PAGE_FAULT_IN_NONPAGED_AREA bugchecks always indicates an invalid kernel
reference to kernel memory (though not all invalid kernel memory references
result in this bugcheck). While servicing the page fault, the page fault
handler will determine that the kernel address is bogus and crash the system
(what else could it do?).
KERNEL_MODE_EXCEPTION_NOT_HANDLED with STATUS_ACCESS_VIOLATION is slightly
different. The bugcheck code itself means that a structured exception was
raised in kernel mode (e.g. ExRaiseStatus) and no registered structured
exception handler caught the exception. Thus, the exception made it back to
the default exception handler, which simply bugchecks the system with the
NTSTATUS value passed to ExRaiseStatus.
Exceptions are raised for all sorts of reasons in the O/S, so it’s fairly
common to get a KERNEL_MODE_EXCEPTION_NOT_HANDLED bugcheck (for amusement
you can even generate your own by calling ExRaiseStatus without an exception
handler). However, the quote you cited is speaking specifically to fact that
exceptions are raised by the page fault handler as a result of references to
invalid *user* memory. That is to say, references to invalid memory in the
low 2GB (or 8TB) of the addressing space.
So, if I dereference an invalid user address from my driver, the page fault
handler will execute. The page fault handler looks at the faulting address,
determines that it falls within the user portion of the address space, and
calls ExRaiseStatus(STATUS_ACCESS_VIOLATION). If my driver wraps the user
mode access in an exception handler, I can catch the exception and return an
error to the user. If I fail to wrap the access in an exception handler,
I’ll get a KERNEL_MODE_EXCEPTION_NOT_HANDLED/STATUS_ACCESS_VIOLATION
bugcheck. Note that due to the fact that the NULL value happens to be in the
low part of the addressing space exceptions are also raised on NULL pointer
dereferences (assuming that you’re < DISPATCH_LEVEL).
Finally, just for completeness, it is possible for an access violation to
also be raised for some kernel addresses. This is far more rare in my
experience, but worth keeping in mind in case you see it.
-scott
–
Scott Noone
Consulting Associate and Chief System Problem Analyst
OSR Open Systems Resources, Inc.
http://www.osronline.com
wrote in message news:xxxxx@ntdev…
Hi
Can you please tell me the differences between
- PAGE_FAULT_IN_NONPAGED_AREA
and
- KERNEL_MODE_EXCEPTION_NOT_HANDLED with STATUS_ACCESS_VIOLATION?
I am asking this because;
-
For PAGE_FAULT_IN_NONPAGED_AREA , this link (
http://www.osronline.com/article.cfm?article=335 ) says that: “The most
common reason for this bugcheck is a driver de-referencing a bad pointer.”
-
For KERNEL_MODE_EXCEPTION_NOT_HANDLED with STATUS_ACCESS_VIOLATION this
link( http://www.osronline.com/article.cfm?id=49 ) says that: “As for
STATUS_ ACCESS_VIOLATION, it almost always means a thread tried to
dereference an uninitialized, NULL, or corrupted pointer.”