82 lines
4.0 KiB
Diff
82 lines
4.0 KiB
Diff
From b7eebd396261199cd9722a2cba14698446740f0d Mon Sep 17 00:00:00 2001
|
||
From: miaoguanqin <miaoguanqin@huawei.com>
|
||
Date: Thu, 17 Nov 2022 21:19:39 +0800
|
||
Subject: [PATCH] multipathd: Fixed multipathd parameter invoking sequence
|
||
changed problem in CVE-2022-41974.
|
||
|
||
Users may fail to execute command: multipathd and mpathpersist.
|
||
|
||
When we execute the command mpathpersist：
|
||
mpathpersist --out --register --param-sark=123 --prout-type=5 /dev/mapper/mpathb
|
||
It return an error : Missing arguement. The preceding command calls the function
|
||
cli_setprkey, which is called by checking whether the handle values are consistent
|
||
with the command input. CVE-2022-41974 changed the handler value of function and
|
||
changed the mode of calculating handle. The handler value is not equal to the
|
||
command input, causing multipathd can not execute the true funcion. It could be
|
||
an same error for executing multipoathd by the old mode.
|
||
|
||
multipathd invokes the corresponding function based on the handle value.
|
||
CVE-2022-41964 changed the method of calculating handler value. Modify the handle
|
||
value so that the corresponding function can be correctly execute.
|
||
|
||
Signed-off-by: miaoguanqin <miaoguanqin@huawei.com>
|
||
Signed-off-by: lixiaokeng <lixiaokeng@huawei.com>
|
||
---
|
||
multipathd/callbacks.c | 18 +++++++++---------
|
||
multipathd/cli.h | 9 ++++++++-
|
||
2 files changed, 17 insertions(+), 10 deletions(-)
|
||
|
||
diff --git a/multipathd/callbacks.c b/multipathd/callbacks.c
|
||
index fb87b280..f32666be 100644
|
||
--- a/multipathd/callbacks.c
|
||
+++ b/multipathd/callbacks.c
|
||
@@ -57,16 +57,16 @@ void init_handler_callbacks(void)
|
||
set_handler_callback(VRB_RESTOREQ | Q1_MAPS, HANDLER(cli_restore_all_queueing));
|
||
set_unlocked_handler_callback(VRB_QUIT, HANDLER(cli_quit));
|
||
set_unlocked_handler_callback(VRB_SHUTDOWN, HANDLER(cli_shutdown));
|
||
- set_handler_callback(VRB_GETPRSTATUS | Q1_MAP, HANDLER(cli_getprstatus));
|
||
- set_handler_callback(VRB_SETPRSTATUS | Q1_MAP, HANDLER(cli_setprstatus));
|
||
- set_handler_callback(VRB_UNSETPRSTATUS | Q1_MAP, HANDLER(cli_unsetprstatus));
|
||
+ set_handler_callback(KEY_MAP | Q1_GETPRSTATUS, HANDLER(cli_getprstatus));
|
||
+ set_handler_callback(KEY_MAP | Q1_SETSTATUS, HANDLER(cli_setprstatus));
|
||
+ set_handler_callback(KEY_MAP | Q1_UNSETSTATUS, HANDLER(cli_unsetprstatus));
|
||
set_handler_callback(VRB_FORCEQ | Q1_DAEMON, HANDLER(cli_force_no_daemon_q));
|
||
set_handler_callback(VRB_RESTOREQ | Q1_DAEMON, HANDLER(cli_restore_no_daemon_q));
|
||
- set_handler_callback(VRB_GETPRKEY | Q1_MAP, HANDLER(cli_getprkey));
|
||
- set_handler_callback(VRB_SETPRKEY | Q1_MAP | Q2_KEY, HANDLER(cli_setprkey));
|
||
- set_handler_callback(VRB_UNSETPRKEY | Q1_MAP, HANDLER(cli_unsetprkey));
|
||
- set_handler_callback(VRB_SETMARGINAL | Q1_PATH, HANDLER(cli_set_marginal));
|
||
- set_handler_callback(VRB_UNSETMARGINAL | Q1_PATH, HANDLER(cli_unset_marginal));
|
||
- set_handler_callback(VRB_UNSETMARGINAL | Q1_MAP,
|
||
+ set_handler_callback(KEY_MAP | Q1_GETPRKEY, HANDLER(cli_getprkey));
|
||
+ set_handler_callback(KEY_MAP | Q1_SETKEY | Q2_KEY, HANDLER(cli_setprkey));
|
||
+ set_handler_callback(KEY_MAP | Q1_UNSETKEY, HANDLER(cli_unsetprkey));
|
||
+ set_handler_callback(KEY_PATH | Q1_SETMARGINAL, HANDLER(cli_set_marginal));
|
||
+ set_handler_callback(KEY_PATH | Q1_UNSETMARGINAL, HANDLER(cli_unset_marginal));
|
||
+ set_handler_callback(KEY_MAP | Q1_UNSETMARGINAL,
|
||
HANDLER(cli_unset_all_marginal));
|
||
}
|
||
diff --git a/multipathd/cli.h b/multipathd/cli.h
|
||
index c6b79c9d..08ee5c8d 100644
|
||
--- a/multipathd/cli.h
|
||
+++ b/multipathd/cli.h
|
||
@@ -80,7 +80,14 @@ enum {
|
||
Q1_ALL = KEY_ALL << 8,
|
||
Q1_DAEMON = KEY_DAEMON << 8,
|
||
Q1_STATUS = KEY_STATUS << 8,
|
||
-
|
||
+ Q1_SETKEY = VRB_SETPRKEY << 8,
|
||
+ Q1_UNSETKEY = VRB_UNSETPRKEY << 8,
|
||
+ Q1_SETSTATUS = VRB_SETPRSTATUS << 8,
|
||
+ Q1_UNSETSTATUS = VRB_UNSETPRSTATUS << 8,
|
||
+ Q1_GETPRSTATUS = VRB_GETPRSTATUS << 8,
|
||
+ Q1_GETPRKEY = VRB_GETPRKEY << 8,
|
||
+ Q1_SETMARGINAL = VRB_SETMARGINAL << 8,
|
||
+ Q1_UNSETMARGINAL = VRB_UNSETMARGINAL << 8,
|
||
/* byte 2: qualifier 2 */
|
||
Q2_FMT = KEY_FMT << 16,
|
||
Q2_RAW = KEY_RAW << 16,
|
||
--
|
||
2.33.0
|
||
|