September 2023 - dev - lists.frrouting.org

FRR 9.0.1 and 8.5.3 Releases
by Jafar Al-Gharaibeh 28 Nov '23

28 Nov '23

Dear FRR Community, We are pleased to announce FRR 9.0.1 and FRR 8.5.3 bug fix releases. For release notes please visit: https://frrouting.org/release/ https://github.com/FRRouting/frr/releases Security updates: https://frrouting.org/security Cheers, The FRR Development Team!

1 1

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 28 Sep '23

28 Sep '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 6 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 6 of 6 defect(s) ** CID 1568381: Insecure data handling (TAINTED_SCALAR) /bgpd/bgp_linkstate_tlv.c: 1408 in bgp_linkstate_tlv_opaque_display() ________________________________________________________________________________________________________ *** CID 1568381: Insecure data handling (TAINTED_SCALAR) /bgpd/bgp_linkstate_tlv.c: 1408 in bgp_linkstate_tlv_opaque_display() 1402 1403 if (pnt + sub_length > lim) { 1404 vty_out(vty, "Bad length received: %u\n", sub_length); 1405 break; 1406 } 1407 >>> CID 1568381: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "sub_length" as a loop boundary. 1408 for (i = 0; i < sub_length; i++) { 1409 if (i != 0 && i % 8 == 0) 1410 vty_out(vty, " "); 1411 vty_out(vty, "%02x", *pnt); 1412 } 1413 } ** CID 1568380: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1568380: Insecure data handling (TAINTED_SCALAR) /bgpd/bgp_linkstate_tlv.c: 692 in bgp_linkstate_nlri_prefix_json() 686 length = pnt_decode16(&pnt); 687 688 if (pnt + length > lim) 689 /* bad length */ 690 return; 691 >>> CID 1568380: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "length" to "bgp_linkstate_nlri_value_display", which uses it as an offset. 692 ret = bgp_linkstate_nlri_value_display(NULL, 0, pnt, nlri_type, 693 type, length, false, 694 json_nlri); 695 696 if (!ret) 697 /* bad length */ ** CID 1568379: Control flow issues (DEADCODE) /bgpd/bgp_attr.c: 784 in link_state_hash_cmp() ________________________________________________________________________________________________________ *** CID 1568379: Control flow issues (DEADCODE) /bgpd/bgp_attr.c: 784 in link_state_hash_cmp() 778 const struct bgp_attr_ls *link_state1 = p1; 779 const struct bgp_attr_ls *link_state2 = p2; 780 781 if (!link_state1 && link_state2) 782 return false; 783 if (!link_state1 && link_state2) >>> CID 1568379: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "return false;". 784 return false; 785 if (!link_state1 && !link_state2) 786 return true; 787 788 if (link_state1->length != link_state2->length) 789 return false; ** CID 1568378: (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1568378: (TAINTED_SCALAR) /bgpd/bgp_linkstate_tlv.c: 1747 in bgp_linkstate_tlv_attribute_display() 1741 vty_out(vty, "Bad length received: %u\n", 1742 length); 1743 break; 1744 } 1745 } 1746 >>> CID 1568378: (TAINTED_SCALAR) >>> Passing tainted expression "length" to "bgp_linkstate_tlv_attribute_value_display", which uses it as a loop boundary. 1747 bgp_linkstate_tlv_attribute_value_display( 1748 vty, pnt, type, length, indent, json_tlv); 1749 } /bgpd/bgp_linkstate_tlv.c: 1747 in bgp_linkstate_tlv_attribute_display() 1741 vty_out(vty, "Bad length received: %u\n", 1742 length); 1743 break; 1744 } 1745 } 1746 >>> CID 1568378: (TAINTED_SCALAR) >>> Passing tainted expression "length" to "bgp_linkstate_tlv_attribute_value_display", which uses it as a loop boundary. 1747 bgp_linkstate_tlv_attribute_value_display( 1748 vty, pnt, type, length, indent, json_tlv); 1749 } /bgpd/bgp_linkstate_tlv.c: 1747 in bgp_linkstate_tlv_attribute_display() 1741 vty_out(vty, "Bad length received: %u\n", 1742 length); 1743 break; 1744 } 1745 } 1746 >>> CID 1568378: (TAINTED_SCALAR) >>> Passing tainted expression "length" to "bgp_linkstate_tlv_attribute_value_display", which uses it as an offset. 1747 bgp_linkstate_tlv_attribute_value_display( 1748 vty, pnt, type, length, indent, json_tlv); 1749 } /bgpd/bgp_linkstate_tlv.c: 1747 in bgp_linkstate_tlv_attribute_display() 1741 vty_out(vty, "Bad length received: %u\n", 1742 length); 1743 break; 1744 } 1745 } 1746 >>> CID 1568378: (TAINTED_SCALAR) >>> Passing tainted expression "length" to "bgp_linkstate_tlv_attribute_value_display", which uses it as a loop boundary. 