January 2025 - dev - lists.frrouting.org

FRR Release 10.2
by Jafar Al-Gharaibeh 10 Nov '25

10 Nov '25

Dear FRR Community, We are pleased to announce FRR release 10.2. Release notes are available at: https://frrouting.org/release https://github.com/FRRouting/frr/releases Please let us know if you see any issues. Cheers, The FRR Development Team!

2 8

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 20 Jan '25

20 Jan '25

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1620101: (USE_AFTER_FREE) /lib/northbound_notif.c: 585 in timer_walk_continue() /lib/northbound_notif.c: 585 in timer_walk_continue() ________________________________________________________________________________________________________ *** CID 1620101: (USE_AFTER_FREE) /lib/northbound_notif.c: 585 in timer_walk_continue() 579 const char *path; 580 int ret; 581 582 /* 583 * Notify about deletes until we have add changes to collect. 584 */ >>> CID 1620101: (USE_AFTER_FREE) >>> Dereferencing freed pointer "group". 585 while (group->cur_changes == &group->dels) { 586 ret = nb_notify_delete_changes(args); 587 if (ret) { 588 timer_walk_abort(args); 589 return; 590 } /lib/northbound_notif.c: 585 in timer_walk_continue() 579 const char *path; 580 int ret; 581 582 /* 583 * Notify about deletes until we have add changes to collect. 584 */ >>> CID 1620101: (USE_AFTER_FREE) >>> Dereferencing freed pointer "group". 585 while (group->cur_changes == &group->dels) { 586 ret = nb_notify_delete_changes(args); 587 if (ret) { 588 timer_walk_abort(args); 589 return; 590 } ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/freerangerouting-frr?tab=overview

