[Bug]: vboxdrv triggers a kernel BUG during load and all VMs fail to start if `kernel.kptr_restrict=2` sysctl is set

[ArrayBolt3]

Version

7.1.18

Host OS Type

Linux

Host OS name + version

Debian 13.4

Host Architecture

x86

Guest OS Type

all

Guest Architecture

x86

Guest OS name + version

N/A

Component

VMM

What happened?

(Apologies if I have the component wrong, I wasn't sure whether to pick VMM or Host Support.)

If a Debian system has the kernel.kptr_restrict=2 sysctl set, VBoxDrv will trigger a kernel BUG on load. vboxdrv.service will show as failed in the output of systemctl. The module will technically be loaded into the kernel, but it is completely non-functional in this state, attempting to boot a VM always fails. If the user is unlucky enough to also have panic-on-oops enabled on their machine, this will result in the entire machine crashing.

The relevant output from dmesg is:

[    4.956947] vboxdrv: loading out-of-tree module taints kernel.
[    4.956953] vboxdrv: module verification failed: signature and/or required key missing - tainting kernel
[    4.968023] vboxdrv: Found 8 processor cores/threads
[    4.974793] RTR0DbgKrnlInfoOpen: /proc/kallsym method failed. get_user_pages address off by +0x74a91580
[    5.006678] Missing ENDBR: kallsyms_lookup_name+0x0/0xd0
[    5.007463] ------------[ cut here ]------------
[    5.007464] kernel BUG at arch/x86/kernel/cet.c:132!
[    5.008234] Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
[    5.009003] CPU: 2 UID: 0 PID: 1232 Comm: modprobe Tainted: G           OE      6.12.74+deb13+1-amd64 #1  Debian 6.12.74-2
[    5.009793] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[    5.010566] Hardware name: Notebook NV4XMB,ME,MZ/NV4XMB,ME,MZ, BIOS 1.07.13NMIN29 07/12/2021
[    5.011434] RIP: 0010:exc_control_protection+0x29f/0x2b0
[    5.012312] Code: d8 b9 09 00 00 00 48 8b 93 80 00 00 00 be 80 00 00 00 48 c7 c7 1a 6b 6e 8c e8 fd a9 3c ff 80 a3 8a 00 00 00 fb e9 38 fe ff ff <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
[    5.013215] RSP: 0018:ffffd523c163b8c8 EFLAGS: 00010002
[    5.014115] RAX: 000000000000002c RBX: ffffd523c163b8f8 RCX: 0000000000000000
[    5.015024] RDX: 0000000000000000 RSI: ffff8f2451321780 RDI: ffff8f2451321780
[    5.015936] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffd523c163b758
[    5.016841] R10: ffffffff8ceb43c8 R11: 0000000000000003 R12: 0000000000000003
[    5.017737] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[    5.018648] FS:  00007fbc4d69f5c0(0000) GS:ffff8f2451300000(0000) knlGS:0000000000000000
[    5.019557] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    5.020460] CR2: 00007fbc4cef3cb0 CR3: 000000010d6ca005 CR4: 0000000000f72ef0
[    5.021364] PKRU: 55555554
[    5.022275] Call Trace:
[    5.023183]  <TASK>
[    5.024070]  asm_exc_control_protection+0x26/0x30
[    5.024964] RIP: 0010:kallsyms_lookup_name+0x0/0xd0
