[PATCH] virtio_balloon: Add option mprotect to handle guest kernel cheat issue

Hui Zhu posted 1 patch 5 years, 8 months ago
Test docker-mingw@fedora passed
Test docker-quick@centos7 passed
Test checkpatch failed
Test FreeBSD passed
Test asan failed
Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/1584010572-10308-1-git-send-email-teawater@gmail.com
Maintainers: "Michael S. Tsirkin" <mst@redhat.com>, Paolo Bonzini <pbonzini@redhat.com>, Richard Henderson <rth@twiddle.net>
exec.c                             | 33 +++++++++++++++++++++++----------
hw/virtio/virtio-balloon.c         | 20 +++++++++++++++++---
include/exec/cpu-common.h          |  2 ++
include/hw/virtio/virtio-balloon.h |  2 ++
include/qemu/osdep.h               |  1 +
util/osdep.c                       |  9 +++++++++
6 files changed, 54 insertions(+), 13 deletions(-)
[PATCH] virtio_balloon: Add option mprotect to handle guest kernel cheat issue
Posted by Hui Zhu 5 years, 8 months ago
QEMU virtio_balloon decreases the memory usage of VM depends on the
cooperation of the guest kernel.  If the guest kernel cheats with
the virtio_balloon, it can break the limit.

[1] is a Linux kernel with a cheat code.
This is an example in a VM with 1G memory 1CPU that use this kernel:
// Start VM.
// In the guest, use usemem(https://git.kernel.org/pub/scm/linux/kernel/git/wfg/vm-scalability.git)
// allocate 800M memory then the usage of VM will increase.
usemem 800m

// Check anon memory usage of QEMU in the host.
ps -e | grep qemu
67768 pts/5    00:00:02 qemu-system-x86
cat /proc/67768/status | grep RssAnon:
RssAnon:          994892 kB

// Connect to the monitor of QEMU and inflate the balloon 800M.
(qemu) device_add virtio-balloon-pci,id=balloon1
(qemu) info balloon
balloon: actual=1024
(qemu) balloon 224
(qemu) info balloon
balloon: actual=224

// Check anon memory usage of QEMU in the host again.
cat /proc/67768/status | grep RssAnon:
RssAnon:          175848 kB

// Use the cheat code inside the guest kernel to
// access the memory of the balloon.
cat /proc/virtio_balloon
204800

// The memory usage of QEMU increase back without deflation the balloon.
cat /proc/67768/status | grep RssAnon:
RssAnon:          995036 kB

This commit tries to handle the issue.
It set the address of balloon pages to cannot access with mprotect
when inflating the balloon and set it back when deflating the balloon.
When guest kernel cheat code tries to access the pages inside the balloon,
the host kernel will call handle_ept_violation-> tdp_page_fault to handle it.
tdp_page_fault will call hva_to_pfn to get PFN of the page.
hva_to_pfn_fast and hva_to_pfn_slow will check the VMA access permission.
Then change the VMA access permission can handle the issue.

This is an example in a VM with 1G memory 1CPU that use this kernel:
// Start VM.
// In the guest, use usemem(https://git.kernel.org/pub/scm/linux/kernel/git/wfg/vm-scalability.git)
// allocate 800M memory then the usage of VM will increase.
usemem 800m

// Connect to the monitor of QEMU and inflate the balloon 800M.
(qemu) device_add virtio-balloon-pci,id=balloon1,mprotect=on
(qemu) info balloon
balloon: actual=1024
(qemu) balloon 224
(qemu) info balloon
balloon: actual=224

// Use the cheat code inside the guest kernel to access the memory of balloon.
cat /proc/virtio_balloon
error: kvm run failed Bad address
RAX=000000000783c000 RBX=0000000000000000 RCX=ffff88803952bc00 RDX=ffff888000000000
RSI=ffffea00001e0f40 RDI=ffffea00001e0f48 RBP=ffff88803aac7180 RSP=ffffc90000207a70
R8 =ffff8880396af100 R9 =ffff88803a802700 R10=0000000000001000 R11=ffffffffffffffff
R12=ffff8880396af120 R13=0000000000000001 R14=ffffc90000207c60 R15=ffff88803aac7180
RIP=ffffffff81604aad RFL=00010206 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000bcd880 ffffffff 00c00000
GS =0000 ffff88803ec00000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00000000008a2260 CR3=00000000396b6004 CR4=00360ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
Code=05 72 5b e1 00 48 8b 15 7b 5b e1 00 48 c1 f8 06 48 c1 e0 0c <c6> 04 10 01 83 a9 a8 12 00 00 01 48 8b 46 08 83 c3 01 48 8d 50 f8 48 8d 46 08 49 35

This shows that the access is refused and QEMU stops.

[1] https://github.com/teawater/linux/tree/write_balloon

Signed-off-by: Hui Zhu <teawaterz@linux.alibaba.com>
---
 exec.c                             | 33 +++++++++++++++++++++++----------
 hw/virtio/virtio-balloon.c         | 20 +++++++++++++++++---
 include/exec/cpu-common.h          |  2 ++
 include/hw/virtio/virtio-balloon.h |  2 ++
 include/qemu/osdep.h               |  1 +
 util/osdep.c                       |  9 +++++++++
 6 files changed, 54 insertions(+), 13 deletions(-)

diff --git a/exec.c b/exec.c
index 0cc500d..ea14412 100644
--- a/exec.c
+++ b/exec.c
@@ -3846,17 +3846,20 @@ int qemu_ram_foreach_block(RAMBlockIterFunc func, void *opaque)
  * they a) read as 0, b) Trigger whatever fault mechanism
  * the OS provides for postcopy.
  * The pages must be unmapped by the end of the function.
+ * If do_mprotect is true, call mprotect to change the
+ * protection to PROT_NONE before unmap.
  * Returns: 0 on success, none-0 on failure
  *
  */
-int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length)
+int __ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length,
+                              bool do_mprotect)
 {
     int ret = -1;
 
     uint8_t *host_startaddr = rb->host + start;
 
     if (!QEMU_PTR_IS_ALIGNED(host_startaddr, rb->page_size)) {
-        error_report("ram_block_discard_range: Unaligned start address: %p",
+        error_report("__ram_block_discard_range: Unaligned start address: %p",
                      host_startaddr);
         goto err;
     }
@@ -3864,11 +3867,16 @@ int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length)
     if ((start + length) <= rb->used_length) {
         bool need_madvise, need_fallocate;
         if (!QEMU_IS_ALIGNED(length, rb->page_size)) {
-            error_report("ram_block_discard_range: Unaligned length: %zx",
+            error_report("__ram_block_discard_range: Unaligned length: %zx",
                          length);
             goto err;
         }
 
+        if (do_mprotect && qemu_mprotect_none(host_startaddr, length) < 0) {
+            ret = -errno;
+            goto err;
+        }
+
         errno = ENOTSUP; /* If we are missing MADVISE etc */
 
         /* The logic here is messy;
@@ -3887,15 +3895,15 @@ int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length)
                             start, length);
             if (ret) {
                 ret = -errno;
-                error_report("ram_block_discard_range: Failed to fallocate "
+                error_report("__ram_block_discard_range: Failed to fallocate "
                              "%s:%" PRIx64 " +%zx (%d)",
                              rb->idstr, start, length, ret);
                 goto err;
             }
 #else
             ret = -ENOSYS;
-            error_report("ram_block_discard_range: fallocate not available/file"
-                         "%s:%" PRIx64 " +%zx (%d)",
+            error_report("__ram_block_discard_range: fallocate not "
+                         "available/file %s:%" PRIx64 " +%zx (%d)",
                          rb->idstr, start, length, ret);
             goto err;
 #endif
@@ -3910,14 +3918,14 @@ int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length)
             ret =  madvise(host_startaddr, length, MADV_DONTNEED);
             if (ret) {
                 ret = -errno;
-                error_report("ram_block_discard_range: Failed to discard range "
-                             "%s:%" PRIx64 " +%zx (%d)",
+                error_report("__ram_block_discard_range: Failed to discard "
+                             "range %s:%" PRIx64 " +%zx (%d)",
                              rb->idstr, start, length, ret);
                 goto err;
             }
 #else
             ret = -ENOSYS;
-            error_report("ram_block_discard_range: MADVISE not available"
+            error_report("__ram_block_discard_range: MADVISE not available "
                          "%s:%" PRIx64 " +%zx (%d)",
                          rb->idstr, start, length, ret);
             goto err;
@@ -3926,7 +3934,7 @@ int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length)
         trace_ram_block_discard_range(rb->idstr, host_startaddr, length,
                                       need_madvise, need_fallocate, ret);
     } else {
-        error_report("ram_block_discard_range: Overrun block '%s' (%" PRIu64
+        error_report("__ram_block_discard_range: Overrun block '%s' (%" PRIu64
                      "/%zx/" RAM_ADDR_FMT")",
                      rb->idstr, start, length, rb->used_length);
     }
@@ -3935,6 +3943,11 @@ err:
     return ret;
 }
 
+int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length)
+{
+    return __ram_block_discard_range(rb, start, length, false);
+}
+
 bool ramblock_is_pmem(RAMBlock *rb)
 {
     return rb->flags & RAM_PMEM;
diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
index a4729f7..77c0c4b 100644
--- a/hw/virtio/virtio-balloon.c
+++ b/hw/virtio/virtio-balloon.c
@@ -81,7 +81,8 @@ static void balloon_inflate_page(VirtIOBalloon *balloon,
     if (rb_page_size == BALLOON_PAGE_SIZE) {
         /* Easy case */
 
-        ram_block_discard_range(rb, rb_offset, rb_page_size);
+        __ram_block_discard_range(rb, rb_offset, rb_page_size,
+                                  balloon->do_mprotect);
         /* We ignore errors from ram_block_discard_range(), because it
          * has already reported them, and failing to discard a balloon
          * page is not fatal */
@@ -120,8 +121,9 @@ static void balloon_inflate_page(VirtIOBalloon *balloon,
         /* We've accumulated a full host page, we can actually discard
          * it now */
 
-        ram_block_discard_range(rb, rb_aligned_offset, rb_page_size);
-        /* We ignore errors from ram_block_discard_range(), because it
+        __ram_block_discard_range(rb, rb_aligned_offset, rb_page_size,
+                                  balloon->do_mprotect);
+        /* We ignore errors from __ram_block_discard_range(), because it
          * has already reported them, and failing to discard a balloon
          * page is not fatal */
         virtio_balloon_pbp_free(pbp);
@@ -145,6 +147,9 @@ static void balloon_deflate_page(VirtIOBalloon *balloon,
 
     host_addr = (void *)((uintptr_t)addr & ~(rb_page_size - 1));
 