1747 bgp_linkstate_tlv_attribute_value_display( 1748 vty, pnt, type, length, indent, json_tlv); 1749 } /bgpd/bgp_linkstate_tlv.c: 1747 in bgp_linkstate_tlv_attribute_display() 1741 vty_out(vty, "Bad length received: %u\n", 1742 length); 1743 break; 1744 } 1745 } 1746 >>> CID 1568378: (TAINTED_SCALAR) >>> Passing tainted expression "length" to "bgp_linkstate_tlv_attribute_value_display", which uses it as an offset. 1747 bgp_linkstate_tlv_attribute_value_display( 1748 vty, pnt, type, length, indent, json_tlv); 1749 } /bgpd/bgp_linkstate_tlv.c: 1747 in bgp_linkstate_tlv_attribute_display() 1741 vty_out(vty, "Bad length received: %u\n", 1742 length); 1743 break; 1744 } 1745 } 1746 >>> CID 1568378: (TAINTED_SCALAR) >>> Passing tainted expression "length" to "bgp_linkstate_tlv_attribute_value_display", which uses it as an offset. 1747 bgp_linkstate_tlv_attribute_value_display( 1748 vty, pnt, type, length, indent, json_tlv); 1749 } ** CID 1568377: (OVERRUN) /bgpd/bgp_linkstate_tlv.c: 156 in bgp_ls_tlv_check_size() /bgpd/bgp_linkstate_tlv.c: 165 in bgp_ls_tlv_check_size() /bgpd/bgp_linkstate_tlv.c: 161 in bgp_ls_tlv_check_size() /bgpd/bgp_linkstate_tlv.c: 163 in bgp_ls_tlv_check_size() ________________________________________________________________________________________________________ *** CID 1568377: (OVERRUN) /bgpd/bgp_linkstate_tlv.c: 156 in bgp_ls_tlv_check_size() 150 }; 151 /* clang-format on */ 152 153 /* Return the TLV length is valid for the TLV type */ 154 static bool bgp_ls_tlv_check_size(enum bgp_linkstate_tlv type, size_t length) 155 { >>> CID 1568377: (OVERRUN) >>> Overrunning array "bgp_linkstate_tlv_infos" of 1253 16-byte elements at element index 1253 (byte offset 20063) using index "type" (which evaluates to 1253). 156 if (type > BGP_LS_TLV_MAX || 157 bgp_linkstate_tlv_infos[type].descr == NULL) 158 /* TLV type is not defined. Cannot check size */ 159 return false; 160 161 if (bgp_linkstate_tlv_infos[type].min_size > length) /bgpd/bgp_linkstate_tlv.c: 165 in bgp_ls_tlv_check_size() 159 return false; 160 161 if (bgp_linkstate_tlv_infos[type].min_size > length) 162 return false; 163 if (bgp_linkstate_tlv_infos[type].max_size < length) 164 return false; >>> CID 1568377: (OVERRUN) >>> Overrunning array "bgp_linkstate_tlv_infos" of 1253 16-byte elements at element index 1253 (byte offset 20063) using index "type" (which evaluates to 1253). 165 if (length % bgp_linkstate_tlv_infos[type].multiple != 0) 166 return false; 167 168 return true; 169 } 170 /bgpd/bgp_linkstate_tlv.c: 161 in bgp_ls_tlv_check_size() 155 { 156 if (type > BGP_LS_TLV_MAX || 157 bgp_linkstate_tlv_infos[type].descr == NULL) 158 /* TLV type is not defined. Cannot check size */ 159 return false; 160 >>> CID 1568377: (OVERRUN) >>> Overrunning array "bgp_linkstate_tlv_infos" of 1253 16-byte elements at element index 1253 (byte offset 20063) using index "type" (which evaluates to 1253). 161 if (bgp_linkstate_tlv_infos[type].min_size > length) 162 return false; 163 if (bgp_linkstate_tlv_infos[type].max_size < length) 164 return false; 165 if (length % bgp_linkstate_tlv_infos[type].multiple != 0) 166 return false; /bgpd/bgp_linkstate_tlv.c: 163 in bgp_ls_tlv_check_size() 157 bgp_linkstate_tlv_infos[type].descr == NULL) 158 /* TLV type is not defined. Cannot check size */ 159 return false; 160 161 if (bgp_linkstate_tlv_infos[type].min_size > length) 162 return false; >>> CID 1568377: (OVERRUN) >>> Overrunning array "bgp_linkstate_tlv_infos" of 1253 16-byte elements at element index 1253 (byte offset 20063) using index "type" (which evaluates to 1253). 163 if (bgp_linkstate_tlv_infos[type].max_size < length) 164 return false; 165 if (length % bgp_linkstate_tlv_infos[type].multiple != 0) 166 return false; 167 168 return true; ** CID 1568376: Null pointer dereferences (REVERSE_INULL) /bgpd/bgp_attr.c: 4985 in bgp_packet_attribute() ________________________________________________________________________________________________________ *** CID 1568376: Null pointer dereferences (REVERSE_INULL) /bgpd/bgp_attr.c: 4985 in bgp_packet_attribute() 4979 /* VNC attribute */ 4980 bgp_packet_mpattr_tea(bgp, peer, s, attr, BGP_ATTR_VNC); 4981 #endif 4982 } 4983 4984 /* BGP Link-State */ >>> CID 1568376: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "attr" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 4985 if (attr && attr->link_state) { 4986 stream_putc(s, BGP_ATTR_FLAG_OPTIONAL); 4987 stream_putc(s, BGP_ATTR_LINK_STATE); 4988 stream_putc(s, attr->link_state->length); 4989 stream_put(s, attr->link_state->data, attr->link_state->length); 4990 } ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 22 Sep '23

