|
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-devel] [xen-4.2-testing test] 60150: regressions - FAIL
flight 60150 xen-4.2-testing real [real] http://logs.test-lab.xenproject.org/osstest/logs/60150/ Regressions :-( Tests which did not succeed and are blocking, including tests which could not be run: test-amd64-amd64-xl-qemut-win7-amd64 9 windows-install fail REGR. vs. 58892 test-amd64-i386-xl-qemut-win7-amd64 9 windows-install fail REGR. vs. 58892 test-amd64-i386-xl-qemuu-win7-amd64 9 windows-install fail REGR. vs. 58892 test-amd64-amd64-xl-qemuu-win7-amd64 9 windows-install fail REGR. vs. 58892 test-amd64-amd64-xl-win7-amd64 9 windows-install fail REGR. vs. 58892 Regressions which are regarded as allowable (not blocking): test-i386-i386-libvirt 15 guest-start/debian.repeat fail REGR. vs. 58892 test-amd64-amd64-libvirt 15 guest-start/debian.repeat fail REGR. vs. 58892 test-amd64-i386-xl-win7-amd64 16 guest-stop fail like 58892 Tests which did not succeed, but are not blocking: test-i386-i386-rumpuserxen-i386 1 build-check(1) blocked n/a test-amd64-i386-rumpuserxen-i386 1 build-check(1) blocked n/a test-amd64-amd64-rumpuserxen-amd64 1 build-check(1) blocked n/a build-i386-rumpuserxen 5 rumpuserxen-build fail never pass build-amd64-rumpuserxen 5 rumpuserxen-build fail never pass test-i386-i386-xl-qcow2 9 debian-di-install fail never pass test-amd64-i386-xl-qcow2 9 debian-di-install fail never pass test-amd64-amd64-libvirt-qcow2 9 debian-di-install fail never pass test-i386-i386-libvirt-qcow2 9 debian-di-install fail never pass test-amd64-i386-libvirt-qcow2 9 debian-di-install fail never pass test-amd64-i386-xl-qemuu-ovmf-amd64 9 debian-hvm-install fail never pass test-amd64-amd64-amd64-pvgrub 10 guest-start fail never pass test-amd64-amd64-i386-pvgrub 10 guest-start fail never pass test-amd64-amd64-xl-qemuu-ovmf-amd64 9 debian-hvm-install fail never pass test-amd64-amd64-xl-qcow2 9 debian-di-install fail never pass test-amd64-i386-libvirt-raw 9 debian-di-install fail never pass test-i386-i386-libvirt 12 migrate-support-check fail never pass test-amd64-amd64-libvirt-raw 9 debian-di-install fail never pass test-i386-i386-libvirt-raw 9 debian-di-install fail never pass test-amd64-i386-libvirt-vhd 9 debian-di-install fail never pass test-amd64-i386-libvirt 12 migrate-support-check fail never pass test-i386-i386-libvirt-vhd 9 debian-di-install fail never pass test-amd64-amd64-libvirt 12 migrate-support-check fail never pass test-amd64-amd64-libvirt-vhd 14 guest-start/debian.repeat fail never pass test-amd64-amd64-libvirt-vhd 11 migrate-support-check fail never pass test-amd64-i386-xend-winxpsp3 20 leak-check/check fail never pass test-amd64-i386-xend-qemut-winxpsp3 20 leak-check/check fail never pass version targeted for testing: xen b20c28064c54d345f366528a0f452ad14911e146 baseline version: xen 38fcda225d6613ecc4bf44769806887252d7b2b1 Last test of basis 58892 2015-06-25 05:21:03 Z 37 days Testing same since 60150 2015-07-30 18:44:41 Z 2 days 1 attempts ------------------------------------------------------------ People who touched revisions under test: Ian Campbell <ian,campbell@xxxxxxxxxx> Ian Jackson <ian.jackson@xxxxxxxxxxxxx> Kevin Wolf <kwolf@xxxxxxxxxx> jobs: build-amd64 pass build-i386 pass build-amd64-libvirt pass build-i386-libvirt pass build-amd64-pvops pass build-i386-pvops pass build-amd64-rumpuserxen fail build-i386-rumpuserxen fail test-amd64-amd64-xl pass test-amd64-i386-xl pass test-i386-i386-xl pass test-amd64-i386-rhel6hvm-amd pass test-amd64-i386-qemut-rhel6hvm-amd pass test-amd64-i386-qemuu-rhel6hvm-amd pass test-amd64-amd64-xl-qemut-debianhvm-amd64 