How can i detect the kernel stack space?

NTFSD
1

Dear All,

My file system filter driver running on Windows 2000 Professional SP4
with an Anti-virus product it works fine usually.But it crash on another
PC with same hardware environment and configuration. The bugcheck code:

0x0000007f (0x00000008, 0x00000000, 0x00000000, 0x00000000)
UNEXPECTED_KERNEL_MODE_TRAP

As my experience this is a kernel stack overflow.The DbgView.exe shows
NTFS: stack space low.Posting create request.I search for the list of
ntfsd,i found that Rohit Dhamija’s question same to me.

In his mail tony said you can also add stack size detection code and
POST(When safe) operations that have used"too much"stack.

How can i detect the kernel stack space?

Best Regards
Ken Wang

2

IoGetStackLimits

wrote in message news:xxxxx@ntfsd…
> Dear All,
>
> My file system filter driver running on Windows 2000 Professional SP4
> with an Anti-virus product it works fine usually.But it crash on another
> PC with same hardware environment and configuration. The bugcheck code:
>
> 0x0000007f (0x00000008, 0x00000000, 0x00000000, 0x00000000)
> UNEXPECTED_KERNEL_MODE_TRAP
>
> As my experience this is a kernel stack overflow.The DbgView.exe shows
> NTFS: stack space low.Posting create request.I search for the list of
> ntfsd,i found that Rohit Dhamija’s question same to me.
>
> In his mail tony said you can also add stack size detection code and
> POST(When safe) operations that have used"too much"stack.
>
> How can i detect the kernel stack space?
>
> Best Regards
> Ken Wang
>
>
>

3

Check out the OSR article Stacking the Deck, it also mentions
IoGetRemainingStackSize.

/Daniel

wrote in message news:xxxxx@ntfsd…
> Dear All,
>
> My file system filter driver running on Windows 2000 Professional SP4
> with an Anti-virus product it works fine usually.But it crash on another
> PC with same hardware environment and configuration. The bugcheck code:
>
> 0x0000007f (0x00000008, 0x00000000, 0x00000000, 0x00000000)
> UNEXPECTED_KERNEL_MODE_TRAP
>
> As my experience this is a kernel stack overflow.The DbgView.exe shows
> NTFS: stack space low.Posting create request.I search for the list of
> ntfsd,i found that Rohit Dhamija’s question same to me.
>
> In his mail tony said you can also add stack size detection code and
> POST(When safe) operations that have used"too much"stack.
>
> How can i detect the kernel stack space?
>
> Best Regards
> Ken Wang
>
>
>

4

Doh! That’s the right one :slight_smile:

“Daniel Terhell” wrote in message
news:xxxxx@ntfsd…
> Check out the OSR article Stacking the Deck, it also mentions
> IoGetRemainingStackSize.
>
> /Daniel
>
>
> wrote in message news:xxxxx@ntfsd…
>> Dear All,
>>
>> My file system filter driver running on Windows 2000 Professional SP4
>> with an Anti-virus product it works fine usually.But it crash on another
>> PC with same hardware environment and configuration. The bugcheck code:
>>
>> 0x0000007f (0x00000008, 0x00000000, 0x00000000, 0x00000000)
>> UNEXPECTED_KERNEL_MODE_TRAP
>>
>> As my experience this is a kernel stack overflow.The DbgView.exe shows
>> NTFS: stack space low.Posting create request.I search for the list of
>> ntfsd,i found that Rohit Dhamija’s question same to me.
>>
>> In his mail tony said you can also add stack size detection code and
>> POST(When safe) operations that have used"too much"stack.
>>
>> How can i detect the kernel stack space?
>>
>> Best Regards
>> Ken Wang
>>
>>
>>
>
>
>

5

> My file system filter driver running on Windows 2000 Professional SP4

with an Anti-virus product it works fine usually.But it crash on another
PC with same hardware environment and configuration. The bugcheck code:

0x0000007f (0x00000008, 0x00000000, 0x00000000, 0x00000000)
UNEXPECTED_KERNEL_MODE_TRAP

As my experience this is a kernel stack overflow.

Yes.

Use Ex/IoQueueWorkItem to switch to another stack.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com