- dev - lists.frrouting.org

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 16 Apr '24

16 Apr '24

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1585206: Error handling issues (CHECKED_RETURN) /bgpd/bgp_fsm.c: 1804 in bgp_connect_in_progress_update_connection() ________________________________________________________________________________________________________ *** CID 1585206: Error handling issues (CHECKED_RETURN) /bgpd/bgp_fsm.c: 1804 in bgp_connect_in_progress_update_connection() 1798 1799 /* after connect is called(), getpeername is able to return 1800 * port and address on non established streams 1801 */ 1802 static void bgp_connect_in_progress_update_connection(struct peer *peer) 1803 { >>> CID 1585206: Error handling issues (CHECKED_RETURN) >>> Calling "bgp_getsockname" without checking return value (as is done elsewhere 5 out of 6 times). 1804 bgp_getsockname(peer); 1805 if (!peer->su_remote && !BGP_CONNECTION_SU_UNSPEC(peer->connection)) { 1806 /* if connect initiated, then dest port and dest addresses are well known */ 1807 peer->su_remote = sockunion_dup(&peer->connection->su); 1808 if (sockunion_family(peer->su_remote) == AF_INET) 1809 peer->su_remote->sin.sin_port = htons(peer->port); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=u001.AxU2LYlgjL6eX23u9ErQy-2…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 12 Apr '24

12 Apr '24

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1585094: (FORWARD_NULL) /bgpd/bgp_zebra.c: 1789 in bgp_handle_route_announcements_to_zebra() /bgpd/bgp_zebra.c: 1804 in bgp_handle_route_announcements_to_zebra() ________________________________________________________________________________________________________ *** CID 1585094: (FORWARD_NULL) /bgpd/bgp_zebra.c: 1789 in bgp_handle_route_announcements_to_zebra() 1783 table = bgp_dest_table(dest); 1784 install = CHECK_FLAG(dest->flags, BGP_NODE_SCHEDULE_FOR_INSTALL); 1785 if (table && table->afi == AFI_L2VPN && table->safi == SAFI_EVPN) 1786 is_evpn = true; 1787 1788 if (BGP_DEBUG(zebra, ZEBRA)) >>> CID 1585094: (FORWARD_NULL) >>> Dereferencing null pointer "table". 1789 zlog_debug("BGP %s route %pBD(%s) with dest %p and flags 0x%x to zebra", 1790 install ? "announcing" : "withdrawing", dest, 1791 table->bgp->name_pretty, dest, dest->flags); 1792 1793 if (install) { 1794 if (is_evpn) /bgpd/bgp_zebra.c: 1804 in bgp_handle_route_announcements_to_zebra() 1798 (const struct prefix_evpn 1799 *) 1800 bgp_dest_get_prefix( 1801 dest), 1802 dest->za_bgp_pi); 1803 else >>> CID 1585094: (FORWARD_NULL) >>> Dereferencing null pointer "table". 1804 status = bgp_zebra_announce_actual(dest, 1805 dest->za_bgp_pi, 1806 table->bgp); 1807 UNSET_FLAG(dest->flags, BGP_NODE_SCHEDULE_FOR_INSTALL); 1808 } else { 1809 if (is_evpn) ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=u001.AxU2LYlgjL6eX23u9ErQy-2…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 12 Mar '24

12 Mar '24

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1584308: Concurrent data access violations (MISSING_LOCK) /zebra/zserv.c: 328 in zserv_read() ________________________________________________________________________________________________________ *** CID 1584308: Concurrent data access violations (MISSING_LOCK) /zebra/zserv.c: 328 in zserv_read() 322 size_t already; 323 struct stream_fifo *cache; 324 uint32_t p2p; /* Temp p2p used to process */ 325 uint32_t p2p_orig; /* Configured p2p (Default-1000) */ 326 int p2p_avail; /* How much space is available for p2p */ 327 struct zmsghdr hdr; >>> CID 1584308: Concurrent data access violations (MISSING_LOCK) >>> Accessing "client->ibuf_fifo" without holding lock "zserv.ibuf_mtx". Elsewhere, "zserv.ibuf_fifo" is written to with "zserv.ibuf_mtx" held 2 out of 2 times. 328 size_t client_ibuf_fifo_cnt = stream_fifo_count_safe(client->ibuf_fifo); 329 330 p2p_orig = atomic_load_explicit(&zrouter.packets_to_process, 331 memory_order_relaxed); 332 p2p_avail = p2p_orig - client_ibuf_fifo_cnt; 333 ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=u001.AxU2LYlgjL6eX23u9ErQy-2…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 06 Mar '24

06 Mar '24

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 1584234: (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1584234: (TAINTED_SCALAR) /zebra/fpm_listener.c: 594 in fpm_serve() 588 while (1) { 589 590 hdr = read_fpm_msg(buf, sizeof(buf)); 591 if (!hdr) 592 return; 593 >>> CID 1584234: (TAINTED_SCALAR) >>> Passing tainted expression "*hdr" to "process_fpm_msg", which uses it as a loop boundary. 594 process_fpm_msg(hdr); 595 } 596 } 597 598 int main(int argc, char **argv) 599 { /zebra/fpm_listener.c: 594 in fpm_serve() 588 while (1) { 589 590 hdr = read_fpm_msg(buf, sizeof(buf)); 591 if (!hdr) 592 return; 593 >>> CID 1584234: (TAINTED_SCALAR) >>> Passing tainted expression "hdr->msg_len" to "process_fpm_msg", which uses it as a loop boundary. 594 process_fpm_msg(hdr); 595 } 596 } 597 598 int main(int argc, char **argv) 599 { /zebra/fpm_listener.c: 594 in fpm_serve() 588 while (1) { 589 590 hdr = read_fpm_msg(buf, sizeof(buf)); 591 if (!hdr) 592 return; 593 >>> CID 1584234: (TAINTED_SCALAR) >>> Passing tainted expression "hdr->msg_len" to "process_fpm_msg", which uses it as a loop boundary. 594 process_fpm_msg(hdr); 595 } 596 } 597 598 int main(int argc, char **argv) 599 { /zebra/fpm_listener.c: 594 in fpm_serve() 588 while (1) { 589 590 hdr = read_fpm_msg(buf, sizeof(buf)); 591 if (!hdr) 592 return; 593 >>> CID 1584234: (TAINTED_SCALAR) >>> Passing tainted expression "hdr" to "process_fpm_msg", which uses it as a loop boundary. 594 process_fpm_msg(hdr); 595 } 596 } 597 598 int main(int argc, char **argv) 599 { /zebra/fpm_listener.c: 594 in fpm_serve() 588 while (1) { 589 590 hdr = read_fpm_msg(buf, sizeof(buf)); 591 if (!hdr) 592 return; 593 >>> CID 1584234: (TAINTED_SCALAR) >>> Passing tainted expression "hdr" to "process_fpm_msg", which uses it as a loop boundary. 594 process_fpm_msg(hdr); 595 } 596 } 597 598 int main(int argc, char **argv) 599 { ** CID 1584233: (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1584233: (TAINTED_SCALAR) /zebra/fpm_listener.c: 577 in process_fpm_msg() 571 572 if (hdr->msg_type != FPM_MSG_TYPE_NETLINK) { 573 fprintf(stderr, "Unknown fpm message type %u\n", hdr->msg_type); 574 return; 575 } 576 >>> CID 1584233: (TAINTED_SCALAR) >>> Passing tainted expression "fpm_msg_data_len(hdr)" to "parse_netlink_msg", which uses it as a loop boundary. 577 parse_netlink_msg(fpm_msg_data(hdr), fpm_msg_data_len(hdr)); 578 } 579 580 /* 581 * fpm_serve 582 */ /zebra/fpm_listener.c: 577 in process_fpm_msg() 571 572 if (hdr->msg_type != FPM_MSG_TYPE_NETLINK) { 573 fprintf(stderr, "Unknown fpm message type %u\n", hdr->msg_type); 574 return; 575 } 576 >>> CID 1584233: (TAINTED_SCALAR) >>> Passing tainted expression "fpm_msg_data_len(hdr)" to "parse_netlink_msg", which uses it as a loop boundary. 577 parse_netlink_msg(fpm_msg_data(hdr), fpm_msg_data_len(hdr)); 578 } 579 580 /* 581 * fpm_serve 582 */ ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=u001.AxU2LYlgjL6eX23u9ErQy-2…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 05 Mar '24

