DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS

WINDBG
1

Hi All,

Here is a call stack for a a bug. I looked thru the pMDL, see the process (
EPROCESS *) is
Indeed afg.exe, the current process.

It seems like when it was getting exited ( kill … ), the system was trying
to clean the address space, and found
That one of the user page is locked.

Any help on what might be the case !.

Thanx as always

-prokash

//call stack
kd> !analyze -v
****************************************************************************
***
*
*
* Bugcheck Analysis
*
*
*
****************************************************************************
***

DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS (cb)
Caused by a driver not cleaning up completely after an I/O.
When possible, the guilty driver’s name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: f485ce71, The calling address in the driver that locked the pages or
if the
IO manager locked the pages this points to the dispatch routine of
the top driver on the stack to which the IRP was sent.
Arg2: f4853e83, The caller of the calling address in the driver that locked
the
pages. If the IO manager locked the pages this points to the device
object of the top driver on the stack to which the IRP was sent.
Arg3: 81d50318, A pointer to the MDL containing the locked pages.
Arg4: 00000001, The number of locked pages.

Debugging Details:

FAULTING_MODULE:
afd!AfdSuperAccept+fe
f485ce71 834dfcff or dword ptr [ebp-0x4],0xffffffff

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: CB

LAST_CONTROL_TRANSFER: from 80505272 to 804f14ff

ChildEBP RetAddr Args to Child

00 f3e42c18 80505272 000000cb f485ce71 f4853e83 nt!KeBugCheckEx+0x19 (FPO:
[Non-Fpo])
01 f3e42c60 805a6ff1 fffffff1 81c48da8 81c48ff0
nt!MmCleanProcessAddressSpace+0x33e (FPO: [Non-Fpo])
02 f3e42d08 805a7192 00000000 81c48da8 00000000 nt!PspExitThread+0x668 (FPO:
[Non-Fpo])
03 f3e42d28 805a7365 81c48da8 00000000 f3e42d64
nt!PspTerminateThreadByPointer+0x50 (FPO: [Non-Fpo])
04 f3e42d54 8052a3c1 00000000 00000000 80542240 nt!NtTerminateProcess+0x103
(FPO: [Non-Fpo])
05 f3e42d54 7ffe0304 00000000 00000000 80542240 nt!KiSystemService+0xc4
(FPO: [0,0] TrapFrame @ f3e42d64)
06 0006fef0 00000000 00000000 00000000 00000000
SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])

kd> !process
PROCESS 81ce69f8 SessionId: 0 Cid: 05b8 Peb: 7ffdf000 ParentCid: 0248
DirBase: 1adea000 ObjectTable: 00000000 TableSize: 0.
Image: alg.exe
VadRoot 00000000 Vads 0 Clone 0 Private 0. Modified 8. Locked 1.
DeviceMap e1b440d0
Token e23dbd08
unable to read memory @ 7ffe0000
ElapsedTime 1189:01:19.0207
UserTime 0:00:00.0050
KernelTime 0:00:00.0080
QuotaPoolUsage[PagedPool] 328
QuotaPoolUsage[NonPagedPool] 304
Working Set Sizes (now,min,max) (5, 50, 345) (20KB, 200KB, 1380KB)
PeakWorkingSetSize 1082
VirtualSize 17 Mb
PeakVirtualSize 39 Mb
PageFaultCount 1147
MemoryPriority BACKGROUND
BasePriority 8
CommitCharge 0

2

A good place to look is at IRP completion. This message pops when you have not completed an IRP but the owning process terminates. You may need a cancel routine, or you may need to fix the cancel routine.

Gary G. Little
Have Computere, will travel …
909-551-2105
909-698-3191
“Prokash Sinha” wrote in message news:xxxxx@windbg…
Hi All,

Here is a call stack for a a bug. I looked thru the pMDL, see the process ( EPROCESS *) is

Indeed afg.exe, the current process.

It seems like when it was getting exited ( kill … ), the system was trying to clean the address space, and found

That one of the user page is locked.

Any help on what might be the case !.

Thanx as always

-prokash

//call stack

kd> !analyze -v

Bugcheck Analysis





DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS (cb)

Caused by a driver not cleaning up completely after an I/O.

When possible, the guilty driver’s name (Unicode string) is printed on

the bugcheck screen and saved in KiBugCheckDriver.

Arguments:

Arg1: f485ce71, The calling address in the driver that locked the pages or if the

IO manager locked the pages this points to the dispatch routine of

the top driver on the stack to which the IRP was sent.

Arg2: f4853e83, The caller of the calling address in the driver that locked the

pages. If the IO manager locked the pages this points to the device

object of the top driver on the stack to which the IRP was sent.

Arg3: 81d50318, A pointer to the MDL containing the locked pages.

Arg4: 00000001, The number of locked pages.

