[PATCH 1/2] libmultipath: make sure sscanf sets a max field width for strings

[PATCH 1/2] libmultipath: make sure sscanf sets a max field width for strings

[Benjamin Marzinski]

In the iet and datacore prioritizers, multipath was using sscanf to get
a string for a 255 byte buffer, without limiting the size of the string.
This could result in a buffer overflow, if there was a bad value in
multipath.conf.

Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com>
---

Note:
This patch applies on top of Martin's ("libmultipath: iet prioritizer:
obtain PATH_ID from udev") commit, from the "tip" branch.

 libmultipath/prioritizers/datacore.c | 6 +++---
 libmultipath/prioritizers/iet.c      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/libmultipath/prioritizers/datacore.c b/libmultipath/prioritizers/datacore.c
index ab813a0e..a7c2ae3e 100644
--- a/libmultipath/prioritizers/datacore.c
+++ b/libmultipath/prioritizers/datacore.c
@@ -49,11 +49,11 @@ int datacore_prio (const char *dev, int sg_fd, char * args,
 		return 0;
 	}
 
-	if (sscanf(args, "timeout=%i preferredsds=%s",
+	if (sscanf(args, "timeout=%i preferredsds=%254s",
 		   (int *)&timeout_ms, preferredsds) == 2) {}
-	else if (sscanf(args, "preferredsds=%s timeout=%i",
+	else if (sscanf(args, "preferredsds=%254s timeout=%i",
 			preferredsds, (int *)&timeout_ms) == 2) {}
-	else if (sscanf(args, "preferredsds=%s",
+	else if (sscanf(args, "preferredsds=%254s",
 			preferredsds) == 1) {}
 	else {
 		dc_log(0, "unexpected prio_args format");
diff --git a/libmultipath/prioritizers/iet.c b/libmultipath/prioritizers/iet.c
index 97d35192..cddf29c6 100644
--- a/libmultipath/prioritizers/iet.c
+++ b/libmultipath/prioritizers/iet.c
@@ -101,7 +101,7 @@ int iet_prio(struct udev_device *udev, char *args)
 		return 0;
 	}
 	// check if args format is OK
-	if (sscanf(args, "preferredip=%s", preferredip) != 1) {
+	if (sscanf(args, "preferredip=%254s", preferredip) != 1) {
 		if (!arg_logged) {
 			dc_log(2, "unexpected prio_args format");
 			arg_logged = true;
-- 
2.53.0

[PATCH 2/2] Remove unsed DEFAULT_DISABLE_CHANGED_WWIDS define

[Benjamin Marzinski]

disable_changed_wwids is deprecated and unused.

Suggested-by: Xose Vazquez Perez <xose.vazquez@gmail.com>
Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com>
---
 libmultipath/defaults.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/libmultipath/defaults.h b/libmultipath/defaults.h
index ea1fce0e..c3ae42e9 100644
--- a/libmultipath/defaults.h
+++ b/libmultipath/defaults.h
@@ -49,7 +49,6 @@
 #define UNSET_PARTITION_DELIM "/UNSET/"
 #define DEFAULT_PARTITION_DELIM	NULL
 #define DEFAULT_SKIP_KPARTX SKIP_KPARTX_OFF
-#define DEFAULT_DISABLE_CHANGED_WWIDS 1
 #define DEFAULT_MAX_SECTORS_KB MAX_SECTORS_KB_UNDEF
 #define DEFAULT_GHOST_DELAY GHOST_DELAY_OFF
 #define DEFAULT_FIND_MULTIPATHS_TIMEOUT -10
-- 
2.53.0

Re: [PATCH 1/2] libmultipath: make sure sscanf sets a max field width for strings

[Xose Vazquez Perez]

On 7/7/26 2:48 AM, Benjamin Marzinski wrote:

> Note:
> This patch applies on top of Martin's ("libmultipath: iet prioritizer:
> obtain PATH_ID from udev") commit, from the "tip" branch.
Martin, this should be removed from iet.c:
"// Uses /dev/disk/by-path to find the IP of the device."