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 16 Jan '25

16 Jan '25

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 7 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 7 of 7 defect(s) ** CID 1617729: API usage errors (PRINTF_ARGS) ________________________________________________________________________________________________________ *** CID 1617729: API usage errors (PRINTF_ARGS) /lib/mgmt_be_client.c: 624 in mgmt_be_txn_cfg_prepare() 618 } 619 } 620 621 mgmt_be_send_cfgdata_create_reply(client_ctx, txn->txn_id, 622 error ? false : true, error ? err_buf : NULL); 623 >>> CID 1617729: API usage errors (PRINTF_ARGS) >>> Length modifier "L" not applicable to conversion specifier in "%Lu". 624 debug_be_client("Avg-nb-edit-duration %Lu uSec, nb-prep-duration %lu (avg: %Lu) uSec, batch size %u", 625 client_ctx->avg_edit_nb_cfg_tm, prep_nb_cfg_tm, 626 client_ctx->avg_prep_nb_cfg_tm, (uint32_t)num_processed); 627 628 if (error) 629 mgmt_be_txn_cfg_abort(txn); ** CID 1617728: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1617728: Insecure data handling (TAINTED_SCALAR) /zebra/dplane_fpm_nl.c: 726 in fpm_read() 720 * enqueue it to zebra for processing. 721 */ 722 ctx = dplane_ctx_alloc(); 723 dplane_ctx_route_init(ctx, DPLANE_OP_ROUTE_NOTIFY, NULL, 724 NULL); 725 >>> CID 1617728: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "hdr->rta_len" to "netlink_route_notify_read_ctx", which uses it as a loop boundary. 726 if (netlink_route_notify_read_ctx(hdr, 0, ctx) >= 0) { 727 /* In the FPM encoding, the vrfid is present */ 728 ival = dplane_ctx_get_table(ctx); 729 dplane_ctx_set_vrf(ctx, ival); 730 dplane_ctx_set_table(ctx, 731 ZEBRA_ROUTE_TABLE_UNKNOWN); ** CID 1617727: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1617727: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_vty.c: 6016 in no_neighbor_capability_enhe() 6010 argv[idx_peer]->arg); 6011 return CMD_WARNING_CONFIG_FAILED; 6012 } 6013 6014 ret = peer_flag_unset_vty(vty, argv[idx_peer]->arg, PEER_FLAG_CAPABILITY_ENHE); 6015 >>> CID 1617727: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "peer" to "bgp_capability_send", which dereferences it. 6016 bgp_capability_send(peer, AFI_IP, SAFI_UNICAST, CAPABILITY_CODE_ENHE, 6017 CAPABILITY_ACTION_UNSET); 6018 6019 return ret; 6020 } 6021 ** CID 1617726: API usage errors (PRINTF_ARGS) ________________________________________________________________________________________________________ *** CID 1617726: API usage errors (PRINTF_ARGS) /lib/mgmt_be_client.c: 791 in mgmt_be_txn_proc_cfgapply() 785 mgmt_be_batches_del(&txn->apply_cfgs, batch); 786 mgmt_be_batches_add_tail(&txn->cfg_batches, batch); 787 } 788 789 mgmt_be_send_apply_reply(client_ctx, txn->txn_id, true, NULL); 790 >>> CID 1617726: API usage errors (PRINTF_ARGS) >>> Length modifier "L" not applicable to conversion specifier in "%Lu". 791 debug_be_client("Nb-apply-duration %lu (avg: %Lu) uSec", apply_nb_cfg_tm, 792 client_ctx->avg_apply_nb_cfg_tm); 793 794 return 0; 795 } 796 ** CID 1617725: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1617725: Memory - illegal accesses (USE_AFTER_FREE) /lib/northbound_notif.c: 670 in nb_notif_terminate() 664 665 EVENT_OFF(nb_notif_timer); 666 667 if (nb_notif_walk) { 668 nb_oper_cancel_walk(nb_notif_walk); 669 /* need to free the group that's in the walk */ >>> CID 1617725: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "nb_oper_walk_finish_arg" dereferences freed pointer "nb_notif_walk". 670 args = nb_oper_walk_finish_arg(nb_notif_walk); 671 if (args) 672 op_changes_group_free(args->group); 673 nb_notif_walk = NULL; 674 } 675 ** CID 1617724: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1617724: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_vty.c: 5988 in neighbor_capability_enhe() 5982 peer = peer_and_group_lookup_vty(vty, argv[idx_peer]->arg); 5983 if (peer && peer->conf_if) 5984 return CMD_SUCCESS; 5985 5986 ret = peer_flag_set_vty(vty, argv[idx_peer]->arg, PEER_FLAG_CAPABILITY_ENHE); 5987 >>> CID 1617724: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "peer" to "bgp_capability_send", which dereferences it. 5988 bgp_capability_send(peer, AFI_IP, SAFI_UNICAST, CAPABILITY_CODE_ENHE, CAPABILITY_ACTION_SET); 5989 5990 return ret; 5991 } 5992 5993 DEFUN (no_neighbor_capability_enhe, ** CID 1617723: (PRINTF_ARGS) ________________________________________________________________________________________________________ *** CID 1617723: (PRINTF_ARGS) /mgmtd/mgmt_fe_adapter.c: 1669 in fe_adapter_handle_notify_select() 1663 // [ ] Keep a local tree to optimize sending selectors to BE? 1664 // [*] Or just KISS and fanout the original message to BEs? 1665 // mgmt_remove_add_notify_selectors(session->notify_xpaths, selectors); 1666 new = darr_append_nz(session->notify_xpaths, darr_len(selectors)); 1667 memcpy(new, selectors, darr_len(selectors) * sizeof(*selectors)); 1668 } else { >>> CID 1617723: (PRINTF_ARGS) >>> Length modifier "L" not applicable to conversion specifier in "%Lu". 1669 __log_err("Invalid msg from session-id: %Lu: no selectors present in non-replace msg", 1670 session->session_id); 1671 darr_free_free(selectors); 1672 selectors = NULL; 1673 goto done; 1674 } /mgmtd/mgmt_fe_adapter.c: 1698 in fe_adapter_handle_notify_select() 1692 clients = mgmt_be_interested_clients("/", MGMT_BE_XPATH_SUBSCR_TYPE_OPER); 1693 } else { 1694 darr_foreach_p (selectors, sp) 1695 clients |= mgmt_be_interested_clients(*sp, MGMT_BE_XPATH_SUBSCR_TYPE_OPER); 1696 } 1697 if (!clients) { >>> CID 1617723: (PRINTF_ARGS) >>> Length modifier "L" not applicable to conversion specifier in "%Lu". 1698 __dbg("No backends provide oper for notify selectors: '%s' txn-id %Lu session-id: %Lu", 1699 selstr, session->txn_id, session->session_id); 1700 goto done; 1701 } 1702 1703 /* We don't use a transaction for this, just send the message */ /mgmtd/mgmt_fe_adapter.c: 1680 in fe_adapter_handle_notify_select() 1674 } 1675 1676 1677 if (session->notify_xpaths && DEBUG_MODE_CHECK(&mgmt_debug_fe, DEBUG_MODE_ALL)) { 1678 const char **sel = session->notify_xpaths; 1679 char *s = frrstr_join(sel, darr_len(sel), ", "); >>> CID 1617723: (PRINTF_ARGS) >>> Length modifier "L" not applicable to conversion specifier in "%Lu". 1680 __dbg("New NOTIF %d selectors '%s' (replace: %d) txn-id: %Lu for session-id: %Lu", 1681 darr_len(sel), s, msg->replace, session->cfg_txn_id, session->session_id); 1682 XFREE(MTYPE_TMP, s); 1683 } 1684 1685 /* Add the new selectors to the global tree */ ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/freerangerouting-frr?tab=overview