05 Mar '24

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 32 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 32 defect(s) ** CID 1583972: Concurrent data access violations (MISSING_LOCK) /zebra/zebra_dplane.c: 7532 in zebra_dplane_init_internal() ________________________________________________________________________________________________________ *** CID 1583972: Concurrent data access violations (MISSING_LOCK) /zebra/zebra_dplane.c: 7532 in zebra_dplane_init_internal() 7526 memset(&zdplane_info, 0, sizeof(zdplane_info)); 7527 7528 pthread_mutex_init(&zdplane_info.dg_mutex, NULL); 7529 7530 dplane_prov_list_init(&zdplane_info.dg_providers); 7531 >>> CID 1583972: Concurrent data access violations (MISSING_LOCK) >>> Accessing "zdplane_info.dg_update_list" without holding lock "zebra_dplane_globals.dg_mutex". Elsewhere, "zebra_dplane_globals.dg_update_list" is written to with "zebra_dplane_globals.dg_mutex" held 5 out of 6 times. 7532 dplane_ctx_list_init(&zdplane_info.dg_update_list); 7533 zns_info_list_init(&zdplane_info.dg_zns_list); 7534 7535 zdplane_info.dg_updates_per_cycle = DPLANE_DEFAULT_NEW_WORK; 7536 7537 zdplane_info.dg_max_queued_updates = DPLANE_DEFAULT_MAX_QUEUED; ** CID 1583971: Concurrent data access violations (MISSING_LOCK) /zebra/dplane_fpm_nl.c: 1398 in fpm_process_queue() ________________________________________________________________________________________________________ *** CID 1583971: Concurrent data access violations (MISSING_LOCK) /zebra/dplane_fpm_nl.c: 1398 in fpm_process_queue() 1392 struct zebra_dplane_ctx *ctx; 1393 bool no_bufs = false; 1394 uint64_t processed_contexts = 0; 1395 1396 while (true) { 1397 /* No space available yet. */ >>> CID 1583971: Concurrent data access violations (MISSING_LOCK) >>> Accessing "fnc->obuf" without holding lock "fpm_nl_ctx.obuf_mutex". Elsewhere, "fpm_nl_ctx.obuf" is written to with "fpm_nl_ctx.obuf_mutex" held 8 out of 8 times. 1398 if (STREAM_WRITEABLE(fnc->obuf) < NL_PKT_BUF_SIZE) { 1399 no_bufs = true; 1400 break; 1401 } 1402 1403 /* Dequeue next item or quit processing. */ ** CID 1583970: Program hangs (LOCK) /zebra/zebra_dplane.c: 6892 in kernel_dplane_process_ipset_entry() ________________________________________________________________________________________________________ *** CID 1583970: Program hangs (LOCK) /zebra/zebra_dplane.c: 6892 in kernel_dplane_process_ipset_entry() 6886 static void 6887 kernel_dplane_process_ipset_entry(struct zebra_dplane_provider *prov, 6888 struct zebra_dplane_ctx *ctx) 6889 { 6890 zebra_pbr_process_ipset_entry(ctx); 6891 dplane_provider_enqueue_out_ctx(prov, ctx); >>> CID 1583970: Program hangs (LOCK) >>> Returning without unlocking "prov->dp_mutex". 6892 } 6893 6894 void dplane_rib_add_multipath(afi_t afi, safi_t safi, struct prefix *p, 6895 struct prefix_ipv6 *src_p, struct route_entry *re, 6896 struct nexthop_group *ng, int startup, 6897 struct zebra_dplane_ctx *ctx) ** CID 1583969: Program hangs (ORDER_REVERSAL) ________________________________________________________________________________________________________ *** CID 1583969: Program hangs (ORDER_REVERSAL) /bgpd/bgp_keepalives.c: 198 in bgp_keepalives_start() 192 pthread_mutex_lock(peerhash_mtx); 193 194 /* register cleanup handler */ 195 pthread_cleanup_push(&bgp_keepalives_finish, NULL); 196 197 /* notify anybody waiting on us that we are done starting up */ >>> CID 1583969: Program hangs (ORDER_REVERSAL) >>> Calling "frr_pthread_notify_running" acquires lock "frr_pthread.running_cond_mtx" while holding lock "peerhash_mtx" (count: 1 / 2). 198 frr_pthread_notify_running(fpt); 199 200 while (atomic_load_explicit(&fpt->running, memory_order_relaxed)) { 201 if (peerhash->count > 0) 202 pthread_cond_timedwait(peerhash_cond, peerhash_mtx, 203 &next_update_ts); ** CID 1583968: (LOCK) /zebra/zebra_dplane.c: 6926 in kernel_dplane_process_func() /zebra/zebra_dplane.c: 6968 in kernel_dplane_process_func() /zebra/zebra_dplane.c: 6951 in kernel_dplane_process_func() /zebra/zebra_dplane.c: 6968 in kernel_dplane_process_func() /zebra/zebra_dplane.c: 6951 in kernel_dplane_process_func() ________________________________________________________________________________________________________ *** CID 1583968: (LOCK) /zebra/zebra_dplane.c: 6934 in kernel_dplane_process_func() 6928 break; 6929 if (IS_ZEBRA_DEBUG_DPLANE_DETAIL) 6930 kernel_dplane_log_detail(ctx); 6931 6932 if ((dplane_ctx_get_op(ctx) == DPLANE_OP_IPTABLE_ADD 6933 || dplane_ctx_get_op(ctx) == DPLANE_OP_IPTABLE_DELETE)) >>> CID 1583968: (LOCK) >>> "kernel_dplane_process_iptable" unlocks "prov->dp_mutex" while it is unlocked. 6934 kernel_dplane_process_iptable(prov, ctx); 6935 else if ((dplane_ctx_get_op(ctx) == DPLANE_OP_IPSET_ADD 6936 || dplane_ctx_get_op(ctx) == DPLANE_OP_IPSET_DELETE)) 6937 kernel_dplane_process_ipset(prov, ctx); 6938 else if ((dplane_ctx_get_op(ctx) == DPLANE_OP_IPSET_ENTRY_ADD 6939 || dplane_ctx_get_op(ctx) /zebra/zebra_dplane.c: 6941 in kernel_dplane_process_func() 6935 else if ((dplane_ctx_get_op(ctx) == DPLANE_OP_IPSET_ADD 6936 || dplane_ctx_get_op(ctx) == DPLANE_OP_IPSET_DELETE)) 6937 kernel_dplane_process_ipset(prov, ctx); 6938 else if ((dplane_ctx_get_op(ctx) == DPLANE_OP_IPSET_ENTRY_ADD 6939 || dplane_ctx_get_op(ctx) 6940 == DPLANE_OP_IPSET_ENTRY_DELETE)) >>> CID 1583968: (LOCK) >>> "kernel_dplane_process_ipset_entry" unlocks "prov->dp_mutex" while it is unlocked. 6941 kernel_dplane_process_ipset_entry(prov, ctx); 6942 else 6943 dplane_ctx_list_add_tail(&work_list, ctx); 6944 } 6945 6946 kernel_update_multi(&work_list); /zebra/zebra_dplane.c: 6937 in kernel_dplane_process_func() 6931 6932 if ((dplane_ctx_get_op(ctx) == DPLANE_OP_IPTABLE_ADD 6933 || dplane_ctx_get_op(ctx) == DPLANE_OP_IPTABLE_DELETE)) 6934 kernel_dplane_process_iptable(prov, ctx); 6935 else if ((dplane_ctx_get_op(ctx) == DPLANE_OP_IPSET_ADD 6936 || dplane_ctx_get_op(ctx) == DPLANE_OP_IPSET_DELETE)) >>> CID 1583968: (LOCK) >>> "kernel_dplane_process_ipset" unlocks "prov->dp_mutex" while it is unlocked. 6937 kernel_dplane_process_ipset(prov, ctx); 6938 else if ((dplane_ctx_get_op(ctx) == DPLANE_OP_IPSET_ENTRY_ADD 6939 || dplane_ctx_get_op(ctx) 6940 == DPLANE_OP_IPSET_ENTRY_DELETE)) 6941 kernel_dplane_process_ipset_entry(prov, ctx); 6942 else /zebra/zebra_dplane.c: 6926 in kernel_dplane_process_func() 6920 6921 if (IS_ZEBRA_DEBUG_DPLANE_DETAIL) 6922 zlog_debug("dplane provider '%s': processing", 6923 dplane_provider_get_name(prov)); 6924 6925 for (counter = 0; counter < limit; counter++) { >>> CID 1583968: (LOCK) >>> "dplane_provider_dequeue_in_ctx" unlocks "prov->dp_mutex" while it is unlocked. 6926 ctx = dplane_provider_dequeue_in_ctx(prov); 6927 if (ctx == NULL) 6928 break; 6929 if (IS_ZEBRA_DEBUG_DPLANE_DETAIL) 6930 kernel_dplane_log_detail(ctx); 6931 /zebra/zebra_dplane.c: 6968 in kernel_dplane_process_func() 6962 atomic_fetch_add_explicit(&zdplane_info.dg_update_yields, 6963 1, memory_order_relaxed); 6964 6965 dplane_provider_work_ready(); 6966 } 6967 >>> CID 1583968: (LOCK) >>> Returning without unlocking "prov->dp_mutex". 6968 return 0; 6969 } 6970 6971 static int kernel_dplane_shutdown_func(struct zebra_dplane_provider *prov, 6972 bool early) 6973 { /zebra/zebra_dplane.c: 6926 in kernel_dplane_process_func() 6920 6921 if (IS_ZEBRA_DEBUG_DPLANE_DETAIL) 6922 zlog_debug("dplane provider '%s': processing", 6923 dplane_provider_get_name(prov)); 6924 6925 for (counter = 0; counter < limit; counter++) { >>> CID 1583968: (LOCK) >>> "dplane_provider_dequeue_in_ctx" unlocks "prov->dp_mutex" while it is unlocked. 