
+	if (WARN_ON_ONCE(need != ZFCP_ERP_ACTION_REOPEN_LUN &&
+			 need != ZFCP_ERP_ACTION_REOPEN_PORT &&
+			 need != ZFCP_ERP_ACTION_REOPEN_PORT_FORCED &&
+			 need != ZFCP_ERP_ACTION_REOPEN_ADAPTER))
+		return NULL;
+
 	switch (need) {
 	case ZFCP_ERP_ACTION_REOPEN_LUN:
 		zfcp_sdev = sdev_to_zfcp(sdev);
diff -druNp --no-dereference linux-libre-4.4.187-gnu/drivers/xen/swiotlb-xen.c linux-libre-4.4.188-gnu/drivers/xen/swiotlb-xen.c
--- linux-libre-4.4.187-gnu/drivers/xen/swiotlb-xen.c	2019-08-04 03:35:02.000000000 -0400
+++ linux-libre-4.4.188-gnu/drivers/xen/swiotlb-xen.c	2019-08-06 12:28:29.000000000 -0400
@@ -365,8 +365,8 @@ xen_swiotlb_free_coherent(struct device
 	/* Convert the size to actually allocated. */
 	size = 1UL << (order + XEN_PAGE_SHIFT);
 
-	if (((dev_addr + size - 1 <= dma_mask)) ||
-	    range_straddles_page_boundary(phys, size))
+	if (!WARN_ON((dev_addr + size - 1 > dma_mask) ||
+		     range_straddles_page_boundary(phys, size)))
 		xen_destroy_contiguous_region(phys, order);
 
 	xen_free_coherent_pages(hwdev, size, vaddr, (dma_addr_t)phys, attrs);
diff -druNp --no-dereference linux-libre-4.4.187-gnu/fs/adfs/super.c linux-libre-4.4.188-gnu/fs/adfs/super.c
--- linux-libre-4.4.187-gnu/fs/adfs/super.c	2019-08-04 03:35:02.000000000 -0400
+++ linux-libre-4.4.188-gnu/fs/adfs/super.c	2019-08-06 12:28:29.000000000 -0400
@@ -368,6 +368,7 @@ static int adfs_fill_super(struct super_
 	struct buffer_head *bh;
 	struct object_info root_obj;
 	unsigned char *b_data;
+	unsigned int blocksize;
 	struct adfs_sb_info *asb;
 	struct inode *root;
 	int ret = -EINVAL;
@@ -419,8 +420,10 @@ static int adfs_fill_super(struct super_
 		goto error_free_bh;
 	}
 
+	blocksize = 1 << dr->log2secsize;
 	brelse(bh);
-	if (sb_set_blocksize(sb, 1 << dr->log2secsize)) {
+
+	if (sb_set_blocksize(sb, blocksize)) {
 		bh = sb_bread(sb, ADFS_DISCRECORD / sb->s_blocksize);
 		if (!bh) {
 			adfs_error(sb, "couldn't read superblock on "
diff -druNp --no-dereference linux-libre-4.4.187-gnu/fs/btrfs/volumes.c linux-libre-4.4.188-gnu/fs/btrfs/volumes.c
--- linux-libre-4.4.187-gnu/fs/btrfs/volumes.c	2019-08-04 03:35:02.000000000 -0400
+++ linux-libre-4.4.188-gnu/fs/btrfs/volumes.c	2019-08-06 12:28:29.000000000 -0400
@@ -4942,8 +4942,7 @@ static inline int btrfs_chunk_max_errors
 
