|
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-devel] [qemu-upstream-unstable baseline-only test] 44185: regressions - FAIL
This run is configured for baseline tests only. flight 44185 qemu-upstream-unstable real [real] http://osstest.xs.citrite.net/~osstest/testlogs/logs/44185/ Regressions :-( Tests which did not succeed and are blocking, including tests which could not be run: test-amd64-amd64-qemuu-nested-intel 16 debian-hvm-install/l1/l2 fail REGR. vs. 38728 Regressions which are regarded as allowable (not blocking): test-amd64-amd64-xl-qemuu-win7-amd64 16 guest-stop fail like 38728 Tests which did not succeed, but are not blocking: test-armhf-armhf-libvirt-xsm 12 migrate-support-check fail never pass test-armhf-armhf-libvirt-xsm 14 guest-saverestore fail never pass test-armhf-armhf-libvirt 14 guest-saverestore fail never pass test-armhf-armhf-libvirt 12 migrate-support-check fail never pass test-armhf-armhf-libvirt-qcow2 11 migrate-support-check fail never pass test-armhf-armhf-libvirt-qcow2 13 guest-saverestore fail never pass test-amd64-amd64-xl-pvh-intel 11 guest-start fail never pass test-amd64-amd64-xl-pvh-amd 11 guest-start fail never pass test-armhf-armhf-libvirt-raw 13 guest-saverestore fail never pass test-armhf-armhf-libvirt-raw 11 migrate-support-check fail never pass test-armhf-armhf-xl 12 migrate-support-check fail never pass test-armhf-armhf-xl 13 saverestore-support-check fail never pass test-armhf-armhf-xl-xsm 13 saverestore-support-check fail never pass test-armhf-armhf-xl-xsm 12 migrate-support-check fail never pass test-armhf-armhf-xl-multivcpu 13 saverestore-support-check fail never pass test-armhf-armhf-xl-multivcpu 12 migrate-support-check fail never pass test-armhf-armhf-xl-midway 13 saverestore-support-check fail never pass test-armhf-armhf-xl-midway 12 migrate-support-check fail never pass test-amd64-i386-libvirt 12 migrate-support-check fail never pass test-armhf-armhf-xl-credit2 13 saverestore-support-check fail never pass test-armhf-armhf-xl-credit2 12 migrate-support-check fail never pass test-armhf-armhf-xl-rtds 13 saverestore-support-check fail never pass test-armhf-armhf-xl-rtds 12 migrate-support-check fail never pass test-amd64-amd64-libvirt-xsm 12 migrate-support-check fail never pass test-amd64-amd64-libvirt 12 migrate-support-check fail never pass test-amd64-amd64-qemuu-nested-amd 16 debian-hvm-install/l1/l2 fail never pass test-amd64-i386-libvirt-qemuu-debianhvm-amd64-xsm 10 migrate-support-check fail never pass test-amd64-i386-libvirt-xsm 12 migrate-support-check fail never pass test-armhf-armhf-xl-vhd 11 migrate-support-check fail never pass test-armhf-armhf-xl-vhd 12 saverestore-support-check fail never pass test-amd64-amd64-libvirt-vhd 11 migrate-support-check fail never pass test-amd64-amd64-libvirt-qemuu-debianhvm-amd64-xsm 10 migrate-support-check fail never pass version targeted for testing: qemuu 316a862e5534249a6e6d876b4e203342d3fb870e baseline version: qemuu e9d825298c0d7e14caf6c4d36d4d3894d138f858 Last test of basis 38728 2016-02-06 13:19:13 Z 20 days Testing same since 44185 2016-02-26 15:50:48 Z 0 days 1 attempts ------------------------------------------------------------ People who touched revisions