Re: libmultipath: fix NULL dereference in get_be64

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Mon, 2021-02-01 at 19:49 +0800, lixiaokeng wrote:
> 
> 
> On 2021/2/1 19:16, Martin Wilck wrote:
> > I don't understand. All callers (uev_add_path(), cli_add_path(),
> > check_path()) call pathinfo() first, which would return
> > PATHINFO_SKIPPED if the path was blacklisted. How do you end up 
> > in ev_add_path() with a blacklisted path?
> > 
> > And how is it possible that add_map_with_path(vecs, pp, 1) returns
> > non-
> > NULL and pp->mpp is NULL?
> 
> The sdb is a local disk, stack:
> 
> cli_add_path
>    ->ev_add_path
>       ->add_map_with_path
>          ->adopt_paths
>             ->pathinfo
>                ->filter_property
>                ->return PATHINFO_SKIPPED,
>             ->pp->mpp is NULL and not be set
>             ->return 0

This returns 0, but add_map_with_path() has this code to check whether
the path passed to it was actually added to the new map:

	if (adopt_paths(vecs->pathvec, mpp) ||
	    find_slot(vecs->pathvec, pp) == -1)
		goto out;  -> return NULL

So ev_add_path() should have seen a NULL return from
add_map_with_path(), should not have set start_waiter, and failed. 

Wait ... perhaps it could happen if after "goto rescan:" that
start_waiter was already set to one.

Can you try the attached patch?


>       ->mpath_pr_event_handle
>          ->get_be64 //pp->mpp is dereference
> 
> The multipath.conf show:
> defaults {
>         find_multipaths no
> }
> 
> Here, my local disks can't pass filter_property. Why?

This depends on the disk, and on your blacklisting settings. By
default, multipathd refuses paths that have neither
SCSI_IDENT_* nor ID_WWN_* properties set. See multipath.conf(5).

Regards
Martin

From f3f5440de274590d5d2439861aecfb70b1721988 Mon Sep 17 00:00:00 2001
From: Martin Wilck <mwilck@xxxxxxxx>
Date: Mon, 1 Feb 2021 13:10:46 +0100
Subject: [PATCH] multipathd: ev_add_path: fail if add_map_with_path() fails

If start_waiter was set before and the "rescan" label was used,
we may try to set up an empty/invalid map.
Always fail if add_map_with_path() isn't successful.

Signed-off-by: Martin Wilck <mwilck@xxxxxxxx>
---
 multipathd/main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/multipathd/main.c b/multipathd/main.c
index 6f851ae..134185f 100644
--- a/multipathd/main.c
+++ b/multipathd/main.c
@@ -1028,7 +1028,7 @@ rescan:
 			 */
 			start_waiter = 1;
 		}
-		if (!start_waiter)
+		else
 			goto fail; /* leave path added to pathvec */
 	}
 
-- 
2.29.2

--
dm-devel mailing list
dm-devel@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/dm-devel

[Index of Archives]     [DM Crypt]     [Fedora Desktop]     [ATA RAID]     [Fedora Marketing]     [Fedora Packaging]     [Fedora SELinux]     [Yosemite Discussion]     [KDE Users]     [Fedora Docs]

  Powered by Linux