+    if (balloon->do_mprotect)
+        g_assert(qemu_mprotect_rw(host_addr, rb_page_size) == 0);
+
     /* When a page is deflated, we hint the whole host page it lives
      * on, since we can't do anything smaller */
     ret = qemu_madvise(host_addr, rb_page_size, QEMU_MADV_WILLNEED);
@@ -780,6 +785,14 @@ static void virtio_balloon_device_realize(DeviceState *dev, Error **errp)
     virtio_init(vdev, "virtio-balloon", VIRTIO_ID_BALLOON,
                 virtio_balloon_config_size(s));
 
+    if (s->do_mprotect
+        && virtio_has_feature(s->host_features,
+                              VIRTIO_BALLOON_F_FREE_PAGE_HINT)) {
+        error_setg(errp, "mprotect and free-page-hint cannot work together");
+        virtio_cleanup(vdev);
+        return;
+    }
+
     ret = qemu_add_balloon_handler(virtio_balloon_to_target,
                                    virtio_balloon_stat, s);
 
@@ -924,6 +937,7 @@ static Property virtio_balloon_properties[] = {
                      qemu_4_0_config_size, false),
     DEFINE_PROP_LINK("iothread", VirtIOBalloon, iothread, TYPE_IOTHREAD,
                      IOThread *),
+    DEFINE_PROP_BOOL("mprotect", VirtIOBalloon, do_mprotect, false),
     DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index b47e563..ffeb4a6 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -104,6 +104,8 @@ typedef int (RAMBlockIterFunc)(RAMBlock *rb, void *opaque);
 
 int qemu_ram_foreach_block(RAMBlockIterFunc func, void *opaque);
 int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length);
+int __ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length,
+                              bool do_mprotect);
 
 #endif
 
diff --git a/include/hw/virtio/virtio-balloon.h b/include/hw/virtio/virtio-balloon.h
index d1c968d..6f15085 100644
--- a/include/hw/virtio/virtio-balloon.h
+++ b/include/hw/virtio/virtio-balloon.h
@@ -70,6 +70,8 @@ typedef struct VirtIOBalloon {
     uint32_t host_features;
 
     bool qemu_4_0_config_size;
+
+    bool do_mprotect;
 } VirtIOBalloon;
 
 #endif
diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index 9bd3dcf..1bcb4e4 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -458,6 +458,7 @@ void sigaction_invoke(struct sigaction *action,
 
 int qemu_madvise(void *addr, size_t len, int advice);
 int qemu_mprotect_rwx(void *addr, size_t size);
+int qemu_mprotect_rw(void *addr, size_t size);
 int qemu_mprotect_none(void *addr, size_t size);
 
 int qemu_open(const char *name, int flags, ...);
diff --git a/util/osdep.c b/util/osdep.c
index 4829c07..2aff13b 100644
--- a/util/osdep.c
+++ b/util/osdep.c
@@ -105,6 +105,15 @@ int qemu_mprotect_rwx(void *addr, size_t size)
 #endif
 }
 
+int qemu_mprotect_rw(void *addr, size_t size)
+{
+#ifdef _WIN32
+    return qemu_mprotect__osdep(addr, size, PAGE_EXECUTE_READWRITE);
+#else
+    return qemu_mprotect__osdep(addr, size, PROT_READ | PROT_WRITE);
+#endif
+}
+
 int qemu_mprotect_none(void *addr, size_t size)
 {
 #ifdef _WIN32
-- 
2.7.4


Re: [PATCH] virtio_balloon: Add option mprotect to handle guest kernel cheat issue
Posted by Igor Mammedov 5 years, 8 months ago
On Thu, 12 Mar 2020 18:56:12 +0800
Hui Zhu <teawater@gmail.com> wrote:

> QEMU virtio_balloon decreases the memory usage of VM depends on the
> cooperation of the guest kernel.  If the guest kernel cheats with
> the virtio_balloon, it can break the limit.

I think David (CCed) works on better approach called virtio-mem

> 
> [1] is a Linux kernel with a cheat code.
> This is an example in a VM with 1G memory 1CPU that use this kernel:
> // Start VM.
> // In the guest, use usemem(https://git.kernel.org/pub/scm/linux/kernel/git/wfg/vm-scalability.git)
> // allocate 800M memory then the usage of VM will increase.
> usemem 800m
> 
> // Check anon memory usage of QEMU in the host.
> ps -e | grep qemu
> 67768 pts/5    00:00:02 qemu-system-x86
> cat /proc/67768/status | grep RssAnon:
> RssAnon:          994892 kB
> 
> // Connect to the monitor of QEMU and inflate the balloon 800M.
> (qemu) device_add virtio-balloon-pci,id=balloon1
> (qemu) info balloon
> balloon: actual=1024
> (qemu) balloon 224
> (qemu) info balloon
> balloon: actual=224
> 
> // Check anon memory usage of QEMU in the host again.
> cat /proc/67768/status | grep RssAnon:
> RssAnon:          175848 kB
> 
> // Use the cheat code inside the guest kernel to
> // access the memory of the balloon.
> cat /proc/virtio_balloon
> 204800
> 
> // The memory usage of QEMU increase back without deflation the balloon.
> cat /proc/67768/status | grep RssAnon:
> RssAnon:          995036 kB
> 
> This commit tries to handle the issue.
> It set the address of balloon pages to cannot access with mprotect
> when inflating the balloon and set it back when deflating the balloon.
> When guest kernel cheat code tries to access the pages inside the balloon,
> the host kernel will call handle_ept_violation-> tdp_page_fault to handle it.
> tdp_page_fault will call hva_to_pfn to get PFN of the page.
> hva_to_pfn_fast and hva_to_pfn_slow will check the VMA access permission.
> Then change the VMA access permission can handle the issue.
> 
> This is an example in a VM with 1G memory 1CPU that use this kernel:
> // Start VM.
> // In the guest, use usemem(https://git.kernel.org/pub/scm/linux/kernel/git/wfg/vm-scalability.git)
> // allocate 800M memory then the usage of VM will increase.
> usemem 800m
> 
> // Connect to the monitor of QEMU and inflate the balloon 800M.
> (qemu) device_add virtio-balloon-pci,id=balloon1,mprotect=on
> (qemu) info balloon
> balloon: actual=1024
> (qemu) balloon 224
> (qemu) info balloon
> balloon: actual=224
> 
> // Use the cheat code inside the guest kernel to access the memory of balloon.
> cat /proc/virtio_balloon
> error: kvm run failed Bad address
> RAX=000000000783c000 RBX=0000000000000000 RCX=ffff88803952bc00 RDX=ffff888000000000
> RSI=ffffea00001e0f40 RDI=ffffea00001e0f48 RBP=ffff88803aac7180 RSP=ffffc90000207a70
> R8 =ffff8880396af100 R9 =ffff88803a802700 R10=0000000000001000 R11=ffffffffffffffff
> R12=ffff8880396af120 R13=0000000000000001 R14=ffffc90000207c60 R15=ffff88803aac7180
> RIP=ffffffff81604aad RFL=00010206 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
> ES =0000 0000000000000000 ffffffff 00c00000
> CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
> SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
> DS =0000 0000000000000000 ffffffff 00c00000
> FS =0000 0000000000bcd880 ffffffff 00c00000
> GS =0000 ffff88803ec00000 ffffffff 00c00000
> LDT=0000 0000000000000000 ffffffff 00c00000
> TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
> GDT=     fffffe0000001000 0000007f
> IDT=     fffffe0000000000 00000fff
> CR0=80050033 CR2=00000000008a2260 CR3=00000000396b6004 CR4=00360ef0
> DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
> DR6=00000000fffe0ff0 DR7=0000000000000400
> EFER=0000000000000d01
> Code=05 72 5b e1 00 48 8b 15 7b 5b e1 00 48 c1 f8 06 48 c1 e0 0c <c6> 04 10 01 83 a9 a8 12 00 00 01 48 8b 46 08 83 c3 01 48 8d 50 f8 48 8d 46 08 49 35
> 
> This shows that the access is refused and QEMU stops.
> 
> [1] https://github.com/teawater/linux/tree/write_balloon
> 
> Signed-off-by: Hui Zhu <teawaterz@linux.alibaba.com>
> ---
>  exec.c                             | 33 +++++++++++++++++++++++----------
>  hw/virtio/virtio-balloon.c         | 20 +++++++++++++++++---
>  include/exec/cpu-common.h          |  2 ++
>  include/hw/virtio/virtio-balloon.h |  2 ++
>  include/qemu/osdep.h               |  1 +
>  util/osdep.c                       |  9 +++++++++
>  6 files changed, 54 insertions(+), 13 deletions(-)
> 
> diff --git a/exec.c b/exec.c
> index 0cc500d..ea14412 100644
> --- a/exec.c
> +++ b/exec.c
> @@ -3846,17 +3846,20 @@ int qemu_ram_foreach_block(RAMBlockIterFunc func, void *opaque)
>   * they a) read as 0, b) Trigger whatever fault mechanism
>   * the OS provides for postcopy.
>   * The pages must be unmapped by the end of the function.
> + * If do_mprotect is true, call mprotect to change the
> + * protection to PROT_NONE before unmap.
>   * Returns: 0 on success, none-0 on failure
>   *
>   */
> -int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length)
> +int __ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length,
> +                              bool do_mprotect)
>  {
>      int ret = -1;
>  
>      uint8_t *host_startaddr = rb->host + start;
>  
>      if (!QEMU_PTR_IS_ALIGNED(host_startaddr, rb->page_size)) {
> -        error_report("ram_block_discard_range: Unaligned start address: %p",
> +        error_report("__ram_block_discard_range: Unaligned start address: %p",
>                       host_startaddr);
>          goto err;
>      }
> @@ -3864,11 +3867,16 @@ int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length)
>      if ((start + length) <= rb->used_length) {
>          bool need_madvise, need_fallocate;
>          if (!QEMU_IS_ALIGNED(length, rb->page_size)) {
> -            error_report("ram_block_discard_range: Unaligned length: %zx",
> +            error_report("__ram_block_discard_range: Unaligned length: %zx",
>                           length);
>              goto err;
>          }
>  
> +        if (do_mprotect && qemu_mprotect_none(host_startaddr, length) < 0) {
> +            ret = -errno;
> +            goto err;
> +        }
> +
>          errno = ENOTSUP; /* If we are missing MADVISE etc */
>  
>          /* The logic here is messy;
> @@ -3887,15 +3895,15 @@ int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length)
>                              start, length);
>              if (ret) {
>                  ret = -errno;
> -                error_report("ram_block_discard_range: Failed to fallocate "
> +                error_report("__ram_block_discard_range: Failed to fallocate "
>                               "%s:%" PRIx64 " +%zx (%d)",
>                               rb->idstr, start, length, ret);
>                  goto err;
>              }
>  #else
>              ret = -ENOSYS;
> -            error_report("ram_block_discard_range: fallocate not available/file"
> -                         "%s:%" PRIx64 " +%zx (%d)",
> +            error_report("__ram_block_discard_range: fallocate not "
> +                         "available/file %s:%" PRIx64 " +%zx (%d)",
>                           rb->idstr, start, length, ret);
>              goto err;
>  #endif
> @@ -3910,14 +3918,14 @@ int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length)
>              ret =  madvise(host_startaddr, length, MADV_DONTNEED);
>              if (ret) {
>                  ret = -errno;
> -                error_report("ram_block_discard_range: Failed to discard range "
> -                             "%s:%" PRIx64 " +%zx (%d)",
> +                error_report("__ram_block_discard_range: Failed to discard "
> +                             "range %s:%" PRIx64 " +%zx (%d)",
>                               rb->idstr, start, length, ret);
>                  goto err;
>              }
>  #else
>              ret = -ENOSYS;
> -            error_report("ram_block_discard_range: MADVISE not available"
> +            error_report("__ram_block_discard_range: MADVISE not available "
>                           "%s:%" PRIx64 " +%zx (%d)",
>                           rb->idstr, start, length, ret);
>              goto err;
> @@ -3926,7 +3934,7 @@ int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length)
>          trace_ram_block_discard_range(rb->idstr, host_startaddr, length,
>                                        need_madvise, need_fallocate, ret);
>      } else {
> -        error_report("ram_block_discard_range: Overrun block '%s' (%" PRIu64
> +        error_report("__ram_block_discard_range: Overrun block '%s' (%" PRIu64
>                       "/%zx/" RAM_ADDR_FMT")",
>                       rb->idstr, start, length, rb->used_length);
>      }
> @@ -3935,6 +3943,11 @@ err:
>      return ret;
>  }
>  
> +int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length)
> +{
> +    return __ram_block_discard_range(rb, start, length, false);
> +}
> +
>  bool ramblock_is_pmem(RAMBlock *rb)
>  {
>      return rb->flags & RAM_PMEM;
> diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
> index a4729f7..77c0c4b 100644
> --- a/hw/virtio/virtio-balloon.c
> +++ b/hw/virtio/virtio-balloon.c
> @@ -81,7 +81,8 @@ static void balloon_inflate_page(VirtIOBalloon *balloon,
>      if (rb_page_size == BALLOON_PAGE_SIZE) {
>          /* Easy case */
>  
> -        ram_block_discard_range(rb, rb_offset, rb_page_size);
> +        __ram_block_discard_range(rb, rb_offset, rb_page_size,
> +                                  balloon->do_mprotect);
>          /* We ignore errors from ram_block_discard_range(), because it
>           * has already reported them, and failing to discard a balloon
>           * page is not fatal */
> @@ -120,8 +121,9 @@ static void balloon_inflate_page(VirtIOBalloon *balloon,
>          /* We've accumulated a full host page, we can actually discard
>           * it now */
>  
> -        ram_block_discard_range(rb, rb_aligned_offset, rb_page_size);
> -        /* We ignore errors from ram_block_discard_range(), because it
> +        __ram_block_discard_range(rb, rb_aligned_offset, rb_page_size,
> +                                  balloon->do_mprotect);
> +        /* We ignore errors from __ram_block_discard_range(), because it
>           * has already reported them, and failing to discard a balloon
>           * page is not fatal */
>          virtio_balloon_pbp_free(pbp);
> @@ -145,6 +147,9 @@ static void balloon_deflate_page(VirtIOBalloon *balloon,
>  
>      host_addr = (void *)((uintptr_t)addr & ~(rb_page_size - 1));
>  
> +    if (balloon->do_mprotect)
> +        g_assert(qemu_mprotect_rw(host_addr, rb_page_size) == 0);
> +
>      /* When a page is deflated, we hint the whole host page it lives
>       * on, since we can't do anything smaller */
>      ret = qemu_madvise(host_addr, rb_page_size, QEMU_MADV_WILLNEED);
> @@ -780,6 +785,14 @@ static void virtio_balloon_device_realize(DeviceState *dev, Error **errp)
>      virtio_init(vdev, "virtio-balloon", VIRTIO_ID_BALLOON,
>                  virtio_balloon_config_size(s));
>  
> +    if (s->do_mprotect
> +        && virtio_has_feature(s->host_features,
> +                              VIRTIO_BALLOON_F_FREE_PAGE_HINT)) {
> +        error_setg(errp, "mprotect and free-page-hint cannot work together");
> +        virtio_cleanup(vdev);
> +        return;
> +    }
> +
>      ret = qemu_add_balloon_handler(virtio_balloon_to_target,
>                                     virtio_balloon_stat, s);
>  
> @@ -924,6 +937,7 @@ static Property virtio_balloon_properties[] = {
>                       qemu_4_0_config_size, false),
>      DEFINE_PROP_LINK("iothread", VirtIOBalloon, iothread, TYPE_IOTHREAD,
>                       IOThread *),
> +    DEFINE_PROP_BOOL("mprotect", VirtIOBalloon, do_mprotect, false),
>      DEFINE_PROP_END_OF_LIST(),
>  };
>  
> diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
> index b47e563..ffeb4a6 100644
> --- a/include/exec/cpu-common.h
> +++ b/include/exec/cpu-common.h
> @@ -104,6 +104,8 @@ typedef int (RAMBlockIterFunc)(RAMBlock *rb, void *opaque);
>  
>  int qemu_ram_foreach_block(RAMBlockIterFunc func, void *opaque);
>  int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length);
> +int __ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length,
> +                              bool do_mprotect);
>  
>  #endif
>  
> diff --git a/include/hw/virtio/virtio-balloon.h b/include/hw/virtio/virtio-balloon.h
> index d1c968d..6f15085 100644
> --- a/include/hw/virtio/virtio-balloon.h
> +++ b/include/hw/virtio/virtio-balloon.h
> @@ -70,6 +70,8 @@ typedef struct VirtIOBalloon {
>      uint32_t host_features;
>  
>      bool qemu_4_0_config_size;
> +
> +    bool do_mprotect;
>  } VirtIOBalloon;
>  
>  #endif
> diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
> index 9bd3dcf..1bcb4e4 100644
> --- a/include/qemu/osdep.h
> +++ b/include/qemu/osdep.h
> @@ -458,6 +458,7 @@ void sigaction_invoke(struct sigaction *action,
>  
>  int qemu_madvise(void *addr, size_t len, int advice);
>  int qemu_mprotect_rwx(void *addr, size_t size);
> +int qemu_mprotect_rw(void *addr, size_t size);
>  int qemu_mprotect_none(void *addr, size_t size);
>  
>  int qemu_open(const char *name, int flags, ...);
> diff --git a/util/osdep.c b/util/osdep.c
> index 4829c07..2aff13b 100644
> --- a/util/osdep.c
> +++ b/util/osdep.c
> @@ -105,6 +105,15 @@ int qemu_mprotect_rwx(void *addr, size_t size)
>  #endif
>  }
>  
> +int qemu_mprotect_rw(void *addr, size_t size)
> +{
> +#ifdef _WIN32
> +    return qemu_mprotect__osdep(addr, size, PAGE_EXECUTE_READWRITE);
> +#else
> +    return qemu_mprotect__osdep(addr, size, PROT_READ | PROT_WRITE);
> +#endif
> +}
> +
>  int qemu_mprotect_none(void *addr, size_t size)
>  {
>  #ifdef _WIN32