under test: Don Slutz <Don.Slutz@xxxxxxxxx> Gerd Hoffmann <kraxel@xxxxxxxxxx> Jason Wang <jasowang@xxxxxxxxxx> John Snow <jsnow@xxxxxxxxxx> Michael S. Tsirkin <mst@xxxxxxxxxx> P J P <ppandit@xxxxxxxxxx> Paolo Bonzini <pbonzini@xxxxxxxxxx> Peter Maydell <peter.maydell@xxxxxxxxxx> Prasad J Pandit <pjp@xxxxxxxxxxxxxxxxx> Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx> jobs: build-amd64-xsm pass build-armhf-xsm pass build-i386-xsm pass build-amd64 pass build-armhf pass build-i386 pass build-amd64-libvirt pass build-armhf-libvirt pass build-i386-libvirt pass build-amd64-pvops pass build-armhf-pvops pass build-i386-pvops pass test-amd64-amd64-xl pass test-armhf-armhf-xl pass test-amd64-i386-xl pass test-amd64-amd64-libvirt-qemuu-debianhvm-amd64-xsm pass test-amd64-i386-libvirt-qemuu-debianhvm-amd64-xsm pass test-amd64-amd64-xl-qemuu-debianhvm-amd64-xsm pass test-amd64-i386-xl-qemuu-debianhvm-amd64-xsm pass test-amd64-amd64-libvirt-xsm pass test-armhf-armhf-libvirt-xsm fail test-amd64-i386-libvirt-xsm pass test-amd64-amd64-xl-xsm pass test-armhf-armhf-xl-xsm pass test-amd64-i386-xl-xsm pass test-amd64-amd64-qemuu-nested-amd fail test-amd64-amd64-xl-pvh-amd fail test-amd64-i386-qemuu-rhel6hvm-amd pass test-amd64-amd64-xl-qemuu-debianhvm-amd64 pass test-amd64-i386-xl-qemuu-debianhvm-amd64 pass test-amd64-i386-freebsd10-amd64 pass test-amd64-amd64-xl-qemuu-ovmf-amd64 pass test-amd64-i386-xl-qemuu-ovmf-amd64 pass test-amd64-amd64-xl-qemuu-win7-amd64 fail test-amd64-i386-xl-qemuu-win7-amd64 pass test-amd64-amd64-xl-credit2 pass test-armhf-armhf-xl-credit2 pass test-amd64-i386-freebsd10-i386 pass test-amd64-amd64-qemuu-nested-intel fail test-amd64-amd64-xl-pvh-intel fail test-amd64-i386-qemuu-rhel6hvm-intel pass test-amd64-amd64-libvirt pass test-armhf-armhf-libvirt fail test-amd64-i386-libvirt pass test-armhf-armhf-xl-midway pass test-amd64-amd64-xl-multivcpu pass test-armhf-armhf-xl-multivcpu pass test-amd64-amd64-pair pass test-amd64-i386-pair pass test-amd64-amd64-libvirt-pair pass test-amd64-i386-libvirt-pair pass test-amd64-amd64-amd64-pvgrub pass test-amd64-amd64-i386-pvgrub pass test-amd64-amd64-pygrub pass test-armhf-armhf-libvirt-qcow2 fail test-amd64-amd64-xl-qcow2 pass test-armhf-armhf-libvirt-raw fail test-amd64-i386-xl-raw pass test-amd64-amd64-xl-rtds pass test-armhf-armhf-xl-rtds pass test-amd64-i386-xl-qemuu-winxpsp3-vcpus1 pass test-amd64-amd64-libvirt-vhd pass test-armhf-armhf-xl-vhd pass test-amd64-amd64-xl-qemuu-winxpsp3 pass test-amd64-i386-xl-qemuu-winxpsp3 pass ------------------------------------------------------------ sg-report-flight on osstest.xs.citrite.net logs: /home/osstest/logs images: /home/osstest/images Logs, config files, etc. are available at http://osstest.xs.citrite.net/~osstest/testlogs/logs Test harness code can be found at http://xenbits.xensource.com/gitweb?p=osstest.git;a=summary Push not applicable. ------------------------------------------------------------ commit 316a862e5534249a6e6d876b4e203342d3fb870e Author: Don Slutz <don.slutz@xxxxxxxxx> Date: Mon Nov 30 17:11:04 2015 -0500 exec: Stop using memory after free memory_region_unref(mr) can free memory. For example I got: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7f43280d4700 (LWP 4462)] 0x00007f43323283c0 in phys_section_destroy (mr=0x7f43259468b0) at /home/don/xen/tools/qemu-xen-dir/exec.c:1023 1023 if (mr->subpage) { (gdb) bt at /home/don/xen/tools/qemu-xen-dir/exec.c:1023 at /home/don/xen/tools/qemu-xen-dir/exec.c:1034 at /home/don/xen/tools/qemu-xen-dir/exec.c:2205 (gdb) p mr $1 = (MemoryRegion *) 0x7f43259468b0 And this change prevents this. Signed-off-by: Don Slutz <Don.Slutz@xxxxxxxxx> Message-Id: <1448921464-21845-1-git-send-email-Don.Slutz@xxxxxxxxx> Cc: qemu-stable@xxxxxxxxxx Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx> commit 4c15fc66f7764a921ba2fc43cc3cb7b89e0cd35e Author: Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx> Date: Thu Feb 11 17:31:46 2016 +0000 Revert "exec: fix a glitch in checking dma r/w access" This reverts commit 22585843887ce20a106c23162dc5845d64c42edd. The patch should not have been committed, see: http://marc.info/?l=qemu-devel&m=145373225020873. Signed-off-by: Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx> commit 5d63cbb957b0add1f936f6596ddadf988b3ef8f9 Author: Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx> Date: Wed Jan 13 14:59:09 2016 +0000 fix MSI injection on Xen On Xen MSIs can be remapped into pirqs, which are a type of event channels. It's mostly for the benefit of PCI passthrough devices, to avoid the overhead of interacting with the emulated lapic. However remapping interrupts and MSIs is also supported for emulated devices, such as the e1000 and virtio-net. When an interrupt or an MSI is remapped into a pirq, masking and unmasking is done by masking and unmasking the event channel. The masking bit on the PCI config space or MSI-X table should be ignored, but it isn't at the moment. As a consequence emulated devices which use MSI or MSI-X, such as virtio-net, don't work properly (the guest doesn't receive any notifications). The mechanism was working properly when xen_apic was introduced, but I haven't narrowed down which commit in particular is causing the regression. Fix the issue by ignoring the masking bit for MSI and MSI-X which have been remapped into pirqs. Signed-off-by: Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx> Reviewed-by: Michael S. Tsirkin <mst@xxxxxxxxxx> Signed-off-by: Michael S. Tsirkin <mst@xxxxxxxxxx> commit 276b20de45fa4925b3f22821d86a19d559dfd459 Author: Prasad J Pandit <pjp@xxxxxxxxxxxxxxxxx> Date: Fri Nov 20 11:50:31 2015 +0530 net: pcnet: add check to validate receive data size(CVE-2015-7504) In loopback mode, pcnet_receive routine appends CRC code to the receive buffer. If the data size given is same as the buffer size, the appended CRC code overwrites 4 bytes after s->buffer. Added a check to avoid that. Reported by: Qinghao Tang <luodalongde@xxxxxxxxx> Cc: qemu-stable@xxxxxxxxxx Reviewed-by: Michael S. Tsirkin <mst@xxxxxxxxxx> Signed-off-by: Prasad J Pandit <pjp@xxxxxxxxxxxxxxxxx> Signed-off-by: Jason Wang <jasowang@xxxxxxxxxx> commit 5d936e155198995f01c348da6184ceddb8deecce Author: Jason Wang <jasowang@xxxxxxxxxx> Date: Mon Nov 30 15:00:06 2015 +0800 pcnet: fix rx buffer overflow(CVE-2015-7512) Backends could provide a packet whose length is greater than buffer size. Check for this and truncate the packet to