How to find which driver cause CRITICAL_OBJECT_TERMINATION

David_Wu · March 24, 2007, 9:20am

Hi All,
This question might be a little bit off topic. Any help will be very
appreciated.
I got random bug check 0xF4 (CRITICAL_OBJECT_TERMINATION)on my system.
csrss.exe
took an unexpected exception, and, it terminated itself. Incidentally
csrss.exe is a critical process, and, the machine bugchecked.
How can I recover the exception record and the context record from the stack
and finally find out which driver cause this CRITICAL_OBJECT_TERMINATION?

0: kd> !analyze -v
****************************************************************************
***
*
*
* Bugcheck Analysis
*
*
*
****************************************************************************
***

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or
been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 00000003, Process
Arg2: 86143da0, Terminating object
Arg3: 86143f14, Process image file name
Arg4: 80604528, Explanatory message (ascii)

Debugging Details:

PROCESS_OBJECT: 86143da0

IMAGE_NAME: csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: csrss

FAULTING_MODULE: 00000000

PROCESS_NAME: csrss.exe

EXCEPTION_RECORD: f771d9d8 – (.exr fffffffff771d9d8)
ExceptionAddress: 75b7b1c1
ExceptionCode: c0000006 (In-page I/O error)
ExceptionFlags: 00000000
NumberParameters: 3
Parameter[0]: 00000000
Parameter[1]: 75b7b1c1
Parameter[2]: c000000e
Inpage operation failed at 75b7b1c1, due to I/O error c000000e

EXCEPTION_CODE: (NTSTATUS) 0xc000000e - A device which does not exist was
specified.

DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO

ERROR_CODE: (NTSTATUS) 0xc0000006 - The instruction at “0x%08lx” referenced
memory at “0x%08lx”. The required data was not placed into memory because of
an I/O error status of “0x%08lx”.

IO_ERROR: (NTSTATUS) 0xc000000e - A device which does not exist was
specified.

EXCEPTION_STR: 0xc0000006_c000000e

FAULTING_IP:
+75b7b1c1
75b7b1c1 ?? ???

BUGCHECK_STR: 0xF4_IOERR_C000000E

STACK_TEXT:
f771d520 8063423d 000000f4 00000003 86143da0 nt!KeBugCheckEx+0x1b
f771d544 806044e6 80604528 86143da0 86143f14 nt!PspCatchCriticalBreak+0x75
f771d574 804dd99f 86143fe8 c0000006 f771d9b0 nt!NtTerminateProcess+0x7d
f771d574 804e46a7 86143fe8 c0000006 f771d9b0 nt!KiFastCallEntry+0xfc
f771d5f4 80522146 ffffffff c0000006 f771d9f8 nt!ZwTerminateProcess+0x11
f771d9b0 80517e65 f771d9d8 00000000 f771dd64 nt!KiDispatchException+0x3a0
f771dd34 804e12a8 0069fbe8 0069fc08 00000000 nt!KiRaiseException+0x175
f771dd50 804dd99f 0069fbe8 0069fc08 00000000 nt!NtRaiseException+0x33
f771dd50 75b7b1c1 0069fbe8 0069fc08 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0069fff4 00000000 00000000 00000000 00000000 0x75b7b1c1

STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

FAILURE_BUCKET_ID: 0xF4_IOERR_C000000E_IMAGE_csrss.exe

BUCKET_ID: 0xF4_IOERR_C000000E_IMAGE_csrss.exe

Followup: MachineOwner

Frank_Friemel · March 24, 2007, 3:23pm

David,

in yor case try

.exptr f771d9d8

which throws the context record pointer in some of its output lines …then
type

.cxr

---------------------------------------------------------------
“David Wu” wrote news:xxxxx@ntfsd…
Hi All,
This question might be a little bit off topic. Any help will be very
appreciated.
I got random bug check 0xF4 (CRITICAL_OBJECT_TERMINATION)on my system.
csrss.exe
took an unexpected exception, and, it terminated itself. Incidentally
csrss.exe is a critical process, and, the machine bugchecked.
How can I recover the exception record and the context record from the stack
and finally find out which driver cause this CRITICAL_OBJECT_TERMINATION?