Debugging Details:

------------------

FAULTING_MODULE:

afd!AfdSuperAccept+fe

f485ce71 834dfcff or dword ptr [ebp-0x4],0xffffffff

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: CB

LAST_CONTROL_TRANSFER: from 80505272 to 804f14ff

# ChildEBP RetAddr Args to Child

00 f3e42c18 80505272 000000cb f485ce71 f4853e83 nt!KeBugCheckEx+0x19 (FPO: [Non-Fpo])

01 f3e42c60 805a6ff1 fffffff1 81c48da8 81c48ff0 nt!MmCleanProcessAddressSpace+0x33e (FPO: [Non-Fpo])

02 f3e42d08 805a7192 00000000 81c48da8 00000000 nt!PspExitThread+0x668 (FPO: [Non-Fpo])

03 f3e42d28 805a7365 81c48da8 00000000 f3e42d64 nt!PspTerminateThreadByPointer+0x50 (FPO: [Non-Fpo])

04 f3e42d54 8052a3c1 00000000 00000000 80542240 nt!NtTerminateProcess+0x103 (FPO: [Non-Fpo])

05 f3e42d54 7ffe0304 00000000 00000000 80542240 nt!KiSystemService+0xc4 (FPO: [0,0] TrapFrame @ f3e42d64)

06 0006fef0 00000000 00000000 00000000 00000000 SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])

kd> !process

PROCESS 81ce69f8 SessionId: 0 Cid: 05b8 Peb: 7ffdf000 ParentCid: 0248

DirBase: 1adea000 ObjectTable: 00000000 TableSize: 0.

Image: alg.exe

VadRoot 00000000 Vads 0 Clone 0 Private 0. Modified 8. Locked 1.

DeviceMap e1b440d0

Token e23dbd08

unable to read memory @ 7ffe0000

ElapsedTime 1189:01:19.0207

UserTime 0:00:00.0050

KernelTime 0:00:00.0080

QuotaPoolUsage[PagedPool] 328

QuotaPoolUsage[NonPagedPool] 304

Working Set Sizes (now,min,max) (5, 50, 345) (20KB, 200KB, 1380KB)

PeakWorkingSetSize 1082

VirtualSize 17 Mb

PeakVirtualSize 39 Mb

PageFaultCount 1147

MemoryPriority BACKGROUND

BasePriority 8

CommitCharge 0

3

Hi All,

Here is a call stack for a a bug. I looked thru the pMDL, see the process
( EPROCESS *) is

Indeed afg.exe, the current process.

It seems like when it was getting exited ( kill … ), the system was trying
to clean the address space, and found

That one of the user page is locked.

Any help on what might be the case !.

Thanx as always

-prokash

//call stack

kd> !analyze -v

*******************************************************************************

*
*

* Bugcheck Analysis
*

*
*

*******************************************************************************

DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS (cb)

Caused by a driver not cleaning up completely after an I/O.

When possible, the guilty driver’s name (Unicode string) is printed on

the bugcheck screen and saved in KiBugCheckDriver.

Arguments:

Arg1: f485ce71, The calling address in the driver that locked the pages or
if the

IO manager locked the pages this points to the dispatch routine of

the top driver on the stack to which the IRP was sent.

Arg2: f4853e83, The caller of the calling address in the driver that
locked the

pages. If the IO manager locked the pages this points to the device

object of the top driver on the stack to which the IRP was sent.

Arg3: 81d50318, A pointer to the MDL containing the locked pages.

Arg4: 00000001, The number of locked pages.

Debugging Details:

FAULTING_MODULE:

afd!AfdSuperAccept+fe

f485ce71 834dfcff or dword ptr [ebp-0x4],0xffffffff

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: CB

LAST_CONTROL_TRANSFER: from 80505272 to 804f14ff

ChildEBP RetAddr Args to Child

00 f3e42c18 80505272 000000cb f485ce71 f4853e83 nt!KeBugCheckEx+0x19 (FPO:
[Non-Fpo])

01 f3e42c60 805a6ff1 fffffff1 81c48da8 81c48ff0
nt!MmCleanProcessAddressSpace+0x33e (FPO: [Non-Fpo])

02 f3e42d08 805a7192 00000000 81c48da8 00000000 nt!PspExitThread+0x668
(FPO: [Non-Fpo])

03 f3e42d28 805a7365 81c48da8 00000000 f3e42d64
nt!PspTerminateThreadByPointer+0x50 (FPO: [Non-Fpo])

04 f3e42d54 8052a3c1 00000000 00000000 80542240
nt!NtTerminateProcess+0x103 (FPO: [Non-Fpo])

05 f3e42d54 7ffe0304 00000000 00000000 80542240 nt!KiSystemService+0xc4
(FPO: [0,0] TrapFrame @ f3e42d64)

06 0006fef0 00000000 00000000 00000000 00000000
SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])

kd> !process

PROCESS 81ce69f8 SessionId: 0 Cid: 05b8 Peb: 7ffdf000 ParentCid:
0248

DirBase: 1adea000 ObjectTable: 00000000 TableSize: 0.