avoid rx buffer overflow in this case. Cc: Prasad J Pandit <pjp@xxxxxxxxxxxxxxxxx> Cc: qemu-stable@xxxxxxxxxx Reviewed-by: Michael S. Tsirkin <mst@xxxxxxxxxx> Signed-off-by: Jason Wang <jasowang@xxxxxxxxxx> commit c2f9b626486cb6407aa067cac5c62dbbe84d9d8d Author: Gerd Hoffmann <kraxel@xxxxxxxxxx> Date: Mon Dec 14 09:21:23 2015 +0100 ehci: make idt processing more robust Make ehci_process_itd return an error in case we didn't do any actual iso transfer because we've found no active transaction. That'll avoid ehci happily run in circles forever if the guest builds a loop out of idts. This is CVE-2015-8558. Cc: qemu-stable@xxxxxxxxxx Reported-by: Qinghao Tang <luodalongde@xxxxxxxxx> Tested-by: P J P <ppandit@xxxxxxxxxx> Signed-off-by: Gerd Hoffmann <kraxel@xxxxxxxxxx> commit 22585843887ce20a106c23162dc5845d64c42edd Author: Prasad J Pandit <pjp@xxxxxxxxxxxxxxxxx> Date: Mon Jan 25 19:59:50 2016 +0530 exec: fix a glitch in checking dma r/w access While checking r/w access in 'memory_access_is_direct' routine a glitch in the expression leads to segmentation fault while performing dma read operation. Reported-by: Donghai Zdh <donghai.zdh@xxxxxxxxxxxxxxx> Signed-off-by: Prasad J Pandit <pjp@xxxxxxxxxxxxxxxxx> commit e6927b717db724746f8df98d5e7dad2d4f63d9a6 Author: Prasad J Pandit <pjp@xxxxxxxxxxxxxxxxx> Date: Wed Jan 20 01:26:46 2016 +0530 usb: check page select value while processing iTD While processing isochronous transfer descriptors(iTD), the page select(PG) field value could lead to an OOB read access. Add check to avoid it. Reported-by: Qinghao Tang <luodalongde@xxxxxxxxx> Signed-off-by: Prasad J Pandit <pjp@xxxxxxxxxxxxxxxxx> Message-id: 1453233406-12165-1-git-send-email-ppandit@xxxxxxxxxx Signed-off-by: Gerd Hoffmann <kraxel@xxxxxxxxxx> commit ec963204db85b8e7c5758c76a9ec7d21eb256925 Author: Prasad J Pandit <pjp@xxxxxxxxxxxxxxxxx> Date: Fri Jan 15 12:30:40 2016 +0530 net: cadence_gem: check packet size in gem_recieve While receiving packets in 'gem_receive' routine, if Frame Check Sequence(FCS) is enabled, it copies the packet into a local buffer without checking its size. Add check to validate packet length against the buffer size to avoid buffer overflow. Reported-by: Ling Liu <liuling-it@xxxxxx> Signed-off-by: Prasad J Pandit <pjp@xxxxxxxxxxxxxxxxx> Signed-off-by: Jason Wang <jasowang@xxxxxxxxxx> commit b5c0247eec22a343bc135bc8edd7e2f607094b73 Author: Prasad J Pandit <pjp@xxxxxxxxxxxxxxxxx> Date: Mon Jan 11 14:10:42 2016 -0500 ide: ahci: reset ncq object to unused on error When processing NCQ commands, AHCI device emulation prepares a NCQ transfer object; To which an aio control block(aiocb) object is assigned in 'execute_ncq_command'. In case, when the NCQ command is invalid, the 'aiocb' object is not assigned, and NCQ transfer object is left as 'used'. This leads to a use after free kind of error in 'bdrv_aio_cancel_async' via 'ahci_reset_port'. Reset NCQ transfer object to 'unused' to avoid it. [Maintainer edit: s/ACHI/AHCI/ in the commit message. --js] Reported-by: Qinghao Tang <luodalongde@xxxxxxxxx> Signed-off-by: Prasad J Pandit <pjp@xxxxxxxxxxxxxxxxx> Reviewed-by: John Snow <jsnow@xxxxxxxxxx> Message-id: 1452282511-4116-1-git-send-email-ppandit@xxxxxxxxxx