[    5.025844] Code: 79 0a 48 f7 d0 48 03 05 3e d9 29 01 c3 cc cc cc cc 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <66> 0f 1f 00 0f 1f 44 00 00 53 48 83 ec 10 65 48 8b 04 25 28 00 00
[    5.026768] RSP: 0018:ffffd523c163b9a0 EFLAGS: 00010282
[    5.027690] RAX: ffffffff8b3c7c40 RBX: ffff8f1ccd908010 RCX: 0100000000000000
[    5.028613] RDX: 00ffffffffdfffff RSI: 0000000000000000 RDI: ffffffffc243b6a7
[    5.029529] RBP: ffffd523c163b9f8 R08: 0000000000000000 R09: 0000000000000001
[    5.030445] R10: 0000000000000002 R11: 0000000000000001 R12: ffffd523c163ba08
[    5.031362] R13: ffffffffc243b6a7 R14: 0000000000000000 R15: ffff8f1ccaca1368
[    5.032275]  ? __pfx_kallsyms_lookup_name+0x10/0x10
[    5.033188]  VBoxHost_RTR0DbgKrnlInfoQuerySymbol+0x19b/0x280 [vboxdrv]
[    5.034130]  VBoxHost_RTR0DbgKrnlInfoGetSymbol+0x31/0x60 [vboxdrv]
[    5.035063]  rtR0InitNative+0x7c/0xd0 [vboxdrv]
[    5.035984]  VBoxHost_RTR0Init+0x3c/0x150 [vboxdrv]
[    5.036904]  VBoxDrvLinuxInit+0x46/0xff0 [vboxdrv]
[    5.037830]  ? __pfx_VBoxDrvLinuxInit+0x10/0x10 [vboxdrv]
[    5.038750]  do_one_initcall+0x5b/0x310
[    5.039643]  do_init_module+0x60/0x230
[    5.040534]  init_module_from_file+0x89/0xe0
[    5.041412]  idempotent_init_module+0x11e/0x310
[    5.042292]  __x64_sys_finit_module+0x5e/0xb0
[    5.043170]  do_syscall_64+0x82/0x190
[    5.044043]  ? touch_atime+0x1e/0x120
[    5.044904]  ? filemap_read+0x340/0x370
[    5.045780]  ? vfs_read+0x15e/0x360
[    5.046652]  ? vfs_read+0x15e/0x360
[    5.047510]  ? __x64_sys_pread64+0x98/0xd0
[    5.048360]  ? arch_exit_to_user_mode_prepare.isra.0+0x16/0xa0
[    5.049222]  ? syscall_exit_to_user_mode+0x37/0x1b0
[    5.050075]  ? clear_bhb_loop+0x40/0x90
[    5.050924]  ? clear_bhb_loop+0x40/0x90
[    5.051759]  ? clear_bhb_loop+0x40/0x90
[    5.052581]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[    5.053402] RIP: 0033:0x7fbc4cf1a7b9
[    5.054243] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 27 66 0d 00 f7 d8 64 89 01 48
[    5.055107] RSP: 002b:00007fff9b269b78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[    5.055986] RAX: ffffffffffffffda RBX: 00005641100d69d0 RCX: 00007fbc4cf1a7b9
[    5.056854] RDX: 0000000000000000 RSI: 00005640f0a4632b RDI: 0000000000000003
[    5.057727] RBP: 0000000000000000 R08: 0000000000000000 R09: 00005641100d9c00
[    5.058603] R10: 0000000000000000 R11: 0000000000000246 R12: 00005640f0a4632b
[    5.059464] R13: 0000000000040000 R14: 00005641100d6af0 R15: 0000000000000000
[    5.060305]  </TASK>