Re: [PATCH] virtio_balloon: Add option mprotect to handle guest kernel cheat issue
Posted by David Hildenbrand 5 years, 8 months ago
On 12.03.20 13:40, Igor Mammedov wrote:
> On Thu, 12 Mar 2020 18:56:12 +0800
> Hui Zhu <teawater@gmail.com> wrote:
> 
>> QEMU virtio_balloon decreases the memory usage of VM depends on the
>> cooperation of the guest kernel.  If the guest kernel cheats with
>> the virtio_balloon, it can break the limit.
> 
> I think David (CCed) works on better approach called virtio-mem
> 

Yes, and doing random mprotects() in virtio-balloon code is wrong on
many levels.

E.g., just do a guest memory dump using HMP/QMP and crash your VM. But
there is a lot more ... #VMAs, guest kdump, double kexec, ...

In summary: Bad idea,

>>
>> [1] is a Linux kernel with a cheat code.
>> This is an example in a VM with 1G memory 1CPU that use this kernel:
>> // Start VM.
>> // In the guest, use usemem(https://git.kernel.org/pub/scm/linux/kernel/git/wfg/vm-scalability.git)
>> // allocate 800M memory then the usage of VM will increase.
>> usemem 800m
>>
>> // Check anon memory usage of QEMU in the host.
>> ps -e | grep qemu
>> 67768 pts/5    00:00:02 qemu-system-x86
>> cat /proc/67768/status | grep RssAnon:
>> RssAnon:          994892 kB
>>
>> // Connect to the monitor of QEMU and inflate the balloon 800M.
>> (qemu) device_add virtio-balloon-pci,id=balloon1
>> (qemu) info balloon
>> balloon: actual=1024
>> (qemu) balloon 224
>> (qemu) info balloon
>> balloon: actual=224
>>
>> // Check anon memory usage of QEMU in the host again.
>> cat /proc/67768/status | grep RssAnon:
>> RssAnon:          175848 kB
>>
>> // Use the cheat code inside the guest kernel to
>> // access the memory of the balloon.
>> cat /proc/virtio_balloon
>> 204800
>>
>> // The memory usage of QEMU increase back without deflation the balloon.
>> cat /proc/67768/status | grep RssAnon:
>> RssAnon:          995036 kB
>>
>> This commit tries to handle the issue.
>> It set the address of balloon pages to cannot access with mprotect
>> when inflating the balloon and set it back when deflating the balloon.
>> When guest kernel cheat code tries to access the pages inside the balloon,
>> the host kernel will call handle_ept_violation-> tdp_page_fault to handle it.
>> tdp_page_fault will call hva_to_pfn to get PFN of the page.
>> hva_to_pfn_fast and hva_to_pfn_slow will check the VMA access permission.
>> Then change the VMA access permission can handle the issue.
>>
>> This is an example in a VM with 1G memory 1CPU that use this kernel:
>> // Start VM.
>> // In the guest, use usemem(https://git.kernel.org/pub/scm/linux/kernel/git/wfg/vm-scalability.git)
>> // allocate 800M memory then the usage of VM will increase.
>> usemem 800m
>>
>> // Connect to the monitor of QEMU and inflate the balloon 800M.
>> (qemu) device_add virtio-balloon-pci,id=balloon1,mprotect=on
>> (qemu) info balloon
>> balloon: actual=1024
>> (qemu) balloon 224
>> (qemu) info balloon
>> balloon: actual=224
>>
>> // Use the cheat code inside the guest kernel to access the memory of balloon.
>> cat /proc/virtio_balloon
>> error: kvm run failed Bad address
>> RAX=000000000783c000 RBX=0000000000000000 RCX=ffff88803952bc00 RDX=ffff888000000000
>> RSI=ffffea00001e0f40 RDI=ffffea00001e0f48 RBP=ffff88803aac7180 RSP=ffffc90000207a70
>> R8 =ffff8880396af100 R9 =ffff88803a802700 R10=0000000000001000 R11=ffffffffffffffff
>> R12=ffff8880396af120 R13=0000000000000001 R14=ffffc90000207c60 R15=ffff88803aac7180
>> RIP=ffffffff81604aad RFL=00010206 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
>> ES =0000 0000000000000000 ffffffff 00c00000
>> CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
>> SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
>> DS =0000 0000000000000000 ffffffff 00c00000
>> FS =0000 0000000000bcd880 ffffffff 00c00000
>> GS =0000 ffff88803ec00000 ffffffff 00c00000
>> LDT=0000 0000000000000000 ffffffff 00c00000
>> TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
>> GDT=     fffffe0000001000 0000007f
>> IDT=     fffffe0000000000 00000fff
>> CR0=80050033 CR2=00000000008a2260 CR3=00000000396b6004 CR4=00360ef0
>> DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
>> DR6=00000000fffe0ff0 DR7=0000000000000400
>> EFER=0000000000000d01
>> Code=05 72 5b e1 00 48 8b 15 7b 5b e1 00 48 c1 f8 06 48 c1 e0 0c <c6> 04 10 01 83 a9 a8 12 00 00 01 48 8b 46 08 83 c3 01 48 8d 50 f8 48 8d 46 08 49 35
>>
>> This shows that the access is refused and QEMU stops.
>>
>> [1] https://github.com/teawater/linux/tree/write_balloon
>>
>> Signed-off-by: Hui Zhu <teawaterz@linux.alibaba.com>
>> ---
>>  exec.c                             | 33 +++++++++++++++++++++++----------
>>  hw/virtio/virtio-balloon.c         | 20 +++++++++++++++++---
>>  include/exec/cpu-common.h          |  2 ++
>>  include/hw/virtio/virtio-balloon.h |  2 ++
>>  include/qemu/osdep.h               |  1 +
>>  util/osdep.c                       |  9 +++++++++
>>  6 files changed, 54 insertions(+), 13 deletions(-)
>>
>> diff --git a/exec.c b/exec.c
>> index 0cc500d..ea14412 100644
>> --- a/exec.c
>> +++ b/exec.c
>> @@ -3846,17 +3846,20 @@ int qemu_ram_foreach_block(RAMBlockIterFunc func, void *opaque)
>>   * they a) read as 0, b) Trigger whatever fault mechanism
>>   * the OS provides for postcopy.
>>   * The pages must be unmapped by the end of the function.
>> + * If do_mprotect is true, call mprotect to change the
>> + * protection to PROT_NONE before unmap.
>>   * Returns: 0 on success, none-0 on failure
>>   *
>>   */
>> -int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length)
>> +int __ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length,
>> +                              bool do_mprotect)
>>  {
>>      int ret = -1;
>>  
>>      uint8_t *host_startaddr = rb->host + start;
>>  
>>      if (!QEMU_PTR_IS_ALIGNED(host_startaddr, rb->page_size)) {
>> -        error_report("ram_block_discard_range: Unaligned start address: %p",
>> +        error_report("__ram_block_discard_range: Unaligned start address: %p",
>>                       host_startaddr);
>>          goto err;
>>      }
>> @@ -3864,11 +3867,16 @@ int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length)
>>      if ((start + length) <= rb->used_length) {
>>          bool need_madvise, need_fallocate;
>>          if (!QEMU_IS_ALIGNED(length, rb->page_size)) {
>> -            error_report("ram_block_discard_range: Unaligned length: %zx",
>> +            error_report("__ram_block_discard_range: Unaligned length: %zx",
>>                           length);
>>              goto err;
>>          }
>>  
>> +        if (do_mprotect && qemu_mprotect_none(host_startaddr, length) < 0) {
>> +            ret = -errno;
>> +            goto err;
>> +        }
>> +
>>          errno = ENOTSUP; /* If we are missing MADVISE etc */
>>  
>>          /* The logic here is messy;
>> @@ -3887,15 +3895,15 @@ int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length)
>>                              start, length);
>>              if (ret) {
>>                  ret = -errno;
>> -                error_report("ram_block_discard_range: Failed to fallocate "
>> +                error_report("__ram_block_discard_range: Failed to fallocate "
>>                               "%s:%" PRIx64 " +%zx (%d)",
>>                               rb->idstr, start, length, ret);
>>                  goto err;
>>              }
>>  #else
>>              ret = -ENOSYS;
>> -            error_report("ram_block_discard_range: fallocate not available/file"
>> -                         "%s:%" PRIx64 " +%zx (%d)",
>> +            error_report("__ram_block_discard_range: fallocate not "
>> +                         "available/file %s:%" PRIx64 " +%zx (%d)",
>>                           rb->idstr, start, length, ret);
>>              goto err;
>>  #endif
>> @@ -3910,14 +3918,14 @@ int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length)
>>              ret =  madvise(host_startaddr, length, MADV_DONTNEED);
>>              if (ret) {
>>                  ret = -errno;
>> -                error_report("ram_block_discard_range: Failed to discard range "
>> -                             "%s:%" PRIx64 " +%zx (%d)",
>> +                error_report("__ram_block_discard_range: Failed to discard "
>> +                             "range %s:%" PRIx64 " +%zx (%d)",
>>                               rb->idstr, start, length, ret);
>>                  goto err;
>>              }
>>  #else
>>              ret = -ENOSYS;
>> -            error_report("ram_block_discard_range: MADVISE not available"
>> +            error_report("__ram_block_discard_range: MADVISE not available "
>>                           "%s:%" PRIx64 " +%zx (%d)",
>>                           rb->idstr, start, length, ret);
>>              goto err;
>> @@ -3926,7 +3934,7 @@ int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length)
>>          trace_ram_block_discard_range(rb->idstr, host_startaddr, length,
>>                                        need_madvise, need_fallocate, ret);
>>      } else {
>> -        error_report("ram_block_discard_range: Overrun block '%s' (%" PRIu64
>> +        error_report("__ram_block_discard_range: Overrun block '%s' (%" PRIu64
>>                       "/%zx/" RAM_ADDR_FMT")",
>>                       rb->idstr, start, length, rb->used_length);
>>      }
>> @@ -3935,6 +3943,11 @@ err:
>>      return ret;
>>  }
>>  
>> +int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length)
>> +{
>> +    return __ram_block_discard_range(rb, start, length, false);
>> +}
>> +
>>  bool ramblock_is_pmem(RAMBlock *rb)
>>  {
>>      return rb->flags & RAM_PMEM;
>> diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
>> index a4729f7..77c0c4b 100644
>> --- a/hw/virtio/virtio-balloon.c
>> +++ b/hw/virtio/virtio-balloon.c
>> @@ -81,7 +81,8 @@ static void balloon_inflate_page(VirtIOBalloon *balloon,
>>      if (rb_page_size == BALLOON_PAGE_SIZE) {
>>          /* Easy case */
>>  
>> -        ram_block_discard_range(rb, rb_offset, rb_page_size);
>> +        __ram_block_discard_range(rb, rb_offset, rb_page_size,
>> +                                  balloon->do_mprotect);
>>          /* We ignore errors from ram_block_discard_range(), because it
>>           * has already reported them, and failing to discard a balloon
>>           * page is not fatal */
>> @@ -120,8 +121,9 @@ static void balloon_inflate_page(VirtIOBalloon *balloon,
>>          /* We've accumulated a full host page, we can actually discard
>>           * it now */
>>  
>> -        ram_block_discard_range(rb, rb_aligned_offset, rb_page_size);
>> -        /* We ignore errors from ram_block_discard_range(), because it
>> +        __ram_block_discard_range(rb, rb_aligned_offset, rb_page_size,
>> +                                  balloon->do_mprotect);
>> +        /* We ignore errors from __ram_block_discard_range(), because it
>>           * has already reported them, and failing to discard a balloon
>>           * page is not fatal */
>>          virtio_balloon_pbp_free(pbp);
>> @@ -145,6 +147,9 @@ static void balloon_deflate_page(VirtIOBalloon *balloon,
>>  
>>      host_addr = (void *)((uintptr_t)addr & ~(rb_page_size - 1));
>>  
>> +    if (balloon->do_mprotect)
>> +        g_assert(qemu_mprotect_rw(host_addr, rb_page_size) == 0);
>> +
>>      /* When a page is deflated, we hint the whole host page it lives
>>       * on, since we can't do anything smaller */
>>      ret = qemu_madvise(host_addr, rb_page_size, QEMU_MADV_WILLNEED);
>> @@ -780,6 +785,14 @@ static void virtio_balloon_device_realize(DeviceState *dev, Error **errp)
>>      virtio_init(vdev, "virtio-balloon", VIRTIO_ID_BALLOON,
>>                  virtio_balloon_config_size(s));
>>  
>> +    if (s->do_mprotect
>> +        && virtio_has_feature(s->host_features,
>> +                              VIRTIO_BALLOON_F_FREE_PAGE_HINT)) {
>> +        error_setg(errp, "mprotect and free-page-hint cannot work together");
>> +        virtio_cleanup(vdev);
>> +        return;
>> +    }
>> +
>>      ret = qemu_add_balloon_handler(virtio_balloon_to_target,
>>                                     virtio_balloon_stat, s);
>>  
>> @@ -924,6 +937,7 @@ static Property virtio_balloon_properties[] = {
>>                       qemu_4_0_config_size, false),
>>      DEFINE_PROP_LINK("iothread", VirtIOBalloon, iothread, TYPE_IOTHREAD,
>>                       IOThread *),
>> +    DEFINE_PROP_BOOL("mprotect", VirtIOBalloon, do_mprotect, false),
>>      DEFINE_PROP_END_OF_LIST(),
>>  };
>>  
>> diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
>> index b47e563..ffeb4a6 100644
>> --- a/include/exec/cpu-common.h
>> +++ b/include/exec/cpu-common.h
>> @@ -104,6 +104,8 @@ typedef int (RAMBlockIterFunc)(RAMBlock *rb, void *opaque);
>>  
>>  int qemu_ram_foreach_block(RAMBlockIterFunc func, void *opaque);
>>  int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length);
>> +int __ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length,
>> +                              bool do_mprotect);
>>  
>>  #endif
>>  
>> diff --git a/include/hw/virtio/virtio-balloon.h b/include/hw/virtio/virtio-balloon.h
>> index d1c968d..6f15085 100644
>> --- a/include/hw/virtio/virtio-balloon.h
>> +++ b/include/hw/virtio/virtio-balloon.h
>> @@ -70,6 +70,8 @@ typedef struct VirtIOBalloon {
>>      uint32_t host_features;
>>  
>>      bool qemu_4_0_config_size;
>> +
>> +    bool do_mprotect;
>>  } VirtIOBalloon;
>>  
>>  #endif
>> diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
>> index 9bd3dcf..1bcb4e4 100644
>> --- a/include/qemu/osdep.h
>> +++ b/include/qemu/osdep.h
>> @@ -458,6 +458,7 @@ void sigaction_invoke(struct sigaction *action,
>>  
>>  int qemu_madvise(void *addr, size_t len, int advice);
>>  int qemu_mprotect_rwx(void *addr, size_t size);
>> +int qemu_mprotect_rw(void *addr, size_t size);
>>  int qemu_mprotect_none(void *addr, size_t size);
>>  
>>  int qemu_open(const char *name, int flags, ...);
>> diff --git a/util/osdep.c b/util/osdep.c
>> index 4829c07..2aff13b 100644
>> --- a/util/osdep.c
>> +++ b/util/osdep.c
>> @@ -105,6 +105,15 @@ int qemu_mprotect_rwx(void *addr, size_t size)
>>  #endif
>>  }
>>  
>> +int qemu_mprotect_rw(void *addr, size_t size)
>> +{
>> +#ifdef _WIN32
>> +    return qemu_mprotect__osdep(addr, size, PAGE_EXECUTE_READWRITE);
>> +#else
>> +    return qemu_mprotect__osdep(addr, size, PROT_READ | PROT_WRITE);
>> +#endif
>> +}
>> +
>>  int qemu_mprotect_none(void *addr, size_t size)
>>  {
>>  #ifdef _WIN32
> 