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 14 Jan '25

14 Jan '25

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 128 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 128 defect(s) ** CID 1617478: Insecure data handling (INTEGER_OVERFLOW) ________________________________________________________________________________________________________ *** CID 1617478: Insecure data handling (INTEGER_OVERFLOW) /ospfd/ospf_api.c: 642 in new_msg_lsa_change_notify() 636 len = ntohs(data->length); 637 if (len > data_maxs) 638 len = data_maxs; 639 memcpy(nmsg_data, data, len); 640 len += sizeof(struct msg_lsa_change_notify) - sizeof(struct lsa_header); 641 >>> CID 1617478: Insecure data handling (INTEGER_OVERFLOW) >>> "len", which might have overflowed, is passed to "msg_new(msgtype, nmsg, seqnum, len)". 642 return msg_new(msgtype, nmsg, seqnum, len); 643 } 644 645 struct msg *new_msg_reachable_change(uint32_t seqnum, uint16_t nadd, 646 struct in_addr *add, uint16_t nremove, 647 struct in_addr *remove) ** CID 1617477: Data race undermines locking (LOCK_EVASION) /bgpd/bgpd.c: 7020 in peer_password_unset() ________________________________________________________________________________________________________ *** CID 1617477: Data race undermines locking (LOCK_EVASION) /bgpd/bgpd.c: 7020 in peer_password_unset() 7014 for (ALL_LIST_ELEMENTS(peer->group->peer, node, nnode, member)) { 7015 /* Skip peers with overridden configuration. */ 7016 if (CHECK_FLAG(member->flags_override, PEER_FLAG_PASSWORD)) 7017 continue; 7018 7019 /* Remove flag and configuration on peer-group member. */ >>> CID 1617477: Data race undermines locking (LOCK_EVASION) >>> Thread1 sets "flags" to a new value. Now the two threads have an inconsistent view of "flags" and updates to fields correlated with "flags" may be lost. 7020 UNSET_FLAG(member->flags, PEER_FLAG_PASSWORD); 7021 XFREE(MTYPE_PEER_PASSWORD, member->password); 7022 7023 /* Send notification or reset peer depending on state. */ 7024 if (!peer_notify_config_change(member->connection)) 7025 bgp_session_reset(member); ** CID 1617476: Insecure data handling (INTEGER_OVERFLOW) ________________________________________________________________________________________________________ *** CID 1617476: Insecure data handling (INTEGER_OVERFLOW) /ospfd/ospf_api.c: 669 in new_msg_reachable_change() 663 memcpy(&nmsg->router_ids[nadd], remove, nremove * insz); 664 665 nmsg->nadd = htons(nadd); 666 nmsg->nremove = htons(nremove); 667 len = sizeof(*nmsg) + insz * (nadd + nremove); 668 >>> CID 1617476: Insecure data handling (INTEGER_OVERFLOW) >>> "len", which might have overflowed, is passed to "msg_new(18, nmsg, seqnum, len)". 669 return msg_new(MSG_REACHABLE_CHANGE, nmsg, seqnum, len); 670 } 671 672 struct msg *new_msg_router_id_change(uint32_t seqnum, struct in_addr router_id) 673 { 674 struct msg_router_id_change rmsg = {.router_id = router_id}; ** CID 1617475: Program hangs (LOCK) /zebra/zapi_msg.c: 1443 in zread_fec_register() ________________________________________________________________________________________________________ *** CID 1617475: Program hangs (LOCK) /zebra/zapi_msg.c: 1443 in zread_fec_register() 1437 l += 4; 1438 } else if (flags & ZEBRA_FEC_REGISTER_LABEL_INDEX) { 1439 STREAM_GETL(s, label_index); 1440 l += 4; 1441 } 1442 >>> CID 1617475: Program hangs (LOCK) >>> "zebra_mpls_fec_register" locks "client->obuf_mtx" while it is locked. 