I am debugging one 0xD1 bugcheck and finding an inconsistency in the stack trace.
Here goes the stack trace:
# Child-SP RetAddr Call Site
15750468 fffff8040d1c6869 nt!KeBugCheckEx
15750470 fffff8040d1c2c8e nt!KiBugCheckDispatch+0x69
157505b0 fffff804675d3088 nt!KiPageFault+0x44e
15750740 fffff804675d35fb MyDriver!Function7+0x38
15750770 fffff804675f3005 MyDriver!Function4+0x39b
05 (Inline Function) --------
-------- MyDriver!Function3+0x10c 06 fffff804157507f0 fffff804
6760507f MyDriver!Function2+0x2e5 07 fffff80415750870 fffff804
6d87a6f8 MyDriver!Function1+0x34f 08 fffff80415750900 fffff804
0d067729 storport!RaidpAdapterTimerDpcRoutine+0x58 09 fffff80415750960 fffff804
0d0666e7 nt!KiProcessExpiredTimerList+0x159 0a fffff80415750a50 fffff804
0d1b8a5a nt!KiRetireDpcList+0x4a7 0b fffff80415750c60 00000000`00000000 nt!KiIdleLoop+0x5a
Note that Function7 is getting called from Function 4.
Here is the skeleton of Function 4:
In the WinDbg the line where Function6 is called is highlighted, which means the the control was passed from the previous line.
That happens to be a call to Function 5 using a pointer to that function. So in the stack Function5 should show up after Function 4, but is is Function7! The Function7 is never called from anywhere within Function4 anyway.
Any idea what can lead to this? If I execute a 'ln' command on the value of that function pointer (pFunction5) I correctly get Function 5!
It looks like you're new here. If you want to get involved, click one of these buttons!
|Upcoming OSR Seminars|
|Developing Minifilters||29 July 2019||OSR Seminar Space|
|Writing WDF Drivers||23 Sept 2019||OSR Seminar Space|
|Kernel Debugging||21 Oct 2019||OSR Seminar Space|
|Internals & Software Drivers||18 Nov 2019||Dulles, VA|