Hello.
I am investigating blue screen dump file and I am confused with things I saw.
Stack:
STACK_TEXT:
8078ad48 8b005700 badb0d00 00000001 00000000 nt!KiTrap0E+0x2cf
8078add8 8b1db71f 85fbf868 85d20e00 85f6d5d0 CLASSPNP!ClassIoComplete+0x142
8078adf4 82ab5913 85fbf868 85d20e00 85f6d5b8 disk!DiskFlushComplete+0x49
8078ae38 8adb7da3 8adc30a0 85c48910 8078ae60 nt!IopfCompleteRequest+0x128
8078ae48 8adb85b7 851c56c8 85d20e00 85f6d5d0 ataport!IdeCompleteScsiIrp+0x31
8078ae60 8adb54bd 85c48910 85c48910 851c70e0 ataport!IdeAlwaysSuccessCrbCompletion+0x21
8078ae7c 8adbb474 851c70e0 85c48910 85c48910 ataport!IdeTranslateCompletedRequest+0x161
8078aef4 8adbb677 851c70e0 85c48910 851c709c ataport!IdeProcessCompletedRequests+0x2a0
8078af48 82ab51b5 851c709c 851c7028 00000000 ataport!IdePortCompletionDpc+0xab
8078afa4 82ab5018 82b67d20 86fe0b88 00000000 nt!KiExecuteAllDpcs+0xf9
8078aff4 82ab47dc 880b5ab4 00000000 00000000 nt!KiRetireDpcList+0xd5
8078aff8 880b5ab4 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2c
WARNING: Frame IP not in any known module. Following frames may be wrong.
82ab47dc 00000000 0000001a 00d6850f bb830000 0x880b5ab4
STACK_COMMAND: kb
FOLLOWUP_IP:
CLASSPNP!ClassIoComplete+142
8b005700 c680a100000000 mov byte ptr [eax+0A1h],0
I found the line corresponding this instruction in function ClassIoComplete ( WINDDK\7600.16385.1\src\storage\class\classpnp\class.c)
fdoData->LoggedTURFailureSinceLastIO = FALSE;
eax=00000001
0A1h - is an offset of LoggedTURFailureSinceLastIO field, so fdoData wrong pointer:
0: kd> dt classpnp!_CLASS_PRIVATE_FDO_DATA
+0x000 SqmData : Uint4B
+0x004 TrackingFlags : Uint4B
…
+0x0a1 LoggedTURFailureSinceLastIO : UChar
…
The thing most confused me: device object arrived to ClassIoComplete belongs to FltMgr:
0: kd> !devobj 85fbf868
Device object (85fbf868) is for:
\FileSystem\FltMgr DriverObject 85b0fe40
Current Irp 00000000 RefCount 0 Type 00000008 Flags 00040000
DevExt 85fbf920 DevObjExt 85fbf950
ExtensionFlags (0x00000800)
Unknown flags 0x00000800
AttachedTo (Lower) 85fc6020 \FileSystem\Ntfs
Device queue is not busy.
ClassIoComplete expects another type of device (with FUNCTIONAL_DEVICE_EXTENSION extension):
PFUNCTIONAL_DEVICE_EXTENSION fdoExtension = Fdo->DeviceExtension;
PCLASS_PRIVATE_FDO_DATA fdoData = fdoExtension->PrivateFdoData;
And after this instructions device extension has been taken from DeviceExtension of FltMgr device and fdoData==0x00000001 in my case, which is invalid pointer.
Irp is available, but it also contains unexpected device of FltMgr in stack:
0: kd> !irp 85d20e00
Irp is active with 11 stacks 8 is current (= 0x85d20f6c)
No Mdl: No System Buffer: Thread 86fe0b88: Irp stack trace. Pending has been returned
cmd flg cl Device File Completion-Context
[0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[f, 0] 0 0 851c5610 00000000 8b1db6d6-85f6d5b8
\Driver\atapi disk!DiskFlushComplete
Args: 00000000 00000000 00000000 85c48910
[9, 0] 0 e1 85fbf868 85e48d18 8af21a08-00000009 Success Error Cancel pending
\FileSystem\FltMgr volmgr!VmpRefCountCompletionRoutine
Args: 00000000 00000000 00000000 00000000
[9, 0] 0 e0 85f72030 85e48d18 8b075fff-00000000 Success Error Cancel
\Driver\volmgr Ntfs!NtfsFlushCompletionRoutine
Args: 00000000 00000000 00000000 00000000
[9, 0] 0 e0 85fc6020 85e48d18 8b02d4de-85e298d0 Success Error Cancel
\FileSystem\Ntfs fltmgr!FltpSynchronizedOperationCompletion
Args: 00000000 00000000 00000000 00000000
[9, 0] 0 0 85fbf868 85e48d18 00000000-00000000
\FileSystem\FltMgr
Args: 00000000 00000000 00000000 00000000
This situation is not reproducible, but appeared just after my minifilter was started. So I am trying to find a reason of this.
Any ideas or tips why such situation could appear? What can be checked in dump to specify problem?
Thanks.
Best regards,
Alexey Barabash