- dev - lists.frrouting.org

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 16 Jan '25

16 Jan '25

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 7 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 7 of 7 defect(s) ** CID 1617729: API usage errors (PRINTF_ARGS) ________________________________________________________________________________________________________ *** CID 1617729: API usage errors (PRINTF_ARGS) /lib/mgmt_be_client.c: 624 in mgmt_be_txn_cfg_prepare() 618 } 619 } 620 621 mgmt_be_send_cfgdata_create_reply(client_ctx, txn->txn_id, 622 error ? false : true, error ? err_buf : NULL); 623 >>> CID 1617729: API usage errors (PRINTF_ARGS) >>> Length modifier "L" not applicable to conversion specifier in "%Lu". 624 debug_be_client("Avg-nb-edit-duration %Lu uSec, nb-prep-duration %lu (avg: %Lu) uSec, batch size %u", 625 client_ctx->avg_edit_nb_cfg_tm, prep_nb_cfg_tm, 626 client_ctx->avg_prep_nb_cfg_tm, (uint32_t)num_processed); 627 628 if (error) 629 mgmt_be_txn_cfg_abort(txn); ** CID 1617728: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1617728: Insecure data handling (TAINTED_SCALAR) /zebra/dplane_fpm_nl.c: 726 in fpm_read() 720 * enqueue it to zebra for processing. 721 */ 722 ctx = dplane_ctx_alloc(); 723 dplane_ctx_route_init(ctx, DPLANE_OP_ROUTE_NOTIFY, NULL, 724 NULL); 725 >>> CID 1617728: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "hdr->rta_len" to "netlink_route_notify_read_ctx", which uses it as a loop boundary. 726 if (netlink_route_notify_read_ctx(hdr, 0, ctx) >= 0) { 727 /* In the FPM encoding, the vrfid is present */ 728 ival = dplane_ctx_get_table(ctx); 729 dplane_ctx_set_vrf(ctx, ival); 730 dplane_ctx_set_table(ctx, 731 ZEBRA_ROUTE_TABLE_UNKNOWN); ** CID 1617727: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1617727: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_vty.c: 6016 in no_neighbor_capability_enhe() 6010 argv[idx_peer]->arg); 6011 return CMD_WARNING_CONFIG_FAILED; 6012 } 6013 6014 ret = peer_flag_unset_vty(vty, argv[idx_peer]->arg, PEER_FLAG_CAPABILITY_ENHE); 6015 >>> CID 1617727: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "peer" to "bgp_capability_send", which dereferences it. 6016 bgp_capability_send(peer, AFI_IP, SAFI_UNICAST, CAPABILITY_CODE_ENHE, 6017 CAPABILITY_ACTION_UNSET); 6018 6019 return ret; 6020 } 6021 ** CID 1617726: API usage errors (PRINTF_ARGS) ________________________________________________________________________________________________________ *** CID 1617726: API usage errors (PRINTF_ARGS) /lib/mgmt_be_client.c: 791 in mgmt_be_txn_proc_cfgapply() 785 mgmt_be_batches_del(&txn->apply_cfgs, batch); 786 mgmt_be_batches_add_tail(&txn->cfg_batches, batch); 787 } 788 789 mgmt_be_send_apply_reply(client_ctx, txn->txn_id, true, NULL); 790 >>> CID 1617726: API usage errors (PRINTF_ARGS) >>> Length modifier "L" not applicable to conversion specifier in "%Lu". 791 debug_be_client("Nb-apply-duration %lu (avg: %Lu) uSec", apply_nb_cfg_tm, 792 client_ctx->avg_apply_nb_cfg_tm); 793 794 return 0; 795 } 796 ** CID 1617725: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1617725: Memory - illegal accesses (USE_AFTER_FREE) /lib/northbound_notif.c: 670 in nb_notif_terminate() 664 665 EVENT_OFF(nb_notif_timer); 666 667 if (nb_notif_walk) { 668 nb_oper_cancel_walk(nb_notif_walk); 669 /* need to free the group that's in the walk */ >>> CID 1617725: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "nb_oper_walk_finish_arg" dereferences freed pointer "nb_notif_walk". 