6926 ctx = dplane_provider_dequeue_in_ctx(prov); 6927 if (ctx == NULL) 6928 break; 6929 if (IS_ZEBRA_DEBUG_DPLANE_DETAIL) 6930 kernel_dplane_log_detail(ctx); 6931 /zebra/zebra_dplane.c: 6951 in kernel_dplane_process_func() 6945 6946 kernel_update_multi(&work_list); 6947 6948 while ((ctx = dplane_ctx_list_pop(&work_list)) != NULL) { 6949 kernel_dplane_handle_result(ctx); 6950 >>> CID 1583968: (LOCK) >>> "dplane_provider_enqueue_out_ctx" locks "prov->dp_mutex" while it is locked. 6951 dplane_provider_enqueue_out_ctx(prov, ctx); 6952 } 6953 6954 /* Ensure that we'll run the work loop again if there's still 6955 * more work to do. 6956 */ /zebra/zebra_dplane.c: 6926 in kernel_dplane_process_func() 6920 6921 if (IS_ZEBRA_DEBUG_DPLANE_DETAIL) 6922 zlog_debug("dplane provider '%s': processing", 6923 dplane_provider_get_name(prov)); 6924 6925 for (counter = 0; counter < limit; counter++) { >>> CID 1583968: (LOCK) >>> "dplane_provider_dequeue_in_ctx" locks "prov->dp_mutex" while it is locked. 6926 ctx = dplane_provider_dequeue_in_ctx(prov); 6927 if (ctx == NULL) 6928 break; 6929 if (IS_ZEBRA_DEBUG_DPLANE_DETAIL) 6930 kernel_dplane_log_detail(ctx); 6931 /zebra/zebra_dplane.c: 6968 in kernel_dplane_process_func() 6962 atomic_fetch_add_explicit(&zdplane_info.dg_update_yields, 6963 1, memory_order_relaxed); 6964 6965 dplane_provider_work_ready(); 6966 } 6967 >>> CID 1583968: (LOCK) >>> Returning without unlocking "prov->dp_mutex". 6968 return 0; 6969 } 6970 6971 static int kernel_dplane_shutdown_func(struct zebra_dplane_provider *prov, 6972 bool early) 6973 { /zebra/zebra_dplane.c: 6951 in kernel_dplane_process_func() 6945 6946 kernel_update_multi(&work_list); 6947 6948 while ((ctx = dplane_ctx_list_pop(&work_list)) != NULL) { 6949 kernel_dplane_handle_result(ctx); 6950 >>> CID 1583968: (LOCK) >>> "dplane_provider_enqueue_out_ctx" unlocks "prov->dp_mutex" while it is unlocked. 6951 dplane_provider_enqueue_out_ctx(prov, ctx); 6952 } 6953 6954 /* Ensure that we'll run the work loop again if there's still 6955 * more work to do. 6956 */ ** CID 1583967: Concurrent data access violations (MISSING_LOCK) /pceplib/pcep_timers.c: 404 in reset_timer() ________________________________________________________________________________________________________ *** CID 1583967: Concurrent data access violations (MISSING_LOCK) /pceplib/pcep_timers.c: 404 in reset_timer() 398 pthread_mutex_unlock(&timers_context_->timer_list_lock); 399 400 if (timers_context_->timer_cancel_func) { 401 /* Keeping this log for now, since in older versions of FRR the 402 * timer cancellation was blocking. This allows us to see how 403 * long the it takes.*/ >>> CID 1583967: Concurrent data access violations (MISSING_LOCK) >>> Accessing "timer_to_reset->timer_id" without holding lock "pcep_timers_context_.timer_list_lock". Elsewhere, "pcep_timer_.timer_id" is written to with "pcep_timers_context_.timer_list_lock" held 4 out of 4 times (4 of these accesses strongly imply that it is necessary). 404 pcep_log(LOG_DEBUG, "%s: Resetting timer [%d] with callback", 405 __func__, timer_to_reset->timer_id); 406 timers_context_->timer_cancel_func( 407 &timer_to_reset->external_timer); 408 timer_to_reset->external_timer = NULL; 409 } ** CID 1583966: Concurrent data access violations (MISSING_LOCK) /pceplib/pcep_timers.c: 53 in timer_list_node_timer_id_compare() ________________________________________________________________________________________________________ *** CID 1583966: Concurrent data access violations (MISSING_LOCK) /pceplib/pcep_timers.c: 53 in timer_list_node_timer_id_compare() 47 48 /* simple compare method callback used by pcep_utils_ordered_list 49 * ordered_list_remove_first_node_equals2 to remove a timer based on 50 * its timer_id. */ 51 int timer_list_node_timer_id_compare(void *list_entry, void *new_entry) 52 { >>> CID 1583966: Concurrent data access violations (MISSING_LOCK) >>> Accessing "((pcep_timer *)new_entry)->timer_id" without holding lock "pcep_timers_context_.timer_list_lock". Elsewhere, "pcep_timer_.timer_id" is written to with "pcep_timers_context_.timer_list_lock" held 4 out of 4 times (4 of these accesses strongly imply that it is necessary). 53 return ((pcep_timer *)new_entry)->timer_id 54 - ((pcep_timer *)list_entry)->timer_id; 55 } 56 57 /* simple compare method callback used by pcep_utils_ordered_list 58 * ordered_list_remove_first_node_equals2 to remove a timer based on ** CID 1583965: (LOCK) /zebra/dplane_fpm_nl.c: 1650 in fpm_nl_process() /zebra/dplane_fpm_nl.c: 1601 in fpm_nl_process() /zebra/dplane_fpm_nl.c: 1650 in fpm_nl_process() ________________________________________________________________________________________________________ *** CID 1583965: (LOCK) /zebra/dplane_fpm_nl.c: 1650 in fpm_nl_process() 1644 &fnc->t_dequeue); 1645 1646 /* Ensure dataplane thread is rescheduled if we hit the work limit */ 1647 if (counter >= limit) 1648 dplane_provider_work_ready(); 1649 >>> CID 1583965: (LOCK) >>> Returning without unlocking "prov->dp_mutex". 1650 return 0; 1651 } 1652 1653 static int fpm_nl_new(struct event_loop *tm) 1654 { 1655 struct zebra_dplane_provider *prov = NULL; /zebra/dplane_fpm_nl.c: 1601 in fpm_nl_process() 1595 int counter, limit; 1596 uint64_t cur_queue, peak_queue = 0, stored_peak_queue; 1597 1598 fnc = dplane_provider_get_data(prov); 1599 limit = dplane_provider_get_work_limit(prov); 1600 for (counter = 0; counter < limit; counter++) { >>> CID 1583965: (LOCK) >>> "dplane_provider_dequeue_in_ctx" unlocks "prov->dp_mutex" while it is unlocked. 1601 ctx = dplane_provider_dequeue_in_ctx(prov); 1602 if (ctx == NULL) 1603 break; 1604 1605 /* 1606 * Skip all notifications if not connected, we'll walk the RIB /zebra/dplane_fpm_nl.c: 1650 in fpm_nl_process() 1644 &fnc->t_dequeue); 1645 1646 /* Ensure dataplane thread is rescheduled if we hit the work limit */ 1647 if (counter >= limit) 1648 dplane_provider_work_ready(); 1649 >>> CID 1583965: (LOCK) >>> Returning without unlocking "prov->dp_mutex". 1650 return 0; 1651 } 1652 1653 static int fpm_nl_new(struct event_loop *tm) 1654 { 1655 struct zebra_dplane_provider *prov = NULL; /zebra/dplane_fpm_nl.c: 1630 in fpm_nl_process() 1624 if (peak_queue < cur_queue) 1625 peak_queue = cur_queue; 1626 continue; 1627 } 1628 1629 dplane_ctx_set_status(ctx, ZEBRA_DPLANE_REQUEST_SUCCESS); >>> CID 1583965: (LOCK) >>> "dplane_provider_enqueue_out_ctx" unlocks "prov->dp_mutex" while it is unlocked. 1630 dplane_provider_enqueue_out_ctx(prov, ctx); 1631 } 1632 1633 /* Update peak queue length, if we just observed a new peak */ 1634 stored_peak_queue = atomic_load_explicit( 1635 &fnc->counters.ctxqueue_len_peak, memory_order_relaxed); /zebra/dplane_fpm_nl.c: 1601 in fpm_nl_process() 1595 int counter, limit; 1596 uint64_t cur_queue, peak_queue = 0, stored_peak_queue; 1597 1598 fnc = dplane_provider_get_data(prov); 1599 limit = dplane_provider_get_work_limit(prov); 1600 for (counter = 0; counter < limit; counter++) { >>> CID 1583965: (LOCK) >>> "dplane_provider_dequeue_in_ctx" locks "prov->dp_mutex" while it is locked. 