0: kd> !analyze -v
*******************************************************************

Bugcheck Analysis

*************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or
been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 00000003, Process
Arg2: 86143da0, Terminating object
Arg3: 86143f14, Process image file name
Arg4: 80604528, Explanatory message (ascii)

Debugging Details:
------------------

PROCESS_OBJECT: 86143da0

IMAGE_NAME: csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: csrss

FAULTING_MODULE: 00000000

PROCESS_NAME: csrss.exe

EXCEPTION_RECORD: f771d9d8 – (.exr fffffffff771d9d8)
ExceptionAddress: 75b7b1c1
ExceptionCode: c0000006 (In-page I/O error)
ExceptionFlags: 00000000
NumberParameters: 3
Parameter[0]: 00000000
Parameter[1]: 75b7b1c1
Parameter[2]: c000000e
Inpage operation failed at 75b7b1c1, due to I/O error c000000e

EXCEPTION_CODE: (NTSTATUS) 0xc000000e - A device which does not exist was
specified.

DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO

ERROR_CODE: (NTSTATUS) 0xc0000006 - The instruction at “0x%08lx” referenced
memory at “0x%08lx”. The required data was not placed into memory because of
an I/O error status of “0x%08lx”.

IO_ERROR: (NTSTATUS) 0xc000000e - A device which does not exist was
specified.

EXCEPTION_STR: 0xc0000006_c000000e

FAULTING_IP:
+75b7b1c1
75b7b1c1 ?? ???

BUGCHECK_STR: 0xF4_IOERR_C000000E

STACK_TEXT:
f771d520 8063423d 000000f4 00000003 86143da0 nt!KeBugCheckEx+0x1b
f771d544 806044e6 80604528 86143da0 86143f14 nt!PspCatchCriticalBreak+0x75
f771d574 804dd99f 86143fe8 c0000006 f771d9b0 nt!NtTerminateProcess+0x7d
f771d574 804e46a7 86143fe8 c0000006 f771d9b0 nt!KiFastCallEntry+0xfc
f771d5f4 80522146 ffffffff c0000006 f771d9f8 nt!ZwTerminateProcess+0x11
f771d9b0 80517e65 f771d9d8 00000000 f771dd64 nt!KiDispatchException+0x3a0
f771dd34 804e12a8 0069fbe8 0069fc08 00000000 nt!KiRaiseException+0x175
f771dd50 804dd99f 0069fbe8 0069fc08 00000000 nt!NtRaiseException+0x33
f771dd50 75b7b1c1 0069fbe8 0069fc08 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0069fff4 00000000 00000000 00000000 00000000 0x75b7b1c1

STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

FAILURE_BUCKET_ID: 0xF4_IOERR_C000000E_IMAGE_csrss.exe

BUCKET_ID: 0xF4_IOERR_C000000E_IMAGE_csrss.exe

Followup: MachineOwner
---------

David_Wu · March 24, 2007, 9:54pm

Hi Frank,
I try what you said and get this:
0: kd> .exptr f771d9d8

----- Exception record at c0000006:
ExceptionAddress: 08670f67
ExceptionCode: d8670f67
ExceptionFlags: e8670f67
NumberParameters: 409407404
Parameter[0]: 28670f74
Parameter[1]: 38670f74
Parameter[2]: 48670f74
Parameter[3]: 58670f70
Parameter[4]: 68670f70
Parameter[5]: 78670f70
Parameter[6]: 88670f70
Parameter[7]: 98670f70
Parameter[8]: a8670f70
Parameter[9]: b8670f74
Parameter[10]: c8670f74
Parameter[11]: d8670f74
Parameter[12]: e8670f74
Parameter[13]: f8670f74
Parameter[14]: 08670f74

But .cxr can not get further info from any of number.
Any suggestion?

Thanks

David

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of frank
Sent: Saturday, March 24, 2007 2:23 PM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] How to find which driver cause
CRITICAL_OBJECT_TERMINATION

David,

in yor case try

.exptr f771d9d8

which throws the context record pointer in some of its output lines …then
type

.cxr

---------------------------------------------------------------
“David Wu” wrote news:xxxxx@ntfsd…
Hi All, This question might be a little bit off topic. Any help will be very
appreciated. I got random bug check 0xF4 (CRITICAL_OBJECT_TERMINATION)on my
system. csrss.exe took an unexpected exception, and, it terminated itself.
Incidentally csrss.exe is a critical process, and, the machine bugchecked.
How can I recover the exception record and the context record from the stack
and finally find out which driver cause this CRITICAL_OBJECT_TERMINATION?