670 args = nb_oper_walk_finish_arg(nb_notif_walk); 671 if (args) 672 op_changes_group_free(args->group); 673 nb_notif_walk = NULL; 674 } 675 ** CID 1617724: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1617724: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_vty.c: 5988 in neighbor_capability_enhe() 5982 peer = peer_and_group_lookup_vty(vty, argv[idx_peer]->arg); 5983 if (peer && peer->conf_if) 5984 return CMD_SUCCESS; 5985 5986 ret = peer_flag_set_vty(vty, argv[idx_peer]->arg, PEER_FLAG_CAPABILITY_ENHE); 5987 >>> CID 1617724: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "peer" to "bgp_capability_send", which dereferences it. 5988 bgp_capability_send(peer, AFI_IP, SAFI_UNICAST, CAPABILITY_CODE_ENHE, CAPABILITY_ACTION_SET); 5989 5990 return ret; 5991 } 5992 5993 DEFUN (no_neighbor_capability_enhe, ** CID 1617723: (PRINTF_ARGS) ________________________________________________________________________________________________________ *** CID 1617723: (PRINTF_ARGS) /mgmtd/mgmt_fe_adapter.c: 1669 in fe_adapter_handle_notify_select() 1663 // [ ] Keep a local tree to optimize sending selectors to BE? 1664 // [*] Or just KISS and fanout the original message to BEs? 1665 // mgmt_remove_add_notify_selectors(session->notify_xpaths, selectors); 1666 new = darr_append_nz(session->notify_xpaths, darr_len(selectors)); 1667 memcpy(new, selectors, darr_len(selectors) * sizeof(*selectors)); 1668 } else { >>> CID 1617723: (PRINTF_ARGS) >>> Length modifier "L" not applicable to conversion specifier in "%Lu". 1669 __log_err("Invalid msg from session-id: %Lu: no selectors present in non-replace msg", 1670 session->session_id); 1671 darr_free_free(selectors); 1672 selectors = NULL; 1673 goto done; 1674 } /mgmtd/mgmt_fe_adapter.c: 1698 in fe_adapter_handle_notify_select() 1692 clients = mgmt_be_interested_clients("/", MGMT_BE_XPATH_SUBSCR_TYPE_OPER); 1693 } else { 1694 darr_foreach_p (selectors, sp) 1695 clients |= mgmt_be_interested_clients(*sp, MGMT_BE_XPATH_SUBSCR_TYPE_OPER); 1696 } 1697 if (!clients) { >>> CID 1617723: (PRINTF_ARGS) >>> Length modifier "L" not applicable to conversion specifier in "%Lu". 1698 __dbg("No backends provide oper for notify selectors: '%s' txn-id %Lu session-id: %Lu", 1699 selstr, session->txn_id, session->session_id); 1700 goto done; 1701 } 1702 1703 /* We don't use a transaction for this, just send the message */ /mgmtd/mgmt_fe_adapter.c: 1680 in fe_adapter_handle_notify_select() 1674 } 1675 1676 1677 if (session->notify_xpaths && DEBUG_MODE_CHECK(&mgmt_debug_fe, DEBUG_MODE_ALL)) { 1678 const char **sel = session->notify_xpaths; 1679 char *s = frrstr_join(sel, darr_len(sel), ", "); >>> CID 1617723: (PRINTF_ARGS) >>> Length modifier "L" not applicable to conversion specifier in "%Lu". 1680 __dbg("New NOTIF %d selectors '%s' (replace: %d) txn-id: %Lu for session-id: %Lu", 1681 darr_len(sel), s, msg->replace, session->cfg_txn_id, session->session_id); 1682 XFREE(MTYPE_TMP, s); 1683 } 1684 1685 /* Add the new selectors to the global tree */ ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/freerangerouting-frr?tab=overview