-- 
Thanks,

David / dhildenb


Re: [PATCH] virtio_balloon: Add option mprotect to handle guest kernel cheat issue
Posted by no-reply@patchew.org 5 years, 8 months ago
Patchew URL: https://patchew.org/QEMU/1584010572-10308-1-git-send-email-teawater@gmail.com/



Hi,

This series seems to have some coding style problems. See output below for
more information:

Subject: [PATCH] virtio_balloon: Add option mprotect to handle guest kernel cheat issue
Message-id: 1584010572-10308-1-git-send-email-teawater@gmail.com
Type: series

=== TEST SCRIPT BEGIN ===
#!/bin/bash
git rev-parse base > /dev/null || exit 0
git config --local diff.renamelimit 0
git config --local diff.renames True
git config --local diff.algorithm histogram
./scripts/checkpatch.pl --mailback base..
=== TEST SCRIPT END ===

From https://github.com/patchew-project/qemu
   6e8a73e..5931ed5  master     -> master
Switched to a new branch 'test'
4528326 virtio_balloon: Add option mprotect to handle guest kernel cheat issue

=== OUTPUT BEGIN ===
WARNING: Block comments use a leading /* on a separate line
#224: FILE: hw/virtio/virtio-balloon.c:126:
+        /* We ignore errors from __ram_block_discard_range(), because it

ERROR: braces {} are necessary for all arms of this statement
#232: FILE: hw/virtio/virtio-balloon.c:150:
+    if (balloon->do_mprotect)
[...]

total: 1 errors, 1 warnings, 181 lines checked

Commit 4528326453b1 (virtio_balloon: Add option mprotect to handle guest kernel cheat issue) has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.
=== OUTPUT END ===

Test command exited with code: 1


The full log is available at
http://patchew.org/logs/1584010572-10308-1-git-send-email-teawater@gmail.com/testing.checkpatch/?type=message.
---
Email generated automatically by Patchew [https://patchew.org/].
Please send your feedback to patchew-devel@redhat.com
Re: [PATCH] virtio_balloon: Add option mprotect to handle guest kernel cheat issue
Posted by no-reply@patchew.org 5 years, 8 months ago
Patchew URL: https://patchew.org/QEMU/1584010572-10308-1-git-send-email-teawater@gmail.com/



Hi,

This series failed the asan build test. Please find the testing commands and
their output below. If you have Docker installed, you can probably reproduce it
locally.

=== TEST SCRIPT BEGIN ===
#!/bin/bash
export ARCH=x86_64
make docker-image-fedora V=1 NETWORK=1
time make docker-test-debug@fedora TARGET_LIST=x86_64-softmmu J=14 NETWORK=1
=== TEST SCRIPT END ===