Image: alg.exe

VadRoot 00000000 Vads 0 Clone 0 Private 0. Modified 8. Locked 1.

DeviceMap e1b440d0

Token e23dbd08

unable to read memory @ 7ffe0000

ElapsedTime 1189:01:19.0207

UserTime 0:00:00.0050

KernelTime 0:00:00.0080

QuotaPoolUsage[PagedPool] 328

QuotaPoolUsage[NonPagedPool] 304

Working Set Sizes (now,min,max) (5, 50, 345) (20KB, 200KB, 1380KB)

PeakWorkingSetSize 1082

VirtualSize 17 Mb

PeakVirtualSize 39 Mb

PageFaultCount 1147

MemoryPriority BACKGROUND

BasePriority 8

CommitCharge 0

4

Thanx a bunch.

I am trying to find the irp still pending …

-prokash

-----Original Message-----
From: Gary G. Little [mailto:xxxxx@inland.net]
Sent: Monday, September 09, 2002 10:06 AM
To: Kernel Debugging Interest List
Subject: [windbg] Re: DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS

A good place to look is at IRP completion. This message pops when you have
not completed an IRP but the owning process terminates. You may need a
cancel routine, or you may need to fix the cancel routine.

Gary G. Little
Have Computere, will travel …
909-551-2105
909-698-3191
“Prokash Sinha” > wrote in
message news:xxxxx@windbg news:xxxxx …
Hi All,

Here is a call stack for a a bug. I looked thru the pMDL, see the process (
EPROCESS *) is
Indeed afg.exe, the current process.

It seems like when it was getting exited ( kill … ), the system was trying
to clean the address space, and found
That one of the user page is locked.

Any help on what might be the case !.

Thanx as always

-prokash

//call stack
kd> !analyze -v
*******************************************************************


Bugcheck Analysis



*************************************************************************

DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS (cb)
Caused by a driver not cleaning up completely after an I/O.
When possible, the guilty driver’s name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: f485ce71, The calling address in the driver that locked the pages or
if the
IO manager locked the pages this points to the dispatch routine of
the top driver on the stack to which the IRP was sent.
Arg2: f4853e83, The caller of the calling address in the driver that locked
the
pages. If the IO manager locked the pages this points to the device
object of the top driver on the stack to which the IRP was sent.
Arg3: 81d50318, A pointer to the MDL containing the locked pages.
Arg4: 00000001, The number of locked pages.

Debugging Details:
------------------

FAULTING_MODULE:
afd!AfdSuperAccept+fe
f485ce71 834dfcff or dword ptr [ebp-0x4],0xffffffff

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: CB

LAST_CONTROL_TRANSFER: from 80505272 to 804f14ff

# ChildEBP RetAddr Args to Child
00 f3e42c18 80505272 000000cb f485ce71 f4853e83 nt!KeBugCheckEx+0x19 (FPO:
[Non-Fpo])
01 f3e42c60 805a6ff1 fffffff1 81c48da8 81c48ff0
nt!MmCleanProcessAddressSpace+0x33e (FPO: [Non-Fpo])
02 f3e42d08 805a7192 00000000 81c48da8 00000000 nt!PspExitThread+0x668 (FPO:
[Non-Fpo])
03 f3e42d28 805a7365 81c48da8 00000000 f3e42d64
nt!PspTerminateThreadByPointer+0x50 (FPO: [Non-Fpo])
04 f3e42d54 8052a3c1 00000000 00000000 80542240 nt!NtTerminateProcess+0x103
(FPO: [Non-Fpo])
05 f3e42d54 7ffe0304 00000000 00000000 80542240 nt!KiSystemService+0xc4
(FPO: [0,0] TrapFrame @ f3e42d64)
06 0006fef0 00000000 00000000 00000000 00000000
SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])

kd> !process
PROCESS 81ce69f8 SessionId: 0 Cid: 05b8 Peb: 7ffdf000 ParentCid: 0248
DirBase: 1adea000 ObjectTable: 00000000 TableSize: 0.
Image: alg.exe
VadRoot 00000000 Vads 0 Clone 0 Private 0. Modified 8. Locked 1.
DeviceMap e1b440d0
Token e23dbd08
unable to read memory @ 7ffe0000
ElapsedTime 1189:01:19.0207
UserTime 0:00:00.0050
KernelTime 0:00:00.0080
QuotaPoolUsage[PagedPool] 328
QuotaPoolUsage[NonPagedPool] 304
Working Set Sizes (now,min,max) (5, 50, 345) (20KB, 200KB, 1380KB)
PeakWorkingSetSize 1082
VirtualSize 17 Mb
PeakVirtualSize 39 Mb
PageFaultCount 1147
MemoryPriority BACKGROUND
BasePriority 8
CommitCharge 0

—
You are currently subscribed to windbg as: xxxxx@zonelabs.com
To unsubscribe send a blank email to %%email.unsub%%</news:xxxxx>