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 14 Jan '25

14 Jan '25

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 128 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 128 defect(s) ** CID 1617478: Insecure data handling (INTEGER_OVERFLOW) ________________________________________________________________________________________________________ *** CID 1617478: Insecure data handling (INTEGER_OVERFLOW) /ospfd/ospf_api.c: 642 in new_msg_lsa_change_notify() 636 len = ntohs(data->length); 637 if (len > data_maxs) 638 len = data_maxs; 639 memcpy(nmsg_data, data, len); 640 len += sizeof(struct msg_lsa_change_notify) - sizeof(struct lsa_header); 641 >>> CID 1617478: Insecure data handling (INTEGER_OVERFLOW) >>> "len", which might have overflowed, is passed to "msg_new(msgtype, nmsg, seqnum, len)". 642 return msg_new(msgtype, nmsg, seqnum, len); 643 } 644 645 struct msg *new_msg_reachable_change(uint32_t seqnum, uint16_t nadd, 646 struct in_addr *add, uint16_t nremove, 647 struct in_addr *remove) ** CID 1617477: Data race undermines locking (LOCK_EVASION) /bgpd/bgpd.c: 7020 in peer_password_unset() ________________________________________________________________________________________________________ *** CID 1617477: Data race undermines locking (LOCK_EVASION) /bgpd/bgpd.c: 7020 in peer_password_unset() 7014 for (ALL_LIST_ELEMENTS(peer->group->peer, node, nnode, member)) { 7015 /* Skip peers with overridden configuration. */ 7016 if (CHECK_FLAG(member->flags_override, PEER_FLAG_PASSWORD)) 7017 continue; 7018 7019 /* Remove flag and configuration on peer-group member. */ >>> CID 1617477: Data race undermines locking (LOCK_EVASION) >>> Thread1 sets "flags" to a new value. Now the two threads have an inconsistent view of "flags" and updates to fields correlated with "flags" may be lost. 7020 UNSET_FLAG(member->flags, PEER_FLAG_PASSWORD); 7021 XFREE(MTYPE_PEER_PASSWORD, member->password); 7022 7023 /* Send notification or reset peer depending on state. */ 7024 if (!peer_notify_config_change(member->connection)) 7025 bgp_session_reset(member); ** CID 1617476: Insecure data handling (INTEGER_OVERFLOW) ________________________________________________________________________________________________________ *** CID 1617476: Insecure data handling (INTEGER_OVERFLOW) /ospfd/ospf_api.c: 669 in new_msg_reachable_change() 663 memcpy(&nmsg->router_ids[nadd], remove, nremove * insz); 664 665 nmsg->nadd = htons(nadd); 666 nmsg->nremove = htons(nremove); 667 len = sizeof(*nmsg) + insz * (nadd + nremove); 668 >>> CID 1617476: Insecure data handling (INTEGER_OVERFLOW) >>> "len", which might have overflowed, is passed to "msg_new(18, nmsg, seqnum, len)". 669 return msg_new(MSG_REACHABLE_CHANGE, nmsg, seqnum, len); 670 } 671 672 struct msg *new_msg_router_id_change(uint32_t seqnum, struct in_addr router_id) 673 { 674 struct msg_router_id_change rmsg = {.router_id = router_id}; ** CID 1617475: Program hangs (LOCK) /zebra/zapi_msg.c: 1443 in zread_fec_register() ________________________________________________________________________________________________________ *** CID 1617475: Program hangs (LOCK) /zebra/zapi_msg.c: 1443 in zread_fec_register() 1437 l += 4; 1438 } else if (flags & ZEBRA_FEC_REGISTER_LABEL_INDEX) { 1439 STREAM_GETL(s, label_index); 1440 l += 4; 1441 } 1442 >>> CID 1617475: Program hangs (LOCK) >>> "zebra_mpls_fec_register" locks "client->obuf_mtx" while it is locked. 1443 zebra_mpls_fec_register(zvrf, &p, label, label_index, client); 1444 } 1445 1446 stream_failure: 1447 return; 1448 } ** CID 1617474: (LOCK) /bgpd/bgpd.c: 8684 in bgp_pthreads_run() /bgpd/bgpd.c: 8684 in bgp_pthreads_run() ________________________________________________________________________________________________________ *** CID 1617474: (LOCK) /bgpd/bgpd.c: 8684 in bgp_pthreads_run() 8678 frr_pthread_run(bgp_pth_io, NULL); 8679 frr_pthread_run(bgp_pth_ka, NULL); 8680 8681 /* Wait until threads are ready. */ 8682 frr_pthread_wait_running(bgp_pth_io); 8683 frr_pthread_wait_running(bgp_pth_ka); >>> CID 1617474: (LOCK) >>> Returning without unlocking "bgp_pth_io->running_cond_mtx". 8684 } 8685 8686 void bgp_pthreads_finish(void) 8687 { 8688 frr_pthread_stop_all(); 8689 } /bgpd/bgpd.c: 8684 in bgp_pthreads_run() 8678 frr_pthread_run(bgp_pth_io, NULL); 8679 frr_pthread_run(bgp_pth_ka, NULL); 8680 8681 /* Wait until threads are ready. */ 8682 frr_pthread_wait_running(bgp_pth_io); 8683 frr_pthread_wait_running(bgp_pth_ka); >>> CID 1617474: (LOCK) >>> Returning without unlocking "bgp_pth_ka->running_cond_mtx". 