1601 ctx = dplane_provider_dequeue_in_ctx(prov); 1602 if (ctx == NULL) 1603 break; 1604 1605 /* 1606 * Skip all notifications if not connected, we'll walk the RIB ** CID 1583964: Concurrent data access violations (MISSING_LOCK) /lib/northbound_grpc.cpp: 1127 in grpc_pthread_start(void *)() ________________________________________________________________________________________________________ *** CID 1583964: Concurrent data access violations (MISSING_LOCK) /lib/northbound_grpc.cpp: 1127 in grpc_pthread_start(void *)() 1121 builder.RegisterService(&service); 1122 builder.AddChannelArgument( 1123 GRPC_ARG_HTTP2_MIN_RECV_PING_INTERVAL_WITHOUT_DATA_MS, 5000); 1124 std::unique_ptr<grpc::ServerCompletionQueue> cq = 1125 builder.AddCompletionQueue(); 1126 std::unique_ptr<grpc::Server> server = builder.BuildAndStart(); >>> CID 1583964: Concurrent data access violations (MISSING_LOCK) >>> Accessing "s_server" without holding lock "s_server_lock". Elsewhere, "s_server" is written to with "s_server_lock" held 2 out of 3 times. 1127 s_server = server.get(); 1128 1129 pthread_mutex_lock(&s_server_lock); // Make coverity happy 1130 grpc_running = true; 1131 pthread_mutex_unlock(&s_server_lock); // Make coverity happy 1132 ** CID 1583963: Concurrent data access violations (MISSING_LOCK) /pceplib/pcep_timers.c: 467 in pceplib_external_timer_expire_handler() ________________________________________________________________________________________________________ *** CID 1583963: Concurrent data access violations (MISSING_LOCK) /pceplib/pcep_timers.c: 467 in pceplib_external_timer_expire_handler() 461 timer_node); 462 463 pthread_mutex_unlock(&timers_context_->timer_list_lock); 464 465 /* Cannot continue if the timer does not exist */ 466 if (timer_node == NULL) { >>> CID 1583963: Concurrent data access violations (MISSING_LOCK) >>> Accessing "timer->timer_id" without holding lock "pcep_timers_context_.timer_list_lock". Elsewhere, "pcep_timer_.timer_id" is written to with "pcep_timers_context_.timer_list_lock" held 4 out of 4 times (4 of these accesses strongly imply that it is necessary). 467 pcep_log( 468 LOG_WARNING, 469 "%s: pceplib_external_timer_expire_handler timer [%p] id [%d] does not exist", 470 __func__, timer, timer->timer_id); 471 return; 472 } ** CID 1583962: Concurrent data access violations (MISSING_LOCK) /pceplib/test/pcep_socket_comm_loop_test.c: 176 in test_handle_reads_read_message_close() ________________________________________________________________________________________________________ *** CID 1583962: Concurrent data access violations (MISSING_LOCK) /pceplib/test/pcep_socket_comm_loop_test.c: 176 in test_handle_reads_read_message_close() 170 /* Setup the comm session so that it can read. 171 * It should read 0 bytes, which simulates that the socket closed */ 172 test_comm_session->socket_fd = 11; 173 read_handler_info.bytes_read = 0; 174 FD_SET(test_comm_session->socket_fd, 175 &test_socket_comm_handle->read_master_set); >>> CID 1583962: Concurrent data access violations (MISSING_LOCK) >>> Accessing "test_socket_comm_handle->read_list" without holding lock "pcep_socket_comm_handle_.socket_comm_mutex". Elsewhere, "pcep_socket_comm_handle_.read_list" is written to with "pcep_socket_comm_handle_.socket_comm_mutex" held 5 out of 7 times. 176 ordered_list_add_node(test_socket_comm_handle->read_list, 177 test_comm_session); 178 179 handle_reads(test_socket_comm_handle); 180 181 CU_ASSERT_TRUE(read_handler_info.handler_called); ** CID 1583961: Concurrent data access violations (MISSING_LOCK) /pceplib/pcep_timers.c: 291 in create_timer() ________________________________________________________________________________________________________ *** CID 1583961: Concurrent data access violations (MISSING_LOCK) /pceplib/pcep_timers.c: 291 in create_timer() 285 if (timers_context_->timer_create_func) { 286 timers_context_->timer_create_func( 287 timers_context_->external_timer_infra_data, 288 &timer->external_timer, sleep_seconds, timer); 289 } 290 >>> CID 1583961: Concurrent data access violations (MISSING_LOCK) >>> Accessing "timer->timer_id" without holding lock "pcep_timers_context_.timer_list_lock". Elsewhere, "pcep_timer_.timer_id" is written to with "pcep_timers_context_.timer_list_lock" held 4 out of 4 times (4 of these accesses strongly imply that it is necessary). 291 return timer->timer_id; 292 } 293 294 295 bool cancel_timer(int timer_id) 296 { ** CID 1583960: Performance inefficiencies (AUTO_CAUSES_COPY) /lib/northbound_grpc.cpp: 730 in HandleUnaryLoadToCandidate(UnaryRpcState<frr::LoadToCandidateRequest, frr::LoadToCandidateResponse> *)() ________________________________________________________________________________________________________ *** CID 1583960: Performance inefficiencies (AUTO_CAUSES_COPY) /lib/northbound_grpc.cpp: 730 in HandleUnaryLoadToCandidate(UnaryRpcState<frr::LoadToCandidateRequest, frr::LoadToCandidateResponse> *)() 724 725 grpc_debug("%s(candidate_id: %u)", __func__, candidate_id); 726 727 // Request: LoadType type = 2; 728 int load_type = tag->request.type(); 729 // Request: DataTree config = 3; >>> CID 1583960: Performance inefficiencies (AUTO_CAUSES_COPY) >>> Using the "auto" keyword without an "&" causes the copy of an object of type "frr::DataTree". 730 auto config = tag->request.config(); 731 732 struct candidate *candidate = tag->cdb->get_candidate(candidate_id); 733 if (!candidate) 734 return grpc::Status(grpc::StatusCode::NOT_FOUND, 735 "candidate configuration not found"); ** CID 1583959: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1583959: Memory - illegal accesses (USE_AFTER_FREE) /bgpd/bgp_nexthop.c: 644 in bgp_multiaccess_check_v6() 638 return false; 639 } 640 641 ret = (dest1 == dest2); 642 643 bgp_dest_unlock_node(dest1); >>> CID 1583959: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "bgp_dest_unlock_node" dereferences freed pointer "dest2". 644 bgp_dest_unlock_node(dest2); 645 646 return ret; 647 } 648 649 bool bgp_subgrp_multiaccess_check_v6(struct in6_addr nexthop, ** CID 1583958: (LOCK) /zebra/zebra_dplane.c: 6993 in kernel_dplane_shutdown_func() /zebra/zebra_dplane.c: 6983 in kernel_dplane_shutdown_func() /zebra/zebra_dplane.c: 6983 in kernel_dplane_shutdown_func() ________________________________________________________________________________________________________ *** CID 1583958: (LOCK) /zebra/zebra_dplane.c: 6993 in kernel_dplane_shutdown_func() 6987 while (ctx) { 6988 dplane_ctx_free(&ctx); 6989 6990 ctx = dplane_provider_dequeue_out_ctx(prov); 6991 } 6992 >>> CID 1583958: (LOCK) >>> Returning without unlocking "prov->dp_mutex". 6993 return 1; 6994 } 6995 6996 #ifdef DPLANE_TEST_PROVIDER 6997 6998 /* /zebra/zebra_dplane.c: 6983 in kernel_dplane_shutdown_func() 6977 return 1; 6978 6979 ctx = dplane_provider_dequeue_in_ctx(prov); 6980 while (ctx) { 6981 dplane_ctx_free(&ctx); 6982 >>> CID 1583958: (LOCK) >>> "dplane_provider_dequeue_in_ctx" unlocks "prov->dp_mutex" while it is unlocked. 6983 ctx = dplane_provider_dequeue_in_ctx(prov); 6984 } 6985 6986 ctx = dplane_provider_dequeue_out_ctx(prov); 6987 while (ctx) { 6988 dplane_ctx_free(&ctx); /zebra/zebra_dplane.c: 6983 in kernel_dplane_shutdown_func() 6977 return 1; 6978 6979 ctx = dplane_provider_dequeue_in_ctx(prov); 6980 while (ctx) { 6981 dplane_ctx_free(&ctx); 6982 >>> CID 1583958: (LOCK) >>> "dplane_provider_dequeue_in_ctx" unlocks "prov->dp_mutex" while it is unlocked. 