1443 zebra_mpls_fec_register(zvrf, &p, label, label_index, client); 1444 } 1445 1446 stream_failure: 1447 return; 1448 } ** CID 1617474: (LOCK) /bgpd/bgpd.c: 8684 in bgp_pthreads_run() /bgpd/bgpd.c: 8684 in bgp_pthreads_run() ________________________________________________________________________________________________________ *** CID 1617474: (LOCK) /bgpd/bgpd.c: 8684 in bgp_pthreads_run() 8678 frr_pthread_run(bgp_pth_io, NULL); 8679 frr_pthread_run(bgp_pth_ka, NULL); 8680 8681 /* Wait until threads are ready. */ 8682 frr_pthread_wait_running(bgp_pth_io); 8683 frr_pthread_wait_running(bgp_pth_ka); >>> CID 1617474: (LOCK) >>> Returning without unlocking "bgp_pth_io->running_cond_mtx". 8684 } 8685 8686 void bgp_pthreads_finish(void) 8687 { 8688 frr_pthread_stop_all(); 8689 } /bgpd/bgpd.c: 8684 in bgp_pthreads_run() 8678 frr_pthread_run(bgp_pth_io, NULL); 8679 frr_pthread_run(bgp_pth_ka, NULL); 8680 8681 /* Wait until threads are ready. */ 8682 frr_pthread_wait_running(bgp_pth_io); 8683 frr_pthread_wait_running(bgp_pth_ka); >>> CID 1617474: (LOCK) >>> Returning without unlocking "bgp_pth_ka->running_cond_mtx". 8684 } 8685 8686 void bgp_pthreads_finish(void) 8687 { 8688 frr_pthread_stop_all(); 8689 } ** CID 1617473: Program hangs (LOCK) /bgpd/rfapi/rfapi_vty.c: 976 in rfapiShowVncQueries() ________________________________________________________________________________________________________ *** CID 1617473: Program hangs (LOCK) /bgpd/rfapi/rfapi_vty.c: 976 in rfapiShowVncQueries() 970 971 fp(out, "%-15s %-15s", buf_vn, buf_un); 972 printedquerier = 1; 973 } else 974 fp(out, "%-15s %-15s", "", ""); 975 buf_remain[0] = 0; >>> CID 1617473: Program hangs (LOCK) >>> "event_timer_remain_second" locks "mon_eth->timer->mtx" while it is locked. 976 rfapiFormatSeconds(event_timer_remain_second( 977 mon_eth->timer), 978 buf_remain, BUFSIZ); 979 fp(out, " %-17s %10d %-10s\n", 980 rfapi_ntop(pfx_mac.family, &pfx_mac.u.prefix, 981 buf_pfx, BUFSIZ), ** CID 1617472: Program hangs (LOCK) /bgpd/bgp_keepalives.c: 227 in bgp_keepalives_start() ________________________________________________________________________________________________________ *** CID 1617472: Program hangs (LOCK) /bgpd/bgp_keepalives.c: 227 in bgp_keepalives_start() 221 TIMEVAL_TO_TIMESPEC(&next_update, &next_update_ts); 222 } 223 224 /* clean up */ 225 pthread_cleanup_pop(1); 226 >>> CID 1617472: Program hangs (LOCK) >>> Returning without unlocking "fpt->running_cond_mtx". 227 return NULL; 228 } 229 230 /* --- thread external functions ------------------------------------------- */ 231 232 void bgp_keepalives_on(struct peer_connection *connection) ** CID 1617471: Program hangs (LOCK) /ospfd/ospf_lsa.c: 3210 in ospf_maxage_lsa_remover() ________________________________________________________________________________________________________ *** CID 1617471: Program hangs (LOCK) /ospfd/ospf_lsa.c: 3210 in ospf_maxage_lsa_remover() 3204 if (lsa->retransmit_counter > 0) { 3205 reschedule = 1; 3206 continue; 3207 } 3208 3209 /* TODO: maybe convert this function to a work-queue */ >>> CID 1617471: Program hangs (LOCK) >>> "event_should_yield" locks "event->mtx" while it is locked. 3210 if (event_should_yield(event)) { 3211 OSPF_TIMER_ON(ospf->t_maxage, 3212 ospf_maxage_lsa_remover, 0); 3213 route_unlock_node( 3214 rn); /* route_top/route_next */ 3215 return; ** CID 1617470: Insecure data handling (INTEGER_OVERFLOW) ________________________________________________________________________________________________________ *** CID 1617470: Insecure data handling (INTEGER_OVERFLOW) /ospfd/ospf_api.c: 517 in new_msg_originate_request() 511 if (omsglen > data_maxs) 512 omsglen = data_maxs; 513 memcpy(omsg_data, data, omsglen); 514 omsglen += sizeof(struct msg_originate_request) 515 - sizeof(struct lsa_header); 516 >>> CID 1617470: Insecure data handling (INTEGER_OVERFLOW) >>> "omsglen", which might have overflowed, is passed to "msg_new(5, omsg, seqnum, omsglen)". 