[    5.061145] Modules linked in: vboxdrv(OE+) qrtr bnep binfmt_misc intel_rapl_msr intel_rapl_common nls_ascii intel_uncore_frequency nls_cp437 intel_uncore_frequency_common vfat x86_pkg_temp_thermal fat snd_sof_pci_intel_tgl snd_sof_pci_intel_cnl snd_sof_intel_hda_generic soundwire_intel soundwire_generic_allocation soundwire_cadence snd_sof_intel_hda_common snd_soc_hdac_hda snd_sof_intel_hda_mlink snd_sof_intel_hda snd_sof_pci snd_sof_xtensa_dsp snd_sof snd_hda_codec_hdmi snd_sof_utils snd_soc_acpi_intel_match intel_powerclamp snd_soc_acpi coretemp soundwire_bus iwlmvm kvm_intel snd_soc_avs snd_soc_hda_codec snd_hda_ext_core snd_hda_codec_realtek kvm mac80211 snd_hda_codec_generic snd_soc_core snd_hda_scodec_component irqbypass snd_compress crct10dif_pclmul snd_pcm_dmaengine libarc4 ghash_clmulni_intel snd_hda_intel sha512_ssse3 uvcvideo sha256_ssse3 btusb snd_intel_dspcfg iwlwifi sha1_ssse3 snd_intel_sdw_acpi btrtl snd_hda_codec videobuf2_vmalloc aesni_intel btintel uvc videobuf2_memops videobuf2_v4l2 btbcm gf128mul
[    5.061182]  btmtk crypto_simd snd_hda_core videodev cryptd mei_hdcp mei_pxp bluetooth snd_hwdep videobuf2_common cfg80211 rapl snd_pcm intel_cstate mc wmi_bmof ecdh_generic snd_timer mei_me intel_uncore snd pcspkr mei ee1004 soundcore rfkill intel_pmc_core igen6_edac joydev intel_hid intel_vsec ac sparse_keymap pmt_telemetry acpi_pad pmt_class evdev msr parport_pc ppdev lp parport configfs efi_pstore nfnetlink efivarfs ip_tables x_tables autofs4 ext4 crc16 mbcache jbd2 crc32c_generic xe drm_gpuvm drm_exec gpu_sched drm_suballoc_helper drm_ttm_helper i915 drm_buddy i2c_algo_bit drm_display_helper cec hid_multitouch rc_core hid_generic ttm i2c_hid_acpi drm_kms_helper i2c_hid iTCO_wdt hid rtsx_pci_sdmmc intel_pmc_bxt r8169 xhci_pci iTCO_vendor_support mmc_core realtek xhci_hcd watchdog nvme psmouse mdio_devres ucsi_acpi drm thunderbolt libphy typec_ucsi crc32_pclmul serio_raw nvme_core usbcore crc32c_intel typec intel_lpss_pci i2c_i801 rtsx_pci intel_lpss i2c_smbus roles button video idma64 battery nvme_auth usb_common
[    5.065862]  wmi
[    5.071988] ---[ end trace 0000000000000000 ]---
[    5.104282] iwlwifi 0000:00:14.3: Registered PHC clock: iwlwifi-PTP, with index: 0
[    5.307927] RIP: 0010:exc_control_protection+0x29f/0x2b0
[    5.309913] Code: d8 b9 09 00 00 00 48 8b 93 80 00 00 00 be 80 00 00 00 48 c7 c7 1a 6b 6e 8c e8 fd a9 3c ff 80 a3 8a 00 00 00 fb e9 38 fe ff ff <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
[    5.311914] RSP: 0018:ffffd523c163b8c8 EFLAGS: 00010002
[    5.313900] RAX: 000000000000002c RBX: ffffd523c163b8f8 RCX: 0000000000000000
[    5.315871] RDX: 0000000000000000 RSI: ffff8f2451321780 RDI: ffff8f2451321780
[    5.317860] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffd523c163b758
[    5.319866] R10: ffffffff8ceb43c8 R11: 0000000000000003 R12: 0000000000000003
[    5.321883] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[    5.323901] FS:  00007fbc4d69f5c0(0000) GS:ffff8f2451300000(0000) knlGS:0000000000000000
[    5.325902] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    5.327892] CR2: 00007fbc4cef3cb0 CR3: 000000010d6ca005 CR4: 0000000000f72ef0
[    5.329912] PKRU: 55555554
[    5.331911] note: modprobe[1232] exited with irqs disabled