6983 ctx = dplane_provider_dequeue_in_ctx(prov); 6984 } 6985 6986 ctx = dplane_provider_dequeue_out_ctx(prov); 6987 while (ctx) { 6988 dplane_ctx_free(&ctx); ** CID 1583957: Program hangs (LOCK) /zebra/zebra_dplane.c: 6877 in kernel_dplane_process_iptable() ________________________________________________________________________________________________________ *** CID 1583957: Program hangs (LOCK) /zebra/zebra_dplane.c: 6877 in kernel_dplane_process_iptable() 6871 6872 static void kernel_dplane_process_iptable(struct zebra_dplane_provider *prov, 6873 struct zebra_dplane_ctx *ctx) 6874 { 6875 zebra_pbr_process_iptable(ctx); 6876 dplane_provider_enqueue_out_ctx(prov, ctx); >>> CID 1583957: Program hangs (LOCK) >>> Returning without unlocking "prov->dp_mutex". 6877 } 6878 6879 static void kernel_dplane_process_ipset(struct zebra_dplane_provider *prov, 6880 struct zebra_dplane_ctx *ctx) 6881 { 6882 zebra_pbr_process_ipset(ctx); ** CID 1583956: (LOCK) /zebra/sample_plugin.c: 72 in sample_process() /zebra/sample_plugin.c: 72 in sample_process() ________________________________________________________________________________________________________ *** CID 1583956: (LOCK) /zebra/sample_plugin.c: 72 in sample_process() 66 67 /* Just set 'success' status and return to the dataplane */ 68 dplane_ctx_set_status(ctx, ZEBRA_DPLANE_REQUEST_SUCCESS); 69 dplane_provider_enqueue_out_ctx(prov_p, ctx); 70 } 71 >>> CID 1583956: (LOCK) >>> Returning without unlocking "prov_p->dp_mutex". 72 return 0; 73 } 74 75 /* 76 * Init entry point called during zebra startup. This is registered during 77 * module init. /zebra/sample_plugin.c: 63 in sample_process() 57 limit = dplane_provider_get_work_limit(prov_p); 58 59 /* Respect the configured limit on the amount of work to do in 60 * any one call. 61 */ 62 for (counter = 0; counter < limit; counter++) { >>> CID 1583956: (LOCK) >>> "dplane_provider_dequeue_in_ctx" locks "prov_p->dp_mutex" while it is locked. 63 ctx = dplane_provider_dequeue_in_ctx(prov_p); 64 if (!ctx) 65 break; 66 67 /* Just set 'success' status and return to the dataplane */ 68 dplane_ctx_set_status(ctx, ZEBRA_DPLANE_REQUEST_SUCCESS); /zebra/sample_plugin.c: 63 in sample_process() 57 limit = dplane_provider_get_work_limit(prov_p); 58 59 /* Respect the configured limit on the amount of work to do in 60 * any one call. 61 */ 62 for (counter = 0; counter < limit; counter++) { >>> CID 1583956: (LOCK) >>> "dplane_provider_dequeue_in_ctx" unlocks "prov_p->dp_mutex" while it is unlocked. 63 ctx = dplane_provider_dequeue_in_ctx(prov_p); 64 if (!ctx) 65 break; 66 67 /* Just set 'success' status and return to the dataplane */ 68 dplane_ctx_set_status(ctx, ZEBRA_DPLANE_REQUEST_SUCCESS); /zebra/sample_plugin.c: 69 in sample_process() 63 ctx = dplane_provider_dequeue_in_ctx(prov_p); 64 if (!ctx) 65 break; 66 67 /* Just set 'success' status and return to the dataplane */ 68 dplane_ctx_set_status(ctx, ZEBRA_DPLANE_REQUEST_SUCCESS); >>> CID 1583956: (LOCK) >>> "dplane_provider_enqueue_out_ctx" unlocks "prov_p->dp_mutex" while it is unlocked. 69 dplane_provider_enqueue_out_ctx(prov_p, ctx); 70 } 71 72 return 0; 73 } 74 /zebra/sample_plugin.c: 72 in sample_process() 66 67 /* Just set 'success' status and return to the dataplane */ 68 dplane_ctx_set_status(ctx, ZEBRA_DPLANE_REQUEST_SUCCESS); 69 dplane_provider_enqueue_out_ctx(prov_p, ctx); 70 } 71 >>> CID 1583956: (LOCK) >>> Returning without unlocking "prov_p->dp_mutex". 72 return 0; 73 } 74 75 /* 76 * Init entry point called during zebra startup. This is registered during 77 * module init. ** CID 1583955: Concurrent data access violations (MISSING_LOCK) /zebra/zserv.c: 1095 in zebra_show_client_detail() ________________________________________________________________________________________________________ *** CID 1583955: Concurrent data access violations (MISSING_LOCK) /zebra/zserv.c: 1095 in zebra_show_client_detail() 1089 0, client->local_es_del_cnt); 1090 vty_out(vty, "ES-EVI %-12u%-12u%-12u\n", 1091 client->local_es_evi_add_cnt, 0, client->local_es_evi_del_cnt); 1092 vty_out(vty, "Errors: %u\n", client->error_cnt); 1093 1094 #if defined DEV_BUILD >>> CID 1583955: Concurrent data access violations (MISSING_LOCK) >>> Accessing "client->ibuf_fifo" without holding lock "zserv.ibuf_mtx". Elsewhere, "zserv.ibuf_fifo" is written to with "zserv.ibuf_mtx" held 2 out of 2 times. 1095 vty_out(vty, "Input Fifo: %zu:%zu Output Fifo: %zu:%zu\n", 1096 client->ibuf_fifo->count, client->ibuf_fifo->max_count, 1097 client->obuf_fifo->count, client->obuf_fifo->max_count); 1098 #endif 1099 vty_out(vty, "\n"); 1100 } ** CID 1583954: Concurrent data access violations (MISSING_LOCK) /pceplib/pcep_session_logic.c: 56 in run_session_logic_common() ________________________________________________________________________________________________________ *** CID 1583954: Concurrent data access violations (MISSING_LOCK) /pceplib/pcep_session_logic.c: 56 in run_session_logic_common() 50 51 session_logic_handle_ = pceplib_malloc( 52 PCEPLIB_INFRA, sizeof(pcep_session_logic_handle)); 53 memset(session_logic_handle_, 0, sizeof(pcep_session_logic_handle)); 54 55 session_logic_handle_->active = true; >>> CID 1583954: Concurrent data access violations (MISSING_LOCK) >>> Accessing "session_logic_handle_->session_list" without holding lock "pcep_session_logic_handle_.session_list_mutex". Elsewhere, "pcep_session_logic_handle_.session_list" is written to with "pcep_session_logic_handle_.session_list_mutex" held 2 out of 3 times. 56 session_logic_handle_->session_list = 57 ordered_list_initialize(pointer_compare_function); 58 session_logic_handle_->session_event_queue = queue_initialize(); 59 60 /* Initialize the event queue */ 61 session_logic_event_queue_ = ** CID 1583953: (OVERRUN) ________________________________________________________________________________________________________ *** CID 1583953: (OVERRUN) /pceplib/pcep_msg_objects_encoding.c: 1021 in pcep_decode_object() 1015 if (object == NULL) { 1016 pcep_log(LOG_INFO, "%s: Unable to decode Object class [%d].", 1017 __func__, object_hdr.object_class); 1018 return NULL; 1019 } 1020 >>> CID 1583953: (OVERRUN) >>> Overrunning callee's array of size 41 by passing argument "object_hdr.object_class" (which evaluates to 63) in call to "pcep_object_has_tlvs". 1021 if (pcep_object_has_tlvs(&object_hdr)) { 1022 object->tlv_list = dll_initialize(); 1023 int num_iterations = 0; 1024 uint16_t tlv_index = pcep_object_get_length_by_hdr(&object_hdr); 1025 while ((object->encoded_object_length - tlv_index) > 0 1026 && num_iterations++ < MAX_ITERATIONS) { /pceplib/pcep_msg_objects_encoding.c: 1024 in pcep_decode_object() 1018 return NULL; 1019 } 1020 1021 if (pcep_object_has_tlvs(&object_hdr)) { 1022 object->tlv_list = dll_initialize(); 1023 int num_iterations = 0; >>> CID 1583953: (OVERRUN) >>> Overrunning callee's array of size 41 by passing argument "object_hdr.object_class" (which evaluates to 63) in call to "pcep_object_get_length_by_hdr". 1024 uint16_t tlv_index = pcep_object_get_length_by_hdr(&object_hdr); 1025 while ((object->encoded_object_length - tlv_index) > 0 1026 && num_iterations++ < MAX_ITERATIONS) { 1027 struct pcep_object_tlv_header *tlv = 1028 pcep_decode_tlv(obj_buf + tlv_index); 1029 if (tlv == NULL) { ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=u001.AxU2LYlgjL6eX23u9ErQy-2…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 28 Feb '24