pass test-amd64-i386-xl-qemut-debianhvm-amd64 pass test-amd64-amd64-xl-qemuu-debianhvm-amd64 pass test-amd64-i386-xl-qemuu-debianhvm-amd64 pass test-amd64-i386-qemuu-freebsd10-amd64 pass test-amd64-amd64-xl-qemuu-ovmf-amd64 fail test-amd64-i386-xl-qemuu-ovmf-amd64 fail test-amd64-amd64-rumpuserxen-amd64 blocked test-amd64-amd64-xl-qemut-win7-amd64 fail test-amd64-i386-xl-qemut-win7-amd64 fail test-amd64-amd64-xl-qemuu-win7-amd64 fail test-amd64-i386-xl-qemuu-win7-amd64 fail test-amd64-amd64-xl-win7-amd64 fail test-amd64-i386-xl-win7-amd64 fail test-amd64-amd64-xl-credit2 pass test-i386-i386-xl-credit2 pass test-amd64-i386-qemuu-freebsd10-i386 pass test-amd64-i386-rumpuserxen-i386 blocked test-i386-i386-rumpuserxen-i386 blocked test-amd64-i386-rhel6hvm-intel pass test-amd64-i386-qemut-rhel6hvm-intel pass test-amd64-i386-qemuu-rhel6hvm-intel pass test-amd64-amd64-libvirt fail test-amd64-i386-libvirt pass test-i386-i386-libvirt fail test-amd64-amd64-xl-multivcpu pass test-i386-i386-xl-multivcpu pass test-amd64-amd64-pair pass test-amd64-i386-pair pass test-i386-i386-pair pass test-amd64-amd64-pv pass test-amd64-i386-pv pass test-i386-i386-pv pass test-amd64-amd64-amd64-pvgrub fail test-amd64-amd64-i386-pvgrub fail test-amd64-amd64-pygrub pass test-amd64-amd64-libvirt-qcow2 fail test-amd64-i386-libvirt-qcow2 fail test-i386-i386-libvirt-qcow2 fail test-amd64-amd64-xl-qcow2 fail test-amd64-i386-xl-qcow2 fail test-i386-i386-xl-qcow2 fail test-amd64-amd64-libvirt-raw fail test-amd64-i386-libvirt-raw fail test-i386-i386-libvirt-raw fail test-amd64-amd64-xl-raw pass test-amd64-i386-xl-raw pass test-i386-i386-xl-raw pass test-amd64-i386-xl-qemut-winxpsp3-vcpus1 pass test-amd64-i386-xl-qemuu-winxpsp3-vcpus1 pass test-amd64-i386-xl-winxpsp3-vcpus1 pass test-amd64-amd64-libvirt-vhd fail test-amd64-i386-libvirt-vhd fail test-i386-i386-libvirt-vhd fail test-amd64-amd64-xl-vhd pass test-amd64-i386-xl-vhd pass test-i386-i386-xl-vhd pass test-amd64-i386-xend-qemut-winxpsp3 fail test-amd64-amd64-xl-qemut-winxpsp3 pass test-i386-i386-xl-qemut-winxpsp3 pass test-amd64-amd64-xl-qemuu-winxpsp3 pass test-i386-i386-xl-qemuu-winxpsp3 pass test-amd64-i386-xend-winxpsp3 fail test-amd64-amd64-xl-winxpsp3 pass test-i386-i386-xl-winxpsp3 pass ------------------------------------------------------------ sg-report-flight on osstest.test-lab.xenproject.org logs: /home/logs/logs images: /home/logs/images Logs, config files, etc. are available at http://logs.test-lab.xenproject.org/osstest/logs Explanation of these reports, and of osstest in general, is at http://xenbits.xen.org/gitweb/?p=osstest.git;a=blob;f=README.email;hb=master http://xenbits.xen.org/gitweb/?p=osstest.git;a=blob;f=README;hb=master Test harness code can be found at http://xenbits.xen.org/gitweb?p=osstest.git;a=summary Not pushing. ------------------------------------------------------------ commit b20c28064c54d345f366528a0f452ad14911e146 Author: Ian Jackson <ian.jackson@xxxxxxxxxxxxx> Date: Mon Jun 15 14:50:42 2015 +0100 xl: Sane handling of extra config file arguments Various xl sub-commands take additional parameters containing = as additional config fragments. The handling of these config fragments has a number of bugs: 1. Use of a static 1024-byte buffer. (If truncation would occur, with semi-trusted input, a security risk arises due to quotes being lost.) 2. Mishandling of the return value from snprintf, so that if truncation occurs, the to-write pointer is updated with the wanted-to-write length, resulting in stack corruption. (This is XSA-137.) 