PASS 1 fdc-test /x86_64/fdc/cmos
PASS 2 fdc-test /x86_64/fdc/no_media_on_start
PASS 3 fdc-test /x86_64/fdc/read_without_media
==11645==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 4 fdc-test /x86_64/fdc/media_change
PASS 5 fdc-test /x86_64/fdc/sense_interrupt
PASS 6 fdc-test /x86_64/fdc/relative_seek
---
PASS 33 test-opts-visitor /visitor/opts/dict/unvisited
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-coroutine -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-coroutine" 
PASS 11 fdc-test /x86_64/fdc/read_no_dma_18
==11703==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==11703==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7ffe24e26000; bottom 0x7f3bc3ecb000; size: 0x00c260f5b000 (834850369536)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 1 test-coroutine /basic/no-dangling-access
---
PASS 11 test-aio /aio/event/wait
PASS 12 test-aio /aio/event/flush
PASS 13 test-aio /aio/event/wait/no-flush-cb
==11718==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 14 test-aio /aio/timer/schedule
PASS 15 test-aio /aio/coroutine/queue-chaining
PASS 16 test-aio /aio-gsource/flush
---
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  QTEST_QEMU_BINARY=x86_64-softmmu/qemu-system-x86_64 QTEST_QEMU_IMG=qemu-img tests/qtest/ide-test -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="ide-test" 
PASS 28 test-aio /aio-gsource/timer/schedule
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-aio-multithread -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-aio-multithread" 
==11726==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 1 ide-test /x86_64/ide/identify
==11732==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 1 test-aio-multithread /aio/multi/lifecycle
==11735==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 2 ide-test /x86_64/ide/flush
PASS 2 test-aio-multithread /aio/multi/schedule
==11752==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 3 ide-test /x86_64/ide/bmdma/simple_rw
==11763==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 3 test-aio-multithread /aio/multi/mutex/contended
PASS 4 ide-test /x86_64/ide/bmdma/trim
==11774==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 4 test-aio-multithread /aio/multi/mutex/handoff
PASS 5 test-aio-multithread /aio/multi/mutex/mcs
PASS 6 test-aio-multithread /aio/multi/mutex/pthread
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-throttle -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-throttle" 
==11791==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 1 test-throttle /throttle/leak_bucket
PASS 2 test-throttle /throttle/compute_wait
PASS 3 test-throttle /throttle/init
---
PASS 14 test-throttle /throttle/config/max
PASS 15 test-throttle /throttle/config/iops_size
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-thread-pool -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-thread-pool" 
==11795==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 1 test-thread-pool /thread-pool/submit
PASS 2 test-thread-pool /thread-pool/submit-aio
PASS 3 test-thread-pool /thread-pool/submit-co
PASS 4 test-thread-pool /thread-pool/submit-many
==11862==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 5 test-thread-pool /thread-pool/cancel
PASS 6 test-thread-pool /thread-pool/cancel-async
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-hbitmap -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-hbitmap" 
---
PASS 28 test-hbitmap /hbitmap/truncate/shrink/medium
PASS 29 test-hbitmap /hbitmap/truncate/shrink/large
PASS 30 test-hbitmap /hbitmap/meta/zero
==11872==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 31 test-hbitmap /hbitmap/meta/one
PASS 32 test-hbitmap /hbitmap/meta/byte
PASS 33 test-hbitmap /hbitmap/meta/word
==11878==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 34 test-hbitmap /hbitmap/meta/sector
PASS 35 test-hbitmap /hbitmap/serialize/align
PASS 36 test-hbitmap /hbitmap/serialize/basic
---
PASS 44 test-hbitmap /hbitmap/next_dirty_area/next_dirty_area_4
PASS 45 test-hbitmap /hbitmap/next_dirty_area/next_dirty_area_after_truncate
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-bdrv-drain -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-bdrv-drain" 
==11885==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 1 test-bdrv-drain /bdrv-drain/nested
PASS 2 test-bdrv-drain /bdrv-drain/multiparent
PASS 3 test-bdrv-drain /bdrv-drain/set_aio_context
---
PASS 41 test-bdrv-drain /bdrv-drain/bdrv_drop_intermediate/poll
PASS 42 test-bdrv-drain /bdrv-drain/replace_child/mid-drain
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-bdrv-graph-mod -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-bdrv-graph-mod" 
==11924==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 1 test-bdrv-graph-mod /bdrv-graph-mod/update-perm-tree
PASS 2 test-bdrv-graph-mod /bdrv-graph-mod/should-update-child
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-blockjob -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-blockjob" 
==11928==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 1 test-blockjob /blockjob/ids
PASS 2 test-blockjob /blockjob/cancel/created
PASS 3 test-blockjob /blockjob/cancel/running
---
PASS 7 test-blockjob /blockjob/cancel/pending
PASS 8 test-blockjob /blockjob/cancel/concluded
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-blockjob-txn -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-blockjob-txn" 
==11932==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 1 test-blockjob-txn /single/success
PASS 2 test-blockjob-txn /single/failure
PASS 3 test-blockjob-txn /single/cancel
---
PASS 6 test-blockjob-txn /pair/cancel
PASS 7 test-blockjob-txn /pair/fail-cancel-race
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-block-backend -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-block-backend" 
==11936==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 1 test-block-backend /block-backend/drain_aio_error
PASS 2 test-block-backend /block-backend/drain_all_aio_error
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-block-iothread -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-block-iothread" 
==11940==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 1 test-block-iothread /sync-op/pread
PASS 2 test-block-iothread /sync-op/pwrite
PASS 3 test-block-iothread /sync-op/load_vmstate
---
PASS 15 test-block-iothread /propagate/diamond
PASS 16 test-block-iothread /propagate/mirror
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-image-locking -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-image-locking" 
==11962==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 1 test-image-locking /image-locking/basic
PASS 2 test-image-locking /image-locking/set-perm-abort
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-x86-cpuid -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-x86-cpuid" 
PASS 1 test-x86-cpuid /cpuid/topology/basic
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-xbzrle -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-xbzrle" 
==11959==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 1 test-xbzrle /xbzrle/uleb
PASS 2 test-xbzrle /xbzrle/encode_decode_zero
PASS 3 test-xbzrle /xbzrle/encode_decode_unchanged
---
PASS 2 rcutorture /rcu/torture/10readers
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-rcu-list -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-rcu-list" 
PASS 1 test-rcu-list /rcu/qlist/single-threaded
==12030==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 2 test-rcu-list /rcu/qlist/short-few
PASS 3 test-rcu-list /rcu/qlist/long-many
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-rcu-simpleq -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-rcu-simpleq" 
PASS 1 test-rcu-simpleq /rcu/qsimpleq/single-threaded
PASS 2 test-rcu-simpleq /rcu/qsimpleq/short-few
==12090==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 3 test-rcu-simpleq /rcu/qsimpleq/long-many
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-rcu-tailq -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-rcu-tailq" 
PASS 1 test-rcu-tailq /rcu/qtailq/single-threaded
PASS 2 test-rcu-tailq /rcu/qtailq/short-few
PASS 3 test-rcu-tailq /rcu/qtailq/long-many
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-rcu-slist -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-rcu-slist" 
==12129==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 1 test-rcu-slist /rcu/qslist/single-threaded
PASS 2 test-rcu-slist /rcu/qslist/short-few
PASS 3 test-rcu-slist /rcu/qslist/long-many
---
PASS 7 test-qdist /qdist/binning/expand
PASS 8 test-qdist /qdist/binning/shrink
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-qht -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-qht" 
==12175==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 5 ide-test /x86_64/ide/bmdma/various_prdts
==12181==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==12181==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7ffe3f88c000; bottom 0x7f56581fe000; size: 0x00a7e768e000 (721141948416)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 6 ide-test /x86_64/ide/bmdma/no_busmaster
PASS 7 ide-test /x86_64/ide/flush/nodev
==12192==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 8 ide-test /x86_64/ide/flush/empty_drive
==12197==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 9 ide-test /x86_64/ide/flush/retry_pci
==12203==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 10 ide-test /x86_64/ide/flush/retry_isa
==12209==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 11 ide-test /x86_64/ide/cdrom/pio
==12215==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 12 ide-test /x86_64/ide/cdrom/pio_large
==12221==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 13 ide-test /x86_64/ide/cdrom/dma
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  QTEST_QEMU_BINARY=x86_64-softmmu/qemu-system-x86_64 QTEST_QEMU_IMG=qemu-img tests/qtest/ahci-test -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="ahci-test" 
==12235==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 1 ahci-test /x86_64/ahci/sanity
==12241==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 1 test-qht /qht/mode/default
PASS 2 ahci-test /x86_64/ahci/pci_spec
PASS 2 test-qht /qht/mode/resize
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-qht-par -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-qht-par" 
==12247==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 3 ahci-test /x86_64/ahci/pci_enable
==12262==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 1 test-qht-par /qht/parallel/2threads-0%updates-1s
PASS 4 ahci-test /x86_64/ahci/hba_spec
==12274==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 5 ahci-test /x86_64/ahci/hba_enable
PASS 2 test-qht-par /qht/parallel/2threads-20%updates-1s
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-bitops -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-bitops" 
==12280==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 1 test-bitops /bitops/sextract32
PASS 2 test-bitops /bitops/sextract64
PASS 3 test-bitops /bitops/half_shuffle32
---
PASS 8 check-qom-proplist /qom/proplist/delchild
PASS 9 check-qom-proplist /qom/resolve/partial
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-qemu-opts -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-qemu-opts" 
==12305==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 1 test-qemu-opts /qemu-opts/find_unknown_opts
PASS 2 test-qemu-opts /qemu-opts/find_opts
PASS 3 test-qemu-opts /qemu-opts/opts_create
---
PASS 4 test-crypto-hash /crypto/hash/digest
PASS 5 test-crypto-hash /crypto/hash/base64
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-crypto-hmac -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-crypto-hmac" 
==12331==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 1 test-crypto-hmac /crypto/hmac/iov
PASS 2 test-crypto-hmac /crypto/hmac/alloc
PASS 3 test-crypto-hmac /crypto/hmac/prealloc
---
PASS 16 test-crypto-secret /crypto/secret/crypt/badiv
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-crypto-tlscredsx509 -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-crypto-tlscredsx509" 
PASS 8 ahci-test /x86_64/ahci/reset
==12358==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==12358==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7ffedf707000; bottom 0x7fb4131fe000; size: 0x004acc509000 (321255411712)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 9 ahci-test /x86_64/ahci/io/pio/lba28/simple/zero
