1From 0168696f95b5c610c3861ced8ef98accd1a83b91 Mon Sep 17 00:00:00 2001 2From: Benjamin Marzinski <bmarzins@redhat.com> 3Date: Tue, 27 Sep 2022 12:36:37 +0200 4Subject: [PATCH] multipathd: ignore duplicated multipathd command keys 5 6multipath adds rather than or-s the values of command keys. Fix this. 7Also, return an invalid fingerprint if a key is used more than once. 8 9CVE: CVE-2022-41974 10 11References: 12https://nvd.nist.gov/vuln/detail/CVE-2022-41974 13https://github.com/opensvc/multipath-tools/issues/59 14 15Upstream-Status: Backport 16[https://github.com/openSUSE/multipath-tools/commit/fbbf280a0e26026c19879d938ebb2a8200b6357c] 17 18Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com> 19 20Signed-off-by: Yogita Urade <yogita.urade@windriver.com> 21--- 22 multipathd/cli.c | 8 ++-- 23 multipathd/main.c | 104 +++++++++++++++++++++++----------------------- 24 2 files changed, 57 insertions(+), 55 deletions(-) 25 26diff --git a/multipathd/cli.c b/multipathd/cli.c 27index 800c0fbe..0a266761 100644 28--- a/multipathd/cli.c 29+++ b/multipathd/cli.c 30@@ -336,9 +336,11 @@ fingerprint(vector vec) 31 if (!vec) 32 return 0; 33 34- vector_foreach_slot(vec, kw, i) 35- fp += kw->code; 36- 37+ vector_foreach_slot(vec, kw, i) { 38+ if (fp & kw->code) 39+ return (uint64_t)-1; 40+ fp |= kw->code; 41+ } 42 return fp; 43 } 44 45diff --git a/multipathd/main.c b/multipathd/main.c 46index 8baf9abe..975287d2 100644 47--- a/multipathd/main.c 48+++ b/multipathd/main.c 49@@ -1522,61 +1522,61 @@ uxlsnrloop (void * ap) 50 /* Tell main thread that thread has started */ 51 post_config_state(DAEMON_CONFIGURE); 52 53- set_handler_callback(LIST+PATHS, cli_list_paths); 54- set_handler_callback(LIST+PATHS+FMT, cli_list_paths_fmt); 55- set_handler_callback(LIST+PATHS+RAW+FMT, cli_list_paths_raw); 56- set_handler_callback(LIST+PATH, cli_list_path); 57- set_handler_callback(LIST+MAPS, cli_list_maps); 58- set_handler_callback(LIST+STATUS, cli_list_status); 59- set_unlocked_handler_callback(LIST+DAEMON, cli_list_daemon); 60- set_handler_callback(LIST+MAPS+STATUS, cli_list_maps_status); 61- set_handler_callback(LIST+MAPS+STATS, cli_list_maps_stats); 62- set_handler_callback(LIST+MAPS+FMT, cli_list_maps_fmt); 63- set_handler_callback(LIST+MAPS+RAW+FMT, cli_list_maps_raw); 64- set_handler_callback(LIST+MAPS+TOPOLOGY, cli_list_maps_topology); 65- set_handler_callback(LIST+TOPOLOGY, cli_list_maps_topology); 66- set_handler_callback(LIST+MAPS+JSON, cli_list_maps_json); 67- set_handler_callback(LIST+MAP+TOPOLOGY, cli_list_map_topology); 68- set_handler_callback(LIST+MAP+FMT, cli_list_map_fmt); 69- set_handler_callback(LIST+MAP+RAW+FMT, cli_list_map_fmt); 70- set_handler_callback(LIST+MAP+JSON, cli_list_map_json); 71- set_handler_callback(LIST+CONFIG+LOCAL, cli_list_config_local); 72- set_handler_callback(LIST+CONFIG, cli_list_config); 73- set_handler_callback(LIST+BLACKLIST, cli_list_blacklist); 74- set_handler_callback(LIST+DEVICES, cli_list_devices); 75- set_handler_callback(LIST+WILDCARDS, cli_list_wildcards); 76- set_handler_callback(RESET+MAPS+STATS, cli_reset_maps_stats); 77- set_handler_callback(RESET+MAP+STATS, cli_reset_map_stats); 78- set_handler_callback(ADD+PATH, cli_add_path); 79- set_handler_callback(DEL+PATH, cli_del_path); 80- set_handler_callback(ADD+MAP, cli_add_map); 81- set_handler_callback(DEL+MAP, cli_del_map); 82- set_handler_callback(SWITCH+MAP+GROUP, cli_switch_group); 83+ set_handler_callback(LIST|PATHS, cli_list_paths); 84+ set_handler_callback(LIST|PATHS|FMT, cli_list_paths_fmt); 85+ set_handler_callback(LIST|PATHS|RAW|FMT, cli_list_paths_raw); 86+ set_handler_callback(LIST|PATH, cli_list_path); 87+ set_handler_callback(LIST|MAPS, cli_list_maps); 88+ set_handler_callback(LIST|STATUS, cli_list_status); 89+ set_unlocked_handler_callback(LIST|DAEMON, cli_list_daemon); 90+ set_handler_callback(LIST|MAPS|STATUS, cli_list_maps_status); 91+ set_handler_callback(LIST|MAPS|STATS, cli_list_maps_stats); 92+ set_handler_callback(LIST|MAPS|FMT, cli_list_maps_fmt); 93+ set_handler_callback(LIST|MAPS|RAW|FMT, cli_list_maps_raw); 