diff -druNp --no-dereference linux-libre-3.14.78-gnu/drivers/hid/hid-input.c linux-libre-3.14.79-gnu/drivers/hid/hid-input.c
--- linux-libre-3.14.78-gnu/drivers/hid/hid-input.c	2016-09-07 02:30:12.000000000 -0400
+++ linux-libre-3.14.79-gnu/drivers/hid/hid-input.c	2016-09-11 04:00:18.000000000 -0400
@@ -1084,7 +1084,7 @@ void hidinput_hid_event(struct hid_devic
 		return;
 
 	/* report the usage code as scancode if the key status has changed */
-	if (usage->type == EV_KEY && !!test_bit(usage->code, input->key) != value)
+	if (usage->type == EV_KEY && (!!test_bit(usage->code, input->key)) != value)
 		input_event(input, EV_MSC, MSC_SCAN, usage->hid);
 
 	input_event(input, usage->type, usage->code, value);
diff -druNp --no-dereference linux-libre-3.14.78-gnu/drivers/media/dvb-frontends/stb6100.c linux-libre-3.14.79-gnu/drivers/media/dvb-frontends/stb6100.c
--- linux-libre-3.14.78-gnu/drivers/media/dvb-frontends/stb6100.c	2016-09-07 02:30:12.000000000 -0400
+++ linux-libre-3.14.79-gnu/drivers/media/dvb-frontends/stb6100.c	2016-09-11 04:00:18.000000000 -0400
@@ -193,7 +193,7 @@ static int stb6100_write_reg_range(struc
 		.len	= len + 1
 	};
 
-	if (1 + len > sizeof(buf)) {
+	if (1 + len > sizeof(cmdbuf)) {
 		printk(KERN_WARNING
 		       "%s: i2c wr: len=%d is too big!\n",
 		       KBUILD_MODNAME, len);
diff -druNp --no-dereference linux-libre-3.14.78-gnu/drivers/net/can/dev.c linux-libre-3.14.79-gnu/drivers/net/can/dev.c
--- linux-libre-3.14.78-gnu/drivers/net/can/dev.c	2016-09-07 02:30:12.000000000 -0400
+++ linux-libre-3.14.79-gnu/drivers/net/can/dev.c	2016-09-11 04:00:18.000000000 -0400
@@ -665,9 +665,6 @@ static int can_changelink(struct net_dev
 		}
 	}
 
-	if (!data)
-		return 0;
-
 	if (data[IFLA_CAN_CTRLMODE]) {
 		struct can_ctrlmode *cm;
 
diff -druNp --no-dereference linux-libre-3.14.78-gnu/drivers/s390/char/sclp_ctl.c linux-libre-3.14.79-gnu/drivers/s390/char/sclp_ctl.c
--- linux-libre-3.14.78-gnu/drivers/s390/char/sclp_ctl.c	2016-09-07 02:30:12.000000000 -0400
+++ linux-libre-3.14.79-gnu/drivers/s390/char/sclp_ctl.c	2016-09-11 04:00:18.000000000 -0400
@@ -56,6 +56,7 @@ static int sclp_ctl_ioctl_sccb(void __us
 {
 	struct sclp_ctl_sccb ctl_sccb;
 	struct sccb_header *sccb;
+	unsigned long copied;
 	int rc;
 
 	if (copy_from_user(&ctl_sccb, user_area, sizeof(ctl_sccb)))
@@ -65,14 +66,15 @@ static int sclp_ctl_ioctl_sccb(void __us
 	sccb = (void *) get_zeroed_page(GFP_KERNEL | GFP_DMA);
 	if (!sccb)
 		return -ENOMEM;
-	if (copy_from_user(sccb, u64_to_uptr(ctl_sccb.sccb), sizeof(*sccb))) {
+	copied = PAGE_SIZE -
+		copy_from_user(sccb, u64_to_uptr(ctl_sccb.sccb), PAGE_SIZE);
+	if (offsetof(struct sccb_header, length) +
+	    sizeof(sccb->length) > copied || sccb->length > copied) {
 		rc = -EFAULT;
 		goto out_free;
 	}
-	if (sccb->length > PAGE_SIZE || sccb->length < 8)
-		return -EINVAL;
-	if (copy_from_user(sccb, u64_to_uptr(ctl_sccb.sccb), sccb->length)) {
-		rc = -EFAULT;
+	if (sccb->length < 8) {
+		rc = -EINVAL;
 		goto out_free;
 	}
 	rc = sclp_sync_request(ctl_sccb.cmdw, sccb);
diff -druNp --no-dereference linux-libre-3.14.78-gnu/drivers/scsi/be2iscsi/be_main.c linux-libre-3.14.79-gnu/drivers/scsi/be2iscsi/be_main.c
--- linux-libre-3.14.78-gnu/drivers/scsi/be2iscsi/be_main.c	2016-09-07 02:30:12.000000000 -0400
+++ linux-libre-3.14.79-gnu/drivers/scsi/be2iscsi/be_main.c	2016-09-11 04:00:18.000000000 -0400
@@ -3172,7 +3172,7 @@ be_sgl_create_contiguous(void *virtual_a
 {
 	WARN_ON(!virtual_address);
 	WARN_ON(!physical_address);
-	WARN_ON(!length > 0);
+	WARN_ON(!length);
 	WARN_ON(!sgl);
 