PASS 1 test-crypto-tlscredsx509 /qcrypto/tlscredsx509/perfectserver
PASS 2 test-crypto-tlscredsx509 /qcrypto/tlscredsx509/perfectclient
==12364==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==12364==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7fff0999d000; bottom 0x7fb5cddfe000; size: 0x00493bb9f000 (314534653952)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 10 ahci-test /x86_64/ahci/io/pio/lba28/simple/low
==12370==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==12370==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7ffd3e722000; bottom 0x7f7f3f9fe000; size: 0x007dfed24000 (541146103808)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 11 ahci-test /x86_64/ahci/io/pio/lba28/simple/high
==12376==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==12376==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7fff2e691000; bottom 0x7f0717dfe000; size: 0x00f816893000 (1065529978880)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 3 test-crypto-tlscredsx509 /qcrypto/tlscredsx509/goodca1
PASS 12 ahci-test /x86_64/ahci/io/pio/lba28/double/zero
==12382==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 4 test-crypto-tlscredsx509 /qcrypto/tlscredsx509/goodca2
==12382==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7ffca4547000; bottom 0x7fd96c7fe000; size: 0x002337d49000 (151260532736)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 13 ahci-test /x86_64/ahci/io/pio/lba28/double/low
---
PASS 7 test-crypto-tlscredsx509 /qcrypto/tlscredsx509/badca2
PASS 8 test-crypto-tlscredsx509 /qcrypto/tlscredsx509/badca3
PASS 9 test-crypto-tlscredsx509 /qcrypto/tlscredsx509/goodserver1
==12388==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==12388==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7ffdbda45000; bottom 0x7f4caa1fe000; size: 0x00b113847000 (760536657920)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 14 ahci-test /x86_64/ahci/io/pio/lba28/double/high
==12394==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 10 test-crypto-tlscredsx509 /qcrypto/tlscredsx509/goodserver2
==12394==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7ffc49820000; bottom 0x7f7700ffe000; size: 0x008548822000 (572447137792)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 11 test-crypto-tlscredsx509 /qcrypto/tlscredsx509/goodserver3
PASS 15 ahci-test /x86_64/ahci/io/pio/lba28/long/zero
==12400==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==12400==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7fff75e63000; bottom 0x7feea8b24000; size: 0x0010cd33f000 (72162209792)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 16 ahci-test /x86_64/ahci/io/pio/lba28/long/low
==12406==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 12 test-crypto-tlscredsx509 /qcrypto/tlscredsx509/goodserver4
==12406==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7ffd11c4b000; bottom 0x7f34c41fe000; size: 0x00c84da4d000 (860296105984)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 17 ahci-test /x86_64/ahci/io/pio/lba28/long/high
==12412==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 13 test-crypto-tlscredsx509 /qcrypto/tlscredsx509/goodserver5
PASS 18 ahci-test /x86_64/ahci/io/pio/lba28/short/zero
==12418==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 14 test-crypto-tlscredsx509 /qcrypto/tlscredsx509/goodserver6
PASS 19 ahci-test /x86_64/ahci/io/pio/lba28/short/low
PASS 15 test-crypto-tlscredsx509 /qcrypto/tlscredsx509/goodserver7
---
PASS 32 test-crypto-tlscredsx509 /qcrypto/tlscredsx509/inactive1
PASS 33 test-crypto-tlscredsx509 /qcrypto/tlscredsx509/inactive2
PASS 34 test-crypto-tlscredsx509 /qcrypto/tlscredsx509/inactive3
==12424==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 20 ahci-test /x86_64/ahci/io/pio/lba28/short/high
PASS 35 test-crypto-tlscredsx509 /qcrypto/tlscredsx509/chain1
PASS 36 test-crypto-tlscredsx509 /qcrypto/tlscredsx509/chain2
---
PASS 38 test-crypto-tlscredsx509 /qcrypto/tlscredsx509/missingserver
PASS 39 test-crypto-tlscredsx509 /qcrypto/tlscredsx509/missingclient
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-crypto-tlssession -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-crypto-tlssession" 
==12430==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==12430==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7ffce00a9000; bottom 0x7fa2a03fe000; size: 0x005a3fcab000 (387617304576)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 21 ahci-test /x86_64/ahci/io/pio/lba48/simple/zero
PASS 1 test-crypto-tlssession /qcrypto/tlssession/psk
==12440==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==12440==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7ffd294a2000; bottom 0x7f02dddfe000; size: 0x00fa4b6a4000 (1075007078400)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 22 ahci-test /x86_64/ahci/io/pio/lba48/simple/low
PASS 2 test-crypto-tlssession /qcrypto/tlssession/basicca
PASS 3 test-crypto-tlssession /qcrypto/tlssession/differentca
==12446==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==12446==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7ffc9c488000; bottom 0x7fde0bffe000; size: 0x001e9048a000 (131269697536)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 23 ahci-test /x86_64/ahci/io/pio/lba48/simple/high
==12452==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==12452==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7ffd458a0000; bottom 0x7f3e113fe000; size: 0x00bf344a2000 (821216026624)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 24 ahci-test /x86_64/ahci/io/pio/lba48/double/zero
==12458==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 4 test-crypto-tlssession /qcrypto/tlssession/altname1
==12458==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7fff400cc000; bottom 0x7f0fbbdfe000; size: 0x00ef842ce000 (1028714717184)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 25 ahci-test /x86_64/ahci/io/pio/lba48/double/low
PASS 5 test-crypto-tlssession /qcrypto/tlssession/altname2
==12464==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 6 test-crypto-tlssession /qcrypto/tlssession/altname3
==12464==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7ffe42ae9000; bottom 0x7f055c9fe000; size: 0x00f8e60eb000 (1069011611648)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 26 ahci-test /x86_64/ahci/io/pio/lba48/double/high
==12470==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 7 test-crypto-tlssession /qcrypto/tlssession/altname4
==12470==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7ffc6a107000; bottom 0x7f06f7f7c000; size: 0x00f57218b000 (1054181208064)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 27 ahci-test /x86_64/ahci/io/pio/lba48/long/zero
==12476==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==12476==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7ffdda1c1000; bottom 0x7f068117c000; size: 0x00f759045000 (1062350376960)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 28 ahci-test /x86_64/ahci/io/pio/lba48/long/low
==12482==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==12482==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7ffe838c1000; bottom 0x7fec87324000; size: 0x0011fc59d000 (77248188416)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 8 test-crypto-tlssession /qcrypto/tlssession/altname5
PASS 29 ahci-test /x86_64/ahci/io/pio/lba48/long/high
==12488==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 30 ahci-test /x86_64/ahci/io/pio/lba48/short/zero
==12494==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 31 ahci-test /x86_64/ahci/io/pio/lba48/short/low
PASS 9 test-crypto-tlssession /qcrypto/tlssession/altname6
==12500==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 32 ahci-test /x86_64/ahci/io/pio/lba48/short/high
PASS 10 test-crypto-tlssession /qcrypto/tlssession/wildcard1
==12506==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 11 test-crypto-tlssession /qcrypto/tlssession/wildcard2
PASS 33 ahci-test /x86_64/ahci/io/dma/lba28/fragmented
PASS 12 test-crypto-tlssession /qcrypto/tlssession/wildcard3
==12512==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 13 test-crypto-tlssession /qcrypto/tlssession/wildcard4
PASS 34 ahci-test /x86_64/ahci/io/dma/lba28/retry
==12518==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 14 test-crypto-tlssession /qcrypto/tlssession/wildcard5
PASS 15 test-crypto-tlssession /qcrypto/tlssession/wildcard6
PASS 16 test-crypto-tlssession /qcrypto/tlssession/cachain
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-qga -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-qga" 
PASS 35 ahci-test /x86_64/ahci/io/dma/lba28/simple/zero
==12532==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 1 test-qga /qga/sync-delimited
PASS 2 test-qga /qga/sync
PASS 3 test-qga /qga/ping
---
PASS 16 test-qga /qga/invalid-args
PASS 17 test-qga /qga/fsfreeze-status
PASS 36 ahci-test /x86_64/ahci/io/dma/lba28/simple/low
==12540==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 37 ahci-test /x86_64/ahci/io/dma/lba28/simple/high
PASS 18 test-qga /qga/blacklist
PASS 19 test-qga /qga/config
PASS 20 test-qga /qga/guest-exec
PASS 21 test-qga /qga/guest-exec-invalid
==12547==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 38 ahci-test /x86_64/ahci/io/dma/lba28/double/zero
==12565==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 22 test-qga /qga/guest-get-osinfo
PASS 23 test-qga /qga/guest-get-host-name
PASS 24 test-qga /qga/guest-get-timezone
---
PASS 7 test-util-sockets /socket/fd-pass/num/bad
PASS 8 test-util-sockets /socket/fd-pass/num/nocli
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-authz-simple -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-authz-simple" 
==12584==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 1 test-authz-simple /authz/simple
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-authz-list -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-authz-list" 
PASS 1 test-authz-list /auth/list/complex
---
PASS 4 test-io-channel-socket /io/channel/socket/ipv6-sync
PASS 5 test-io-channel-socket /io/channel/socket/ipv6-async
PASS 6 test-io-channel-socket /io/channel/socket/unix-sync
==12603==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 7 test-io-channel-socket /io/channel/socket/unix-async
PASS 8 test-io-channel-socket /io/channel/socket/unix-fd-pass
PASS 9 test-io-channel-socket /io/channel/socket/unix-listen-cleanup
---
PASS 4 test-io-channel-file /io/channel/pipe/sync
PASS 5 test-io-channel-file /io/channel/pipe/async
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-io-channel-tls -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-io-channel-tls" 
==12603==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7ffd237d8000; bottom 0x7fcfddb23000; size: 0x002d45cb5000 (194444480512)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 41 ahci-test /x86_64/ahci/io/dma/lba28/long/zero
==12668==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 1 test-io-channel-tls /qio/channel/tls/basic
==12668==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7ffe54c42000; bottom 0x7f72671fd000; size: 0x008beda45000 (600987422720)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-io-channel-command -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-io-channel-command" 
---
PASS 8 test-crypto-ivgen /crypto/ivgen/essiv/1f2e3d4c
PASS 9 test-crypto-ivgen /crypto/ivgen/essiv/1f2e3d4c5b6a7988
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-crypto-afsplit -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-crypto-afsplit" 
==12683==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 1 test-crypto-afsplit /crypto/afsplit/sha256/5
PASS 2 test-crypto-afsplit /crypto/afsplit/sha256/5000
PASS 3 test-crypto-afsplit /crypto/afsplit/sha256/big
---
PASS 17 test-crypto-xts /crypto/xts/t-21-key-32-ptx-31/basic
PASS 18 test-crypto-xts /crypto/xts/t-21-key-32-ptx-31/unaligned
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-crypto-block -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-crypto-block" 
==12683==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7ffe28320000; bottom 0x7f2fea1fd000; size: 0x00ce3e123000 (885804642304)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 43 ahci-test /x86_64/ahci/io/dma/lba28/long/high
---
PASS 3 test-logging /logging/logfile_write_path
PASS 4 test-logging /logging/logfile_lock_path
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-replication -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-replication" 