The following window appears when trying to launch a VM in this state:

VirtualBox - Error In suplibOsInit

VERR_VM_DRIVER_OPEN_ERROR (rc=-1911)

The VirtualBox Linux kernel driver is either not loaded or not
set up correctly. Please try setting it up again by executing

'/sbin/vboxconfig'

as root.

If your system has EFI Secure Boot enabled you may also need
to sign the kernel modules (vboxdrv, vboxnetflt, vboxnetadp,
vboxpci) before you can load them. Please see your Linux
system's documentation for more information.

where: suplibOsInit what: 3
VERR_VM_DRIVER_OPEN_ERROR (-1911) - Was not able to
open the support driver. Generic open error used when none
of the other ones fit.

How can we reproduce this?

1. Install a fresh copy of Debian 13.4 with the GNOME desktop on a physical device. (I'm using a laptop with an i5-1135G7 processor.)
2. Install VirtualBox 7.1 following the "Debian-based Linux distributions" instructions from https://www.virtualbox.org/wiki/Linux_Downloads.
3. Run sudo modprobe -r kvm_intel; sudo modprobe -r kvm to make sure KVM doesn't get in the way of VirtualBox.
4. Launch VirtualBox, and create a FreeDOS virtual machine.
5. Verify that you can boot the VM successfully.
6. Create a file at /usr/lib/sysctl.d/990-crash-vbox.conf, with the contents kernel.kptr_restrict=2.
7. Reboot the device.
8. Run systemctl status vboxdrv.service. Observe that it shows as Active: failed.
9. Run sudo dmesg. You will see a kernel backtrace.
10. Run sudo modprobe -r kvm_intel; sudo modprobe -r kvm to get KVM to go away again.
11. Launch VirtualBox, and attempt to launch the FreeDOS virtual machine. The window described above will appear and the VM will not launch.

Did you upload all of your necessary log files, screenshots, etc.?

• Yes, I've uploaded all pertinent files to this issue.

[ArrayBolt3]

(Forgot to mention it in the original report, but this also occurs with VirtualBox 7.2.8. It did not used to happen, VirtualBox 7.2.6 is unaffected.)

[AlexanderEichner]

Hi, thanks for the report. I think I know what is going wrong there and have a potential fix. You might try applying the following patch to our kernel sources locally and rebuild the module:

Index: src/VBox/Runtime/r0drv/linux/dbgkrnlinfo-r0drv-linux.c
===================================================================
--- src/VBox/Runtime/r0drv/linux/dbgkrnlinfo-r0drv-linux.c	(Revision 173765)
+++ src/VBox/Runtime/r0drv/linux/dbgkrnlinfo-r0drv-linux.c	(Arbeitskopie)
@@ -61,6 +61,7 @@
 #include <iprt/dbg.h>
 
 #include <iprt/asm.h>
+#include <iprt/asm-amd64-x86.h>
 #include <iprt/assert.h>
 #include <iprt/ctype.h>
 #include <iprt/err.h>
@@ -67,6 +68,7 @@
 #include <iprt/file.h>
 #include <iprt/mem.h>
 #include <iprt/string.h>
+#include <iprt/thread.h>
 #include "internal/magics.h"
 
 
@@ -86,6 +88,18 @@
 #endif
 
 
+#define X86_CPUID_STEXT_FEATURE_EDX_CET_IBT RT_BIT_32(20)
+#ifndef MSR_IA32_S_CET
+# define MSR_IA32_S_CET                     0x6a2
+#endif
+#ifndef MSR_IA32_CET_ENDBR_EN
+# define MSR_IA32_CET_ENDBR_EN              RT_BIT_64(2)
+#endif
+#ifndef MSR_IA32_CET_SUPPRESS
+# define MSR_IA32_CET_SUPPRESS              RT_BIT_64(10)
+#endif
+
+
 /*********************************************************************************************************************************
 *   Structures and Typedefs                                                                                                      *
 *********************************************************************************************************************************/
@@ -577,7 +591,29 @@
     if (!g_pfnKallsymsLookupName)
         return rtR0DbgKrnlInfoLnxQuerySymbolKprobe(pszSymbol, ppvSymbol);
 