8684 } 8685 8686 void bgp_pthreads_finish(void) 8687 { 8688 frr_pthread_stop_all(); 8689 } ** CID 1617473: Program hangs (LOCK) /bgpd/rfapi/rfapi_vty.c: 976 in rfapiShowVncQueries() ________________________________________________________________________________________________________ *** CID 1617473: Program hangs (LOCK) /bgpd/rfapi/rfapi_vty.c: 976 in rfapiShowVncQueries() 970 971 fp(out, "%-15s %-15s", buf_vn, buf_un); 972 printedquerier = 1; 973 } else 974 fp(out, "%-15s %-15s", "", ""); 975 buf_remain[0] = 0; >>> CID 1617473: Program hangs (LOCK) >>> "event_timer_remain_second" locks "mon_eth->timer->mtx" while it is locked. 976 rfapiFormatSeconds(event_timer_remain_second( 977 mon_eth->timer), 978 buf_remain, BUFSIZ); 979 fp(out, " %-17s %10d %-10s\n", 980 rfapi_ntop(pfx_mac.family, &pfx_mac.u.prefix, 981 buf_pfx, BUFSIZ), ** CID 1617472: Program hangs (LOCK) /bgpd/bgp_keepalives.c: 227 in bgp_keepalives_start() ________________________________________________________________________________________________________ *** CID 1617472: Program hangs (LOCK) /bgpd/bgp_keepalives.c: 227 in bgp_keepalives_start() 221 TIMEVAL_TO_TIMESPEC(&next_update, &next_update_ts); 222 } 223 224 /* clean up */ 225 pthread_cleanup_pop(1); 226 >>> CID 1617472: Program hangs (LOCK) >>> Returning without unlocking "fpt->running_cond_mtx". 227 return NULL; 228 } 229 230 /* --- thread external functions ------------------------------------------- */ 231 232 void bgp_keepalives_on(struct peer_connection *connection) ** CID 1617471: Program hangs (LOCK) /ospfd/ospf_lsa.c: 3210 in ospf_maxage_lsa_remover() ________________________________________________________________________________________________________ *** CID 1617471: Program hangs (LOCK) /ospfd/ospf_lsa.c: 3210 in ospf_maxage_lsa_remover() 3204 if (lsa->retransmit_counter > 0) { 3205 reschedule = 1; 3206 continue; 3207 } 3208 3209 /* TODO: maybe convert this function to a work-queue */ >>> CID 1617471: Program hangs (LOCK) >>> "event_should_yield" locks "event->mtx" while it is locked. 3210 if (event_should_yield(event)) { 3211 OSPF_TIMER_ON(ospf->t_maxage, 3212 ospf_maxage_lsa_remover, 0); 3213 route_unlock_node( 3214 rn); /* route_top/route_next */ 3215 return; ** CID 1617470: Insecure data handling (INTEGER_OVERFLOW) ________________________________________________________________________________________________________ *** CID 1617470: Insecure data handling (INTEGER_OVERFLOW) /ospfd/ospf_api.c: 517 in new_msg_originate_request() 511 if (omsglen > data_maxs) 512 omsglen = data_maxs; 513 memcpy(omsg_data, data, omsglen); 514 omsglen += sizeof(struct msg_originate_request) 515 - sizeof(struct lsa_header); 516 >>> CID 1617470: Insecure data handling (INTEGER_OVERFLOW) >>> "omsglen", which might have overflowed, is passed to "msg_new(5, omsg, seqnum, omsglen)". 517 return msg_new(MSG_ORIGINATE_REQUEST, omsg, seqnum, omsglen); 518 } 519 520 struct msg *new_msg_delete_request(uint32_t seqnum, struct in_addr addr, 521 uint8_t lsa_type, uint8_t opaque_type, 522 uint32_t opaque_id, uint8_t flags) ** CID 1617469: Program hangs (ORDER_REVERSAL) /bgpd/bgp_fsm.c: 1504 in bgp_stop() ________________________________________________________________________________________________________ *** CID 1617469: Program hangs (ORDER_REVERSAL) /bgpd/bgp_fsm.c: 1504 in bgp_stop() 1498 EVENT_OFF(connection->t_connect); 1499 EVENT_OFF(connection->t_holdtime); 1500 EVENT_OFF(connection->t_routeadv); 1501 EVENT_OFF(connection->t_delayopen); 1502 1503 /* Clear input and output buffer. */ >>> CID 1617469: Program hangs (ORDER_REVERSAL) >>> Calling "_frr_mtx_lock" acquires lock "peer_connection.io_mtx" while holding lock "event_loop.mtx" (count: 5 / 51). 1504 frr_with_mutex (&connection->io_mtx) { 1505 if (connection->ibuf) 1506 stream_fifo_clean(connection->ibuf); 1507 if (connection->obuf) 1508 stream_fifo_clean(connection->obuf); 1509 ** CID 1617468: Integer handling issues (INTEGER_OVERFLOW) /lib/bitfield.h: 204 in bf_find_next_clear_bit_wrap() ________________________________________________________________________________________________________ *** CID 1617468: Integer handling issues (INTEGER_OVERFLOW) /lib/bitfield.h: 204 in bf_find_next_clear_bit_wrap() 198 199 /* 200 * start looking for a clear bit at the start of the bitfield and 201 * stop when we reach start_index 202 */ 203 scanbits = WORD_SIZE; >>> CID 1617468: Integer handling issues (INTEGER_OVERFLOW) >>> Expression "start_index - 1U", where "start_index" is known to be equal to 0, underflows the type of "start_index - 1U", which is type "unsigned int". 