0: kd> !analyze -v
*******************************************************************

Bugcheck Analysis

*************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or
been terminated. Several processes and threads are necessary for the
operation of the system; when they are terminated (for any reason), the
system can no longer function.
Arguments:
Arg1: 00000003, Process
Arg2: 86143da0, Terminating object
Arg3: 86143f14, Process image file name
Arg4: 80604528, Explanatory message (ascii)

Debugging Details:
------------------

PROCESS_OBJECT: 86143da0

IMAGE_NAME: csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: csrss

FAULTING_MODULE: 00000000

PROCESS_NAME: csrss.exe

EXCEPTION_RECORD: f771d9d8 – (.exr fffffffff771d9d8)
ExceptionAddress: 75b7b1c1
ExceptionCode: c0000006 (In-page I/O error)
ExceptionFlags: 00000000
NumberParameters: 3
Parameter[0]: 00000000
Parameter[1]: 75b7b1c1
Parameter[2]: c000000e
Inpage operation failed at 75b7b1c1, due to I/O error c000000e

EXCEPTION_CODE: (NTSTATUS) 0xc000000e - A device which does not exist was
specified.

DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO

ERROR_CODE: (NTSTATUS) 0xc0000006 - The instruction at “0x%08lx” referenced
memory at “0x%08lx”. The required data was not placed into memory because of
an I/O error status of “0x%08lx”.

IO_ERROR: (NTSTATUS) 0xc000000e - A device which does not exist was
specified.

EXCEPTION_STR: 0xc0000006_c000000e

FAULTING_IP:
+75b7b1c1
75b7b1c1 ?? ???

BUGCHECK_STR: 0xF4_IOERR_C000000E

STACK_TEXT:
f771d520 8063423d 000000f4 00000003 86143da0 nt!KeBugCheckEx+0x1b
f771d544 806044e6 80604528 86143da0 86143f14 nt!PspCatchCriticalBreak+0x75
f771d574 804dd99f 86143fe8 c0000006 f771d9b0 nt!NtTerminateProcess+0x7d
f771d574 804e46a7 86143fe8 c0000006 f771d9b0 nt!KiFastCallEntry+0xfc
f771d5f4 80522146 ffffffff c0000006 f771d9f8 nt!ZwTerminateProcess+0x11
f771d9b0 80517e65 f771d9d8 00000000 f771dd64 nt!KiDispatchException+0x3a0
f771dd34 804e12a8 0069fbe8 0069fc08 00000000 nt!KiRaiseException+0x175
f771dd50 804dd99f 0069fbe8 0069fc08 00000000 nt!NtRaiseException+0x33
f771dd50 75b7b1c1 0069fbe8 0069fc08 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0069fff4 00000000 00000000 00000000 00000000 0x75b7b1c1

STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

FAILURE_BUCKET_ID: 0xF4_IOERR_C000000E_IMAGE_csrss.exe

BUCKET_ID: 0xF4_IOERR_C000000E_IMAGE_csrss.exe

Followup: MachineOwner
---------

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@sbcglobal.net To
unsubscribe send a blank email to xxxxx@lists.osr.com

Frank_Friemel · March 26, 2007, 3:44am

Sorry, my suggestion was obviously wrong.

What is the output of

.exr f771d9d8

Your context record may be at 0069fc08

“David Wu” wrote news:xxxxx@ntfsd…
Hi Frank,
I try what you said and get this:
0: kd> .exptr f771d9d8

----- Exception record at c0000006:
ExceptionAddress: 08670f67
ExceptionCode: d8670f67
ExceptionFlags: e8670f67
NumberParameters: 409407404
Parameter[0]: 28670f74
Parameter[1]: 38670f74
Parameter[2]: 48670f74
Parameter[3]: 58670f70
Parameter[4]: 68670f70
Parameter[5]: 78670f70
Parameter[6]: 88670f70
Parameter[7]: 98670f70
Parameter[8]: a8670f70
Parameter[9]: b8670f74
Parameter[10]: c8670f74
Parameter[11]: d8670f74
Parameter[12]: e8670f74
Parameter[13]: f8670f74
Parameter[14]: 08670f74

But .cxr can not get further info from any of number.
Any suggestion?