-    if ((*ppvSymbol = (void *)g_pfnKallsymsLookupName(pszSymbol)) != NULL)
+    /*
+     * Note! kallsyms_lookup_name isn't exported, so we have to temporarily disable the
+     *       indirect branch track machinery in order to call it safely.
+     *       (Setting the SUPPRESS bit to 1 probably won't help much here, as
+     *       the call is done via __x86_indirect_thunk_xxx.)
+     */
+    RTTHREADPREEMPTSTATE Preempt = RTTHREADPREEMPTSTATE_INITIALIZER;
+    uint32_t const uLeaves = ASMCpuId_EAX(0);
+    RTThreadPreemptDisable(&Preempt);
+    if (   uLeaves >= 7
+        && RTX86IsValidStdRange(uLeaves)
+        && (ASMCpuIdEx_EDX(7, 0) & X86_CPUID_STEXT_FEATURE_EDX_CET_IBT))
+    {
+        uint64_t const fSupCet = ASMRdMsr(MSR_IA32_S_CET);
+        ASMWrMsr(MSR_IA32_S_CET, fSupCet & ~MSR_IA32_CET_ENDBR_EN);
+        *ppvSymbol = (void *)g_pfnKallsymsLookupName(pszSymbol);
+        ASMWrMsr(MSR_IA32_S_CET, fSupCet);
+    }
+    else
+        *ppvSymbol = (void *)g_pfnKallsymsLookupName(pszSymbol);
+    RTThreadPreemptRestore(&Preempt);
+
+    if (*ppvSymbol != NULL)
         return VINF_SUCCESS;
 #endif
 

Please note that the patch is against our internal tree and not the kernel driver source directory so patch will not find the file. The file should be under r0drv/linux/dbgkrnlinfo-r0drv-linux.c from the root of the vboxdrv kernel module sources.

[ArrayBolt3]

@AlexanderEichner I can confirm this fixes the issue for me with both VirtualBox 7.2.8 and 7.1.18. No more kernel oops appears in dmesg, and both Linux and DOS virtual machines start and appear to run properly.

I did have some trouble triggering the module to recompile using sudo dpkg-reconfigure virtualbox-7.x; something attempts to unload the VirtualBox module, which fails (presumably because the broken loaded version of the module is in an inconsistent state, I guess?). So that might be worth taking into account in the package maintainer scripts.

[DeflateAwning]

Hold on, disabling the branch track feature is such a bad way to solve this problem (literally just pushing it down the road). Why don't you fix it the correct way by using only properly-exported ABI functions, as the kernel intends?

I believe the necessary details of such a solution are present in #644, which was closed as a duplicate.

[AlexanderEichner]

The branch tracking is only disabled for that single call and enabled again afterwards. Also this code is only used as a fallback if the /proc/kallsyms and kprobe approach fail. We need certain APIs which are not exported because some people in the Linux kernel community don't give an f about third party kernel modules.

[DeflateAwning]

Given the report in #644, why is the kprobe approach failing?

[AlexanderEichner]

I actually read the code wrong (not originally mine), the kprobe approach is only used when wwe couldn't find kallsyms_lookup_name(). However it doesn't really matter, both approaches are just terrible hacks and it doesn't matter which hack we use.

[DeflateAwning]

Thanks for re-reading. I spent way too long looking at this.

It's a nasty web, and I'm pretty sure there's a genuine bug here. kprobe is not a "nasty hack" - it's the supported approach for this. I strongly suggest the fix being to make sure kprobe is attempted first on all codepaths.

The commit I mentioned in #644 gives AI slop vibes. It seems to re-invent the wheel on these lookups, and it does it wrong (using this unsupported approach). I'd check into it if I were you.

[AlexanderEichner]

I can assure you that no AI was involved in the commit. And why is the kprobe approach not a hack? If this would be the official way for kernel modules to get at internal APIs it would be much easier to just export kallsyms_lookup_name...

[DeflateAwning]

The kprobe approach is the accepted way because it's exported in the ABI...

And thus it doesn't cause a kernel panic when you try to jump to it.