517 return msg_new(MSG_ORIGINATE_REQUEST, omsg, seqnum, omsglen); 518 } 519 520 struct msg *new_msg_delete_request(uint32_t seqnum, struct in_addr addr, 521 uint8_t lsa_type, uint8_t opaque_type, 522 uint32_t opaque_id, uint8_t flags) ** CID 1617469: Program hangs (ORDER_REVERSAL) /bgpd/bgp_fsm.c: 1504 in bgp_stop() ________________________________________________________________________________________________________ *** CID 1617469: Program hangs (ORDER_REVERSAL) /bgpd/bgp_fsm.c: 1504 in bgp_stop() 1498 EVENT_OFF(connection->t_connect); 1499 EVENT_OFF(connection->t_holdtime); 1500 EVENT_OFF(connection->t_routeadv); 1501 EVENT_OFF(connection->t_delayopen); 1502 1503 /* Clear input and output buffer. */ >>> CID 1617469: Program hangs (ORDER_REVERSAL) >>> Calling "_frr_mtx_lock" acquires lock "peer_connection.io_mtx" while holding lock "event_loop.mtx" (count: 5 / 51). 1504 frr_with_mutex (&connection->io_mtx) { 1505 if (connection->ibuf) 1506 stream_fifo_clean(connection->ibuf); 1507 if (connection->obuf) 1508 stream_fifo_clean(connection->obuf); 1509 ** CID 1617468: Integer handling issues (INTEGER_OVERFLOW) /lib/bitfield.h: 204 in bf_find_next_clear_bit_wrap() ________________________________________________________________________________________________________ *** CID 1617468: Integer handling issues (INTEGER_OVERFLOW) /lib/bitfield.h: 204 in bf_find_next_clear_bit_wrap() 198 199 /* 200 * start looking for a clear bit at the start of the bitfield and 201 * stop when we reach start_index 202 */ 203 scanbits = WORD_SIZE; >>> CID 1617468: Integer handling issues (INTEGER_OVERFLOW) >>> Expression "start_index - 1U", where "start_index" is known to be equal to 0, underflows the type of "start_index - 1U", which is type "unsigned int". 204 index_max = bf_index(start_index - 1); 205 for (i = 0; i <= index_max; ++i) { 206 if (i == index_max) 207 scanbits = ((start_index - 1) % WORD_SIZE) + 1; 208 for (offset = start_bit; offset < scanbits; ++offset) { 209 if (!((v->data[i] >> offset) & 1)) ** CID 1617467: Program hangs (LOCK) /pathd/path_pcep_controller.c: 200 in pcep_ctrl_initialize() ________________________________________________________________________________________________________ *** CID 1617467: Program hangs (LOCK) /pathd/path_pcep_controller.c: 200 in pcep_ctrl_initialize() 194 ctrl_state->pcc_opts->addr.ipa_type = IPADDR_NONE; 195 ctrl_state->pcc_opts->port = PCEP_DEFAULT_PORT; 196 197 /* Keep the state reference for events */ 198 set_ctrl_state(*fpt, ctrl_state); 199 >>> CID 1617467: Program hangs (LOCK) >>> Returning without unlocking "(*fpt)->running_cond_mtx". 200 return ret; 201 } 202 203 int pcep_ctrl_finalize(struct frr_pthread **fpt) 204 { 205 assert(fpt != NULL); ** CID 1617466: Concurrent data access violations (MISSING_LOCK) /zebra/zebra_fpm.c: 1760 in zfpm_show_stats() ________________________________________________________________________________________________________ *** CID 1617466: Concurrent data access violations (MISSING_LOCK) /zebra/zebra_fpm.c: 1760 in zfpm_show_stats() 1754 ZFPM_SHOW_STAT(nop_deletes_skipped); 1755 ZFPM_SHOW_STAT(route_adds); 1756 ZFPM_SHOW_STAT(route_dels); 1757 ZFPM_SHOW_STAT(updates_triggered); 1758 ZFPM_SHOW_STAT(redundant_triggers); 1759 ZFPM_SHOW_STAT(dests_del_after_update); >>> CID 1617466: Concurrent data access violations (MISSING_LOCK) >>> Accessing "zfpm_g->last_ivl_stats.t_conn_down_starts" without holding lock "event_loop.mtx". Elsewhere, "zfpm_stats.t_conn_down_starts" is written to with "event_loop.mtx" held 1 out of 1 times. 