22 Sep '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 105 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 1568249: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1568249: Null pointer dereferences (FORWARD_NULL) /isisd/isis_route.c: 966 in isis_route_switchover_nexthop() 960 continue; 961 962 srcdest_rnode_prefixes(rnode, (const struct prefix **)&prefix, 963 (const struct prefix **)&src_p); 964 965 /* Switchover route. */ >>> CID 1568249: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "area" to "isis_route_remove_previous_sid", which dereferences it. 966 isis_route_remove_previous_sid(area, prefix, rinfo); 967 UNSET_FLAG(rinfo->flag, ISIS_ROUTE_FLAG_ZEBRA_SYNCED); 968 isis_route_update(area, prefix, src_p, rinfo->backup); 969 970 isis_route_info_delete(rinfo); 971 972 rnode->info = NULL; 973 route_unlock_node(rnode); 974 } ** CID 1568248: API usage errors (USE_AFTER_FREE) /pimd/pim_ssmpingd.c: 188 in ssmpingd_socket() ________________________________________________________________________________________________________ *** CID 1568248: API usage errors (USE_AFTER_FREE) /pimd/pim_ssmpingd.c: 188 in ssmpingd_socket() 182 set_nonblocking(fd); 183 sockopt_reuseaddr(fd); 184 185 ret = ssmpingd_setsockopt(fd, addr, mttl); 186 if (ret) { 187 zlog_warn("ssmpingd_setsockopt failed"); >>> CID 1568248: API usage errors (USE_AFTER_FREE) >>> Calling "close(int)" closes handle "fd" which has already been closed. 188 close(fd); 189 return -1; 190 } 191 192 return fd; 193 } ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 21 Sep '23

21 Sep '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 13 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 1568217: Memory - illegal accesses (RETURN_LOCAL) /bgpd/bgpd.h: 2604 in timestamp_string() ________________________________________________________________________________________________________ *** CID 1568217: Memory - illegal accesses (RETURN_LOCAL) /bgpd/bgpd.h: 2604 in timestamp_string() 2598 static inline char *timestamp_string(time_t ts) 2599 { 2600 time_t tbuf; 2601 char timebuf[32]; 2602 2603 tbuf = time(NULL) - (monotime(NULL) - ts); >>> CID 1568217: Memory - illegal accesses (RETURN_LOCAL) >>> Returning result of calling "ctime_r". 2604 return ctime_r(&tbuf, timebuf); 2605 } 2606 2607 static inline bool peer_established(struct peer_connection *connection) 2608 { 2609 return connection->status == Established; ** CID 1568216: Integer handling issues (NEGATIVE_RETURNS) ________________________________________________________________________________________________________ *** CID 1568216: Integer handling issues (NEGATIVE_RETURNS) /lib/vty.c: 2416 in vtysh_read() 2410 2411 /* warning: watchfrr hardcodes this result write 2412 */ 2413 header[3] = ret; 2414 buffer_put(vty->obuf, header, 4); 2415 >>> CID 1568216: Integer handling issues (NEGATIVE_RETURNS) >>> "vty->pass_fd" is passed to a parameter that cannot be negative. 2416 if (!vty->t_write && (vtysh_flush(vty) < 0)) 2417 /* Try to flush results; exit if a write 2418 * error occurs. */ 2419 return; 2420 } 2421 } ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 19 Sep '23

