[PATCH] libmultipath: fix crash in print_foreign_topology

[PATCH] libmultipath: fix crash in print_foreign_topology

[Benjamin Marzinski]

print_foreign_topology() called get_paths() to get a vector of
(struct gen_path *) items and then called get_multipath_layout__(),
which expects a vector of (struct gen_multipath *) items, with the path
vector. This can easily end badly. Fix it to correctly call
get_path_layout__(), and rename width to p_width in the functions that
end up calling snprint_multipath_topology__(), which is expecting to get
passed the path field widths.

Fixes: d54f271ef ("libmultipath: introduce width argument for pretty-printing functions")
Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com>
---
 libmultipath/foreign.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/libmultipath/foreign.c b/libmultipath/foreign.c
index 138b2eb3..72fef8b0 100644
--- a/libmultipath/foreign.c
+++ b/libmultipath/foreign.c
@@ -488,7 +488,7 @@ void foreign_multipath_layout(fieldwidth_t *width)
 }
 
 static int snprint_foreign_topology__(struct strbuf *buf, int verbosity,
-				      const fieldwidth_t *width)
+				      const fieldwidth_t *p_width)
 {
 	struct foreign *fgn;
 	int i;
@@ -506,7 +506,7 @@ static int snprint_foreign_topology__(struct strbuf *buf, int verbosity,
 		if (vec != NULL) {
 			vector_foreach_slot(vec, gm, j) {
 				if (snprint_multipath_topology__(
-					    gm, buf, verbosity, width) < 0)
+					    gm, buf, verbosity, p_width) < 0)
 					break;
 			}
 		}
@@ -518,7 +518,7 @@ static int snprint_foreign_topology__(struct strbuf *buf, int verbosity,
 }
 
 int snprint_foreign_topology(struct strbuf *buf, int verbosity,
-			     const fieldwidth_t *width)
+			     const fieldwidth_t *p_width)
 {
 	int rc;
 
@@ -528,7 +528,7 @@ int snprint_foreign_topology(struct strbuf *buf, int verbosity,
 		return 0;
 	}
 	pthread_cleanup_push(unlock_foreigns, NULL);
-	rc = snprint_foreign_topology__(buf, verbosity, width);
+	rc = snprint_foreign_topology__(buf, verbosity, p_width);
 	pthread_cleanup_pop(1);
 	return rc;
 }
@@ -538,9 +538,9 @@ void print_foreign_topology(int verbosity)
 	STRBUF_ON_STACK(buf);
 	struct foreign *fgn;
 	int i;
-	fieldwidth_t *width __attribute__((cleanup(cleanup_ucharp))) = NULL;
+	fieldwidth_t *p_width __attribute__((cleanup(cleanup_ucharp))) = NULL;
 
-	if ((width = alloc_path_layout()) == NULL)
+	if ((p_width = alloc_path_layout()) == NULL)
 		return;
 	rdlock_foreigns();
 	if (foreigns == NULL) {
@@ -554,11 +554,11 @@ void print_foreign_topology(int verbosity)
 		fgn->lock(fgn->context);
 		pthread_cleanup_push(fgn->unlock, fgn->context);
 		vec = fgn->get_paths(fgn->context);
-		get_multipath_layout__(vec, LAYOUT_RESET_NOT, width);
+		get_path_layout__(vec, LAYOUT_RESET_NOT, p_width);
 		fgn->release_paths(fgn->context, vec);
 		pthread_cleanup_pop(1);
 	}
-	snprint_foreign_topology__(&buf, verbosity, width);
+	snprint_foreign_topology__(&buf, verbosity, p_width);
 	pthread_cleanup_pop(1);
 	printf("%s", get_strbuf_str(&buf));
 }
-- 
2.50.1

Re: [PATCH] libmultipath: fix crash in print_foreign_topology

[Martin Wilck]

On Wed, 2025-08-20 at 14:39 -0400, Benjamin Marzinski wrote:
> print_foreign_topology() called get_paths() to get a vector of
> (struct gen_path *) items and then called get_multipath_layout__(),
> which expects a vector of (struct gen_multipath *) items, with the
> path
> vector. This can easily end badly. Fix it to correctly call
> get_path_layout__(), and rename width to p_width in the functions
> that
> end up calling snprint_multipath_topology__(), which is expecting to
> get
> passed the path field widths.

Thanks for catching this!

I don't like the p_width rename so much, as we generally don't have
this kind of variable naming convention, but that's not a problem.

Reviewed-by: Martin Wilck <mwilck@suse.com>