1760 ZFPM_SHOW_STAT(t_conn_down_starts); 1761 ZFPM_SHOW_STAT(t_conn_down_dests_processed); 1762 ZFPM_SHOW_STAT(t_conn_down_yields); 1763 ZFPM_SHOW_STAT(t_conn_down_finishes); 1764 ZFPM_SHOW_STAT(t_conn_up_starts); 1765 ZFPM_SHOW_STAT(t_conn_up_dests_processed); ** CID 1617465: Data race undermines locking (LOCK_EVASION) /zebra/zserv.c: 721 in zserv_close_client() ________________________________________________________________________________________________________ *** CID 1617465: Data race undermines locking (LOCK_EVASION) /zebra/zserv.c: 721 in zserv_close_client() 715 event_cancel_event(zrouter.master, client); 716 EVENT_OFF(client->t_cleanup); 717 EVENT_OFF(client->t_process); 718 719 /* destroy pthread */ 720 frr_pthread_destroy(client->pthread); >>> CID 1617465: Data race undermines locking (LOCK_EVASION) >>> Thread1 sets "pthread" to a new value. Now the two threads have an inconsistent view of "pthread" and updates to fields of "pthread" or fields correlated with "pthread" may be lost. 721 client->pthread = NULL; 722 } 723 724 /* 725 * Final check in case the client struct is in use in another 726 * pthread: if not in-use, continue and free the client ** CID 1617464: Concurrent data access violations (MISSING_LOCK) /zebra/zebra_fpm.c: 1764 in zfpm_show_stats() ________________________________________________________________________________________________________ *** CID 1617464: Concurrent data access violations (MISSING_LOCK) /zebra/zebra_fpm.c: 1764 in zfpm_show_stats() 1758 ZFPM_SHOW_STAT(redundant_triggers); 1759 ZFPM_SHOW_STAT(dests_del_after_update); 1760 ZFPM_SHOW_STAT(t_conn_down_starts); 1761 ZFPM_SHOW_STAT(t_conn_down_dests_processed); 1762 ZFPM_SHOW_STAT(t_conn_down_yields); 1763 ZFPM_SHOW_STAT(t_conn_down_finishes); >>> CID 1617464: Concurrent data access violations (MISSING_LOCK) >>> Accessing "zfpm_g->last_ivl_stats.t_conn_up_starts" without holding lock "event_loop.mtx". Elsewhere, "zfpm_stats.t_conn_up_starts" is written to with "event_loop.mtx" held 1 out of 1 times. 1764 ZFPM_SHOW_STAT(t_conn_up_starts); 1765 ZFPM_SHOW_STAT(t_conn_up_dests_processed); 1766 ZFPM_SHOW_STAT(t_conn_up_yields); 1767 ZFPM_SHOW_STAT(t_conn_up_aborts); 1768 ZFPM_SHOW_STAT(t_conn_up_finishes); 1769 ** CID 1617463: (INTEGER_OVERFLOW) /lib/ptm_lib.c: 320 in _ptm_lib_read_ptm_socket() /lib/ptm_lib.c: 307 in _ptm_lib_read_ptm_socket() ________________________________________________________________________________________________________ *** CID 1617463: (INTEGER_OVERFLOW) /lib/ptm_lib.c: 320 in _ptm_lib_read_ptm_socket() 314 if (retries++ < 2) { 315 usleep(10000); 316 continue; 317 } 318 DLOG("max retries - recv error(%d - %s) bytes read %d (%d)\n", errno, 319 strerror(errno), bytes_read, len); >>> CID 1617463: (INTEGER_OVERFLOW) >>> "bytes_read", which might have overflowed, is returned from the function. 320 return (bytes_read); 321 } else { 322 bytes_read += rc; 323 } 324 } 325 /lib/ptm_lib.c: 307 in _ptm_lib_read_ptm_socket() 301 static int _ptm_lib_read_ptm_socket(int fd, char *buf, int len) 302 { 303 int retries = 0, rc; 304 int bytes_read = 0; 305 306 while (bytes_read != len) { >>> CID 1617463: (INTEGER_OVERFLOW) >>> "len - bytes_read", which might have underflowed, is passed to "recv(fd, (void *)(buf + bytes_read), len - bytes_read, MSG_DONTWAIT)". 