Signed-off-by: John Snow <jsnow@xxxxxxxxxx> commit 78618e0e7f86ff5e6f6af26556a5c020813e13b4 Author: Prasad J Pandit <pjp@xxxxxxxxxxxxxxxxx> Date: Thu Dec 31 17:05:27 2015 +0530 net: ne2000: fix bounds check in ioport operations While doing ioport r/w operations, ne2000 device emulation suffers from OOB r/w errors. Update respective array bounds check to avoid OOB access. Reported-by: Ling Liu <liuling-it@xxxxxx> Cc: qemu-stable@xxxxxxxxxx Signed-off-by: Prasad J Pandit <pjp@xxxxxxxxxxxxxxxxx> Signed-off-by: Jason Wang <jasowang@xxxxxxxxxx> commit a890821b79ccf2f0c5bb60253d70f72f91e52e4c Author: Prasad J Pandit <pjp@xxxxxxxxxxxxxxxxx> Date: Mon Dec 28 16:24:08 2015 +0530 net: rocker: fix an incorrect array bounds check While processing transmit(tx) descriptors in 'tx_consume' routine the switch emulator suffers from an off-by-one error, if a descriptor was to have more than allowed(ROCKER_TX_FRAGS_MAX=16) fragments. Fix an incorrect bounds check to avoid it. Reported-by: Qinghao Tang <luodalongde@xxxxxxxxx> Cc: qemu-stable@xxxxxxxxxx Signed-off-by: Prasad J Pandit <pjp@xxxxxxxxxxxxxxxxx> Signed-off-by: Jason Wang <jasowang@xxxxxxxxxx> commit 9681ffe1bad259f211315216274d2888f2cd3fc1 Author: P J P <ppandit@xxxxxxxxxx> Date: Mon Dec 21 15:13:13 2015 +0530 scsi: initialise info object with appropriate size While processing controller 'CTRL_GET_INFO' command, the routine 'megasas_ctrl_get_info' overflows the '&info' object size. Use its appropriate size to null initialise it. Reported-by: Qinghao Tang <luodalongde@xxxxxxxxx> Signed-off-by: Prasad J Pandit <pjp@xxxxxxxxxxxxxxxxx> Message-Id: <alpine.LFD.2.20.1512211501420.22471@wniryva> Cc: qemu-stable@xxxxxxxxxx Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx> Signed-off-by: P J P <ppandit@xxxxxxxxxx> commit 44c0045b1c17bbf16fd3799b46f1612ce9ddfca2 Author: P J P <ppandit@xxxxxxxxxx> Date: Tue Dec 15 12:27:54 2015 +0530 net: vmxnet3: avoid memory leakage in activate_device Vmxnet3 device emulator does not check if the device is active before activating it, also it did not free the transmit & receive buffers while deactivating the device, thus resulting in memory leakage on the host. This patch fixes both these issues to avoid host memory leakage. Reported-by: Qinghao Tang <luodalongde@xxxxxxxxx> Reviewed-by: Dmitry Fleytman <dmitry@xxxxxxxxxx> Signed-off-by: Prasad J Pandit <pjp@xxxxxxxxxxxxxxxxx> Cc: qemu-stable@xxxxxxxxxx Signed-off-by: Jason Wang <jasowang@xxxxxxxxxx> commit 31663cad8a9e4070d3f6353501c9ac4473c524c9 Author: Prasad J Pandit <pjp@xxxxxxxxxxxxxxxxx> Date: Thu Dec 3 18:54:17 2015 +0530 ui: vnc: avoid floating point exception While sending 'SetPixelFormat' messages to a VNC server, the client could set the 'red-max', 'green-max' and 'blue-max' values to be zero. This leads to a floating point exception in write_png_palette while doing frame buffer updates. Reported-by: Lian Yihan <lianyihan@xxxxxx> Signed-off-by: Prasad J Pandit <pjp@xxxxxxxxxxxxxxxxx> Reviewed-by: Gerd Hoffmann <kraxel@xxxxxxxxxx> Signed-off-by: Peter Maydell <peter.maydell@xxxxxxxxxx> _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxx http://lists.xen.org/xen-devel
|
 |
Lists.xenproject.org is hosted with RackSpace, monitoring our |