Crash in shared folder support

[arb]

The crash backtrace can be seen in the attached image.

Summary:

VbglGRFree [vboxguest] VbglR0HGCMInternalCall [vboxguest] default_spin_lock_flags _spin_lock_irqsave T.528 [vboxguest] VBoxGuestHGCMAsyncWaitCallback [vboxguest] VBoxGuestCommonIOCtl [vboxguest] VBoxGuestIDCCall [vboxguest] vbglDriverIOCtl [vboxsf] show_scaling_max_freq VbglHGCMCall [vboxsf] vboxCallRead [vboxsf] kfree sf_reg_read [vboxsf] vfs_read sf_reg_read [vboxsf] sys_read syscall_call EIP: VbglPhysHeapFree [vboxguest] CR2: 0d

[arb]

Call trace

[arb]

Log files

[Frank Mehnert]

Are you able to reproduce the crash, do you have a simple testcase?

[arb]

Sorry, VirtualBox is terribly unreliable but not in a consistent fashion so I can't reproduce crashes at will!

[Frank Mehnert]

Sorry, but I cannot follow you. VirtualBox is very reliable here. You should be still able to say what did you do to trigger this guest crash. Some information about your guest (e.g. which Linux distribution, did you use a standard kernel or is that a self-compiled kernel, which gcc version) would also help. Also, do you run several VirtualBox VMs in parallel?

[arb]

(By unreliable I mean that either VBoxHeadless crashes (reported in other tickets) or the guest kernel crashes, the latter happening every few days.) I don't do anything specific to trigger the crashes, they happen seemingly randomly whilst the VM is doing some data processing. The kernel is always one of the standard ones provided by Ubuntu. Yes I run several I/O intensive VMs in parallel although I think only one of them uses shared folders (the other ones crash/hang for different reasons).

[arb]

Second crash stack backtrace

[arb]

Another crash, see second attachment.

Again it seems to be a write system call going through vboxsf.

Here's a full trace

[152379.450585] BUG: unable to handle kernel NULL pointer dereference at 0000000
d
[152379.454585] IP: [<f87e8097>] VbglPhysHeapFree+0xb7/0x150 [vboxguest]
[152379.454585] *pdpt = 000000000a5a5001 *pde = 0000000000000000 
[152379.874933] Oops: 0002 [#2] SMP 
[152379.874933] last sysfs file: /sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00
/ACPI0003:00/power_supply/AC/online
[152379.874933] Modules linked in: vboxsf fbcon tileblit ppdev font bitblit soft
cursor parport_pc psmouse lp serio_raw vboxguest parport vga16fb vgastate ahci e
1000
[152380.675590] 
[152380.675590] Pid: 8644, comm: MOD_PR09DB.exe Tainted: G      D W  (2.6.32-42-
generic-pae #95-Ubuntu) VirtualBox
[152380.675590] EIP: 0060:[<f87e8097>] EFLAGS: 00010202 CPU: 1
[152380.675590] EIP is at VbglPhysHeapFree+0xb7/0x150 [vboxguest]
[152381.512277] EAX: 00000001 EBX: f4d20144 ECX: f4d30000 EDX: f4d20000
[152381.512277] ESI: f4d201f4 EDI: f4d2015c EBP: c92f3ce4 ESP: c92f3cd8
[152381.512277]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[152381.928619] Process MOD_PR09DB.exe (pid: 8644, ti=c92f2000 task=f048cc80 tas
k.ti=c92f2000)
[152381.928619] Stack:
[152381.928619]  f6dcacd0 0000003c 00000005 c92f3cf0 f87e685f f4d2015c c92f3dcc 
f87e71e3
[152381.928619] <0> f4d2015c f8801240 ffffffff f7490810 00000001 00000000 f74cff
98 f51cfd50
[152381.928619] <0> 00000004 00000000 f4d201b8 00000001 00170dc0 00000000 000000
01 00000005
[152381.928619] Call Trace:
[152381.928619]  [<f87e685f>] ? VbglGRFree+0x1f/0x30 [vboxguest]
[152381.928619]  [<f87e71e3>] ? VbglR0HGCMInternalCall+0x693/0xe70 [vboxguest]
[152381.928619]  [<c013b628>] ? __wake_up_common+0x48/0x70
[152381.928619]  [<c010f4d8>] ? sched_clock+0x8/0x10
[152381.928619]  [<c0176b84>] ? sched_clock_local+0xa4/0x180
[152381.928619]  [<c035d9d4>] ? rb_erase+0xb4/0x120
[152381.928619]  [<c0131108>] ? default_spin_lock_flags+0x8/0x10
[152381.928619]  [<c05b801f>] ? _spin_lock_irqsave+0x2f/0x50
[152381.928619]  [<f87e4533>] ? T.528+0xd3/0x300 [vboxguest]
[152381.928619]  [<f87e33e0>] ? VBoxGuestHGCMAsyncWaitCallback+0x0/0x20 [vboxgue
st]
[152381.928619]  [<f87e4978>] ? VBoxGuestCommonIOCtl+0x218/0x1e80 [vboxguest]
[152381.928619]  [<f87e2525>] ? VBoxGuestIDCCall+0x45/0x60 [vboxguest]
[152381.928619]  [<f87a9d8d>] ? vbglDriverIOCtl+0x2d/0x40 [vboxsf]
[152381.928619]  [<f87aa79c>] ? VbglHGCMCall+0x3c/0xa0 [vboxsf]
[152381.928619]  [<f87e84ed>] ? VBoxGuest_RTMemTmpAllocTag+0x1d/0x20 [vboxguest]
[152381.928619]  [<f87ab721>] ? VbglR0SfWritePhysCont+0x141/0x170 [vboxsf]
[152381.928619]  [<f87a85fb>] ? sf_reg_write+0x15b/0x250 [vboxsf]
[152381.928619]  [<c02146f2>] ? vfs_write+0xa2/0x1a0
[152381.928619]  [<f87a84a0>] ? sf_reg_write+0x0/0x250 [vboxsf]
[152381.928619]  [<c0214fe2>] ? sys_write+0x42/0x70
[152381.928619]  [<c01097cc>] ? syscall_call+0x7/0xb
[152381.928619] Code: 46 08 01 75 3a 03 56 04 83 c2 18 89 53 04 8b 46 0c 31 d2 8
5 c0 74 09 8b 56 10 89 50 10 8b 56 0c 8b 46 10 85 c0 0f 84 7c 00 00 00 <89> 50 0
c c7 46 0c 00 00 00 00 c7 46 10 00 00 00 00 8b 43 14 8b 
[152381.928619] EIP: [<f87e8097>] VbglPhysHeapFree+0xb7/0x150 [vboxguest] SS:ESP
 0068:c92f3cd8
[152381.928619] CR2: 000000000000000d
[152385.055185] ---[ end trace a7919e7f17c0a729 ]---

[arb]

This fault keeps happenening. Is there some way to trace it so the bugs can be identified and fixed?

[Frank Mehnert]

Could you test again and post another such guest kernel log together with your vboxguest.ko + vboxsf.ko modules from that guest? Please use the attach button to add these files to the ticket. Thanks.

[Frank Mehnert]

No answer -- is this problem relevant at all with VBox 4.2.4?

[arb]

I would have continued testing but I'm sorry I didn't see your replies because trac never sends me emails when a ticket is updated :-(