Re: [PATCH 1/2] libmultipath: make sure sscanf sets a max field width for strings

[Martin Wilck]

On Tue, 2026-07-07 at 07:52 +0200, Xose Vazquez Perez wrote:
> On 7/7/26 2:48 AM, Benjamin Marzinski wrote:
> 
> > Note:
> > This patch applies on top of Martin's ("libmultipath: iet
> > prioritizer:
> > obtain PATH_ID from udev") commit, from the "tip" branch.
> Martin, this should be removed from iet.c:
> "// Uses /dev/disk/by-path to find the IP of the device."

I'm working on a fix. See my "tip" branch.

-- 
Dr. Martin Wilck <mwilck@suse.com>
SUSE Software Solutions Germany GmbH, Frankenstr. 146, 90461 Nürnberg,
Germany
Geschäftsführer: Jochen Jaser, Andrew McDonald (HRB 36809,AG Nürnberg)

Re: [PATCH 1/2] libmultipath: make sure sscanf sets a max field width for strings

[Xose Vazquez Perez]

On 7/7/26 1:46 PM, Martin Wilck wrote:

> On Tue, 2026-07-07 at 07:52 +0200, Xose Vazquez Perez wrote:

>> Martin, this should be removed from iet.c:
>> "// Uses /dev/disk/by-path to find the IP of the device."

> I'm working on a fix. See my "tip" branch.
I mean this:

diff --git i/libmultipath/prioritizers/iet.c w/libmultipath/prioritizers/iet.c
index 97d35192..ab3e1f0c 100644
--- i/libmultipath/prioritizers/iet.c
+++ w/libmultipath/prioritizers/iet.c
@@ -21,7 +21,6 @@
  //   prio      "iet"
  //   prio_args "preferredip=10.11.12.13"
  //
-// Uses /dev/disk/by-path to find the IP of the device.
  // Assigns prio 20 (high) to the preferred IP and prio 10 (low) to the rest.
  //
  // by Olivier Lambert <lambert.olivier.gmail.com>

Re: [PATCH 1/2] libmultipath: make sure sscanf sets a max field width for strings

[Martin Wilck]

On Mon, 2026-07-06 at 20:48 -0400, Benjamin Marzinski wrote:
> In the iet and datacore prioritizers, multipath was using sscanf to
> get
> a string for a 255 byte buffer, without limiting the size of the
> string.
> This could result in a buffer overflow, if there was a bad value in
> multipath.conf.
> 
> Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com>

Reviewed-by: Martin Wilck <mwilck@suse.com>

Re: [PATCH 2/2] Remove unsed DEFAULT_DISABLE_CHANGED_WWIDS define

[Martin Wilck]

On Mon, 2026-07-06 at 20:48 -0400, Benjamin Marzinski wrote:
> disable_changed_wwids is deprecated and unused.
> 
> Suggested-by: Xose Vazquez Perez <xose.vazquez@gmail.com>
> Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com>

Reviewed-by: Martin Wilck <mwilck@suse.com>

Re: [PATCH 1/2] libmultipath: make sure sscanf sets a max field width for strings

[Martin Wilck]

On Mon, 2026-07-06 at 20:48 -0400, Benjamin Marzinski wrote:
> In the iet and datacore prioritizers, multipath was using sscanf to
> get
> a string for a 255 byte buffer, without limiting the size of the
> string.
> This could result in a buffer overflow, if there was a bad value in
> multipath.conf.
> 
> Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com>
> ---
> 
> Note:
> This patch applies on top of Martin's ("libmultipath: iet
> prioritizer:
> obtain PATH_ID from udev") commit, from the "tip" branch.

As that patch hasn't been verified yet, I'm going to apply your patch
on the "queue" branch for now.

Regards
Martin
-- 
Dr. Martin Wilck <mwilck@suse.com>
SUSE Software Solutions Germany GmbH, Frankenstr. 146, 90461 Nürnberg,
Germany
Geschäftsführer: Jochen Jaser, Andrew McDonald (HRB 36809,AG Nürnberg)