28 Feb '24

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1583901: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_nht.c: 1071 in make_prefix() ________________________________________________________________________________________________________ *** CID 1583901: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_nht.c: 1071 in make_prefix() 1065 p->u.prefix6 = p_orig->u.prefix6; 1066 p->prefixlen = p_orig->prefixlen; 1067 } else { 1068 /* If we receive MP_REACH nexthop with ::(LL) 1069 * or LL(LL), use LL address as nexthop cache. 1070 */ >>> CID 1583901: Null pointer dereferences (FORWARD_NULL) >>> Dereferencing null pointer "pi->attr". 1071 if (pi->attr->mp_nexthop_len 1072 == BGP_ATTR_NHLEN_IPV6_GLOBAL_AND_LL 1073 && (IN6_IS_ADDR_UNSPECIFIED( 1074 &pi->attr->mp_nexthop_global) 1075 || IN6_IS_ADDR_LINKLOCAL( 1076 &pi->attr->mp_nexthop_global))) ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=u001.AxU2LYlgjL6eX23u9ErQy-2…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 03 Feb '24

03 Feb '24

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1580028: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1580028: Null pointer dereferences (NULL_RETURNS) /staticd/static_zebra.c: 170 in zebra_connected() 164 165 static void zebra_connected(struct zclient *zclient) 166 { 167 zebra_route_notify_send(ZEBRA_ROUTE_NOTIFY_REQUEST, zclient, true); 168 zclient_send_reg_requests(zclient, VRF_DEFAULT); 169 >>> CID 1580028: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing a pointer that might be "NULL" "vrf_lookup_by_id(0U)" when calling "static_fixup_vrf_ids". 170 static_fixup_vrf_ids(vrf_lookup_by_id(VRF_DEFAULT)); 171 } 172 173 /* API to check whether the configured nexthop address is 174 * one of its local connected address or not. 175 */ ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 30 Jan '24

