* [xen-4.2-testing test] 24747: regressions - trouble: blocked/broken/fail/pass
@ 2014-02-06 22:16 xen.org
0 siblings, 0 replies; only message in thread
From: xen.org @ 2014-02-06 22:16 UTC (permalink / raw)
To: xen-devel; +Cc: ian.jackson
[-- Attachment #1: Type: text/plain, Size: 10788 bytes --]
flight 24747 xen-4.2-testing real [real]
http://www.chiark.greenend.org.uk/~xensrcts/logs/24747/
Regressions :-(
Tests which did not succeed and are blocking,
including tests which could not be run:
build-i386-pvops 3 host-build-prep fail REGR. vs. 24699
Tests which did not succeed, but are not blocking:
test-amd64-i386-rhel6hvm-amd 1 xen-build-check(1) blocked n/a
test-amd64-amd64-xl-pcipt-intel 9 guest-start fail never pass
test-amd64-i386-pv 1 xen-build-check(1) blocked n/a
test-amd64-i386-qemuu-rhel6hvm-amd 1 xen-build-check(1) blocked n/a
test-amd64-i386-xl 1 xen-build-check(1) blocked n/a
test-i386-i386-pv 1 xen-build-check(1) blocked n/a
test-amd64-i386-qemut-rhel6hvm-intel 1 xen-build-check(1) blocked n/a
test-amd64-i386-qemuu-rhel6hvm-intel 1 xen-build-check(1) blocked n/a
test-amd64-i386-xl-credit2 1 xen-build-check(1) blocked n/a
test-i386-i386-xl 1 xen-build-check(1) blocked n/a
test-amd64-i386-rhel6hvm-intel 1 xen-build-check(1) blocked n/a
test-amd64-i386-xl-multivcpu 1 xen-build-check(1) blocked n/a
test-amd64-i386-qemut-rhel6hvm-amd 1 xen-build-check(1) blocked n/a
test-i386-i386-pair 1 xen-build-check(1) blocked n/a
test-amd64-i386-qemuu-freebsd10-amd64 1 xen-build-check(1) blocked n/a
test-amd64-i386-qemuu-freebsd10-i386 1 xen-build-check(1) blocked n/a
test-amd64-i386-pair 1 xen-build-check(1) blocked n/a
test-amd64-i386-xl-qemut-win7-amd64 1 xen-build-check(1) blocked n/a
test-i386-i386-xl-qemut-winxpsp3 1 xen-build-check(1) blocked n/a
test-amd64-amd64-xl-winxpsp3 13 guest-stop fail never pass
test-amd64-i386-xend-qemut-winxpsp3 1 xen-build-check(1) blocked n/a
test-amd64-i386-xl-qemuu-win7-amd64 1 xen-build-check(1) blocked n/a
test-amd64-i386-xl-qemut-winxpsp3-vcpus1 1 xen-build-check(1) blocked n/a
test-amd64-amd64-xl-qemuu-win7-amd64 13 guest-stop fail never pass
test-amd64-i386-xl-winxpsp3-vcpus1 1 xen-build-check(1) blocked n/a
test-amd64-amd64-xl-win7-amd64 13 guest-stop fail never pass
test-amd64-i386-xl-win7-amd64 1 xen-build-check(1) blocked n/a
test-amd64-i386-xl-qemuu-winxpsp3-vcpus1 1 xen-build-check(1) blocked n/a
test-amd64-i386-xend-winxpsp3 1 xen-build-check(1) blocked n/a
test-i386-i386-xl-qemuu-winxpsp3 1 xen-build-check(1) blocked n/a
test-amd64-amd64-xl-qemuu-winxpsp3 13 guest-stop fail never pass
test-i386-i386-xl-winxpsp3 1 xen-build-check(1) blocked n/a
test-amd64-amd64-xl-qemut-win7-amd64 13 guest-stop fail never pass
test-amd64-amd64-xl-qemut-winxpsp3 13 guest-stop fail never pass
version targeted for testing:
xen ae5d69f1c6d6cf5960e72d79ac0840eec1d75856
baseline version:
xen 0037ec360b8792f966acc154e06ac9f627b00f9f
------------------------------------------------------------
People who touched revisions under test:
Daniel De Graaf <dgdegra@tycho.nsa.gov>
Ian Jackson <ian.jackson@eu.citrix.com>
Jan Beulich <jbeulich@suse.com>
Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Matthew Daley <mattd@bugfuzz.com>
------------------------------------------------------------
jobs:
build-amd64 pass
build-i386 pass
build-amd64-oldkern pass
build-i386-oldkern pass
build-amd64-pvops pass
build-i386-pvops broken
test-amd64-amd64-xl pass
test-amd64-i386-xl blocked
test-i386-i386-xl blocked
test-amd64-i386-rhel6hvm-amd blocked
test-amd64-i386-qemut-rhel6hvm-amd blocked
test-amd64-i386-qemuu-rhel6hvm-amd blocked
test-amd64-i386-qemuu-freebsd10-amd64 blocked
test-amd64-amd64-xl-qemut-win7-amd64 fail
test-amd64-i386-xl-qemut-win7-amd64 blocked
test-amd64-amd64-xl-qemuu-win7-amd64 fail
test-amd64-i386-xl-qemuu-win7-amd64 blocked
test-amd64-amd64-xl-win7-amd64 fail
test-amd64-i386-xl-win7-amd64 blocked
test-amd64-i386-xl-credit2 blocked
test-amd64-i386-qemuu-freebsd10-i386 blocked
test-amd64-amd64-xl-pcipt-intel fail
test-amd64-i386-rhel6hvm-intel blocked
test-amd64-i386-qemut-rhel6hvm-intel blocked
test-amd64-i386-qemuu-rhel6hvm-intel blocked
test-amd64-i386-xl-multivcpu blocked
test-amd64-amd64-pair pass
test-amd64-i386-pair blocked
test-i386-i386-pair blocked
test-amd64-amd64-xl-sedf-pin pass
test-amd64-amd64-pv pass
test-amd64-i386-pv blocked
test-i386-i386-pv blocked