 	if (map->type & (BTRFS_BLOCK_GROUP_RAID1 |
 			 BTRFS_BLOCK_GROUP_RAID10 |
-			 BTRFS_BLOCK_GROUP_RAID5 |
-			 BTRFS_BLOCK_GROUP_DUP)) {
+			 BTRFS_BLOCK_GROUP_RAID5)) {
 		max_errors = 1;
 	} else if (map->type & BTRFS_BLOCK_GROUP_RAID6) {
 		max_errors = 2;
diff -druNp --no-dereference linux-libre-4.4.187-gnu/fs/ceph/super.h linux-libre-4.4.188-gnu/fs/ceph/super.h
--- linux-libre-4.4.187-gnu/fs/ceph/super.h	2019-08-04 03:35:02.000000000 -0400
+++ linux-libre-4.4.188-gnu/fs/ceph/super.h	2019-08-06 12:28:29.000000000 -0400
@@ -474,7 +474,12 @@ static inline void __ceph_dir_set_comple
 					   long long release_count,
 					   long long ordered_count)
 {
-	smp_mb__before_atomic();
+	/*
+	 * Makes sure operations that setup readdir cache (update page
+	 * cache and i_size) are strongly ordered w.r.t. the following
+	 * atomic64_set() operations.
+	 */
+	smp_mb();
 	atomic64_set(&ci->i_complete_seq[0], release_count);
 	atomic64_set(&ci->i_complete_seq[1], ordered_count);
 }
diff -druNp --no-dereference linux-libre-4.4.187-gnu/fs/coda/psdev.c linux-libre-4.4.188-gnu/fs/coda/psdev.c
--- linux-libre-4.4.187-gnu/fs/coda/psdev.c	2019-08-04 03:35:02.000000000 -0400
+++ linux-libre-4.4.188-gnu/fs/coda/psdev.c	2019-08-06 12:28:29.000000000 -0400
@@ -187,8 +187,11 @@ static ssize_t coda_psdev_write(struct f
 	if (req->uc_opcode == CODA_OPEN_BY_FD) {
 		struct coda_open_by_fd_out *outp =
 			(struct coda_open_by_fd_out *)req->uc_data;
-		if (!outp->oh.result)
+		if (!outp->oh.result) {
 			outp->fh = fget(outp->fd);
+			if (!outp->fh)
+				return -EBADF;
+		}
 	}
 
         wake_up(&req->uc_sleep);
diff -druNp --no-dereference linux-libre-4.4.187-gnu/include/linux/acpi.h linux-libre-4.4.188-gnu/include/linux/acpi.h
--- linux-libre-4.4.187-gnu/include/linux/acpi.h	2019-08-04 03:35:02.000000000 -0400
+++ linux-libre-4.4.188-gnu/include/linux/acpi.h	2019-08-06 12:28:29.000000000 -0400
@@ -226,7 +226,10 @@ void acpi_set_irq_model(enum acpi_irq_mo
 #ifdef CONFIG_X86_IO_APIC
 extern int acpi_get_override_irq(u32 gsi, int *trigger, int *polarity);
 #else
-#define acpi_get_override_irq(gsi, trigger, polarity) (-1)
+static inline int acpi_get_override_irq(u32 gsi, int *trigger, int *polarity)
+{
+	return -1;
+}
 #endif
 /*
  * This function undoes the effect of one call to acpi_register_gsi().
diff -druNp --no-dereference linux-libre-4.4.187-gnu/include/linux/coda.h linux-libre-4.4.188-gnu/include/linux/coda.h
--- linux-libre-4.4.187-gnu/include/linux/coda.h	2019-08-04 03:35:02.000000000 -0400
+++ linux-libre-4.4.188-gnu/include/linux/coda.h	2019-08-06 12:28:29.000000000 -0400
@@ -58,8 +58,7 @@ Mellon the rights to redistribute these
 #ifndef _CODA_HEADER_
 #define _CODA_HEADER_
 
-#if defined(__linux__)
 typedef unsigned long long u_quad_t;
-#endif
+
 #include <uapi/linux/coda.h>
 #endif 
diff -druNp --no-dereference linux-libre-4.4.187-gnu/include/linux/coda_psdev.h linux-libre-4.4.188-gnu/include/linux/coda_psdev.h
--- linux-libre-4.4.187-gnu/include/linux/coda_psdev.h	2019-08-04 03:35:02.000000000 -0400
+++ linux-libre-4.4.188-gnu/include/linux/coda_psdev.h	2019-08-06 12:28:29.000000000 -0400
@@ -19,6 +19,17 @@ struct venus_comm {
 	struct mutex	    vc_mutex;
 };
 
