--- /dev/null
+From 2076a20fc1a06f7b0333c62a2bb4eeeac7ed1bcb Mon Sep 17 00:00:00 2001
+From: Alec Berg <alecaberg@chromium.org>
+Date: Wed, 19 Mar 2014 18:50:00 +0000
+Subject: iio: querying buffer scan_mask should return 0/1
+
+From: Alec Berg <alecaberg@chromium.org>
+
+commit 2076a20fc1a06f7b0333c62a2bb4eeeac7ed1bcb upstream.
+
+Ensure that querying the IIO buffer scan_mask returns a value of
+0 or 1. Currently querying the scan mask has the value returned
+by test_bit(), which returns either true or false. For some
+architectures test_bit() may return -1 for true, which will appear
+to return an error when returning from iio_scan_mask_query().
+
+Additionally, it's important for the sysfs interface to consistently
+return the same thing when querying the scan_mask.
+
+Signed-off-by: Alec Berg <alecaberg@chromium.org>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/industrialio-buffer.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/industrialio-buffer.c
++++ b/drivers/iio/industrialio-buffer.c
+@@ -119,7 +119,8 @@ static ssize_t iio_scan_el_show(struct d
+ int ret;
+ struct iio_dev *indio_dev = dev_to_iio_dev(dev);
+
+- ret = test_bit(to_iio_dev_attr(attr)->address,
++ /* Ensure ret is 0 or 1. */
++ ret = !!test_bit(to_iio_dev_attr(attr)->address,
+ indio_dev->buffer->scan_mask);
+
+ return sprintf(buf, "%d\n", ret);
+@@ -762,7 +763,8 @@ int iio_scan_mask_query(struct iio_dev *
+ if (!buffer->scan_mask)
+ return 0;
+
+- return test_bit(bit, buffer->scan_mask);
++ /* Ensure return value is 0 or 1. */
++ return !!test_bit(bit, buffer->scan_mask);
+ };
+ EXPORT_SYMBOL_GPL(iio_scan_mask_query);
+
--- /dev/null
+From de3997a7eeb9ea286b15879fdf8a95aae065b4f7 Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Tue, 28 Jan 2014 16:05:15 -0500
+Subject: nfsd4: buffer-length check for SUPPATTR_EXCLCREAT
+
+From: "J. Bruce Fields" <bfields@redhat.com>
+
+commit de3997a7eeb9ea286b15879fdf8a95aae065b4f7 upstream.
+
+This was an omission from 8c18f2052e756e7d5dea712fc6e7ed70c00e8a39
+"nfsd41: SUPPATTR_EXCLCREAT attribute".
+
+Cc: Benny Halevy <bhalevy@primarydata.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfsd/nfs4xdr.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -2401,6 +2401,8 @@ out_acl:
+ WRITE64(stat.ino);
+ }
+ if (bmval2 & FATTR4_WORD2_SUPPATTR_EXCLCREAT) {
++ if ((buflen -= 16) < 0)
++ goto out_resource;
+ WRITE32(3);
+ WRITE32(NFSD_SUPPATTR_EXCLCREAT_WORD0);
+ WRITE32(NFSD_SUPPATTR_EXCLCREAT_WORD1);
--- /dev/null
+From a11fcce1544df08c723d950ff0edef3adac40405 Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Mon, 3 Feb 2014 16:31:42 -0500
+Subject: nfsd4: fix test_stateid error reply encoding
+
+From: "J. Bruce Fields" <bfields@redhat.com>
+
+commit a11fcce1544df08c723d950ff0edef3adac40405 upstream.
+
+If the entire operation fails then there's nothing to encode.
+
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfsd/nfs4xdr.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -3384,6 +3384,9 @@ nfsd4_encode_test_stateid(struct nfsd4_c
+ struct nfsd4_test_stateid_id *stateid, *next;
+ __be32 *p;
+
++ if (nfserr)
++ return nfserr;
++
+ RESERVE_SPACE(4 + (4 * test_stateid->ts_num_ids));
+ *p++ = htonl(test_stateid->ts_num_ids);
+
--- /dev/null
+From 4c69d5855a16f7378648c5733632628fa10431db Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Tue, 28 Jan 2014 16:01:04 -0500
+Subject: nfsd4: session needs room for following op to error out
+
+From: "J. Bruce Fields" <bfields@redhat.com>
+
+commit 4c69d5855a16f7378648c5733632628fa10431db upstream.
+
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfsd/nfs4proc.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -1307,6 +1307,12 @@ nfsd4_proc_compound(struct svc_rqst *rqs
+ /* If op is non-idempotent */
+ if (opdesc->op_flags & OP_MODIFIES_SOMETHING) {
+ plen = opdesc->op_rsize_bop(rqstp, op);
++ /*
++ * If there's still another operation, make sure
++ * we'll have space to at least encode an error:
++ */
++ if (resp->opcnt < args->opcnt)
++ plen += COMPOUND_ERR_SLACK_SPACE;
+ op->status = nfsd4_check_resp_size(resp, plen);
+ }
+
ftrace-x86-one-more-missing-sync-after-fixup-of-function-modification-failure.patch
x86-64-modify_ldt-ban-16-bit-segments-on-64-bit-kernels.patch
usb-fix-crash-during-hotplug-of-pci-usb-controller-card.patch
+iio-querying-buffer-scan_mask-should-return-0-1.patch
+nfsd4-session-needs-room-for-following-op-to-error-out.patch
+nfsd4-buffer-length-check-for-suppattr_exclcreat.patch
+nfsd4-fix-test_stateid-error-reply-encoding.patch