test-amd64-amd64-xl-sedf pass
test-amd64-i386-xl-qemut-winxpsp3-vcpus1 blocked
test-amd64-i386-xl-qemuu-winxpsp3-vcpus1 blocked
test-amd64-i386-xl-winxpsp3-vcpus1 blocked
test-amd64-i386-xend-qemut-winxpsp3 blocked
test-amd64-amd64-xl-qemut-winxpsp3 fail
test-i386-i386-xl-qemut-winxpsp3 blocked
test-amd64-amd64-xl-qemuu-winxpsp3 fail
test-i386-i386-xl-qemuu-winxpsp3 blocked
test-amd64-i386-xend-winxpsp3 blocked
test-amd64-amd64-xl-winxpsp3 fail
test-i386-i386-xl-winxpsp3 blocked
------------------------------------------------------------
sg-report-flight on woking.cam.xci-test.com
logs: /home/xc_osstest/logs
images: /home/xc_osstest/images
Logs, config files, etc. are available at
http://www.chiark.greenend.org.uk/~xensrcts/logs
Test harness code can be found at
http://xenbits.xensource.com/gitweb?p=osstest.git;a=summary
Not pushing.
------------------------------------------------------------
commit ae5d69f1c6d6cf5960e72d79ac0840eec1d75856
Author: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Date: Thu Feb 6 17:39:17 2014 +0100
libvchan: Fix handling of invalid ring buffer indices
The remote (hostile) process can set ring buffer indices to any value
at any time. If that happens, it is possible to get "buffer space"
(either for writing data, or ready for reading) negative or greater
than buffer size. This will end up with buffer overflow in the second
memcpy inside of do_send/do_recv.
Fix this by introducing new available bytes accessor functions
raw_get_data_ready and raw_get_buffer_space which are robust against
mad ring states, and only return sanitised values.
Proof sketch of correctness:
Now {rd,wr}_{cons,prod} are only ever used in the raw available bytes
functions, and in do_send and do_recv.
The raw available bytes functions do unsigned arithmetic on the
returned values. If the result is "negative" or too big it will be
>ring_size (since we used unsigned arithmetic). Otherwise the result
is a positive in-range value representing a reasonable ring state, in
which case we can safely convert it to int (as the rest of the code
expects).
do_send and do_recv immediately mask the ring index value with the
ring size. The result is always going to be plausible. If the ring
state has become mad, the worst case is that our behaviour is
inconsistent with the peer's ring pointer. I.e. we read or write to
arguably-incorrect parts of the ring - but always parts of the ring.
And of course if a peer misoperates the ring they can achieve this
effect anyway.
So the security problem is fixed.
This is XSA-86.
(The patch is essentially Ian Jackson's work, although parts of the
commit message are by Marek.)
Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
master commit: 2efcb0193bf3916c8ce34882e845f5ceb1e511f7
master date: 2014-02-06 16:44:41 +0100
commit 1d65af769af52199132df8ebacc0e7a52fd1f4ca
Author: Matthew Daley <mattd@bugfuzz.com>
Date: Thu Feb 6 17:38:22 2014 +0100
xsm/flask: correct off-by-one in flask_security_avc_cachestats cpu id check
This is XSA-85.
Signed-off-by: Matthew Daley <mattd@bugfuzz.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Ian Campbell <ian.campbell@citrix.com>
master commit: 2e1cba2da4631c5cd7218a8f30d521dce0f41370
master date: 2014-02-06 16:42:36 +0100
commit 6c6b5568e8d2342de1bb653eb70aee4615430db0
Author: Jan Beulich <jbeulich@suse.com>
Date: Thu Feb 6 17:36:40 2014 +0100
flask: fix reading strings from guest memory
Since the string size is being specified by the guest, we must range
check it properly before doing allocations based on it. While for the
two cases that are exposed only to trusted guests (via policy
restriction) this just uses an arbitrary upper limit (PAGE_SIZE), for
the FLASK_[GS]ETBOOL case (which any guest can use) the upper limit
gets enforced based on the longest name across all boolean settings.
This is XSA-84.
Reported-by: Matthew Daley <mattd@bugfuzz.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
master commit: 6c79e0ab9ac6042e60434c02e1d99b0cf0cc3470
master date: 2014-02-06 16:33:50 +0100
(qemu changes not included)
[-- Attachment #2: Type: text/plain, Size: 126 bytes --]
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2014-02-06 22:16 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-02-06 22:16 [xen-4.2-testing test] 24747: regressions - trouble: blocked/broken/fail/pass xen.org
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).