--- /dev/null
+From de3997a7eeb9ea286b15879fdf8a95aae065b4f7 Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Tue, 28 Jan 2014 16:05:15 -0500
+Subject: nfsd4: buffer-length check for SUPPATTR_EXCLCREAT
+
+From: "J. Bruce Fields" <bfields@redhat.com>
+
+commit de3997a7eeb9ea286b15879fdf8a95aae065b4f7 upstream.
+
+This was an omission from 8c18f2052e756e7d5dea712fc6e7ed70c00e8a39
+"nfsd41: SUPPATTR_EXCLCREAT attribute".
+
+Cc: Benny Halevy <bhalevy@primarydata.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfsd/nfs4xdr.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -2410,6 +2410,8 @@ out_acl:
+ WRITE64(stat.ino);
+ }
+ if (bmval2 & FATTR4_WORD2_SUPPATTR_EXCLCREAT) {
++ if ((buflen -= 16) < 0)
++ goto out_resource;
+ WRITE32(3);
+ WRITE32(NFSD_SUPPATTR_EXCLCREAT_WORD0);
+ WRITE32(NFSD_SUPPATTR_EXCLCREAT_WORD1);
--- /dev/null
+From a11fcce1544df08c723d950ff0edef3adac40405 Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Mon, 3 Feb 2014 16:31:42 -0500
+Subject: nfsd4: fix test_stateid error reply encoding
+
+From: "J. Bruce Fields" <bfields@redhat.com>
+
+commit a11fcce1544df08c723d950ff0edef3adac40405 upstream.
+
+If the entire operation fails then there's nothing to encode.
+
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfsd/nfs4xdr.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -3408,6 +3408,9 @@ nfsd4_encode_test_stateid(struct nfsd4_c
+ struct nfsd4_test_stateid_id *stateid, *next;
+ __be32 *p;
+
++ if (nfserr)
++ return nfserr;
++
+ RESERVE_SPACE(4 + (4 * test_stateid->ts_num_ids));
+ *p++ = htonl(test_stateid->ts_num_ids);
+
--- /dev/null
+From 4c69d5855a16f7378648c5733632628fa10431db Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Tue, 28 Jan 2014 16:01:04 -0500
+Subject: nfsd4: session needs room for following op to error out
+
+From: "J. Bruce Fields" <bfields@redhat.com>
+
+commit 4c69d5855a16f7378648c5733632628fa10431db upstream.
+
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfsd/nfs4proc.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -1245,6 +1245,12 @@ nfsd4_proc_compound(struct svc_rqst *rqs
+ /* If op is non-idempotent */
+ if (opdesc->op_flags & OP_MODIFIES_SOMETHING) {
+ plen = opdesc->op_rsize_bop(rqstp, op);
++ /*
++ * If there's still another operation, make sure
++ * we'll have space to at least encode an error:
++ */
++ if (resp->opcnt < args->opcnt)
++ plen += COMPOUND_ERR_SLACK_SPACE;
+ op->status = nfsd4_check_resp_size(resp, plen);
+ }
+
staging-r8712u-fix-case-where-ethtype-was-never-obtained-and-always-be-checked-against-0.patch
x86-64-modify_ldt-ban-16-bit-segments-on-64-bit-kernels.patch
usb-fix-crash-during-hotplug-of-pci-usb-controller-card.patch
+nfsd4-session-needs-room-for-following-op-to-error-out.patch
+nfsd4-buffer-length-check-for-suppattr_exclcreat.patch
+nfsd4-fix-test_stateid-error-reply-encoding.patch