204 index_max = bf_index(start_index - 1); 205 for (i = 0; i <= index_max; ++i) { 206 if (i == index_max) 207 scanbits = ((start_index - 1) % WORD_SIZE) + 1; 208 for (offset = start_bit; offset < scanbits; ++offset) { 209 if (!((v->data[i] >> offset) & 1)) ** CID 1617467: Program hangs (LOCK) /pathd/path_pcep_controller.c: 200 in pcep_ctrl_initialize() ________________________________________________________________________________________________________ *** CID 1617467: Program hangs (LOCK) /pathd/path_pcep_controller.c: 200 in pcep_ctrl_initialize() 194 ctrl_state->pcc_opts->addr.ipa_type = IPADDR_NONE; 195 ctrl_state->pcc_opts->port = PCEP_DEFAULT_PORT; 196 197 /* Keep the state reference for events */ 198 set_ctrl_state(*fpt, ctrl_state); 199 >>> CID 1617467: Program hangs (LOCK) >>> Returning without unlocking "(*fpt)->running_cond_mtx". 200 return ret; 201 } 202 203 int pcep_ctrl_finalize(struct frr_pthread **fpt) 204 { 205 assert(fpt != NULL); ** CID 1617466: Concurrent data access violations (MISSING_LOCK) /zebra/zebra_fpm.c: 1760 in zfpm_show_stats() ________________________________________________________________________________________________________ *** CID 1617466: Concurrent data access violations (MISSING_LOCK) /zebra/zebra_fpm.c: 1760 in zfpm_show_stats() 1754 ZFPM_SHOW_STAT(nop_deletes_skipped); 1755 ZFPM_SHOW_STAT(route_adds); 1756 ZFPM_SHOW_STAT(route_dels); 1757 ZFPM_SHOW_STAT(updates_triggered); 1758 ZFPM_SHOW_STAT(redundant_triggers); 1759 ZFPM_SHOW_STAT(dests_del_after_update); >>> CID 1617466: Concurrent data access violations (MISSING_LOCK) >>> Accessing "zfpm_g->last_ivl_stats.t_conn_down_starts" without holding lock "event_loop.mtx". Elsewhere, "zfpm_stats.t_conn_down_starts" is written to with "event_loop.mtx" held 1 out of 1 times. 1760 ZFPM_SHOW_STAT(t_conn_down_starts); 1761 ZFPM_SHOW_STAT(t_conn_down_dests_processed); 1762 ZFPM_SHOW_STAT(t_conn_down_yields); 1763 ZFPM_SHOW_STAT(t_conn_down_finishes); 1764 ZFPM_SHOW_STAT(t_conn_up_starts); 1765 ZFPM_SHOW_STAT(t_conn_up_dests_processed); ** CID 1617465: Data race undermines locking (LOCK_EVASION) /zebra/zserv.c: 721 in zserv_close_client() ________________________________________________________________________________________________________ *** CID 1617465: Data race undermines locking (LOCK_EVASION) /zebra/zserv.c: 721 in zserv_close_client() 715 event_cancel_event(zrouter.master, client); 716 EVENT_OFF(client->t_cleanup); 717 EVENT_OFF(client->t_process); 718 719 /* destroy pthread */ 720 frr_pthread_destroy(client->pthread); >>> CID 1617465: Data race undermines locking (LOCK_EVASION) >>> Thread1 sets "pthread" to a new value. Now the two threads have an inconsistent view of "pthread" and updates to fields of "pthread" or fields correlated with "pthread" may be lost. 721 client->pthread = NULL; 722 } 723 724 /* 725 * Final check in case the client struct is in use in another 726 * pthread: if not in-use, continue and free the client ** CID 1617464: Concurrent data access violations (MISSING_LOCK) /zebra/zebra_fpm.c: 1764 in zfpm_show_stats() ________________________________________________________________________________________________________ *** CID 1617464: Concurrent data access violations (MISSING_LOCK) /zebra/zebra_fpm.c: 1764 in zfpm_show_stats() 1758 ZFPM_SHOW_STAT(redundant_triggers); 1759 ZFPM_SHOW_STAT(dests_del_after_update); 1760 ZFPM_SHOW_STAT(t_conn_down_starts); 1761 ZFPM_SHOW_STAT(t_conn_down_dests_processed); 1762 ZFPM_SHOW_STAT(t_conn_down_yields); 1763 ZFPM_SHOW_STAT(t_conn_down_finishes); >>> CID 1617464: Concurrent data access violations (MISSING_LOCK) >>> Accessing "zfpm_g->last_ivl_stats.t_conn_up_starts" without holding lock "event_loop.mtx". Elsewhere, "zfpm_stats.t_conn_up_starts" is written to with "event_loop.mtx" held 1 out of 1 times. 1764 ZFPM_SHOW_STAT(t_conn_up_starts); 1765 ZFPM_SHOW_STAT(t_conn_up_dests_processed); 1766 ZFPM_SHOW_STAT(t_conn_up_yields); 1767 ZFPM_SHOW_STAT(t_conn_up_aborts); 1768 ZFPM_SHOW_STAT(t_conn_up_finishes); 1769 ** CID 1617463: (INTEGER_OVERFLOW) /lib/ptm_lib.c: 320 in _ptm_lib_read_ptm_socket() /lib/ptm_lib.c: 307 in _ptm_lib_read_ptm_socket() ________________________________________________________________________________________________________ *** CID 1617463: (INTEGER_OVERFLOW) /lib/ptm_lib.c: 320 in _ptm_lib_read_ptm_socket() 314 if (retries++ < 2) { 315 usleep(10000); 316 continue; 317 } 318 DLOG("max retries - recv error(%d - %s) bytes read %d (%d)\n", errno, 319 strerror(errno), bytes_read, len); >>> CID 1617463: (INTEGER_OVERFLOW) >>> "bytes_read", which might have overflowed, is returned from the function. 