 	sgl->va = virtual_address;
diff -druNp --no-dereference linux-libre-3.14.78-gnu/drivers/staging/comedi/drivers/ni_mio_common.c linux-libre-3.14.79-gnu/drivers/staging/comedi/drivers/ni_mio_common.c
--- linux-libre-3.14.78-gnu/drivers/staging/comedi/drivers/ni_mio_common.c	2016-09-07 02:30:12.000000000 -0400
+++ linux-libre-3.14.79-gnu/drivers/staging/comedi/drivers/ni_mio_common.c	2016-09-11 04:00:18.000000000 -0400
@@ -4404,7 +4404,7 @@ static int ni_E_init(struct comedi_devic
 		else
 			s->maxdata = 0xffffff;
 		s->insn_read = ni_tio_insn_read;
-		s->insn_write = ni_tio_insn_read;
+		s->insn_write = ni_tio_insn_write;
 		s->insn_config = ni_tio_insn_config;
 #ifdef PCIDMA
 		s->subdev_flags |= SDF_CMD_READ /* | SDF_CMD_WRITE */;
diff -druNp --no-dereference linux-libre-3.14.78-gnu/fs/dcache.c linux-libre-3.14.79-gnu/fs/dcache.c
--- linux-libre-3.14.78-gnu/fs/dcache.c	2016-09-07 02:30:12.000000000 -0400
+++ linux-libre-3.14.79-gnu/fs/dcache.c	2016-09-11 04:00:18.000000000 -0400
@@ -2652,6 +2652,7 @@ static void __d_materialise_dentry(struc
 	switch_names(dentry, anon);
 	swap(dentry->d_name.hash, anon->d_name.hash);
 
+	dentry->d_flags |= DCACHE_RCUACCESS;
 	dentry->d_parent = dentry;
 	list_del_init(&dentry->d_child);
 	anon->d_parent = dparent;
diff -druNp --no-dereference linux-libre-3.14.78-gnu/fs/ext4/super.c linux-libre-3.14.79-gnu/fs/ext4/super.c
--- linux-libre-3.14.78-gnu/fs/ext4/super.c	2016-09-07 02:30:12.000000000 -0400
+++ linux-libre-3.14.79-gnu/fs/ext4/super.c	2016-09-11 04:00:18.000000000 -0400
@@ -2071,6 +2071,7 @@ void ext4_group_desc_csum_set(struct sup
 
 /* Called at mount-time, super-block is locked */
 static int ext4_check_descriptors(struct super_block *sb,
+				  ext4_fsblk_t sb_block,
 				  ext4_group_t *first_not_zeroed)
 {
 	struct ext4_sb_info *sbi = EXT4_SB(sb);
@@ -2101,6 +2102,11 @@ static int ext4_check_descriptors(struct
 			grp = i;
 