19 Sep '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 38 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 26 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 38 defect(s) ** CID 1568213: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1568213: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_auth.c: 203 in ospf_auth_check_md5_digest() 197 EVP_DigestUpdate(ctx, auth_key, OSPF_AUTH_MD5_SIZE); 198 EVP_DigestFinal(ctx, digest, &md5_size); 199 EVP_MD_CTX_free(ctx); 200 #elif CRYPTO_INTERNAL 201 memset(&ctx, 0, sizeof(ctx)); 202 MD5Init(&ctx); >>> CID 1568213: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "length" to "md5_loop", which uses it as a loop boundary. 203 MD5Update(&ctx, ospfh, length); 204 MD5Update(&ctx, auth_key, OSPF_AUTH_MD5_SIZE); 205 MD5Final(digest, &ctx); 206 #endif 207 208 /* compare the two */ ** CID 1568212: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1568212: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_auth.c: 254 in ospf_auth_make_md5_digest() 248 EVP_DigestUpdate(ctx, auth_key, OSPF_AUTH_MD5_SIZE); 249 EVP_DigestFinal(ctx, digest, &md5_size); 250 EVP_MD_CTX_free(ctx); 251 #elif CRYPTO_INTERNAL 252 memset(&ctx, 0, sizeof(ctx)); 253 MD5Init(&ctx); >>> CID 1568212: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "length" to "md5_loop", which uses it as a loop boundary. 254 MD5Update(&ctx, ospfh, length); 255 MD5Update(&ctx, auth_key, OSPF_AUTH_MD5_SIZE); 256 MD5Final(digest, &ctx); 257 #endif 258 259 stream_put(op->s, digest, OSPF_AUTH_MD5_SIZE); ** CID 1568211: Integer handling issues (BAD_SHIFT) /pimd/pim6_mld.c: 178 in gm_gsq_pends_del() ________________________________________________________________________________________________________ *** CID 1568211: Integer handling issues (BAD_SHIFT) /pimd/pim6_mld.c: 178 in gm_gsq_pends_del() 172 { 173 uint32_t seed = a->s_bit ? 0x68f0eb5e : 0x156b7f19; 174 175 return jhash(&a->grp, sizeof(a->grp), seed); 176 } 177 >>> CID 1568211: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 178 DECLARE_HASH(gm_gsq_pends, struct gm_gsq_pending, itm, gm_gsq_pending_cmp, 179 gm_gsq_pending_hash); 180 181 /* 182 * interface -> (S,G) 183 */ ** CID 1568210: Integer handling issues (BAD_SHIFT) /vtysh/vtysh_config.c: 88 in config_master_hash_del() ________________________________________________________________________________________________________ *** CID 1568210: Integer handling issues (BAD_SHIFT) /vtysh/vtysh_config.c: 88 in config_master_hash_del() 82 static uint32_t config_hash(const struct config *c) 83 { 84 return string_hash_make(c->name); 85 } 86 87 DECLARE_LIST(config_master, struct config, rbt_item); >>> CID 1568210: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 88 DECLARE_HASH(config_master_hash, struct config, hash_item, config_cmp, 89 config_hash); 90 91 /* 92 * The config_master_head is a list for order of receipt 93 * The hash is for quick lookup under this NODE ** CID 1568209: Integer handling issues (BAD_SHIFT) /lib/event.c: 105 in cpu_records_const_next() ________________________________________________________________________________________________________ *** CID 1568209: Integer handling issues (BAD_SHIFT) /lib/event.c: 105 in cpu_records_const_next() 99 static int cpu_record_hash_cmp(const struct cpu_event_history *a, 100 const struct cpu_event_history *b) 101 { 102 return numcmp((uintptr_t)a->func, (uintptr_t)b->func); 103 } 104 >>> CID 1568209: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 105 DECLARE_HASH(cpu_records, struct cpu_event_history, item, cpu_record_hash_cmp, 106 cpu_record_hash_key); 107 108 static struct cpu_event_history *cpu_records_get(struct event_loop *loop, 109 void (*func)(struct event *e), 110 const char *funcname) ** CID 1568208: Integer handling issues (BAD_SHIFT) /zebra/zebra_opaque.c: 54 in opq_regh_const_next() ________________________________________________________________________________________________________ *** CID 1568208: Integer handling issues (BAD_SHIFT) /zebra/zebra_opaque.c: 54 in opq_regh_const_next() 48 49 /* Registration helper prototypes */ 50 static uint32_t registration_hash(const struct opq_msg_reg *reg); 51 static int registration_compare(const struct opq_msg_reg *reg1, 52 const struct opq_msg_reg *reg2); 53 >>> CID 1568208: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 54 DECLARE_HASH(opq_regh, struct opq_msg_reg, item, registration_compare, 55 registration_hash); 56 57 static struct opq_regh_head opq_reg_hash; 58 59 /* ** CID 1568207: Integer handling issues (BAD_SHIFT) /pathd/path_pcep_pcc.c: 139 in nbkey_map_del() ________________________________________________________________________________________________________ *** CID 1568207: Integer handling issues (BAD_SHIFT) /pathd/path_pcep_pcc.c: 139 in nbkey_map_del() 133 const struct req_map_data *b); 134 static uint32_t req_map_hash(const struct req_map_data *e); 135 136 /* Data Structure Declarations */ 137 DECLARE_HASH(plspid_map, struct plspid_map_data, mi, plspid_map_cmp, 138 plspid_map_hash); >>> CID 1568207: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 139 DECLARE_HASH(nbkey_map, struct nbkey_map_data, mi, nbkey_map_cmp, 140 nbkey_map_hash); 141 DECLARE_HASH(req_map, struct req_map_data, mi, req_map_cmp, req_map_hash); 142 143 static inline int req_entry_compare(const struct req_entry *a, 144 const struct req_entry *b) ** CID 1568206: Integer handling issues (BAD_SHIFT) /lib/event.c: 105 in cpu_records_del() ________________________________________________________________________________________________________ *** CID 1568206: Integer handling issues (BAD_SHIFT) /lib/event.c: 105 in cpu_records_del() 99 static int cpu_record_hash_cmp(const struct cpu_event_history *a, 100 const struct cpu_event_history *b) 101 { 102 return numcmp((uintptr_t)a->func, (uintptr_t)b->func); 103 } 104 >>> CID 1568206: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 105 DECLARE_HASH(cpu_records, struct cpu_event_history, item, cpu_record_hash_cmp, 106 cpu_record_hash_key); 107 108 static struct cpu_event_history *cpu_records_get(struct event_loop *loop, 109 void (*func)(struct event *e), 110 const char *funcname) ** CID 1568205: Integer handling issues (BAD_SHIFT) /bgpd/bgp_bmp.c: 197 in bmp_qhash_del() ________________________________________________________________________________________________________ *** CID 1568205: Integer handling issues (BAD_SHIFT) /bgpd/bgp_bmp.c: 197 in bmp_qhash_del() 191 + PSIZE(e->rd.prefixlen), 192 key); 193 194 return key; 195 } 196 >>> CID 1568205: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 197 DECLARE_HASH(bmp_qhash, struct bmp_queue_entry, bhi, 198 bmp_qhash_cmp, bmp_qhash_hkey); 199 200 static int bmp_active_cmp(const struct bmp_active *a, 201 const struct bmp_active *b) 202 { ** CID 1568204: Integer handling issues (BAD_SHIFT) /bgpd/bgp_bmp.c: 80 in bmp_bgph_const_next() ________________________________________________________________________________________________________ *** CID 1568204: Integer handling issues (BAD_SHIFT) /bgpd/bgp_bmp.c: 80 in bmp_bgph_const_next() 74 75 static uint32_t bmp_bgp_hash(const struct bmp_bgp *e) 76 { 77 return jhash(&e->bgp, sizeof(e->bgp), 0x55aa5a5a); 78 } 79 >>> CID 1568204: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 80 DECLARE_HASH(bmp_bgph, struct bmp_bgp, bbi, bmp_bgp_cmp, bmp_bgp_hash); 81 82 struct bmp_bgph_head bmp_bgph; 83 84 static int bmp_bgp_peer_cmp(const struct bmp_bgp_peer *a, 85 const struct bmp_bgp_peer *b) ** CID 1568203: Integer handling issues (BAD_SHIFT) /zebra/zebra_opaque.c: 54 in opq_regh_del() ________________________________________________________________________________________________________ *** CID 1568203: Integer handling issues (BAD_SHIFT) /zebra/zebra_opaque.c: 54 in opq_regh_del() 48 49 /* Registration helper prototypes */ 50 static uint32_t registration_hash(const struct opq_msg_reg *reg); 51 static int registration_compare(const struct opq_msg_reg *reg1, 52 const struct opq_msg_reg *reg2); 53 >>> CID 1568203: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 54 DECLARE_HASH(opq_regh, struct opq_msg_reg, item, registration_compare, 55 registration_hash); 56 57 static struct opq_regh_head opq_reg_hash; 58 59 /* ** CID 1568202: Integer handling issues (BAD_SHIFT) /pathd/path_pcep_pcc.c: 137 in plspid_map_const_next() ________________________________________________________________________________________________________ *** CID 1568202: Integer handling issues (BAD_SHIFT) /pathd/path_pcep_pcc.c: 137 in plspid_map_const_next() 131 static uint32_t nbkey_map_hash(const struct nbkey_map_data *e); 132 static int req_map_cmp(const struct req_map_data *a, 133 const struct req_map_data *b); 134 static uint32_t req_map_hash(const struct req_map_data *e); 135 136 /* Data Structure Declarations */ >>> CID 1568202: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 137 DECLARE_HASH(plspid_map, struct plspid_map_data, mi, plspid_map_cmp, 138 plspid_map_hash); 139 DECLARE_HASH(nbkey_map, struct nbkey_map_data, mi, nbkey_map_cmp, 140 nbkey_map_hash); 141 DECLARE_HASH(req_map, struct req_map_data, mi, req_map_cmp, req_map_hash); 142 ** CID 1568201: Integer handling issues (BAD_SHIFT) /lib/qobj.c: 32 in qobj_nodes_del() ________________________________________________________________________________________________________ *** CID 1568201: Integer handling issues (BAD_SHIFT) /lib/qobj.c: 32 in qobj_nodes_del() 26 return -1; 27 if (na->nid > nb->nid) 28 return 1; 29 return 0; 30 } 31 >>> CID 1568201: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 32 DECLARE_HASH(qobj_nodes, struct qobj_node, nodehash, 33 qobj_cmp, qobj_hash); 34 35 static pthread_rwlock_t nodes_lock; 36 static struct qobj_nodes_head nodes = { }; 37 ** CID 1568200: Integer handling issues (BAD_SHIFT) /staticd/static_zebra.c: 69 in static_nht_hash_del() ________________________________________________________________________________________________________ *** CID 1568200: Integer handling issues (BAD_SHIFT) /staticd/static_zebra.c: 69 in static_nht_hash_del() 63 unsigned int key = 0; 64 65 key = prefix_hash_key(&nhtd->nh); 66 return jhash_2words(nhtd->nh_vrf_id, nhtd->safi, key); 67 } 68 >>> CID 1568200: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 69 DECLARE_HASH(static_nht_hash, struct static_nht_data, itm, static_nht_data_cmp, 70 static_nht_data_hash); 71 72 static struct static_nht_hash_head static_nht_hash[1]; 73 74 /* Zebra structure to hold current status. */ ** CID 1568199: Integer handling issues (BAD_SHIFT) /pimd/pim6_mld.c: 249 in gm_subscribers_const_next() ________________________________________________________________________________________________________ *** CID 1568199: Integer handling issues (BAD_SHIFT) /pimd/pim6_mld.c: 249 in gm_subscribers_const_next() 243 244 static uint32_t gm_subscriber_hash(const struct gm_subscriber *a) 245 { 246 return jhash(&a->addr, sizeof(a->addr), 0xd0e94ad4); 247 } 248 >>> CID 1568199: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 249 DECLARE_HASH(gm_subscribers, struct gm_subscriber, itm, gm_subscriber_cmp, 250 gm_subscriber_hash); 251 252 static struct gm_subscriber *gm_subscriber_findref(struct gm_if *gm_ifp, 253 pim_addr addr) 254 { ** CID 1568198: Integer handling issues (BAD_SHIFT) /bgpd/bgp_bmp.c: 99 in bmp_peerh_const_next() ________________________________________________________________________________________________________ *** CID 1568198: Integer handling issues (BAD_SHIFT) /bgpd/bgp_bmp.c: 99 in bmp_peerh_const_next() 93 94 static uint32_t bmp_bgp_peer_hash(const struct bmp_bgp_peer *e) 95 { 96 return e->peerid; 97 } 98 >>> CID 1568198: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 99 DECLARE_HASH(bmp_peerh, struct bmp_bgp_peer, bpi, 100 bmp_bgp_peer_cmp, bmp_bgp_peer_hash); 101 102 struct bmp_peerh_head bmp_peerh; 103 104 DECLARE_LIST(bmp_mirrorq, struct bmp_mirrorq, bmi); ** CID 1568197: Integer handling issues (BAD_SHIFT) /lib/table.c: 28 in rn_hash_node_del() ________________________________________________________________________________________________________ *** CID 1568197: Integer handling issues (BAD_SHIFT) /lib/table.c: 28 in rn_hash_node_del() 22 static int route_table_hash_cmp(const struct route_node *a, 23 const struct route_node *b) 24 { 25 return prefix_cmp(&a->p, &b->p); 26 } 27 >>> CID 1568197: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 28 DECLARE_HASH(rn_hash_node, struct route_node, nodehash, route_table_hash_cmp, 29 prefix_hash_key); 30 /* 31 * route_table_init_with_delegate 32 */ 33 struct route_table * ** CID 1568196: Integer handling issues (BAD_SHIFT) /lib/routemap.c: 49 in rmap_cmd_name_const_next() ________________________________________________________________________________________________________ *** CID 1568196: Integer handling issues (BAD_SHIFT) /lib/routemap.c: 49 in rmap_cmd_name_const_next() 43 44 static uint32_t rmap_cmd_name_hash(const struct route_map_rule_cmd_proxy *item) 45 { 46 return jhash(item->cmd->str, strlen(item->cmd->str), 0xbfd69320); 47 } 48 >>> CID 1568196: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 49 DECLARE_HASH(rmap_cmd_name, struct route_map_rule_cmd_proxy, itm, 50 rmap_cmd_name_cmp, rmap_cmd_name_hash); 51 52 static struct rmap_cmd_name_head rmap_match_cmds[1] = { 53 INIT_HASH(rmap_match_cmds[0]), 54 }; ** CID 1568195: Integer handling issues (BAD_SHIFT) /bgpd/bgp_bmp.c: 99 in bmp_peerh_del() ________________________________________________________________________________________________________ *** CID 1568195: Integer handling issues (BAD_SHIFT) /bgpd/bgp_bmp.c: 99 in bmp_peerh_del() 93 94 static uint32_t bmp_bgp_peer_hash(const struct bmp_bgp_peer *e) 95 { 96 return e->peerid; 97 } 98 >>> CID 1568195: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 99 DECLARE_HASH(bmp_peerh, struct bmp_bgp_peer, bpi, 100 bmp_bgp_peer_cmp, bmp_bgp_peer_hash); 101 102 struct bmp_peerh_head bmp_peerh; 103 104 DECLARE_LIST(bmp_mirrorq, struct bmp_mirrorq, bmi); ** CID 1568194: Integer handling issues (BAD_SHIFT) /pimd/pim6_mld.c: 178 in gm_gsq_pends_const_next() ________________________________________________________________________________________________________ *** CID 1568194: Integer handling issues (BAD_SHIFT) /pimd/pim6_mld.c: 178 in gm_gsq_pends_const_next() 172 { 173 uint32_t seed = a->s_bit ? 0x68f0eb5e : 0x156b7f19; 174 175 return jhash(&a->grp, sizeof(a->grp), seed); 176 } 177 >>> CID 1568194: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 178 DECLARE_HASH(gm_gsq_pends, struct gm_gsq_pending, itm, gm_gsq_pending_cmp, 179 gm_gsq_pending_hash); 180 181 /* 182 * interface -> (S,G) 183 */ ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 13 Sep '23

