Mike Snitzer

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to memory corruption that can occur due to NFSv3 LOCALIO reads leaving garbage in `res.replen`. This happens when `nfs3 read done()` copies the value into `server->read hdrsize`, which is then copied to `args.replen` in new requests by `nfs3 proc read setup()`. The value is passed to `rpc prepare reply pages()`, included in `hdrsize` for `xdr init pages`, resulting in `rq rcv buf` containing a ridiculous length. This is eventually copied to `rq private buf` and passed to `sock recvmsg()`, which receives incoming data into the wrong place. The issue can be easily reproduced with NFSv3 LOCALIO servicing reads when it is made to pivot back to using normal RPC, such as when the NFSv3 server is stopped and then restarted while LOCALIO is performing heavy read IO. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue arises when the caller supplies an `iocb->ki pos` value close to the filesystem upper limit, and an iterator with a count that causes an overflow of that limit, resulting in `filemap read()` entering an infinite loop. This behavior was discovered during testing of xfstests generic/525 with the "localio" optimization for loopback NFS mounts. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the Linux kernel, where a vulnerability has been resolved. The vulnerability is associated with the device mapper (DM) and its interaction with the block multiqueue (blk-mq) subsystem. Specifically, the DM uses blk-mq's quiesce/unquiesce mechanism to stop and start the device mapper queue. However, the unquiesce operation may be triggered by outside events, such as elevator switches or updates to nr requests, which can cause requests to be queued during suspend. To address this, the fix involves asking blk-mq to requeue the request. This resolves a kernel panic issue that occurs when running the updating nr requests and dm-mpath suspend/resume stress test. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.