94+ set_handler_callback(LIST|MAPS|TOPOLOGY, cli_list_maps_topology); 95+ set_handler_callback(LIST|TOPOLOGY, cli_list_maps_topology); 96+ set_handler_callback(LIST|MAPS|JSON, cli_list_maps_json); 97+ set_handler_callback(LIST|MAP|TOPOLOGY, cli_list_map_topology); 98+ set_handler_callback(LIST|MAP|FMT, cli_list_map_fmt); 99+ set_handler_callback(LIST|MAP|RAW|FMT, cli_list_map_fmt); 100+ set_handler_callback(LIST|MAP|JSON, cli_list_map_json); 101+ set_handler_callback(LIST|CONFIG|LOCAL, cli_list_config_local); 102+ set_handler_callback(LIST|CONFIG, cli_list_config); 103+ set_handler_callback(LIST|BLACKLIST, cli_list_blacklist); 104+ set_handler_callback(LIST|DEVICES, cli_list_devices); 105+ set_handler_callback(LIST|WILDCARDS, cli_list_wildcards); 106+ set_handler_callback(RESET|MAPS|STATS, cli_reset_maps_stats); 107+ set_handler_callback(RESET|MAP|STATS, cli_reset_map_stats); 108+ set_handler_callback(ADD|PATH, cli_add_path); 109+ set_handler_callback(DEL|PATH, cli_del_path); 110+ set_handler_callback(ADD|MAP, cli_add_map); 111+ set_handler_callback(DEL|MAP, cli_del_map); 112+ set_handler_callback(SWITCH|MAP|GROUP, cli_switch_group); 113 set_unlocked_handler_callback(RECONFIGURE, cli_reconfigure); 114- set_handler_callback(SUSPEND+MAP, cli_suspend); 115- set_handler_callback(RESUME+MAP, cli_resume); 116- set_handler_callback(RESIZE+MAP, cli_resize); 117- set_handler_callback(RELOAD+MAP, cli_reload); 118- set_handler_callback(RESET+MAP, cli_reassign); 119- set_handler_callback(REINSTATE+PATH, cli_reinstate); 120- set_handler_callback(FAIL+PATH, cli_fail); 121- set_handler_callback(DISABLEQ+MAP, cli_disable_queueing); 122- set_handler_callback(RESTOREQ+MAP, cli_restore_queueing); 123- set_handler_callback(DISABLEQ+MAPS, cli_disable_all_queueing); 124- set_handler_callback(RESTOREQ+MAPS, cli_restore_all_queueing); 125+ set_handler_callback(SUSPEND|MAP, cli_suspend); 126+ set_handler_callback(RESUME|MAP, cli_resume); 127+ set_handler_callback(RESIZE|MAP, cli_resize); 128+ set_handler_callback(RELOAD|MAP, cli_reload); 129+ set_handler_callback(RESET|MAP, cli_reassign); 130+ set_handler_callback(REINSTATE|PATH, cli_reinstate); 131+ set_handler_callback(FAIL|PATH, cli_fail); 132+ set_handler_callback(DISABLEQ|MAP, cli_disable_queueing); 133+ set_handler_callback(RESTOREQ|MAP, cli_restore_queueing); 134+ set_handler_callback(DISABLEQ|MAPS, cli_disable_all_queueing); 135+ set_handler_callback(RESTOREQ|MAPS, cli_restore_all_queueing); 136 set_unlocked_handler_callback(QUIT, cli_quit); 137 set_unlocked_handler_callback(SHUTDOWN, cli_shutdown); 138- set_handler_callback(GETPRSTATUS+MAP, cli_getprstatus); 139- set_handler_callback(SETPRSTATUS+MAP, cli_setprstatus); 140- set_handler_callback(UNSETPRSTATUS+MAP, cli_unsetprstatus); 141- set_handler_callback(FORCEQ+DAEMON, cli_force_no_daemon_q); 142- set_handler_callback(RESTOREQ+DAEMON, cli_restore_no_daemon_q); 143- set_handler_callback(GETPRKEY+MAP, cli_getprkey); 144- set_handler_callback(SETPRKEY+MAP+KEY, cli_setprkey); 145- set_handler_callback(UNSETPRKEY+MAP, cli_unsetprkey); 146- set_handler_callback(SETMARGINAL+PATH, cli_set_marginal); 147- set_handler_callback(UNSETMARGINAL+PATH, cli_unset_marginal); 148- set_handler_callback(UNSETMARGINAL+MAP, cli_unset_all_marginal); 149+ set_handler_callback(GETPRSTATUS|MAP, cli_getprstatus); 150+ set_handler_callback(SETPRSTATUS|MAP, cli_setprstatus); 151+ set_handler_callback(UNSETPRSTATUS|MAP, cli_unsetprstatus); 152+ set_handler_callback(FORCEQ|DAEMON, cli_force_no_daemon_q); 153+ set_handler_callback(RESTOREQ|DAEMON, cli_restore_no_daemon_q); 154+ set_handler_callback(GETPRKEY|MAP, cli_getprkey); 155+ set_handler_callback(SETPRKEY|MAP|KEY, cli_setprkey); 156+ set_handler_callback(UNSETPRKEY|MAP, cli_unsetprkey); 157+ set_handler_callback(SETMARGINAL|PATH, cli_set_marginal); 158+ set_handler_callback(UNSETMARGINAL|PATH, cli_unset_marginal); 159+ set_handler_callback(UNSETMARGINAL|MAP, cli_unset_all_marginal); 160 161 umask(077); 162 uxsock_listen(&uxsock_trigger, ux_sock, ap); 163-- 1642.31.1 165