+/* messages between coda filesystem in kernel and Venus */
+struct upc_req {
+	struct list_head	uc_chain;
+	caddr_t			uc_data;
+	u_short			uc_flags;
+	u_short			uc_inSize;  /* Size is at most 5000 bytes */
+	u_short			uc_outSize;
+	u_short			uc_opcode;  /* copied from data to save lookup */
+	int			uc_unique;
+	wait_queue_head_t	uc_sleep;   /* process' wait queue */
+};
 
 static inline struct venus_comm *coda_vcp(struct super_block *sb)
 {
diff -druNp --no-dereference linux-libre-4.4.187-gnu/include/uapi/linux/coda_psdev.h linux-libre-4.4.188-gnu/include/uapi/linux/coda_psdev.h
--- linux-libre-4.4.187-gnu/include/uapi/linux/coda_psdev.h	2019-08-04 03:35:02.000000000 -0400
+++ linux-libre-4.4.188-gnu/include/uapi/linux/coda_psdev.h	2019-08-06 12:28:29.000000000 -0400
@@ -6,19 +6,6 @@
 #define CODA_PSDEV_MAJOR 67
 #define MAX_CODADEVS  5	   /* how many do we allow */
 
-
-/* messages between coda filesystem in kernel and Venus */
-struct upc_req {
-	struct list_head    uc_chain;
-	caddr_t	            uc_data;
-	u_short	            uc_flags;
-	u_short             uc_inSize;  /* Size is at most 5000 bytes */
-	u_short	            uc_outSize;
-	u_short	            uc_opcode;  /* copied from data to save lookup */
-	int		    uc_unique;
-	wait_queue_head_t   uc_sleep;   /* process' wait queue */
-};
-
 #define CODA_REQ_ASYNC  0x1
 #define CODA_REQ_READ   0x2
 #define CODA_REQ_WRITE  0x4
diff -druNp --no-dereference linux-libre-4.4.187-gnu/ipc/mqueue.c linux-libre-4.4.188-gnu/ipc/mqueue.c
--- linux-libre-4.4.187-gnu/ipc/mqueue.c	2019-08-04 03:35:02.000000000 -0400
+++ linux-libre-4.4.188-gnu/ipc/mqueue.c	2019-08-06 12:28:29.000000000 -0400
@@ -371,7 +371,6 @@ static void mqueue_evict_inode(struct in
 {
 	struct mqueue_inode_info *info;
 	struct user_struct *user;
-	unsigned long mq_bytes, mq_treesize;
 	struct ipc_namespace *ipc_ns;
 	struct msg_msg *msg, *nmsg;
 	LIST_HEAD(tmp_msg);
@@ -394,16 +393,18 @@ static void mqueue_evict_inode(struct in
 		free_msg(msg);
 	}
 
-	/* Total amount of bytes accounted for the mqueue */
-	mq_treesize = info->attr.mq_maxmsg * sizeof(struct msg_msg) +
-		min_t(unsigned int, info->attr.mq_maxmsg, MQ_PRIO_MAX) *
-		sizeof(struct posix_msg_tree_node);
-
-	mq_bytes = mq_treesize + (info->attr.mq_maxmsg *
-				  info->attr.mq_msgsize);
-
 	user = info->user;
 	if (user) {
+		unsigned long mq_bytes, mq_treesize;
+
+		/* Total amount of bytes accounted for the mqueue */
+		mq_treesize = info->attr.mq_maxmsg * sizeof(struct msg_msg) +
+			min_t(unsigned int, info->attr.mq_maxmsg, MQ_PRIO_MAX) *
+			sizeof(struct posix_msg_tree_node);
+
+		mq_bytes = mq_treesize + (info->attr.mq_maxmsg *
+					  info->attr.mq_msgsize);
+
 		spin_lock(&mq_lock);
 		user->mq_bytes -= mq_bytes;
 		/*
diff -druNp --no-dereference linux-libre-4.4.187-gnu/kernel/module.c linux-libre-4.4.188-gnu/kernel/module.c
--- linux-libre-4.4.187-gnu/kernel/module.c	2019-08-04 03:35:02.000000000 -0400
+++ linux-libre-4.4.188-gnu/kernel/module.c	2019-08-06 12:28:29.000000000 -0400
@@ -3225,8 +3225,7 @@ static bool finished_loading(const char
 	sched_annotate_sleep();
 	mutex_lock(&module_mutex);
 	mod = find_module_all(name, strlen(name), true);
-	ret = !mod || mod->state == MODULE_STATE_LIVE
-		|| mod->state == MODULE_STATE_GOING;
+	ret = !mod || mod->state == MODULE_STATE_LIVE;
 	mutex_unlock(&module_mutex);
 