13 Sep '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 6 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 26 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 6 of 6 defect(s) ** CID 1568134: Null pointer dereferences (NULL_RETURNS) /isisd/isis_zebra.c: 1146 in isis_zebra_process_srv6_locator_chunk() ________________________________________________________________________________________________________ *** CID 1568134: Null pointer dereferences (NULL_RETURNS) /isisd/isis_zebra.c: 1146 in isis_zebra_process_srv6_locator_chunk() 1140 "prefix %pFX, block_len %u, node_len %u, func_len %u, arg_len %u", 1141 chunk->locator_name, &chunk->prefix, chunk->block_bits_length, 1142 chunk->node_bits_length, chunk->function_bits_length, 1143 chunk->argument_bits_length); 1144 1145 /* Walk through all areas of the ISIS instance */ >>> CID 1568134: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing "isis", which is known to be "NULL". 1146 for (ALL_LIST_ELEMENTS_RO(isis->area_list, node, area)) { 1147 if (strncmp(area->srv6db.config.srv6_locator_name, 1148 chunk->locator_name, 1149 sizeof(area->srv6db.config.srv6_locator_name)) != 0) 1150 continue; 1151 ** CID 1568133: Null pointer dereferences (REVERSE_INULL) /isisd/isis_zebra.c: 1077 in isis_zebra_srv6_adj_sid_uninstall() ________________________________________________________________________________________________________ *** CID 1568133: Null pointer dereferences (REVERSE_INULL) /isisd/isis_zebra.c: 1077 in isis_zebra_srv6_adj_sid_uninstall() 1071 enum seg6local_action_t action = ZEBRA_SEG6_LOCAL_ACTION_UNSPEC; 1072 struct interface *ifp; 1073 uint16_t prefixlen = IPV6_MAX_BITLEN; 1074 struct isis_circuit *circuit = sra->adj->circuit; 1075 struct isis_area *area = circuit->area; 1076 >>> CID 1568133: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "sra" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 1077 if (!sra) 1078 return; 1079 1080 switch (sra->behavior) { 1081 case SRV6_ENDPOINT_BEHAVIOR_END_X: 1082 prefixlen = IPV6_MAX_BITLEN; ** CID 1568132: Null pointer dereferences (REVERSE_INULL) /isisd/isis_zebra.c: 1023 in isis_zebra_srv6_adj_sid_install() ________________________________________________________________________________________________________ *** CID 1568132: Null pointer dereferences (REVERSE_INULL) /isisd/isis_zebra.c: 1023 in isis_zebra_srv6_adj_sid_install() 1017 struct seg6local_context ctx = {}; 1018 uint16_t prefixlen = IPV6_MAX_BITLEN; 1019 struct interface *ifp; 1020 struct isis_circuit *circuit = sra->adj->circuit; 1021 struct isis_area *area = circuit->area; 1022 >>> CID 1568132: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "sra" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 1023 if (!sra) 1024 return; 1025 1026 sr_debug("ISIS-SRv6 (%s): setting adjacency SID %pI6", area->area_tag, 1027 &sra->sid); 1028 ** CID 1568131: Possible Control flow issues (DEADCODE) /bgpd/bgp_route.c: 1503 in bgp_evpn_path_info_cmp() ________________________________________________________________________________________________________ *** CID 1568131: Possible Control flow issues (DEADCODE) /bgpd/bgp_route.c: 1503 in bgp_evpn_path_info_cmp() 1497 { 1498 enum bgp_path_selection_reason reason; 1499 char pfx_buf[PREFIX2STR_BUFFER] = {}; 1500 bool debug = false; 1501 1502 if (debug) >>> CID 1568131: Possible Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "prefix2str(union prefixcons...". 1503 prefix2str(bgp_dest_get_prefix(new->net), pfx_buf, 1504 sizeof(pfx_buf)); 1505 1506 return bgp_path_info_cmp(bgp, new, exist, paths_eq, NULL, debug, 1507 pfx_buf, AFI_L2VPN, SAFI_EVPN, &reason); 1508 } ** CID 1568130: Integer handling issues (BAD_SHIFT) /lib/event.c: 105 in cpu_records_add() ________________________________________________________________________________________________________ *** CID 1568130: Integer handling issues (BAD_SHIFT) /lib/event.c: 105 in cpu_records_add() 99 static int cpu_record_hash_cmp(const struct cpu_event_history *a, 100 const struct cpu_event_history *b) 101 { 102 return numcmp((uintptr_t)a->func, (uintptr_t)b->func); 103 } 104 >>> CID 1568130: Integer handling issues (BAD_SHIFT) >>> In expression "hval >> 33 - h->hh.tabshift", right shifting by more than 31 bits has undefined behavior. The shift amount, "33 - h->hh.tabshift", is 33. 105 DECLARE_HASH(cpu_records, struct cpu_event_history, item, cpu_record_hash_cmp, 106 cpu_record_hash_key); 107 108 static struct cpu_event_history *cpu_records_get(struct event_loop *loop, 109 void (*func)(struct event *e), 110 const char *funcname) ** CID 1568129: Null pointer dereferences (REVERSE_INULL) /isisd/isis_tlvs.c: 2813 in unpack_item_srv6_end_sid() ________________________________________________________________________________________________________ *** CID 1568129: Null pointer dereferences (REVERSE_INULL) /isisd/isis_tlvs.c: 2813 in unpack_item_srv6_end_sid() 2807 sid->subsubtlvs = NULL; 2808 } 2809 2810 append_item(&subtlvs->srv6_end_sids, (struct isis_item *)sid); 2811 return 0; 2812 out: >>> CID 1568129: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "sid" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 2813 if (sid) 2814 free_item_srv6_end_sid((struct isis_item *)sid); 2815 return 1; 2816 } 2817 2818 /* Functions related to TLVs 1 Area Addresses */ ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