3. Clone-and-hack of the code for constructing the appended config file. These are fixed here, by introducing a new function `string_realloc_append' and using it everywhere. The `extra_info' buffers are replaced by pointers, which start off NULL and are explicitly freed on all return paths. The separate variable which will become dom_info.extra_config is abolished (which involves moving the clearing of dom_info). Additional bugs I observe, not fixed here: 4. The functions which now call string_realloc_append use ad-hoc error returns, with multiple calls to `return'. This currently necessitates multiple new calls to `free'. 5. Many of the paths in xl call exit(-rc) where rc is a libxl status code. This is a ridiculous exit status `convention'. 6. The loops for handling extra config data are clone-and-hacks. 7. Once the extra config buffer is accumulated, it must be combined with the appropriate main config file. The code to do this combining is clone-and-hacked too. Signed-off-by: Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx> Tested-by: Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx> Acked-by: Ian Campbell <ian,campbell@xxxxxxxxxx> (cherry picked from commit dd84604f35bd3855c57146eb8fe53924c10d3963) (cherry picked from commit 6040b3aeb32b4bce2d9958ecbcbd020c46c35d61) (cherry picked from commit 214fd40a20fa5988b4ea021c2d06e8aca8dda184) (cherry picked from commit d7ab3a1c1cc245dc0683bb937467c27141754053) commit 31d0387c27a6ba7a74c1f3de7d2399489c164c73 Author: Ian Jackson <ian.jackson@xxxxxxxxxxxxx> Date: Wed Jul 29 16:35:24 2015 +0100 QEMU_TAG update ======================================== commit cbde16cd1c9866a92a7a449e7df5637dd7c3e9cc Author: Kevin Wolf <kwolf@xxxxxxxxxx> Date: Wed Jun 3 14:41:27 2015 +0200 ide: Clear DRQ after handling all expected accesses This is additional hardening against an end_transfer_func that fails to clear the DRQ status bit. The bit must be unset as soon as the PIO transfer has completed, so it's better to do this in a central place instead of duplicating the code in all commands (and forgetting it in some). [ This is XSA-138 / CVE-2015-5154. ] Signed-off-by: Kevin Wolf <kwolf@xxxxxxxxxx> (cherry picked from commit 7f057440b31da38196e3398fd1b618fc36ad97d6) (cherry picked from commit 30c002bffcd6287a7d5bb4e2c691b101c0937013) (cherry picked from commit e1db2596d7c5f8be876481148d407f0cb207b494) commit cec11fdfb212fb5493cdd44b81f1642758eeb869 Author: Kevin Wolf <kwolf@xxxxxxxxxx> Date: Wed Jun 3 14:13:31 2015 +0200 ide: Check array bounds before writing to io_buffer (CVE-2015-5154) If the end_transfer_func of a command is called because enough data has been read or written for the current PIO transfer, and it fails to correctly call the command completion functions, the DRQ bit in the status register and s->end_transfer_func may remain set. This allows the guest to access further bytes in s->io_buffer beyond s->data_end, and eventually overflowing the io_buffer. One case where this currently happens is emulation of the ATAPI command START STOP UNIT. This patch fixes the problem by adding explicit array bounds checks before accessing the buffer instead of relying on end_transfer_func to function correctly. [ This is XSA-138 / CVE-2015-5154. ] Cc: qemu-stable@xxxxxxxxxx Signed-off-by: Kevin Wolf <kwolf@xxxxxxxxxx> (cherry picked from commit d18ac5938d38ed9a9d51e380a2baf8343468f65d) (cherry picked from commit eb745741f519e6cf60a455bfba62a1acc0b5cfe2) (cherry picked from commit 70add61d0c6f7c79b74ed016a0531e40f0cc00b3) _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxx http://lists.xen.org/xen-devel
|
 |
Lists.xenproject.org is hosted with RackSpace, monitoring our |