30 Jan '24

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 12 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 12 of 12 defect(s) ** CID 1576456: Error handling issues (CHECKED_RETURN) /zebra/zebra_cli.c: 446 in link_params_admin_grp_magic() ________________________________________________________________________________________________________ *** CID 1576456: Error handling issues (CHECKED_RETURN) /zebra/zebra_cli.c: 446 in link_params_admin_grp_magic() 440 if (bitpattern[0] != '0' || bitpattern[1] != 'x' || 441 strlen(bitpattern) > 10) { 442 vty_out(vty, "Invalid bitpattern value\n"); 443 return CMD_WARNING_CONFIG_FAILED; 444 } 445 >>> CID 1576456: Error handling issues (CHECKED_RETURN) >>> Calling "sscanf" without checking return value (as is done elsewhere 46 out of 47 times). 446 sscanf(bitpattern, "%x", &value); 447 snprintf(value_str, sizeof(value_str), "%u", value); 448 449 nb_cli_enqueue_change(vty, "./legacy-admin-group", NB_OP_MODIFY, 450 value_str); 451 } else { ** CID 1576455: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1576455: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_cli_clippy.c: 941 in link_params_res_bw() 935 #if 0 /* anything that can fail? */ 936 if (_failcnt) 937 return CMD_WARNING; 938 #endif 939 #endif 940 >>> CID 1576455: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "bandwidth" to "link_params_res_bw_magic", which dereferences it. 941 return link_params_res_bw_magic(self, vty, argc, argv, no, bandwidth); 942 } 943 944 /* link_params_ava_bw => "[no] ava-bw ![BANDWIDTH]" */ 945 DEFUN_CMD_FUNC_DECL(link_params_ava_bw) 946 #define funcdecl_link_params_ava_bw static int link_params_ava_bw_magic(\ ** CID 1576454: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1576454: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_cli_clippy.c: 1039 in link_params_use_bw() 1033 #if 0 /* anything that can fail? */ 1034 if (_failcnt) 1035 return CMD_WARNING; 1036 #endif 1037 #endif 1038 >>> CID 1576454: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "bandwidth" to "link_params_use_bw_magic", which dereferences it. 1039 return link_params_use_bw_magic(self, vty, argc, argv, no, bandwidth); 1040 } 1041 1042 /* link_params_affinity => "[no] affinity NAME..." */ 1043 DEFUN_CMD_FUNC_DECL(link_params_affinity) 1044 #define funcdecl_link_params_affinity static int link_params_affinity_magic(\ ** CID 1576453: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1576453: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_cli_clippy.c: 990 in link_params_ava_bw() 984 #if 0 /* anything that can fail? */ 985 if (_failcnt) 986 return CMD_WARNING; 987 #endif 988 #endif 989 >>> CID 1576453: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "bandwidth" to "link_params_ava_bw_magic", which dereferences it. 990 return link_params_ava_bw_magic(self, vty, argc, argv, no, bandwidth); 991 } 992 993 /* link_params_use_bw => "[no] use-bw ![BANDWIDTH]" */ 994 DEFUN_CMD_FUNC_DECL(link_params_use_bw) 995 #define funcdecl_link_params_use_bw static int link_params_use_bw_magic(\ ** CID 1576452: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1576452: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_cli_clippy.c: 653 in link_params_admin_grp() 647 #if 0 /* anything that can fail? */ 648 if (_failcnt) 649 return CMD_WARNING; 650 #endif 651 #endif 652 >>> CID 1576452: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "bitpattern" to "link_params_admin_grp_magic", which dereferences it. 653 return link_params_admin_grp_magic(self, vty, argc, argv, no, bitpattern); 654 } 655 656 /* link_params_inter_as => "[no] neighbor ![A.B.C.D$ip as (1-4294967295)$as]" */ 657 DEFUN_CMD_FUNC_DECL(link_params_inter_as) 658 #define funcdecl_link_params_inter_as static int link_params_inter_as_magic(\ ** CID 1576451: Error handling issues (CHECKED_RETURN) /zebra/zebra_nb_config.c: 2223 in evpn_mh_dnode_to_esi() ________________________________________________________________________________________________________ *** CID 1576451: Error handling issues (CHECKED_RETURN) /zebra/zebra_nb_config.c: 2223 in evpn_mh_dnode_to_esi() 2217 return NB_OK; 2218 } 2219 2220 static bool evpn_mh_dnode_to_esi(const struct lyd_node *dnode, esi_t *esi) 2221 { 2222 if (yang_dnode_exists(dnode, "type-0/esi")) { >>> CID 1576451: Error handling issues (CHECKED_RETURN) >>> Calling "str_to_esi" without checking return value (as is done elsewhere 8 out of 10 times). 2223 str_to_esi(yang_dnode_get_string(dnode, "type-0/esi"), esi); 2224 } else if (yang_dnode_exists(dnode, "type-3/system-mac") && 2225 yang_dnode_exists(dnode, "type-3/local-discriminator")) { 2226 struct ethaddr mac; 2227 uint32_t lid; 2228 ** CID 1576450: Error handling issues (CHECKED_RETURN) /zebra/zebra_nb_config.c: 2304 in lib_interface_zebra_evpn_mh_type_0_esi_modify() ________________________________________________________________________________________________________ *** CID 1576450: Error handling issues (CHECKED_RETURN) /zebra/zebra_nb_config.c: 2304 in lib_interface_zebra_evpn_mh_type_0_esi_modify() 2298 break; 2299 case NB_EV_PREPARE: 2300 case NB_EV_ABORT: 2301 break; 2302 case NB_EV_APPLY: 2303 ifp = nb_running_get_entry(args->dnode, NULL, true); >>> CID 1576450: Error handling issues (CHECKED_RETURN) >>> Calling "str_to_esi" without checking return value (as is done elsewhere 8 out of 10 times). 2304 str_to_esi(yang_dnode_get_string(args->dnode, NULL), &esi); 2305 zebra_evpn_es_type0_esi_update(ifp->info, &esi); 2306 break; 2307 } 2308 2309 return NB_OK; ** CID 1576449: Null pointer dereferences (NULL_RETURNS) /zebra/zebra_cli.c: 889 in ip_address_peer_magic() ________________________________________________________________________________________________________ *** CID 1576449: Null pointer dereferences (NULL_RETURNS) /zebra/zebra_cli.c: 889 in ip_address_peer_magic() 883 #endif 884 } 885 886 strlcpy(peer_ip, peer_str, sizeof(peer_ip)); 887 888 peer_mask = strchr(peer_ip, '/'); >>> CID 1576449: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing "peer_mask", which is known to be "NULL". 889 *peer_mask = 0; 890 peer_mask++; 891 892 return nb_cli_apply_changes( 893 vty, 894 "./frr-zebra:zebra/ipv4-p2p-addrs[ip='%s'][peer-ip='%s'][peer-prefix-length='%s']", ** CID 1576448: Null pointer dereferences (NULL_RETURNS) /zebra/zebra_cli.c: 937 in ipv6_address_magic() ________________________________________________________________________________________________________ *** CID 1576448: Null pointer dereferences (NULL_RETURNS) /zebra/zebra_cli.c: 937 in ipv6_address_magic() 931 else 932 nb_cli_enqueue_change(vty, ".", NB_OP_CREATE, NULL); 933 934 strlcpy(ip, address_str, sizeof(ip)); 935 936 mask = strchr(ip, '/'); >>> CID 1576448: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing "mask", which is known to be "NULL". 937 *mask = 0; 938 mask++; 939 940 return nb_cli_apply_changes(vty, 941 "./frr-zebra:zebra/ipv6-addrs[ip='%s'][prefix-length='%s']", 942 ip, mask); ** CID 1576447: Uninitialized variables (UNINIT) ________________________________________________________________________________________________________ *** CID 1576447: Uninitialized variables (UNINIT) /zebra/zebra_nb_config.c: 3049 in lib_interface_zebra_ipv6_router_advertisements_rdnss_rdnss_address_create() 3043 rdnss.lifetime = yang_dnode_get_uint32(args->dnode, "lifetime"); 3044 rdnss.lifetime_set = 1; 3045 } else { 3046 rdnss.lifetime_set = 0; 3047 } 3048 >>> CID 1576447: Uninitialized variables (UNINIT) >>> Using uninitialized value "rdnss". Field "rdnss.lifetime" is uninitialized when calling "rtadv_rdnss_set". 3049 p = rtadv_rdnss_set(ifp->info, &rdnss); 3050 nb_running_set_entry(args->dnode, p); 3051 3052 return NB_OK; 3053 } 3054 ** CID 1576446: Uninitialized variables (UNINIT) ________________________________________________________________________________________________________ *** CID 1576446: Uninitialized variables (UNINIT) /zebra/zebra_nb_config.c: 3140 in lib_interface_zebra_ipv6_router_advertisements_dnssl_dnssl_domain_create() 3134 dnssl.lifetime = yang_dnode_get_uint32(args->dnode, "lifetime"); 3135 dnssl.lifetime_set = 1; 3136 } else { 3137 dnssl.lifetime_set = 0; 3138 } 3139 >>> CID 1576446: Uninitialized variables (UNINIT) >>> Using uninitialized value "dnssl". Field "dnssl.encoded_len" is uninitialized when calling "rtadv_dnssl_set". 3140 p = rtadv_dnssl_set(ifp->info, &dnssl); 3141 nb_running_set_entry(args->dnode, p); 3142 3143 return NB_OK; 3144 } 3145 ** CID 1576445: Null pointer dereferences (NULL_RETURNS) /zebra/zebra_cli.c: 820 in ip_address_magic() ________________________________________________________________________________________________________ *** CID 1576445: Null pointer dereferences (NULL_RETURNS) /zebra/zebra_cli.c: 820 in ip_address_magic() 814 #endif 815 } 816 817 strlcpy(ip, address_str, sizeof(ip)); 818 819 mask = strchr(ip, '/'); >>> CID 1576445: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing "mask", which is known to be "NULL". 820 *mask = 0; 821 mask++; 822 823 return nb_cli_apply_changes(vty, 824 "./frr-zebra:zebra/ipv4-addrs[ip='%s'][prefix-length='%s']", 825 ip, mask); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 25 Jan '24