320 return (bytes_read); 321 } else { 322 bytes_read += rc; 323 } 324 } 325 /lib/ptm_lib.c: 307 in _ptm_lib_read_ptm_socket() 301 static int _ptm_lib_read_ptm_socket(int fd, char *buf, int len) 302 { 303 int retries = 0, rc; 304 int bytes_read = 0; 305 306 while (bytes_read != len) { >>> CID 1617463: (INTEGER_OVERFLOW) >>> "len - bytes_read", which might have underflowed, is passed to "recv(fd, (void *)(buf + bytes_read), len - bytes_read, MSG_DONTWAIT)". 307 rc = recv(fd, (void *)(buf + bytes_read), (len - bytes_read), 308 MSG_DONTWAIT); 309 if (rc < 0 && (errno != EAGAIN) && (errno != EWOULDBLOCK)) { 310 ERRLOG("fatal recv error(%s), closing connection, rc %d\n", strerror(errno), 311 rc); 312 return (rc); ** CID 1617462: Program hangs (ORDER_REVERSAL) ________________________________________________________________________________________________________ *** CID 1617462: Program hangs (ORDER_REVERSAL) /zebra/zebra_pw.c: 239 in zebra_pw_install_failure() 233 234 /* schedule to retry later */ 235 EVENT_OFF(pw->install_retry_timer); 236 event_add_timer(zrouter.master, zebra_pw_install_retry, pw, 237 PW_INSTALL_RETRY_INTERVAL, &pw->install_retry_timer); 238 >>> CID 1617462: Program hangs (ORDER_REVERSAL) >>> Calling "zebra_pw_update_status" acquires lock "zserv.obuf_mtx" while holding lock "event_loop.mtx" (count: 1 / 2). 239 zebra_pw_update_status(pw, pwstatus); 240 } 241 242 static void zebra_pw_install_retry(struct event *thread) 243 { 244 struct zebra_pw *pw = EVENT_ARG(thread); ** CID 1617461: Memory - corruptions (USE_AFTER_FREE) /bgpd/bgp_route.c: 9317 in bgp_redistribute_add() ________________________________________________________________________________________________________ *** CID 1617461: Memory - corruptions (USE_AFTER_FREE) /bgpd/bgp_route.c: 9317 in bgp_redistribute_add() 9311 bgp->peer_self, new_attr, bn); 9312 SET_FLAG(new->flags, BGP_PATH_VALID); 9313 9314 bgp_aggregate_increment(bgp, p, new, afi, SAFI_UNICAST); 9315 bgp_path_info_add(bn, new); 9316 bgp_dest_unlock_node(bn); >>> CID 1617461: Memory - corruptions (USE_AFTER_FREE) >>> Dereferencing freed pointer "bn". 9317 SET_FLAG(bn->flags, BGP_NODE_FIB_INSTALLED); 9318 bgp_process(bgp, bn, new, afi, SAFI_UNICAST); 9319 9320 if ((bgp->inst_type == BGP_INSTANCE_TYPE_VRF) 9321 || (bgp->inst_type == BGP_INSTANCE_TYPE_DEFAULT)) { 9322 ** CID 1617460: Program hangs (ORDER_REVERSAL) ________________________________________________________________________________________________________ *** CID 1617460: Program hangs (ORDER_REVERSAL) /bgpd/bgpd.c: 1291 in peer_free() 1285 1286 if (peer->change_local_as_pretty) 1287 XFREE(MTYPE_BGP_NAME, peer->change_local_as_pretty); 1288 if (peer->as_pretty) 1289 XFREE(MTYPE_BGP_NAME, peer->as_pretty); 1290 >>> CID 1617460: Program hangs (ORDER_REVERSAL) >>> Calling "bgp_peer_connection_free" acquires lock "peer_connection.io_mtx" while holding lock "event_loop.mtx" (count: 5 / 51). 1291 bgp_peer_connection_free(&peer->connection); 1292 1293 bgp_unlock(peer->bgp); 1294 1295 stream_free(peer->last_reset_cause); 1296 ** CID 1617459: Data race undermines locking (LOCK_EVASION) /ospf6d/ospf6_network.c: 89 in ospf6_serv_sock() ________________________________________________________________________________________________________ *** CID 1617459: Data race undermines locking (LOCK_EVASION) /ospf6d/ospf6_network.c: 89 in ospf6_serv_sock() 83 ospf6_set_reuseaddr(); 84 #endif /*1*/ 85 ospf6_reset_mcastloop(ospf6_sock); 86 ospf6_set_pktinfo(ospf6_sock); 87 ospf6_set_transport_class(ospf6_sock); 88 >>> CID 1617459: Data race undermines locking (LOCK_EVASION) >>> Thread1 sets "fd" to a new value. Now the two threads have an inconsistent view of "fd" and updates to fields correlated with "fd" may be lost. 89 ospf6->fd = ospf6_sock; 90 /* setup global in6_addr, allspf6 and alldr6 for later use */ 91 inet_pton(AF_INET6, ALLSPFROUTERS6, &allspfrouters6); 92 inet_pton(AF_INET6, ALLDROUTERS6, &alldrouters6); 93 94 return 0; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/freerangerouting-frr?tab=overview