==12724==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==12717==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 1 test-replication /replication/primary/read
PASS 44 ahci-test /x86_64/ahci/io/dma/lba28/short/zero
PASS 2 test-replication /replication/primary/write
==12732==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 3 test-replication /replication/primary/start
PASS 4 test-replication /replication/primary/stop
PASS 5 test-replication /replication/primary/do_checkpoint
PASS 45 ahci-test /x86_64/ahci/io/dma/lba28/short/low
PASS 6 test-replication /replication/primary/get_error_all
==12738==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 7 test-replication /replication/secondary/read
PASS 46 ahci-test /x86_64/ahci/io/dma/lba28/short/high
==12744==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 8 test-replication /replication/secondary/write
PASS 47 ahci-test /x86_64/ahci/io/dma/lba48/simple/zero
==12750==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 48 ahci-test /x86_64/ahci/io/dma/lba48/simple/low
==12756==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 49 ahci-test /x86_64/ahci/io/dma/lba48/simple/high
==12763==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==12724==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7ffe2cb2a000; bottom 0x7fa8f8853000; size: 0x0055342d7000 (365947613184)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 9 test-replication /replication/secondary/start
PASS 50 ahci-test /x86_64/ahci/io/dma/lba48/double/zero
==12786==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 51 ahci-test /x86_64/ahci/io/dma/lba48/double/low
==12792==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 52 ahci-test /x86_64/ahci/io/dma/lba48/double/high
==12798==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==12798==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7fff8052e000; bottom 0x7f330e37b000; size: 0x00cc721b3000 (878087712768)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 53 ahci-test /x86_64/ahci/io/dma/lba48/long/zero
PASS 10 test-replication /replication/secondary/stop
==12805==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==12805==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7ffe9ab95000; bottom 0x7f00f8323000; size: 0x00fda2872000 (1089353490432)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 54 ahci-test /x86_64/ahci/io/dma/lba48/long/low
==12812==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==12812==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7ffdd8f51000; bottom 0x7fa0899fd000; size: 0x005d4f554000 (400762945536)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 55 ahci-test /x86_64/ahci/io/dma/lba48/long/high
==12819==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 11 test-replication /replication/secondary/continuous_replication
PASS 56 ahci-test /x86_64/ahci/io/dma/lba48/short/zero
==12825==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 57 ahci-test /x86_64/ahci/io/dma/lba48/short/low
==12831==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 58 ahci-test /x86_64/ahci/io/dma/lba48/short/high
PASS 12 test-replication /replication/secondary/do_checkpoint
==12837==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 59 ahci-test /x86_64/ahci/io/ncq/simple
==12843==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 13 test-replication /replication/secondary/get_error_all
PASS 60 ahci-test /x86_64/ahci/io/ncq/retry
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-bufferiszero -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-bufferiszero" 
==12849==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 61 ahci-test /x86_64/ahci/flush/simple
==12858==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 62 ahci-test /x86_64/ahci/flush/retry
==12864==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==12870==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 63 ahci-test /x86_64/ahci/flush/migrate
==12878==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==12884==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 64 ahci-test /x86_64/ahci/migrate/sanity
==12892==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==12898==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 65 ahci-test /x86_64/ahci/migrate/dma/simple
==12906==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==12912==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 66 ahci-test /x86_64/ahci/migrate/dma/halted
==12920==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==12926==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 67 ahci-test /x86_64/ahci/migrate/ncq/simple
==12934==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==12940==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 68 ahci-test /x86_64/ahci/migrate/ncq/halted
==12948==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 69 ahci-test /x86_64/ahci/cdrom/eject
==12953==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 70 ahci-test /x86_64/ahci/cdrom/dma/single
==12959==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 71 ahci-test /x86_64/ahci/cdrom/dma/multi
==12965==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 72 ahci-test /x86_64/ahci/cdrom/pio/single
==12971==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==12971==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7fffcae1d000; bottom 0x7ffa2fdfe000; size: 0x00059b01f000 (24075431936)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
PASS 73 ahci-test /x86_64/ahci/cdrom/pio/multi
==12977==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 74 ahci-test /x86_64/ahci/cdrom/pio/bcl
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  QTEST_QEMU_BINARY=x86_64-softmmu/qemu-system-x86_64 QTEST_QEMU_IMG=qemu-img tests/qtest/hd-geo-test -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="hd-geo-test" 
PASS 1 hd-geo-test /x86_64/hd-geo/ide/none
==12991==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 2 hd-geo-test /x86_64/hd-geo/ide/drive/cd_0
==12997==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 3 hd-geo-test /x86_64/hd-geo/ide/drive/mbr/blank
==13003==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 4 hd-geo-test /x86_64/hd-geo/ide/drive/mbr/lba
==13009==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 5 hd-geo-test /x86_64/hd-geo/ide/drive/mbr/chs
==13015==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 6 hd-geo-test /x86_64/hd-geo/ide/device/mbr/blank
==13021==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 7 hd-geo-test /x86_64/hd-geo/ide/device/mbr/lba
==13027==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 8 hd-geo-test /x86_64/hd-geo/ide/device/mbr/chs
==13033==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 9 hd-geo-test /x86_64/hd-geo/ide/device/user/chs
==13038==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 10 hd-geo-test /x86_64/hd-geo/ide/device/user/chst
==13044==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13048==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13052==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13056==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 1 test-bufferiszero /cutils/bufferiszero
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-uuid -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-uuid" 
==13060==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 1 test-uuid /uuid/is_null
PASS 2 test-uuid /uuid/generate
PASS 3 test-uuid /uuid/parse
PASS 4 test-uuid /uuid/unparse
PASS 5 test-uuid /uuid/unparse_strdup
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/ptimer-test -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="ptimer-test" 
==13067==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 1 ptimer-test /ptimer/set_count policy=default
PASS 2 ptimer-test /ptimer/set_limit policy=default
PASS 3 ptimer-test /ptimer/oneshot policy=default
---
PASS 58 ptimer-test /ptimer/oneshot policy=wrap_after_one_period,no_immediate_trigger,
PASS 59 ptimer-test /ptimer/periodic policy=wrap_after_one_period,no_immediate_trigger,
PASS 60 ptimer-test /ptimer/on_the_fly_mode_change policy=wrap_after_one_period,no_immediate_trigger,
==13074==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 61 ptimer-test /ptimer/on_the_fly_period_change policy=wrap_after_one_period,no_immediate_trigger,
PASS 62 ptimer-test /ptimer/on_the_fly_freq_change policy=wrap_after_one_period,no_immediate_trigger,
PASS 63 ptimer-test /ptimer/run_with_period_0 policy=wrap_after_one_period,no_immediate_trigger,
---
PASS 527 ptimer-test /ptimer/periodic_with_load_0 policy=wrap_after_one_period,continuous_trigger,no_immediate_reload,no_counter_rounddown,trigger_only_on_decrement,
PASS 528 ptimer-test /ptimer/oneshot_with_load_0 policy=wrap_after_one_period,continuous_trigger,no_immediate_reload,no_counter_rounddown,trigger_only_on_decrement,
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-qapi-util -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-qapi-util" 
==13078==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 1 test-qapi-util /qapi/util/qapi_enum_parse
PASS 2 test-qapi-util /qapi/util/parse_qapi_name
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  tests/test-qgraph -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="test-qgraph" 
---
PASS 21 test-qgraph /qgraph/test_two_test_same_interface
PASS 22 test-qgraph /qgraph/test_test_in_path
PASS 23 test-qgraph /qgraph/test_double_edge
==13085==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 11 hd-geo-test /x86_64/hd-geo/override/ide
==13095==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13099==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13103==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13107==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13111==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13115==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13119==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13123==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13126==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 12 hd-geo-test /x86_64/hd-geo/override/scsi
==13133==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13137==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13141==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13145==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13149==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13153==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13157==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13161==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13164==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 13 hd-geo-test /x86_64/hd-geo/override/scsi_2_controllers
==13171==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13175==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13179==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13183==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13186==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 14 hd-geo-test /x86_64/hd-geo/override/virtio_blk
==13193==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13197==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13200==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 15 hd-geo-test /x86_64/hd-geo/override/zero_chs
==13207==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13211==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13215==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13219==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13222==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 16 hd-geo-test /x86_64/hd-geo/override/scsi_hot_unplug
==13229==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13233==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13237==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13241==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
==13244==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 17 hd-geo-test /x86_64/hd-geo/override/virtio_hot_unplug
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  QTEST_QEMU_BINARY=x86_64-softmmu/qemu-system-x86_64 QTEST_QEMU_IMG=qemu-img tests/qtest/boot-order-test -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="boot-order-test" 
PASS 1 boot-order-test /x86_64/boot-order/pc
---
Could not access KVM kernel module: No such file or directory
qemu-system-x86_64: -accel kvm: failed to initialize kvm: No such file or directory
qemu-system-x86_64: falling back to tcg
==13313==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!