Re: [dev] Best Version And linux Platform For 40Gbps BW on Frr
by David Schweizer 11 Sep '23

11 Sep '23

Hello Ramin, Take a look at this blog article series: https://ipng.ch/s/articles/2021/08/12/vpp-1.html Kind regards, David On 9/10/23 22:10, Ramin Malekgahsemi via dev wrote: > _______________________________________________ > dev mailing list > dev(a)lists.frrouting.org > https://lists.frrouting.org/listinfo/dev

1 0

Best Version And linux Platform For 40Gbps BW on Frr
by Ramin Malekgahsemi 10 Sep '23

10 Sep '23

Hi Dears I want Forward 40G To up 100G bps BW On Frr Please Suggest To me stable linux version and frr Version Fo this Capacity Thanks

1 0

Re: [dev] FRR 9.0.1 and 8.5.3 Releases
by mike tancsa 08 Sep '23

08 Sep '23

Hi, I am guessing there is still no easy way to upgrade individual instances from 8.5.1 to 8.5.3 when ibgp is involved ? ie its a "do all at once" step ? https://lists.frrouting.org/pipermail/frog/2023-June/001283.html ---Mike On 9/8/2023 11:52 AM, Jafar Al-Gharaibeh via dev wrote: > _______________________________________________ > dev mailing list > dev(a)lists.frrouting.org > https://lists.frrouting.org/listinfo/dev

2 1

Help please: CI run for PR #14278 hangs
by Yasuhiro Ohara 07 Sep '23

07 Sep '23

Hi. I made a PR (#14278), but my CI run does not finish. Would somebody help me please? The Bamboo says: ``` Bamboo has detected that FRR-PULLREQ2-TOPO2DEB10AMD64-13825 may have hung. This build has been running for 1475 minutes. This is 4192% longer than usual. It has been 1463 minutes since Bamboo received a log message for this build. ``` >From what I can see in the left window of the Bamboo, it appears that builds and AddressSanitizers, etc are finishing okay, but almost all topotests fail, and a few topotests is still running (i.e., hanging). I tried to topotest in my local env (Ubuntu 22.04.1 LTS), but even original FRR (current master) didn't finish correctly. It says: ``` = 40 failed, 1322 passed, 153 skipped, 7 warnings, 86 errors in 846.82s (0:14:06) = ``` One of the simple tests bgp_asdot_regex fails like: ``` 2023-08-27 11:04:41,563 INFO: topo: Check if neighbor sessions are up in r1 2023-08-27 11:04:49,762 ERROR: topo: '_bgp_converge' failed after 8.20 seconds 2023-08-27 11:04:49,765 ERROR: topo: test failed at "bgp_asdot_regex.test_bgp_as dot_regex/test_bgp_asdot_regex": Failed to see BGP convergence in "r1" ``` where in the setup period it failed to see two BGP routers become Established. Any help is appreciated. Thanks. Yasu

2 1