From b7eebd396261199cd9722a2cba14698446740f0d Mon Sep 17 00:00:00 2001
From: miaoguanqin <miaoguanqin@huawei.com>
Date: Thu, 17 Nov 2022 21:19:39 +0800
Subject: [PATCH] multipathd: Fixed multipathd parameter invoking sequence
 changed problem in CVE-2022-41974.

Users may fail to execute command: multipathd and mpathpersist.

When we execute the command mpathpersist：
mpathpersist --out --register --param-sark=123 --prout-type=5 /dev/mapper/mpathb
It return an error : Missing arguement. The preceding command calls the function
cli_setprkey, which is called by checking whether the handle values are consistent
with the command input. CVE-2022-41974 changed the handler value of function and
changed the mode of calculating handle.  The handler value is not equal to the
command input, causing multipathd can not execute the true funcion. It could be
an same error for executing multipoathd by the old mode.

multipathd invokes the corresponding function based on the handle value.
CVE-2022-41964 changed the method of calculating handler value. Modify the handle
value so that the corresponding function can be correctly execute.

Signed-off-by: miaoguanqin <miaoguanqin@huawei.com>
Signed-off-by: lixiaokeng <lixiaokeng@huawei.com>
---
 multipathd/callbacks.c | 18 +++++++++---------
 multipathd/cli.h       |  9 ++++++++-
 2 files changed, 17 insertions(+), 10 deletions(-)

diff --git a/multipathd/callbacks.c b/multipathd/callbacks.c
index fb87b280..f32666be 100644
--- a/multipathd/callbacks.c
+++ b/multipathd/callbacks.c
@@ -57,16 +57,16 @@ void init_handler_callbacks(void)
 	set_handler_callback(VRB_RESTOREQ | Q1_MAPS, HANDLER(cli_restore_all_queueing));
 	set_unlocked_handler_callback(VRB_QUIT, HANDLER(cli_quit));
 	set_unlocked_handler_callback(VRB_SHUTDOWN, HANDLER(cli_shutdown));
-	set_handler_callback(VRB_GETPRSTATUS | Q1_MAP, HANDLER(cli_getprstatus));
-	set_handler_callback(VRB_SETPRSTATUS | Q1_MAP, HANDLER(cli_setprstatus));
-	set_handler_callback(VRB_UNSETPRSTATUS | Q1_MAP, HANDLER(cli_unsetprstatus));
+	set_handler_callback(KEY_MAP | Q1_GETPRSTATUS, HANDLER(cli_getprstatus));
+	set_handler_callback(KEY_MAP | Q1_SETSTATUS, HANDLER(cli_setprstatus));
+	set_handler_callback(KEY_MAP | Q1_UNSETSTATUS, HANDLER(cli_unsetprstatus));
 	set_handler_callback(VRB_FORCEQ | Q1_DAEMON, HANDLER(cli_force_no_daemon_q));
 	set_handler_callback(VRB_RESTOREQ | Q1_DAEMON, HANDLER(cli_restore_no_daemon_q));
-	set_handler_callback(VRB_GETPRKEY | Q1_MAP, HANDLER(cli_getprkey));
-	set_handler_callback(VRB_SETPRKEY | Q1_MAP | Q2_KEY, HANDLER(cli_setprkey));
-	set_handler_callback(VRB_UNSETPRKEY | Q1_MAP, HANDLER(cli_unsetprkey));
-	set_handler_callback(VRB_SETMARGINAL | Q1_PATH, HANDLER(cli_set_marginal));
-	set_handler_callback(VRB_UNSETMARGINAL | Q1_PATH, HANDLER(cli_unset_marginal));
-	set_handler_callback(VRB_UNSETMARGINAL | Q1_MAP,
+	set_handler_callback(KEY_MAP | Q1_GETPRKEY, HANDLER(cli_getprkey));
+	set_handler_callback(KEY_MAP | Q1_SETKEY | Q2_KEY, HANDLER(cli_setprkey));
+	set_handler_callback(KEY_MAP | Q1_UNSETKEY, HANDLER(cli_unsetprkey));
+	set_handler_callback(KEY_PATH | Q1_SETMARGINAL, HANDLER(cli_set_marginal));
+	set_handler_callback(KEY_PATH | Q1_UNSETMARGINAL, HANDLER(cli_unset_marginal));
+	set_handler_callback(KEY_MAP | Q1_UNSETMARGINAL,
 			     HANDLER(cli_unset_all_marginal));
 }
diff --git a/multipathd/cli.h b/multipathd/cli.h
index c6b79c9d..08ee5c8d 100644
--- a/multipathd/cli.h
+++ b/multipathd/cli.h
@@ -80,7 +80,14 @@ enum {
 	Q1_ALL			= KEY_ALL << 8,
 	Q1_DAEMON		= KEY_DAEMON << 8,
 	Q1_STATUS		= KEY_STATUS << 8,
-
+	Q1_SETKEY		= VRB_SETPRKEY << 8,
+	Q1_UNSETKEY		= VRB_UNSETPRKEY << 8,
+	Q1_SETSTATUS		= VRB_SETPRSTATUS << 8,
+	Q1_UNSETSTATUS		= VRB_UNSETPRSTATUS << 8,
+	Q1_GETPRSTATUS		= VRB_GETPRSTATUS << 8,
+	Q1_GETPRKEY		= VRB_GETPRKEY << 8,
+	Q1_SETMARGINAL		= VRB_SETMARGINAL << 8,
+	Q1_UNSETMARGINAL	= VRB_UNSETMARGINAL << 8,
 	/* byte 2: qualifier 2 */
 	Q2_FMT			= KEY_FMT << 16,
 	Q2_RAW			= KEY_RAW << 16,
-- 
2.33.0