Windows guest crashes when doing network I/O on some networks

[pornin]

Host is Ubuntu 15.10 (64-bit). VirtualBox is version 5.0.4_Ubuntu r102546 (issue described below already existed with VirtualBox 4.3.26 as packaged in Ubuntu 15.04).

Windows 8 and 10 guests (both 64-bit) crash randomly when doing network I/O (with NAT), but only on my home network.

I believe the hardware is fine: the host Linux, and guest Windows XP VM, are rock solid; memtest86 finds nothing wrong with the RAM.

When I run my Windows 10 VM on my office WiFi, everything is fine. I can do heavy I/O with no problem; in fact, I performed the Windows 8 to 10 upgrade that way (so a complete download of Windows 10 and a full OS install).

When I run my Windows 10 VM on my home network (a pretty standard WiFi with a D-Link router), anything that tries to do some network I/O induces crashes. A download blocks randomly but quite fast (after a dozen megabytes or so); the application (browser) usually crashes, but half the time the OS itself locks up, or reports a blue screen and reboots. When a download completes, the obtained file can be altered (even if coming over SSL !). Sometimes, some pixels in the desktop wallpaper are changed. All of these symptoms point at some memory corruption in the guest kernel, such as what could be obtained with a buffer overflow in the network code.

I have the issue with both the Intel PRO/1000 MT emulation (using the stock Windows driver) and the Virtio-net driver (virtio-win-0.1.110.iso from RedHat's site).

Adding or removing the guest additions has no effect on the bug.

I tried setting the MTU explicitly to 1500 in the NAT settings; this did not change anything.

I tried changing the network type to bridged (with a virtual interface I created explicitly on the Linux), then letting the Linux kernel do the IP forwarding and NAT (with iptables): the Windows guest still crashes.

[Valery Ushakov]

This doesn't sound like a networking problem since you see this symptoms over a wide range of networking options and since a problem with networking in virtual box should not cause the guest process to crash.

[pornin]

Well, the change of network environment seems to trigger the bug. It is possible that the bug really is in Windows' kernel, and that would be interesting in its own right (buffer overflows from the network can lead to remote code execution). However, it is also possible that the problem is in VirtualBox' handling of emulated DMA, when it copies network data into the guest address space.

I can make other tests. For instance, if someone can point me to a driver for a PCNET ethernet card that Windows 10 will accept to work with, then I can try out that interface type (I say that in case there is some problem with jumbo frames -- as far as I can tell, they are not activated on the Windows side, but with Windows I am never sure about such things).

[Valery Ushakov]

For starters, can you avoid EFI? The manual explicitly discourages from using EFI with Windows guests.

[pornin]

I reinstalled a fresh Windows 8 without EFI. No better luck: Internet Explorer crashes as I try a download. Logs show that TiWorker.exe also died (I suppose it tried to download things from Windows Update).

I tried some combinations related to MTU (setting it to 1420 in VirtualBox; setting MTU to 16128 both in VirtualBox and on the interface properties on the Windows side) but this did not change things. I still get crashes for process involved in networking and occasional spontaneous reboots; corrupted pixels also happen. If I disable the network interface, or if I let it enabled but with a disconnected cable, then the machine appears stable. Note: for this VM, 2D and 3D accelerations are disabled, and guest additions are not installed.

I could obtain a network trace with Network Monitor while downloading some data (and IE crashed); I don't see anything wrong with it (although max packet size is at 1460, while I somewhat expected 1500).

Is there some heavy logging mechanism that can be enabled in VirtualBox with regards to network ? I can recompile it if needed.