25 Jan '24

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 4 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 4 of 4 defect(s) ** CID 1576137: (UNUSED_VALUE) /pceplib/test/pcep_msg_tlvs_test.c: 202 in test_pcep_tlv_create_path_setup_type_capability() /pceplib/test/pcep_msg_tlvs_test.c: 184 in test_pcep_tlv_create_path_setup_type_capability() /pceplib/test/pcep_msg_tlvs_test.c: 193 in test_pcep_tlv_create_path_setup_type_capability() ________________________________________________________________________________________________________ *** CID 1576137: (UNUSED_VALUE) /pceplib/test/pcep_msg_tlvs_test.c: 202 in test_pcep_tlv_create_path_setup_type_capability() 196 /* Should still return NULL if pst_list is empty */ 197 tlv = pcep_tlv_create_path_setup_type_capability(pst_list, 198 sub_tlv_list); 199 CU_ASSERT_PTR_NULL(tlv); 200 if (tlv != NULL) { 201 pcep_obj_free_tlv(&tlv->header); >>> CID 1576137: (UNUSED_VALUE) >>> Assigning value "NULL" to "tlv" here, but that stored value is overwritten before it can be used. 202 tlv = NULL; 203 } 204 205 /* Test only populating the pst list */ 206 uint8_t *pst1 = pceplib_malloc(PCEPLIB_MESSAGES, 1); 207 uint8_t *pst2 = pceplib_malloc(PCEPLIB_MESSAGES, 1); /pceplib/test/pcep_msg_tlvs_test.c: 184 in test_pcep_tlv_create_path_setup_type_capability() 178 /* Should return NULL if pst_list is empty */ 179 double_linked_list *pst_list = dll_initialize(); 180 tlv = pcep_tlv_create_path_setup_type_capability(pst_list, NULL); 181 CU_ASSERT_PTR_NULL(tlv); 182 if (tlv != NULL) { 183 pcep_obj_free_tlv(&tlv->header); >>> CID 1576137: (UNUSED_VALUE) >>> Assigning value "NULL" to "tlv" here, but that stored value is overwritten before it can be used. 184 tlv = NULL; 185 } 186 187 /* Should still return NULL if pst_list is NULL */ 188 double_linked_list *sub_tlv_list = dll_initialize(); 189 tlv = pcep_tlv_create_path_setup_type_capability(NULL, sub_tlv_list); /pceplib/test/pcep_msg_tlvs_test.c: 193 in test_pcep_tlv_create_path_setup_type_capability() 187 /* Should still return NULL if pst_list is NULL */ 188 double_linked_list *sub_tlv_list = dll_initialize(); 189 tlv = pcep_tlv_create_path_setup_type_capability(NULL, sub_tlv_list); 190 CU_ASSERT_PTR_NULL(tlv); 191 if (tlv != NULL) { 192 pcep_obj_free_tlv(&tlv->header); >>> CID 1576137: (UNUSED_VALUE) >>> Assigning value "NULL" to "tlv" here, but that stored value is overwritten before it can be used. 193 tlv = NULL; 194 } 195 196 /* Should still return NULL if pst_list is empty */ 197 tlv = pcep_tlv_create_path_setup_type_capability(pst_list, 198 sub_tlv_list); ** CID 1576136: Code maintainability issues (UNUSED_VALUE) /pceplib/test/pcep_msg_tlvs_test.c: 110 in test_pcep_tlv_create_speaker_entity_id() ________________________________________________________________________________________________________ *** CID 1576136: Code maintainability issues (UNUSED_VALUE) /pceplib/test/pcep_msg_tlvs_test.c: 110 in test_pcep_tlv_create_speaker_entity_id() 104 105 double_linked_list *list = dll_initialize(); 106 tlv = pcep_tlv_create_speaker_entity_id(list); 107 CU_ASSERT_PTR_NULL(tlv); 108 if (tlv != NULL) { 109 pceplib_free(PCEPLIB_INFRA, tlv); >>> CID 1576136: Code maintainability issues (UNUSED_VALUE) >>> Assigning value "NULL" to "tlv" here, but that stored value is overwritten before it can be used. 110 tlv = NULL; 111 } 112 113 uint32_t *speaker_entity = 114 pceplib_malloc(PCEPLIB_MESSAGES, sizeof(uint32_t)); 115 *speaker_entity = 42; ** CID 1576135: (UNUSED_VALUE) /pceplib/test/pcep_msg_messages_test.c: 403 in test_pcep_msg_create_update() /pceplib/test/pcep_msg_messages_test.c: 422 in test_pcep_msg_create_update() ________________________________________________________________________________________________________ *** CID 1576135: (UNUSED_VALUE) /pceplib/test/pcep_msg_messages_test.c: 403 in test_pcep_msg_create_update() 397 398 /* Should return NULL if obj_list is empty */ 399 message = pcep_msg_create_update(obj_list); 400 CU_ASSERT_PTR_NULL(message); 401 if (message != NULL) { 402 pcep_msg_free_message(message); >>> CID 1576135: (UNUSED_VALUE) >>> Assigning value "NULL" to "message" here, but that stored value is overwritten before it can be used. 403 message = NULL; 404 } 405 406 struct pcep_object_srp *srp = pcep_obj_create_srp(false, 100, NULL); 407 struct pcep_object_lsp *lsp = 408 pcep_obj_create_lsp(100, PCEP_LSP_OPERATIONAL_UP, true, true, /pceplib/test/pcep_msg_messages_test.c: 422 in test_pcep_msg_create_update() 416 message = pcep_msg_create_update(obj_list); 417 CU_ASSERT_PTR_NULL(message); 418 419 dll_append(obj_list, ero); 420 if (message != NULL) { 421 pcep_msg_free_message(message); >>> CID 1576135: (UNUSED_VALUE) >>> Assigning value "NULL" to "message" here, but that stored value is overwritten before it can be used. 422 message = NULL; 423 } 424 message = pcep_msg_create_update(obj_list); 425 CU_ASSERT_PTR_NOT_NULL(message); 426 pcep_encode_message(message, versioning); 427 assert(message != NULL); ** CID 1576134: (UNUSED_VALUE) /pceplib/test/pcep_msg_messages_test.c: 471 in test_pcep_msg_create_initiate() /pceplib/test/pcep_msg_messages_test.c: 455 in test_pcep_msg_create_initiate() ________________________________________________________________________________________________________ *** CID 1576134: (UNUSED_VALUE) /pceplib/test/pcep_msg_messages_test.c: 471 in test_pcep_msg_create_initiate() 465 /* Should return NULL if obj_list does not have 2 entries */ 466 dll_append(obj_list, srp); 467 message = pcep_msg_create_initiate(obj_list); 468 CU_ASSERT_PTR_NULL(message); 469 if (message != NULL) { 470 pcep_msg_free_message(message); >>> CID 1576134: (UNUSED_VALUE) >>> Assigning value "NULL" to "message" here, but that stored value is overwritten before it can be used. 471 message = NULL; 472 } 473 474 dll_append(obj_list, lsp); 475 dll_append(obj_list, ero); 476 message = pcep_msg_create_initiate(obj_list); /pceplib/test/pcep_msg_messages_test.c: 455 in test_pcep_msg_create_initiate() 449 450 /* Should return NULL if obj_list is empty */ 451 struct pcep_message *message = pcep_msg_create_initiate(NULL); 452 CU_ASSERT_PTR_NULL(message); 453 if (message != NULL) { 454 pcep_msg_free_message(message); >>> CID 1576134: (UNUSED_VALUE) >>> Assigning value "NULL" to "message" here, but that stored value is overwritten before it can be used. 455 message = NULL; 456 } 457 458 struct pcep_object_srp *srp = pcep_obj_create_srp(false, 100, NULL); 459 struct pcep_object_lsp *lsp = 460 pcep_obj_create_lsp(100, PCEP_LSP_OPERATIONAL_UP, true, true, ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 23 Jan '24

23 Jan '24

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 1576001: Incorrect expression (PW.ASSIGN_WHERE_COMPARE_MEANT) /sharpd/sharp_zebra.c: 1020 in () ________________________________________________________________________________________________________ *** CID 1576001: Incorrect expression (PW.ASSIGN_WHERE_COMPARE_MEANT) /sharpd/sharp_zebra.c: 1020 in () 1014 if (!ifp) { 1015 zlog_debug("Failed to lookup interface for neighbor entry: %u for %u", 1016 api.index, vrf_id); 1017 return 0; 1018 } 1019 >>> CID 1576001: Incorrect expression (PW.ASSIGN_WHERE_COMPARE_MEANT) >>> use of "=" where "==" may have been intended 1020 zlog_debug("Received: %s %pSU dev %s lladr %pSU", 1021 (cmd = ZEBRA_NEIGH_ADDED) ? "NEW" : "DEL", &addr, ifp->name, 1022 &lladdr); 1023 1024 return 0; 1025 } ** CID 1576000: Parse warnings (PW.PARAM_SET_BUT_NOT_USED) /sharpd/sharp_zebra.c: 992 in () ________________________________________________________________________________________________________ *** CID 1576000: Parse warnings (PW.PARAM_SET_BUT_NOT_USED) /sharpd/sharp_zebra.c: 992 in () 986 } 987 988 zlog_err("%s: can't get locator_chunk!!", __func__); 989 return 0; 990 } 991 >>> CID 1576000: Parse warnings (PW.PARAM_SET_BUT_NOT_USED) >>> parameter "cmd" was set but never used 992 static int sharp_zebra_process_neigh(ZAPI_CALLBACK_ARGS) 993 { 994 union sockunion addr = {}, lladdr = {}; 995 struct zapi_neigh_ip api = {}; 996 struct interface *ifp; 997 ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0