--- /dev/null
+From 9f67f189939eccaa54f3d2c9cf10788abaf2d584 Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Mon, 24 Feb 2014 14:59:47 -0500
+Subject: nfsd: notify_change needs elevated write count
+
+From: "J. Bruce Fields" <bfields@redhat.com>
+
+commit 9f67f189939eccaa54f3d2c9cf10788abaf2d584 upstream.
+
+Looks like this bug has been here since these write counts were
+introduced, not sure why it was just noticed now.
+
+Thanks also to Jan Kara for pointing out the problem.
+
+Reported-by: Matthew Rahtz <mrahtz@rapitasystems.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfsd/vfs.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -406,6 +406,7 @@ nfsd_setattr(struct svc_rqst *rqstp, str
+ umode_t ftype = 0;
+ __be32 err;
+ int host_err;
++ bool get_write_count;
+ int size_change = 0;
+
+ if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE))
+@@ -413,10 +414,18 @@ nfsd_setattr(struct svc_rqst *rqstp, str
+ if (iap->ia_valid & ATTR_SIZE)
+ ftype = S_IFREG;
+
++ /* Callers that do fh_verify should do the fh_want_write: */
++ get_write_count = !fhp->fh_dentry;
++
+ /* Get inode */
+ err = fh_verify(rqstp, fhp, ftype, accmode);
+ if (err)
+ goto out;
++ if (get_write_count) {
++ host_err = fh_want_write(fhp);
++ if (host_err)
++ return nfserrno(host_err);
++ }
+
+ dentry = fhp->fh_dentry;
+ inode = dentry->d_inode;
--- /dev/null
+From 480efaee085235bb848f1063f959bf144103c342 Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Mon, 10 Mar 2014 14:17:55 -0400
+Subject: nfsd4: fix setclientid encode size
+
+From: "J. Bruce Fields" <bfields@redhat.com>
+
+commit 480efaee085235bb848f1063f959bf144103c342 upstream.
+
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfsd/nfs4proc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -1418,7 +1418,8 @@ static inline u32 nfsd4_setattr_rsize(st
+
+ static inline u32 nfsd4_setclientid_rsize(struct svc_rqst *rqstp, struct nfsd4_op *op)
+ {
+- return (op_encode_hdr_size + 2 + 1024) * sizeof(__be32);
++ return (op_encode_hdr_size + 2 + XDR_QUADLEN(NFS4_VERIFIER_SIZE)) *
++ sizeof(__be32);
+ }
+
+ static inline u32 nfsd4_write_rsize(struct svc_rqst *rqstp, struct nfsd4_op *op)
nfsd4-session-needs-room-for-following-op-to-error-out.patch
nfsd4-buffer-length-check-for-suppattr_exclcreat.patch
nfsd4-fix-test_stateid-error-reply-encoding.patch
+nfsd-notify_change-needs-elevated-write-count.patch
+nfsd4-fix-setclientid-encode-size.patch