 		block_bitmap = ext4_block_bitmap(sb, gdp);
+		if (block_bitmap == sb_block) {
+			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+				 "Block bitmap for group %u overlaps "
+				 "superblock", i);
+		}
 		if (block_bitmap < first_block || block_bitmap > last_block) {
 			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
 			       "Block bitmap for group %u not in group "
@@ -2108,6 +2114,11 @@ static int ext4_check_descriptors(struct
 			return 0;
 		}
 		inode_bitmap = ext4_inode_bitmap(sb, gdp);
+		if (inode_bitmap == sb_block) {
+			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+				 "Inode bitmap for group %u overlaps "
+				 "superblock", i);
+		}
 		if (inode_bitmap < first_block || inode_bitmap > last_block) {
 			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
 			       "Inode bitmap for group %u not in group "
@@ -2115,6 +2126,11 @@ static int ext4_check_descriptors(struct
 			return 0;
 		}
 		inode_table = ext4_inode_table(sb, gdp);
+		if (inode_table == sb_block) {
+			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+				 "Inode table for group %u overlaps "
+				 "superblock", i);
+		}
 		if (inode_table < first_block ||
 		    inode_table + sbi->s_itb_per_group - 1 > last_block) {
 			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
@@ -3869,7 +3885,7 @@ static int ext4_fill_super(struct super_
 			goto failed_mount2;
 		}
 	}
-	if (!ext4_check_descriptors(sb, &first_not_zeroed)) {
+	if (!ext4_check_descriptors(sb, logical_sb_block, &first_not_zeroed)) {
 		ext4_msg(sb, KERN_ERR, "group descriptors corrupted!");
 		goto failed_mount2;
 	}
diff -druNp --no-dereference linux-libre-3.14.78-gnu/Makefile linux-libre-3.14.79-gnu/Makefile
--- linux-libre-3.14.78-gnu/Makefile	2016-09-07 21:43:14.000000000 -0400
+++ linux-libre-3.14.79-gnu/Makefile	2016-09-11 16:11:05.000000000 -0400
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 14
-SUBLEVEL = 78
+SUBLEVEL = 79
 EXTRAVERSION =-gnu
 NAME = Remembering Coco
 
diff -druNp --no-dereference linux-libre-3.14.78-gnu/mm/memory.c linux-libre-3.14.79-gnu/mm/memory.c
--- linux-libre-3.14.78-gnu/mm/memory.c	2016-09-07 02:30:12.000000000 -0400
+++ linux-libre-3.14.79-gnu/mm/memory.c	2016-09-11 04:00:18.000000000 -0400
@@ -3770,8 +3770,18 @@ static int __handle_mm_fault(struct mm_s
 	if (unlikely(pmd_none(*pmd)) &&
 	    unlikely(__pte_alloc(mm, vma, pmd, address)))
 		return VM_FAULT_OOM;
-	/* if an huge pmd materialized from under us just retry later */
-	if (unlikely(pmd_trans_huge(*pmd)))
+	/*
+	 * If a huge pmd materialized under us just retry later.  Use
+	 * pmd_trans_unstable() instead of pmd_trans_huge() to ensure the pmd
+	 * didn't become pmd_trans_huge under us and then back to pmd_none, as
+	 * a result of MADV_DONTNEED running immediately after a huge pmd fault
+	 * in a different thread of this mm, in turn leading to a misleading
+	 * pmd_trans_huge() retval.  All we have to ensure is that it is a
+	 * regular pmd that we can walk with pte_offset_map() and we can do that
+	 * through an atomic read in C, which is what pmd_trans_unstable()
+	 * provides.
+	 */
+	if (unlikely(pmd_trans_unstable(pmd)))
 		return 0;
 	/*
 	 * A regular pmd is established and it can't morph into a huge pmd
diff -druNp --no-dereference linux-libre-3.14.78-gnu/net/rds/recv.c linux-libre-3.14.79-gnu/net/rds/recv.c
--- linux-libre-3.14.78-gnu/net/rds/recv.c	2016-09-07 02:30:12.000000000 -0400
+++ linux-libre-3.14.79-gnu/net/rds/recv.c	2016-09-11 04:00:18.000000000 -0400
@@ -543,5 +543,7 @@ void rds_inc_info_copy(struct rds_incomi
 		minfo.fport = inc->i_hdr.h_dport;
 	}
 
+	minfo.flags = 0;
+
 	rds_info_copy(iter, &minfo, sizeof(minfo));
 }
diff -druNp --no-dereference linux-libre-3.14.78-gnu/sound/pci/oxygen/oxygen_mixer.c linux-libre-3.14.79-gnu/sound/pci/oxygen/oxygen_mixer.c
--- linux-libre-3.14.78-gnu/sound/pci/oxygen/oxygen_mixer.c	2016-09-07 02:30:12.000000000 -0400
+++ linux-libre-3.14.79-gnu/sound/pci/oxygen/oxygen_mixer.c	2016-09-11 04:00:18.000000000 -0400
@@ -88,7 +88,7 @@ static int dac_mute_put(struct snd_kcont
 	int changed;
 
 	mutex_lock(&chip->mutex);
-	changed = !value->value.integer.value[0] != chip->dac_mute;
+	changed = (!value->value.integer.value[0]) != chip->dac_mute;
 	if (changed) {
 		chip->dac_mute = !value->value.integer.value[0];
 		chip->model.update_dac_mute(chip);