1 0

FRR 10.2 Bug report - RIP/RIPNG distribution list fails to filter routes
by Russell Yount 13 Jan '25

13 Jan '25

I attempted to upgrade some FreeBSD 14.2 systems from frr8 ( 8.5.6) to frr10 (10.2) both from the FreeBSD ports collection. I skipped frr9 due to a bug that did not initialize routes from the kernel on startup. The systems are VMs running under Proxmox virtual environment. The distribution-list functionality no longer works for both rip and ripng. The following configuration can reproduce the problem. I would be happy to test any proposed fixes for this. -- router rip network vtnet8 network vtnet9 distribute-list rip-dist-out out exit router ripng network vtnet8 network vtnet9 ipv6 distribute-list ripng-dist-out out exit access-list rip-dist-out seq 5 deny any ipv6 access-list ripng-dist-out seq 5 deny any -- Also I notice in frr10 the routes reflecting the interface addresses going to loopback interface display in "show ip route" and "show ipv6 route" route as a new local(L) route type. I assume this is intentional but thought I would mention it. -Russ Russell J. Yount <Russell.Yount(a)gmail.com>

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 10 Jan '25

10 Jan '25

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 1613932: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1613932: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_route.c: 15206 in peer_adj_routes() 15200 } 15201 15202 output_count += output_count_per_rd; 15203 filtered_count += filtered_count_per_rd; 15204 } 15205 } else { >>> CID 1613932: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "table" to "show_adj_route", which dereferences it. 15206 show_adj_route(vty, peer, table, afi, safi, type, rmap_name, 15207 json, json_ar, show_flags, &header1, &header2, 15208 rd_str, match, &output_count, &filtered_count); 15209 15210 if (use_json) { 15211 if (type == bgp_show_adj_route_advertised || ** CID 1613931: API usage errors (PRINTF_ARGS) ________________________________________________________________________________________________________ *** CID 1613931: API usage errors (PRINTF_ARGS) /mgmtd/mgmt_fe_adapter.c: 1240 in fe_adapter_handle_session_req() 1234 void *__msg, size_t msg_len) 1235 { 1236 struct mgmt_msg_session_req *msg = __msg; 1237 struct mgmt_fe_session_ctx *session; 1238 uint64_t client_id; 1239 >>> CID 1613931: API usage errors (PRINTF_ARGS) >>> Length modifier "L" not applicable to conversion specifier in "%Lu". 1240 __dbg("Got session-req is create %u req-id %Lu for refer-id %Lu from '%s'", 1241 msg->refer_id == 0, msg->req_id, msg->refer_id, adapter->name); 1242 1243 if (msg->refer_id) { 1244 uint64_t session_id = msg->refer_id; 1245 ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, http://url2497.blackduck.com/ls/click?upn=u001.Ji18sHaXCxZb7Rfw8sC51j9Suwl8…

1 0

Stop testing and updates for CentOS 7 / RedHat 7
by Martin Winter 09 Jan '25

09 Jan '25

Hi there, I'm planning to stop releasing any new CentOS 7 / RedHat 7 packages and stop the testing for it. - No more CI tests on CentOS 7 - No new packages for CentOS 7 / RedHat 7 (not even minor updates or security fixes) CentOS 7 is EoL for some time. So far, we still used it for build Redhat 7 / CentOS 7 packages, but there is now the time where repositories get removed or moved. As such, I think the work to maintain this in the CI Infrastructure and Release Build is too much and I'm considering abandoning it. This does NOT impact RedHat 8 or RedHat 9. Please reply if this causes any issues to you or have any other reasons why this should be reconsidered. Regards, Martin Winter

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 02 Jan '25

02 Jan '25

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1602708: Memory - illegal accesses (USE_AFTER_FREE) /bgpd/bgp_route.c: 15789 in bgp_address_family_distance_delete() ________________________________________________________________________________________________________ *** CID 1602708: Memory - illegal accesses (USE_AFTER_FREE) /bgpd/bgp_route.c: 15789 in bgp_address_family_distance_delete() 15783 safi_t safi = SAFI_UNSPEC; 15784 struct bgp_dest *dest = NULL; 15785 struct bgp_distance *bdistance = NULL; 15786 15787 FOREACH_AFI_SAFI (afi, safi) { 15788 for (dest = bgp_table_top(bgp_distance_table[afi][safi]); dest; >>> CID 1602708: Memory - illegal accesses (USE_AFTER_FREE) >>> Passing freed pointer "dest" as an argument to "bgp_route_next". 15789 dest = bgp_route_next(dest)) { 15790 if (!bgp_dest_has_bgp_path_info_data(dest)) 15791 continue; 15792 bdistance = bgp_dest_get_bgp_distance_info(dest); 15793 XFREE(MTYPE_AS_LIST, bdistance->access_list); 15794 bgp_distance_free(bdistance); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=u001.AxU2LYlgjL6eX23u9ErQy-2…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 17 Dec '24