Thanks

David

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of frank
Sent: Saturday, March 24, 2007 2:23 PM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] How to find which driver cause
CRITICAL_OBJECT_TERMINATION

David,

in yor case try

.exptr f771d9d8

which throws the context record pointer in some of its output lines …then
type

.cxr

---------------------------------------------------------------
“David Wu” wrote news:xxxxx@ntfsd…
Hi All, This question might be a little bit off topic. Any help will be very
appreciated. I got random bug check 0xF4 (CRITICAL_OBJECT_TERMINATION)on my
system. csrss.exe took an unexpected exception, and, it terminated itself.
Incidentally csrss.exe is a critical process, and, the machine bugchecked.
How can I recover the exception record and the context record from the stack
and finally find out which driver cause this CRITICAL_OBJECT_TERMINATION?

0: kd> !analyze -v
*******************************************************************

Bugcheck Analysis

*************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or
been terminated. Several processes and threads are necessary for the
operation of the system; when they are terminated (for any reason), the
system can no longer function.
Arguments:
Arg1: 00000003, Process
Arg2: 86143da0, Terminating object
Arg3: 86143f14, Process image file name
Arg4: 80604528, Explanatory message (ascii)

Debugging Details:
------------------

PROCESS_OBJECT: 86143da0

IMAGE_NAME: csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: csrss

FAULTING_MODULE: 00000000

PROCESS_NAME: csrss.exe

EXCEPTION_RECORD: f771d9d8 – (.exr fffffffff771d9d8)
ExceptionAddress: 75b7b1c1
ExceptionCode: c0000006 (In-page I/O error)
ExceptionFlags: 00000000
NumberParameters: 3
Parameter[0]: 00000000
Parameter[1]: 75b7b1c1
Parameter[2]: c000000e
Inpage operation failed at 75b7b1c1, due to I/O error c000000e

EXCEPTION_CODE: (NTSTATUS) 0xc000000e - A device which does not exist was
specified.

DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO

ERROR_CODE: (NTSTATUS) 0xc0000006 - The instruction at “0x%08lx” referenced
memory at “0x%08lx”. The required data was not placed into memory because of
an I/O error status of “0x%08lx”.

IO_ERROR: (NTSTATUS) 0xc000000e - A device which does not exist was
specified.

EXCEPTION_STR: 0xc0000006_c000000e

FAULTING_IP:
+75b7b1c1
75b7b1c1 ?? ???

BUGCHECK_STR: 0xF4_IOERR_C000000E

STACK_TEXT:
f771d520 8063423d 000000f4 00000003 86143da0 nt!KeBugCheckEx+0x1b
f771d544 806044e6 80604528 86143da0 86143f14 nt!PspCatchCriticalBreak+0x75
f771d574 804dd99f 86143fe8 c0000006 f771d9b0 nt!NtTerminateProcess+0x7d
f771d574 804e46a7 86143fe8 c0000006 f771d9b0 nt!KiFastCallEntry+0xfc
f771d5f4 80522146 ffffffff c0000006 f771d9f8 nt!ZwTerminateProcess+0x11
f771d9b0 80517e65 f771d9d8 00000000 f771dd64 nt!KiDispatchException+0x3a0
f771dd34 804e12a8 0069fbe8 0069fc08 00000000 nt!KiRaiseException+0x175
f771dd50 804dd99f 0069fbe8 0069fc08 00000000 nt!NtRaiseException+0x33
f771dd50 75b7b1c1 0069fbe8 0069fc08 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0069fff4 00000000 00000000 00000000 00000000 0x75b7b1c1

STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

FAILURE_BUCKET_ID: 0xF4_IOERR_C000000E_IMAGE_csrss.exe

BUCKET_ID: 0xF4_IOERR_C000000E_IMAGE_csrss.exe

Followup: MachineOwner
---------

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@sbcglobal.net To
unsubscribe send a blank email to xxxxx@lists.osr.com

David_Wu · March 26, 2007, 11:36am

Hi Frank,
I run .exr f771d9d8, here is output:

0: kd> .exr f771d9d8
ExceptionAddress: 75b7b1c1
ExceptionCode: c0000006 (In-page I/O error)
ExceptionFlags: 00000000
NumberParameters: 3
Parameter[0]: 00000000
Parameter[1]: 75b7b1c1
Parameter[2]: c000000e
Inpage operation failed at 75b7b1c1, due to I/O error c000000e

But still, .cxr on any of number including 0069fc08 and 75b7b1c1 will give following out put:
Unable to read context, HRESULT 0x80004002

Did I make something wrong?

