CentOS7 poweroff BUG, Couldn't be written

[Justin-Young]

• Windows: Win10 family Chinese version 20H2 19042.928 Mem 16GB
• CentOS: CentOS Linux release 7.9.2009 (Core)
• Kernel: 3.10.0-1160.el7.x86_64
• Configuration
  • CPU：1cores
  • Mem: 1GB
  • Network Cards: 1 NAT
• Reproduce:

Actually, every centos7 VM has the same problem, and it seems to have nothing to do with the virtual machine configuration. This problem occurs regardless of poweroff, shutdown, init 0 or ACPI shutdown commands. In addition, win10 1909 also has this problem. I wanna know is that a BUG, thank you!

• Error Message

VirtualBoxVM.exe - Application Error: 
The instruction at 0x00007FFED15D9B2C referenced memory at 0x00007FFED15D9B2C. The memory could not be written. 
Click on OK to terminate the program.

[Justin-Young]

I noticed the same exception information in Vbox.3.log and Vbox.log.1 as follows:

!!! rtR3WinUnhandledXcptFilter caught an exception on thread 00000000000035f0!!!
 
 ExceptionCode=0xc0000005 ExceptionFlags=0x00000000 ExceptionAddress=00007ffed15d9b2c
 ExceptionInformation[0]=0000000000000008
 ExceptionInformation[1]=00007ffed15d9b2c

[Klaus Espenlaub]

This does look like a bug. As you noticed, VirtualBoxVM detects this crash and saves some diagnostic information in the corresponding log file. However, it isn't giving a lot of hints.

The best way to help some developer work on this issue would be to enable MiniDumps as described on https://www.virtualbox.org/wiki/Core_dump#WindowsMiniDumps and provide it (usually doesn't work as an attachment due to its size).

You could try upgrading to VirtualBox 6.1.20, because that has some fixes for the audio functionality. I don't remember that it resolves this symptom, but you could narrow it down yourself before upgrading: try disabling audio for your VM and see if the crash still happens.

[Justin-Young]

Replying to klaus:

This does look like a bug. As you noticed, VirtualBoxVM detects this crash and saves some diagnostic information in the corresponding log file. However, it isn't giving a lot of hints.

The best way to help some developer work on this issue would be to enable MiniDumps as described on https://www.virtualbox.org/wiki/Core_dump#WindowsMiniDumps and provide it (usually doesn't work as an attachment due to its size).

You could try upgrading to VirtualBox 6.1.20, because that has some fixes for the audio functionality. I don't remember that it resolves this symptom, but you could narrow it down yourself before upgrading: try disabling audio for your VM and see if the crash still happens.

Thank you for your reply! I tried upgrading to VirtualBox 6.1.20 and disabling audio, but it didn't work. And I tried enabling MiniDumps, but it didn't output any files. I'm sure I have configured it correctly. Maybe the system doesn't think this is a crash, because it just generates an exception message. In addition, I found this exception message is only generated when shutting down and not when restarting.

An exception message in VboxHardening.log is as follows.

