Opened 6 years ago
Last modified 6 years ago
#17820 new defect
VERR_INTERRUPTED errors from guest control service during ptrace debugging
Reported by: | Owned by: | ||
---|---|---|---|
Component: | guest control | Version: | VirtualBox 5.1.38 |
Keywords: | VERR_INTERRUPTED ptrace EINTR | Cc: | |
Guest type: | Linux | Host type: | Linux |
Description
VBoxService should cleanly handle interrupted syscalls. When receiving an error with errno=EINTR, the syscall should be retried.
We have a service that performs an anti-virus scan of running processes, which attaches to processes as a debugger to inspect memory to check for injected malware. Every time a scan is performed an error is reported by the Guest control service:
May 31 09:36:37 rhel74 kernel: 186:39:59.180297 control Error: Getting host message failed with VERR_INTERRUPTED
After a few scans (17?) the Guest control service aborts:
May 31 09:41:10 rhel74 kernel: 186:44:32.414453 control Error: Getting host message failed with VERR_INTERRUPTED May 31 09:41:10 rhel74 kernel: 186:44:32.414591 control Error: Too many failed attempts in a row to get next message, bailing out May 31 09:41:10 rhel74 kernel: 186:44:32.414636 control Guest control service stopped May 31 09:41:10 rhel74 kernel: 186:44:32.414667 control Guest control worker returned with rc=VERR_INTERRUPTED
The error can be reproduced with gdb by attaching to the running VBoxService process:
[root@rhel69 pair]# tail -f /var/log/messages & [1] 4714 [root@rhel69 pair]# May 31 13:44:00 rhel69 kernel: 00:00:00.000152 main Log opened 2018-05-31T12:44:00.767090000Z May 31 13:44:00 rhel69 kernel: 00:00:00.000266 main OS Product: Linux May 31 13:44:00 rhel69 kernel: 00:00:00.000307 main OS Release: 2.6.32-696.3.2.el6.x86_64 May 31 13:44:00 rhel69 kernel: 00:00:00.000355 main OS Version: #1 SMP Wed Jun 7 11:51:39 EDT 2017 May 31 13:44:00 rhel69 kernel: 00:00:00.000388 main Executable: /opt/VBoxGuestAdditions-5.1.38/sbin/VBoxService May 31 13:44:00 rhel69 kernel: 00:00:00.000390 main Process ID: 4698 May 31 13:44:00 rhel69 kernel: 00:00:00.000391 main Package type: LINUX_64BITS_GENERIC May 31 13:44:00 rhel69 kernel: 00:00:00.001758 main 5.1.38 r122592 started. Verbose level = 0 May 31 13:44:00 rhel69 vboxadd-service.sh: VirtualBox Guest Addition service started. May 31 13:44:01 rhel69 kernel: 00:02:52.579824 main Ended. [root@rhel69 pair]# gdb -p `pidof VBoxService` -batch -ex quit Missing separate debuginfo for /opt/VBoxGuestAdditions-5.1.38/sbin/VBoxService [New LWP 4710] [New LWP 4709] [New LWP 4708] [New LWP 4707] [New LWP 4706] [New LWP 4705] [New LWP 4704] [Thread debugging using libthread_db enabled] 0x0000003f5ca0f585 in sigwait () from /lib64/libpthread.so.0 A debugging session is active. Inferior 1 [process 4703] will be detached. Quit anyway? (y or n) [answered Y; input not from terminal] May 31 13:45:55 rhel69 kernel: 00:01:54.476487 control Error: Getting host message failed with VERR_INTERRUPTED [root@rhel69 pair]# [root@rhel69 pair]# kill %1 [root@rhel69 pair]# [1]+ Terminated tail -f /var/log/messages [root@rhel69 pair]#
It looks like VBoxService is failing to handle interrupted system calls correctly.
From http://man7.org/linux/man-pages/man2/ptrace.2.html : (Programs which do not expect such "stray" EINTR errors may behave in an unintended way upon an strace(1) attach.)
I presume VBoxService is waiting on a syscall, such as poll() and receives an EINTR error when the process is interrupted. The error is recoverable, and the call should just be retried in this case, but it looks like the error is being treated as a problem and isn't silently/cleanly recovered.
VBox guest attributes:
 Runtime attributes Screen Resolution 800x600x32 @0,0 VM Uptime 1d 03:48:55 Clipboard Mode Disabled Drag and Drop Mode Disabled VT-x/AMD-V Active Nested Paging Active Unrestricted Execution Active Paravirtualization Interface KVM Guest Additions 5.1.38 r122592 Guest OS Type Linux 2.6 / 3.x / 4.x (64-bit) Remote Desktop Server Port Not Available
Attachments (1)
Change History (2)
by , 6 years ago
Attachment: | RHEL 7.4-2018-06-14-13-15-18.log added |
---|
comment:1 by , 6 years ago
may be related to this kernel bug: https://bugzilla.redhat.com/show_bug.cgi?id=1516394
VBox.log for an affected VM.