Kernel panic (unable to handle kernel paging request) at __netif_receive_skb_core

[Tim Retout]

When starting a Virtualbox VM, I can reliably reproduce a host kernel oops:

[  179.858414]  "kernel tried to execute NX-protected page - exploit attempt? (uid: 1001)
[  179.861529] BUG: unable to handle kernel paging request

It seems to happen when running docker on the same host. The VM has a bridged interface with a static IP, and the stack trace always mentions __netif_receive_skb_core. I'll try to narrow down a test case...

I've tried to rule out these other bugs:

• https://www.virtualbox.org/ticket/13961 - I still get a crash when booted with "nosmap" and "nosmem"
• https://www.virtualbox.org/ticket/11610 - this looks very similar, but shouldn't affect Virtualbox 4.3.28

I'm using Debian unstable, with Debian-provided kernel and virtualbox - I'll try to reproduce it with the Oracle binaries:

$ uname -a
Linux thinkpad 4.0.0-1-amd64 #1 SMP Debian 4.0.2-1 (2015-05-11) x86_64 GNU/Linux

$ virtualbox --help
Oracle VM VirtualBox Manager 4.3.28_Debian

When I booted with "nosmap" and "nosmem", I got a slightly different error message, which I'll also attach.

VBox.log is always empty with these crashes.

I've got a kernel core dump, but I'd rather not upload that publicly - I hope I can help with debugging it, though.

[Tim Retout]

dmesg output

[Tim Retout]

dmesg output (after nosmap and nosmem)

[Tim Retout]

Might be a dupe of #13795?

[Tim Retout]

So far I've found two workarounds that stop the crash:

• Run docker containers with --net=host option (i.e. don't use Docker bridging)
• Change the virtualbox bridge to use "wlan0" instead of "eth0"

I have no idea why the second one changes anything. wlan0 is the physical interface that is actually connected to the internet at the moment, and eth0 is unplugged.

[Frank Mehnert]

This has most likely nothing to do with SMAP. Could you try to reproduce the crash again and provide:

• the outout of 'dmesg'
• the corresponding VBox.log file
• the vboxdrv.ko, vboxnetflt.ko and vboxnetadp.ko modules

Thank you!

[Tim Retout]

Hi frank,

I have reproduced the crash this morning with the official Oracle binaries:

$ virtualbox --help
Oracle VM VirtualBox Manager 4.3.28

I will attach dmesg and the built kernel modules, but VBox.log is always empty when this crash occurs, presumably because the host panics before anything gets written. I'm having to use kdump to get the dmesg output, because the kernel panic doesn't normally get written to disk either.

I do have the kernel core dump produced by kdump, which loads in 'crash', so I can get any debug information if that's useful.

[Tim Retout]

dmesg output (using official binaries)

[Valery Ushakov]

Replying to timretout:

Might be a dupe of #13795?

Looks like it indeed. The fix will be in the next release.