[dm-devel] libmultipath: fix NULL dereference in get_be64

[Martin Wilck]

On Mon, 2021-02-01 at 19:49 +0800, lixiaokeng wrote:
> 
> 
> On 2021/2/1 19:16, Martin Wilck wrote:
> > I don't understand. All callers (uev_add_path(), cli_add_path(),
> > check_path()) call pathinfo() first, which would return
> > PATHINFO_SKIPPED if the path was blacklisted. How do you end up 
> > in ev_add_path() with a blacklisted path?
> > 
> > And how is it possible that add_map_with_path(vecs, pp, 1) returns
> > non-
> > NULL and pp->mpp is NULL?
> 
> The sdb is a local disk, stack:
> 
> cli_add_path
>    ->ev_add_path
>       ->add_map_with_path
>          ->adopt_paths
>             ->pathinfo
>                ->filter_property
>                ->return PATHINFO_SKIPPED,
>             ->pp->mpp is NULL and not be set
>             ->return 0

This returns 0, but add_map_with_path() has this code to check whether
the path passed to it was actually added to the new map:

	if (adopt_paths(vecs->pathvec, mpp) ||
	    find_slot(vecs->pathvec, pp) == -1)
		goto out;  -> return NULL

So ev_add_path() should have seen a NULL return from
add_map_with_path(), should not have set start_waiter, and failed. 

Wait ... perhaps it could happen if after "goto rescan:" that
start_waiter was already set to one.

Can you try the attached patch?


>       ->mpath_pr_event_handle
>          ->get_be64 //pp->mpp is dereference
> 
> The multipath.conf show:
> defaults {
>         find_multipaths no
> }
> 
> Here, my local disks can't pass filter_property. Why?

This depends on the disk, and on your blacklisting settings. By
default, multipathd refuses paths that have neither
SCSI_IDENT_* nor ID_WWN_* properties set. See multipath.conf(5).

Regards
Martin

-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-multipathd-ev_add_path-fail-if-add_map_with_path-fai.patch
Type: text/x-patch
Size: 798 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/dm-devel/attachments/20210201/a05954f6/attachment.bin>