4874.1624: supR3HardenedDllNotificationCallback: Unload 00007ffbfc6b0000 LB 0x00094000 C:\WINDOWS\SYSTEM32\wbemcomn.dll [flags=0x0]
4874.1624: Terminating the normal way: rcExit=0
4874.1624: KiUserExceptionDispatcher: 0xc0000005 (0000000000000008, 00007ffbfb4f9b2c) @ 00007ffbfb4f9b2c (flags=0x0)
  rax=00007ffbfb4f9b2c rbx=00000000018aa810 rcx=00007ffbfb56d700 rdx=000000000000000e
  rsi=000000000000001e rdi=00000000018aa7e8 r8 =0000000000fc1d40 r9 =0000000000000001
  r10=0000000000000000 r11=00000000012fed90 r12=0000000000000000 r13=00007ffc1427b2b0
  r14=00000000018aa8e8 r15=0000000000000001  P1=0000000000000000  P2=0000000000000000
  rip=00007ffbfb4f9b2c rsp=00000000012fef38 rbp=000000000000000c    ctxflags=0010005f
  cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b    eflags=00010206   mxcrx=00001fa0
   P3=0000000000000000  P4=0000000000000000  P5=0000000000000000  P6=0000000000000000
  dr0=0000000000000000 dr1=0000000000000000 dr2=0000000000000000 dr3=0000000000000000
  dr6=0000000000000000 dr7=0000000000000000 vcr=0000000001fd6140 dcr=00007ffc14136491
  lbt=0000000000000000 lbf=0000000000000000 lxt=0000000000000000 lxf=0000000000000000
4874.1624: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\DXCore.dll'.
4874.1624: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\DXCore.dll' [rescheduled]
4874.1624: supR3HardenedIsApiSetDll: ApiSetQueryApiSetPresence(ext-ms-win-kernel32-errorhandling-l1-1-0.dll) -> 0x0, fPresent=1
4874.1624: supR3HardenedMonitor_LdrLoadDll: pName=ext-ms-win-kernel32-errorhandling-l1-1-0.dll (rcNtResolve=0x0) *pfFlags=0x0 pwszSearchPath=0000000000000001:<flags> [calling]
4874.1624: supR3HardenedMonitor_LdrLoadDll: returns rcNt=0x0 hMod=00007ffc14010000 'ext-ms-win-kernel32-errorhandling-l1-1-0.dll'
4874.1624: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\DXCore.dll'.
4874.1624: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\DXCore.dll' [rescheduled]
4874.1624: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\DXCore.dll'.
4874.1624: supR3HardenedWinVerifyCacheProcessWvtTodos: 0 (was 0) fWinVerifyTrust=0 for '\Device\HarddiskVolume3\Windows\System32\DXCore.dll' [rescheduled]
4874.1624: Detected loader lock ownership: rc=VINF_SUCCESS '\Device\HarddiskVolume3\Windows\System32\ntdll.dll'.
4874.1624: '\Device\HarddiskVolume3\Windows\System32\ntdll.dll' has no imports

[moydelgado]

Hi! I having the same problem with Oracle Linux 6.8x64 when shutting down VM.

I already exported the MVs to another computer with VBox 6.1.10, and on that computer the MVs start and close without problem, It seems that it could be due to a recent windows 10 update, because some updates were installed few days ago from today (2 I guess), today I wanted to shutdown the VMs I noticed this problem.

[moydelgado]

error screenshot

[moydelgado]

I'm getting same exception

[moydelgado]

Replying to Justin-Young:

• Windows: Win10 family Chinese version 20H2 19042.928 Mem 16GB
• CentOS: CentOS Linux release 7.9.2009 (Core)
• Kernel: 3.10.0-1160.el7.x86_64
• Configuration
  • CPU：1cores
  • Mem: 1GB
  • Network Cards: 1 NAT
• Reproduce:

Actually, every centos7 VM has the same problem, and it seems to have nothing to do with the virtual machine configuration. This problem occurs regardless of poweroff, shutdown, init 0 or ACPI shutdown commands. In addition, win10 1909 also has this problem. I wanna know is that a BUG, thank you!

• Error Message

VirtualBoxVM.exe - Application Error: 
The instruction at 0x00007FFED15D9B2C referenced memory at 0x00007FFED15D9B2C. The memory could not be written. 
Click on OK to terminate the program.

Hi again!! I finded out the problem was on my McAfee LiveSafe versión, for some reason that I don't know was blocking because a kind of buffer overflow violation was ocurring, it's a coincidence that both windows 10 and mcaffe updates will be installed this week!

I need to investigate more about the features of McAfee could be causing this problem.

[moydelgado]

this is the information I found about the exception KiUserExceptionDispatcher and ntdll: ​https://kc.mcafee.com/corporate/index?page=content&id=KB81308