Looking for expected file 'tests/data/acpi/pc/FACP'
Using expected file 'tests/data/acpi/pc/FACP'
---
Could not access KVM kernel module: No such file or directory
qemu-system-x86_64: -accel kvm: failed to initialize kvm: No such file or directory
qemu-system-x86_64: falling back to tcg
==13319==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!

Looking for expected file 'tests/data/acpi/q35/FACP'
Using expected file 'tests/data/acpi/q35/FACP'
---
Could not access KVM kernel module: No such file or directory
qemu-system-x86_64: -accel kvm: failed to initialize kvm: No such file or directory
qemu-system-x86_64: falling back to tcg
==13325==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!

Looking for expected file 'tests/data/acpi/pc/FACP.bridge'
Looking for expected file 'tests/data/acpi/pc/FACP'
---
Could not access KVM kernel module: No such file or directory
qemu-system-x86_64: -accel kvm: failed to initialize kvm: No such file or directory
qemu-system-x86_64: falling back to tcg
==13331==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!

Looking for expected file 'tests/data/acpi/pc/FACP.ipmikcs'
Looking for expected file 'tests/data/acpi/pc/FACP'
---
Could not access KVM kernel module: No such file or directory
qemu-system-x86_64: -accel kvm: failed to initialize kvm: No such file or directory
qemu-system-x86_64: falling back to tcg
==13337==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!

Looking for expected file 'tests/data/acpi/pc/FACP.cphp'
Looking for expected file 'tests/data/acpi/pc/FACP'
---
Could not access KVM kernel module: No such file or directory
qemu-system-x86_64: -accel kvm: failed to initialize kvm: No such file or directory
qemu-system-x86_64: falling back to tcg
==13344==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!

Looking for expected file 'tests/data/acpi/pc/FACP.memhp'
Looking for expected file 'tests/data/acpi/pc/FACP'
---
Could not access KVM kernel module: No such file or directory
qemu-system-x86_64: -accel kvm: failed to initialize kvm: No such file or directory
qemu-system-x86_64: falling back to tcg
==13350==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!

Looking for expected file 'tests/data/acpi/pc/FACP.numamem'
Looking for expected file 'tests/data/acpi/pc/FACP'
---
Could not access KVM kernel module: No such file or directory
qemu-system-x86_64: -accel kvm: failed to initialize kvm: No such file or directory
qemu-system-x86_64: falling back to tcg
==13356==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!

Looking for expected file 'tests/data/acpi/pc/FACP.dimmpxm'
Looking for expected file 'tests/data/acpi/pc/FACP'
---
Could not access KVM kernel module: No such file or directory
qemu-system-x86_64: -accel kvm: failed to initialize kvm: No such file or directory
qemu-system-x86_64: falling back to tcg
==13365==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!

Looking for expected file 'tests/data/acpi/pc/FACP.acpihmat'
Looking for expected file 'tests/data/acpi/pc/FACP'
---
Could not access KVM kernel module: No such file or directory
qemu-system-x86_64: -accel kvm: failed to initialize kvm: No such file or directory
qemu-system-x86_64: falling back to tcg
==13372==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!

Looking for expected file 'tests/data/acpi/q35/FACP.bridge'
Looking for expected file 'tests/data/acpi/q35/FACP'
---
Could not access KVM kernel module: No such file or directory
qemu-system-x86_64: -accel kvm: failed to initialize kvm: No such file or directory
qemu-system-x86_64: falling back to tcg
==13378==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!

Looking for expected file 'tests/data/acpi/q35/FACP.mmio64'
Looking for expected file 'tests/data/acpi/q35/FACP'
---
Could not access KVM kernel module: No such file or directory
qemu-system-x86_64: -accel kvm: failed to initialize kvm: No such file or directory
qemu-system-x86_64: falling back to tcg
==13384==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!

Looking for expected file 'tests/data/acpi/q35/FACP.ipmibt'
Looking for expected file 'tests/data/acpi/q35/FACP'
---
Could not access KVM kernel module: No such file or directory
qemu-system-x86_64: -accel kvm: failed to initialize kvm: No such file or directory
qemu-system-x86_64: falling back to tcg
==13390==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!

Looking for expected file 'tests/data/acpi/q35/FACP.cphp'
Looking for expected file 'tests/data/acpi/q35/FACP'
---
Could not access KVM kernel module: No such file or directory
qemu-system-x86_64: -accel kvm: failed to initialize kvm: No such file or directory
qemu-system-x86_64: falling back to tcg
==13397==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!

Looking for expected file 'tests/data/acpi/q35/FACP.memhp'
Looking for expected file 'tests/data/acpi/q35/FACP'
---
Could not access KVM kernel module: No such file or directory
qemu-system-x86_64: -accel kvm: failed to initialize kvm: No such file or directory
qemu-system-x86_64: falling back to tcg
==13403==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!

Looking for expected file 'tests/data/acpi/q35/FACP.numamem'
Looking for expected file 'tests/data/acpi/q35/FACP'
---
Could not access KVM kernel module: No such file or directory
qemu-system-x86_64: -accel kvm: failed to initialize kvm: No such file or directory
qemu-system-x86_64: falling back to tcg
==13409==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!

Looking for expected file 'tests/data/acpi/q35/FACP.dimmpxm'
Looking for expected file 'tests/data/acpi/q35/FACP'
---
Could not access KVM kernel module: No such file or directory
qemu-system-x86_64: -accel kvm: failed to initialize kvm: No such file or directory
qemu-system-x86_64: falling back to tcg
==13418==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!

Looking for expected file 'tests/data/acpi/q35/FACP.acpihmat'
Looking for expected file 'tests/data/acpi/q35/FACP'
---
PASS 1 i440fx-test /x86_64/i440fx/defaults
PASS 2 i440fx-test /x86_64/i440fx/pam
PASS 3 i440fx-test /x86_64/i440fx/firmware/bios
==13510==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 4 i440fx-test /x86_64/i440fx/firmware/pflash
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  QTEST_QEMU_BINARY=x86_64-softmmu/qemu-system-x86_64 QTEST_QEMU_IMG=qemu-img tests/qtest/fw_cfg-test -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="fw_cfg-test" 
PASS 1 fw_cfg-test /x86_64/fw_cfg/signature
---
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  QTEST_QEMU_BINARY=x86_64-softmmu/qemu-system-x86_64 QTEST_QEMU_IMG=qemu-img tests/qtest/drive_del-test -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="drive_del-test" 
PASS 1 drive_del-test /x86_64/drive_del/without-dev
PASS 2 drive_del-test /x86_64/drive_del/after_failed_device_add
==13603==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases!
PASS 3 drive_del-test /x86_64/blockdev/drive_del_device_del
MALLOC_PERTURB_=${MALLOC_PERTURB_:-$(( ${RANDOM:-0} % 255 + 1))}  QTEST_QEMU_BINARY=x86_64-softmmu/qemu-system-x86_64 QTEST_QEMU_IMG=qemu-img tests/qtest/wdt_ib700-test -m=quick -k --tap < /dev/null | ./scripts/tap-driver.pl --test-name="wdt_ib700-test" 
PASS 1 wdt_ib700-test /x86_64/wdt_ib700/pause
---
dbus-daemon[13773]: Could not get password database information for UID of current process: User "???" unknown or no memory to allocate password entry

**
ERROR:/tmp/qemu-test/src/tests/qtest/dbus-vmstate-test.c:114:get_connection: assertion failed (err == NULL): The connection is closed (g-io-error-quark, 18)
cleaning up pid 13773
ERROR - Bail out! ERROR:/tmp/qemu-test/src/tests/qtest/dbus-vmstate-test.c:114:get_connection: assertion failed (err == NULL): The connection is closed (g-io-error-quark, 18)
make: *** [/tmp/qemu-test/src/tests/Makefile.include:632: check-qtest-x86_64] Error 1
make: *** Waiting for unfinished jobs....
Traceback (most recent call last):
  File "./tests/docker/docker.py", line 664, in <module>
---
    raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '['sudo', '-n', 'docker', 'run', '--label', 'com.qemu.instance.uuid=90b6df7b6bac435a9cce5f52f3153c20', '-u', '1003', '--security-opt', 'seccomp=unconfined', '--rm', '-e', 'TARGET_LIST=x86_64-softmmu', '-e', 'EXTRA_CONFIGURE_OPTS=', '-e', 'V=', '-e', 'J=14', '-e', 'DEBUG=', '-e', 'SHOW_ENV=', '-e', 'CCACHE_DIR=/var/tmp/ccache', '-v', '/home/patchew2/.cache/qemu-docker-ccache:/var/tmp/ccache:z', '-v', '/var/tmp/patchew-tester-tmp-pbprdpiq/src/docker-src.2020-03-12-07.12.14.3777:/var/tmp/qemu:z,ro', 'qemu:fedora', '/var/tmp/qemu/run', 'test-debug']' returned non-zero exit status 2.
filter=--filter=label=com.qemu.instance.uuid=90b6df7b6bac435a9cce5f52f3153c20
make[1]: *** [docker-run] Error 1
make[1]: Leaving directory `/var/tmp/patchew-tester-tmp-pbprdpiq/src'
make: *** [docker-run-test-debug@fedora] Error 2

real    28m9.058s
user    0m8.536s


The full log is available at
http://patchew.org/logs/1584010572-10308-1-git-send-email-teawater@gmail.com/testing.asan/?type=message.
---
Email generated automatically by Patchew [https://patchew.org/].
Please send your feedback to patchew-devel@redhat.com