307 rc = recv(fd, (void *)(buf + bytes_read), (len - bytes_read), 308 MSG_DONTWAIT); 309 if (rc < 0 && (errno != EAGAIN) && (errno != EWOULDBLOCK)) { 310 ERRLOG("fatal recv error(%s), closing connection, rc %d\n", strerror(errno), 311 rc); 312 return (rc); ** CID 1617462: Program hangs (ORDER_REVERSAL) ________________________________________________________________________________________________________ *** CID 1617462: Program hangs (ORDER_REVERSAL) /zebra/zebra_pw.c: 239 in zebra_pw_install_failure() 233 234 /* schedule to retry later */ 235 EVENT_OFF(pw->install_retry_timer); 236 event_add_timer(zrouter.master, zebra_pw_install_retry, pw, 237 PW_INSTALL_RETRY_INTERVAL, &pw->install_retry_timer); 238 >>> CID 1617462: Program hangs (ORDER_REVERSAL) >>> Calling "zebra_pw_update_status" acquires lock "zserv.obuf_mtx" while holding lock "event_loop.mtx" (count: 1 / 2). 239 zebra_pw_update_status(pw, pwstatus); 240 } 241 242 static void zebra_pw_install_retry(struct event *thread) 243 { 244 struct zebra_pw *pw = EVENT_ARG(thread); ** CID 1617461: Memory - corruptions (USE_AFTER_FREE) /bgpd/bgp_route.c: 9317 in bgp_redistribute_add() ________________________________________________________________________________________________________ *** CID 1617461: Memory - corruptions (USE_AFTER_FREE) /bgpd/bgp_route.c: 9317 in bgp_redistribute_add() 9311 bgp->peer_self, new_attr, bn); 9312 SET_FLAG(new->flags, BGP_PATH_VALID); 9313 9314 bgp_aggregate_increment(bgp, p, new, afi, SAFI_UNICAST); 9315 bgp_path_info_add(bn, new); 9316 bgp_dest_unlock_node(bn); >>> CID 1617461: Memory - corruptions (USE_AFTER_FREE) >>> Dereferencing freed pointer "bn". 9317 SET_FLAG(bn->flags, BGP_NODE_FIB_INSTALLED); 9318 bgp_process(bgp, bn, new, afi, SAFI_UNICAST); 9319 9320 if ((bgp->inst_type == BGP_INSTANCE_TYPE_VRF) 9321 || (bgp->inst_type == BGP_INSTANCE_TYPE_DEFAULT)) { 9322 ** CID 1617460: Program hangs (ORDER_REVERSAL) ________________________________________________________________________________________________________ *** CID 1617460: Program hangs (ORDER_REVERSAL) /bgpd/bgpd.c: 1291 in peer_free() 1285 1286 if (peer->change_local_as_pretty) 1287 XFREE(MTYPE_BGP_NAME, peer->change_local_as_pretty); 1288 if (peer->as_pretty) 1289 XFREE(MTYPE_BGP_NAME, peer->as_pretty); 1290 >>> CID 1617460: Program hangs (ORDER_REVERSAL) >>> Calling "bgp_peer_connection_free" acquires lock "peer_connection.io_mtx" while holding lock "event_loop.mtx" (count: 5 / 51). 1291 bgp_peer_connection_free(&peer->connection); 1292 1293 bgp_unlock(peer->bgp); 1294 1295 stream_free(peer->last_reset_cause); 1296 ** CID 1617459: Data race undermines locking (LOCK_EVASION) /ospf6d/ospf6_network.c: 89 in ospf6_serv_sock() ________________________________________________________________________________________________________ *** CID 1617459: Data race undermines locking (LOCK_EVASION) /ospf6d/ospf6_network.c: 89 in ospf6_serv_sock() 83 ospf6_set_reuseaddr(); 84 #endif /*1*/ 85 ospf6_reset_mcastloop(ospf6_sock); 86 ospf6_set_pktinfo(ospf6_sock); 87 ospf6_set_transport_class(ospf6_sock); 88 >>> CID 1617459: Data race undermines locking (LOCK_EVASION) >>> Thread1 sets "fd" to a new value. Now the two threads have an inconsistent view of "fd" and updates to fields correlated with "fd" may be lost. 89 ospf6->fd = ospf6_sock; 90 /* setup global in6_addr, allspf6 and alldr6 for later use */ 91 inet_pton(AF_INET6, ALLSPFROUTERS6, &allspfrouters6); 92 inet_pton(AF_INET6, ALLDROUTERS6, &alldrouters6); 93 94 return 0; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/freerangerouting-frr?tab=overview