 	return ret;
@@ -3385,8 +3384,7 @@ again:
 	mutex_lock(&module_mutex);
 	old = find_module_all(mod->name, strlen(mod->name), true);
 	if (old != NULL) {
-		if (old->state == MODULE_STATE_COMING
-		    || old->state == MODULE_STATE_UNFORMED) {
+		if (old->state != MODULE_STATE_LIVE) {
 			/* Wait in case it fails to load. */
 			mutex_unlock(&module_mutex);
 			err = wait_event_interruptible(module_wq,
diff -druNp --no-dereference linux-libre-4.4.187-gnu/Makefile linux-libre-4.4.188-gnu/Makefile
--- linux-libre-4.4.187-gnu/Makefile	2019-08-05 00:44:22.000000000 -0400
+++ linux-libre-4.4.188-gnu/Makefile	2019-08-06 19:43:26.000000000 -0400
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 187
+SUBLEVEL = 188
 EXTRAVERSION = -gnu
 NAME = Blurry Fish Butt
 
diff -druNp --no-dereference linux-libre-4.4.187-gnu/mm/cma.c linux-libre-4.4.188-gnu/mm/cma.c
--- linux-libre-4.4.187-gnu/mm/cma.c	2019-08-04 03:35:02.000000000 -0400
+++ linux-libre-4.4.188-gnu/mm/cma.c	2019-08-06 12:28:29.000000000 -0400
@@ -268,6 +268,12 @@ int __init cma_declare_contiguous(phys_a
 	 */
 	alignment = max(alignment,  (phys_addr_t)PAGE_SIZE <<
 			  max_t(unsigned long, MAX_ORDER - 1, pageblock_order));
+	if (fixed && base & (alignment - 1)) {
+		ret = -EINVAL;
+		pr_err("Region at %pa must be aligned to %pa bytes\n",
+			&base, &alignment);
+		goto err;
+	}
 	base = ALIGN(base, alignment);
 	size = ALIGN(size, alignment);
 	limit &= ~(alignment - 1);
@@ -298,6 +304,13 @@ int __init cma_declare_contiguous(phys_a
 	if (limit == 0 || limit > memblock_end)
 		limit = memblock_end;
 
+	if (base + size > limit) {
+		ret = -EINVAL;
+		pr_err("Size (%pa) of region at %pa exceeds limit (%pa)\n",
+			&size, &base, &limit);
+		goto err;
+	}
+
 	/* Reserve memory */
 	if (fixed) {
 		if (memblock_is_region_reserved(base, size) ||
diff -druNp --no-dereference linux-libre-4.4.187-gnu/security/selinux/ss/policydb.c linux-libre-4.4.188-gnu/security/selinux/ss/policydb.c
--- linux-libre-4.4.187-gnu/security/selinux/ss/policydb.c	2019-08-04 03:35:02.000000000 -0400
+++ linux-libre-4.4.188-gnu/security/selinux/ss/policydb.c	2019-08-06 12:28:29.000000000 -0400
@@ -266,6 +266,8 @@ static int rangetr_cmp(struct hashtab *h
 	return v;
 }
 
+static int (*destroy_f[SYM_NUM]) (void *key, void *datum, void *datap);
+
 /*
  * Initialize a policy database structure.
  */
@@ -313,8 +315,10 @@ static int policydb_init(struct policydb
 out:
 	hashtab_destroy(p->filename_trans);
 	hashtab_destroy(p->range_tr);
-	for (i = 0; i < SYM_NUM; i++)
+	for (i = 0; i < SYM_NUM; i++) {
+		hashtab_map(p->symtab[i].table, destroy_f[i], NULL);
 		hashtab_destroy(p->symtab[i].table);
+	}
 	return rc;
 }
 