17 Dec '24

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 1602521: Error handling issues (CHECKED_RETURN) /pimd/pim_rp.c: 1110 in pim_rp_g() ________________________________________________________________________________________________________ *** CID 1602521: Error handling issues (CHECKED_RETURN) /pimd/pim_rp.c: 1110 in pim_rp_g() 1104 if (PIM_DEBUG_PIM_NHT_RP) 1105 zlog_debug( 1106 "%s: NHT Register RP addr %pPA grp %pFX with Zebra", 1107 __func__, &nht_p, &rp_info->group); 1108 pim_nht_find_or_track(pim, nht_p, NULL, rp_info, NULL); 1109 pim_rpf_set_refresh_time(pim); >>> CID 1602521: Error handling issues (CHECKED_RETURN) >>> Calling "pim_nht_lookup_ecmp" without checking return value (as is done elsewhere 9 out of 11 times). 1110 pim_nht_lookup_ecmp(pim, &rp_info->rp.source_nexthop, nht_p, &rp_info->group, true); 1111 return (&rp_info->rp); 1112 } 1113 1114 // About to Go Down 1115 return NULL; ** CID 1602520: Error handling issues (CHECKED_RETURN) /pimd/pim_tib.c: 38 in tib_sg_oil_setup() ________________________________________________________________________________________________________ *** CID 1602520: Error handling issues (CHECKED_RETURN) /pimd/pim_tib.c: 38 in tib_sg_oil_setup() 32 33 pim_addr_to_prefix(&grp, sg.grp); 34 35 up = pim_upstream_find(pim, &sg); 36 if (up) { 37 memcpy(&nexthop, &up->rpf.source_nexthop, sizeof(struct pim_nexthop)); >>> CID 1602520: Error handling issues (CHECKED_RETURN) >>> Calling "pim_nht_lookup_ecmp" without checking return value (as is done elsewhere 9 out of 11 times). 38 pim_nht_lookup_ecmp(pim, &nexthop, vif_source, &grp, false); 39 if (nexthop.interface) 40 input_iface_vif_index = pim_if_find_vifindex_by_ifindex( 41 pim, nexthop.interface->ifindex); 42 } else 43 input_iface_vif_index = pim_nht_lookup_ecmp_if_vif_index(pim, vif_source, &grp); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=u001.AxU2LYlgjL6eX23u9ErQy-2…

1 0

Re: [dev] Supporting Graceful Restart for more SAFIs (e.g. EVPN)
by Donald Sharp 14 Dec '24

14 Dec '24

As I recall from the discussion during the time GR and EVPN was added was that there was uncertainty about behaviors and what we had time for in relation to testing. So it was not added. From my perspective I would love to have someone work on this bit of code. I would like though the addition of a topotest to show that it actually works. Donald > On Dec 12, 2024, at 11:05 AM, Lukas Stockner via dev <dev(a)lists.frrouting.org> wrote: > > <mime-attachment> > _______________________________________________ > dev mailing list > dev(a)lists.frrouting.org > https://lists.frrouting.org/listinfo/dev

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 13 Dec '24

13 Dec '24

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1602463: Error handling issues (CHECKED_RETURN) /pimd/pim_msdp_packet.c: 422 in pim_msdp_pkt_sa_gen() ________________________________________________________________________________________________________ *** CID 1602463: Error handling issues (CHECKED_RETURN) /pimd/pim_msdp_packet.c: 422 in pim_msdp_pkt_sa_gen() 416 417 sa_count = 0; 418 if (PIM_DEBUG_MSDP_INTERNAL) { 419 zlog_debug(" sa gen %d", local_cnt); 420 } 421 >>> CID 1602463: Error handling issues (CHECKED_RETURN) >>> Calling "pim_get_all_mcast_group" without checking return value (as is done elsewhere 9 out of 10 times). 422 pim_get_all_mcast_group(&group_all); 423 pim_msdp_originator_id(pim, &group_all, &rp); 424 local_cnt = pim_msdp_pkt_sa_fill_hdr(pim, local_cnt, rp); 425 426 for (ALL_LIST_ELEMENTS_RO(pim->msdp.sa_list, sanode, sa)) { 427 if (!(sa->flags & PIM_MSDP_SAF_LOCAL)) { ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=u001.AxU2LYlgjL6eX23u9ErQy-2…

1 0

Supporting Graceful Restart for more SAFIs (e.g. EVPN)
by Lukas Stockner 12 Dec '24

12 Dec '24

Hi all, I've been looking into using FRR as a RR for EVPN with Graceful Restart enabled and found that this currently does not work since FOREACH_AFI_SAFI_NSF only goes through the unicast, multicast and MPLS-VPN SAFIs, so EVPN routes aren't preserved and peers which only negotiate EVPN are deleted on disconnect. However, I can't see any reason why such a limitation would be necessary, and simply removing it and using the general FOREACH_AFI_SAFI in the GH code appears to work just fine. >From what I can tell through git blame, it seems like the GH code predates these SAFIs, its loop boundaries weren't updated when e.g. EVPN was added, and when the FOREACH #define was introduced to clean the code up, it was assumed that the difference is intentional. I'd be happy to open a PR to change this, just wanted to check if anyone is aware of a reason to keep this as-is. Cheers, Lukas

1 0