1 0

FRR 10.2 Bug report - RIP/RIPNG distribution list fails to filter routes
by Russell Yount 13 Jan '25

13 Jan '25

I attempted to upgrade some FreeBSD 14.2 systems from frr8 ( 8.5.6) to frr10 (10.2) both from the FreeBSD ports collection. I skipped frr9 due to a bug that did not initialize routes from the kernel on startup. The systems are VMs running under Proxmox virtual environment. The distribution-list functionality no longer works for both rip and ripng. The following configuration can reproduce the problem. I would be happy to test any proposed fixes for this. -- router rip network vtnet8 network vtnet9 distribute-list rip-dist-out out exit router ripng network vtnet8 network vtnet9 ipv6 distribute-list ripng-dist-out out exit access-list rip-dist-out seq 5 deny any ipv6 access-list ripng-dist-out seq 5 deny any -- Also I notice in frr10 the routes reflecting the interface addresses going to loopback interface display in "show ip route" and "show ipv6 route" route as a new local(L) route type. I assume this is intentional but thought I would mention it. -Russ Russell J. Yount <Russell.Yount(a)gmail.com>

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 10 Jan '25

10 Jan '25

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 1613932: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1613932: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_route.c: 15206 in peer_adj_routes() 15200 } 15201 15202 output_count += output_count_per_rd; 15203 filtered_count += filtered_count_per_rd; 15204 } 15205 } else { >>> CID 1613932: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "table" to "show_adj_route", which dereferences it. 15206 show_adj_route(vty, peer, table, afi, safi, type, rmap_name, 15207 json, json_ar, show_flags, &header1, &header2, 15208 rd_str, match, &output_count, &filtered_count); 15209 15210 if (use_json) { 15211 if (type == bgp_show_adj_route_advertised || ** CID 1613931: API usage errors (PRINTF_ARGS) ________________________________________________________________________________________________________ *** CID 1613931: API usage errors (PRINTF_ARGS) /mgmtd/mgmt_fe_adapter.c: 1240 in fe_adapter_handle_session_req() 1234 void *__msg, size_t msg_len) 1235 { 1236 struct mgmt_msg_session_req *msg = __msg; 1237 struct mgmt_fe_session_ctx *session; 1238 uint64_t client_id; 1239 >>> CID 1613931: API usage errors (PRINTF_ARGS) >>> Length modifier "L" not applicable to conversion specifier in "%Lu". 1240 __dbg("Got session-req is create %u req-id %Lu for refer-id %Lu from '%s'", 1241 msg->refer_id == 0, msg->req_id, msg->refer_id, adapter->name); 1242 1243 if (msg->refer_id) { 1244 uint64_t session_id = msg->refer_id; 1245 ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, http://url2497.blackduck.com/ls/click?upn=u001.Ji18sHaXCxZb7Rfw8sC51j9Suwl8…

1 0

Stop testing and updates for CentOS 7 / RedHat 7
by Martin Winter 09 Jan '25

09 Jan '25

Hi there, I'm planning to stop releasing any new CentOS 7 / RedHat 7 packages and stop the testing for it. - No more CI tests on CentOS 7 - No new packages for CentOS 7 / RedHat 7 (not even minor updates or security fixes) CentOS 7 is EoL for some time. So far, we still used it for build Redhat 7 / CentOS 7 packages, but there is now the time where repositories get removed or moved. As such, I think the work to maintain this in the CI Infrastructure and Release Build is too much and I'm considering abandoning it. This does NOT impact RedHat 8 or RedHat 9. Please reply if this causes any issues to you or have any other reasons why this should be reconsidered. Regards, Martin Winter

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 02 Jan '25

02 Jan '25

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1602708: Memory - illegal accesses (USE_AFTER_FREE) /bgpd/bgp_route.c: 15789 in bgp_address_family_distance_delete() ________________________________________________________________________________________________________ *** CID 1602708: Memory - illegal accesses (USE_AFTER_FREE) /bgpd/bgp_route.c: 15789 in bgp_address_family_distance_delete() 15783 safi_t safi = SAFI_UNSPEC; 15784 struct bgp_dest *dest = NULL; 15785 struct bgp_distance *bdistance = NULL; 15786 15787 FOREACH_AFI_SAFI (afi, safi) { 15788 for (dest = bgp_table_top(bgp_distance_table[afi][safi]); dest; >>> CID 1602708: Memory - illegal accesses (USE_AFTER_FREE) >>> Passing freed pointer "dest" as an argument to "bgp_route_next". 15789 dest = bgp_route_next(dest)) { 15790 if (!bgp_dest_has_bgp_path_info_data(dest)) 15791 continue; 15792 bdistance = bgp_dest_get_bgp_distance_info(dest); 15793 XFREE(MTYPE_AS_LIST, bdistance->access_list); 15794 bgp_distance_free(bdistance); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=u001.AxU2LYlgjL6eX23u9ErQy-2…

1 0