--- /dev/null
+From 247500820ebd02ad87525db5d9b199e5b66f6636 Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Fri, 21 Jun 2013 11:48:11 -0400
+Subject: nfsd4: fix decoding of compounds across page boundaries
+
+From: "J. Bruce Fields" <bfields@redhat.com>
+
+commit 247500820ebd02ad87525db5d9b199e5b66f6636 upstream.
+
+A freebsd NFSv4.0 client was getting rare IO errors expanding a tarball.
+A network trace showed the server returning BAD_XDR on the final getattr
+of a getattr+write+getattr compound. The final getattr started on a
+page boundary.
+
+I believe the Linux client ignores errors on the post-write getattr, and
+that that's why we haven't seen this before.
+
+Reported-by: Rick Macklem <rmacklem@uoguelph.ca>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfsd/nfs4xdr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -159,8 +159,8 @@ static __be32 *read_buf(struct nfsd4_com
+ */
+ memcpy(p, argp->p, avail);
+ /* step to next page */
+- argp->p = page_address(argp->pagelist[0]);
+ argp->pagelist++;
++ argp->p = page_address(argp->pagelist[0]);
+ if (argp->pagelen < PAGE_SIZE) {
+ argp->end = argp->p + (argp->pagelen>>2);
+ argp->pagelen = 0;
--- /dev/null
+From 2ee3e26c673e75c05ef8b914f54fadee3d7b9c88 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Mon, 27 May 2013 19:07:19 +0100
+Subject: SCSI: sd: Fix parsing of 'temporary ' cache mode prefix
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+commit 2ee3e26c673e75c05ef8b914f54fadee3d7b9c88 upstream.
+
+Commit 39c60a0948cc '[SCSI] sd: fix array cache flushing bug causing
+performance problems' added temp as a pointer to "temporary " and used
+sizeof(temp) - 1 as its length. But sizeof(temp) is the size of the
+pointer, not the size of the string constant. Change temp to a static
+array so that sizeof() does what was intended.
+
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/sd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -138,7 +138,7 @@ sd_store_cache_type(struct device *dev,
+ char *buffer_data;
+ struct scsi_mode_data data;
+ struct scsi_sense_hdr sshdr;
+- const char *temp = "temporary ";
++ static const char temp[] = "temporary ";
+ int len;
+
+ if (sdp->type != TYPE_DISK)
block-do-not-pass-disk-names-as-format-strings.patch
crypto-sanitize-argument-for-format-string.patch
maintainers-add-stable_kernel_rules.txt-to-stable-maintainer-information.patch
+nfsd4-fix-decoding-of-compounds-across-page-boundaries.patch
+scsi-sd-fix-parsing-of-temporary-cache-mode-prefix.patch