Thanks

David

Sorry, my suggestion was obviously wrong.

What is the output of

.exr f771d9d8

Your context record may be at 0069fc08

“David Wu” wrote news:xxxxx@ntfsd…
Hi Frank,
I try what you said and get this:
0: kd> .exptr f771d9d8

----- Exception record at c0000006:
ExceptionAddress: 08670f67
ExceptionCode: d8670f67
ExceptionFlags: e8670f67
NumberParameters: 409407404
Parameter[0]: 28670f74
Parameter[1]: 38670f74
Parameter[2]: 48670f74
Parameter[3]: 58670f70
Parameter[4]: 68670f70
Parameter[5]: 78670f70
Parameter[6]: 88670f70
Parameter[7]: 98670f70
Parameter[8]: a8670f70
Parameter[9]: b8670f74
Parameter[10]: c8670f74
Parameter[11]: d8670f74
Parameter[12]: e8670f74
Parameter[13]: f8670f74
Parameter[14]: 08670f74

But .cxr can not get further info from any of number.
Any suggestion?

Thanks

David

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of frank
Sent: Saturday, March 24, 2007 2:23 PM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] How to find which driver cause
CRITICAL_OBJECT_TERMINATION

David,

in yor case try

.exptr f771d9d8

which throws the context record pointer in some of its output lines …then
type

.cxr

---------------------------------------------------------------
“David Wu” wrote news:xxxxx@ntfsd…
Hi All, This question might be a little bit off topic. Any help will be very
appreciated. I got random bug check 0xF4 (CRITICAL_OBJECT_TERMINATION)on my
system. csrss.exe took an unexpected exception, and, it terminated itself.
Incidentally csrss.exe is a critical process, and, the machine bugchecked.
How can I recover the exception record and the context record from the stack
and finally find out which driver cause this CRITICAL_OBJECT_TERMINATION?

0: kd> !analyze -v
*******************************************************************

Bugcheck Analysis

*************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or
been terminated. Several processes and threads are necessary for the
operation of the system; when they are terminated (for any reason), the
system can no longer function.
Arguments:
Arg1: 00000003, Process
Arg2: 86143da0, Terminating object
Arg3: 86143f14, Process image file name
Arg4: 80604528, Explanatory message (ascii)

Debugging Details:
------------------

PROCESS_OBJECT: 86143da0

IMAGE_NAME: csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: csrss

FAULTING_MODULE: 00000000

PROCESS_NAME: csrss.exe

EXCEPTION_RECORD: f771d9d8 – (.exr fffffffff771d9d8)
ExceptionAddress: 75b7b1c1
ExceptionCode: c0000006 (In-page I/O error)
ExceptionFlags: 00000000
NumberParameters: 3
Parameter[0]: 00000000
Parameter[1]: 75b7b1c1
Parameter[2]: c000000e
Inpage operation failed at 75b7b1c1, due to I/O error c000000e

EXCEPTION_CODE: (NTSTATUS) 0xc000000e - A device which does not exist was
specified.

DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO

ERROR_CODE: (NTSTATUS) 0xc0000006 - The instruction at “0x%08lx” referenced
memory at “0x%08lx”. The required data was not placed into memory because of
an I/O error status of “0x%08lx”.

IO_ERROR: (NTSTATUS) 0xc000000e - A device which does not exist was
specified.

EXCEPTION_STR: 0xc0000006_c000000e

FAULTING_IP:
+75b7b1c1
75b7b1c1 ?? ???

BUGCHECK_STR: 0xF4_IOERR_C000000E

STACK_TEXT:
f771d520 8063423d 000000f4 00000003 86143da0 nt!KeBugCheckEx+0x1b
f771d544 806044e6 80604528 86143da0 86143f14 nt!PspCatchCriticalBreak+0x75
f771d574 804dd99f 86143fe8 c0000006 f771d9b0 nt!NtTerminateProcess+0x7d
f771d574 804e46a7 86143fe8 c0000006 f771d9b0 nt!KiFastCallEntry+0xfc
f771d5f4 80522146 ffffffff c0000006 f771d9f8 nt!ZwTerminateProcess+0x11
f771d9b0 80517e65 f771d9d8 00000000 f771dd64 nt!KiDispatchException+0x3a0
f771dd34 804e12a8 0069fbe8 0069fc08 00000000 nt!KiRaiseException+0x175
f771dd50 804dd99f 0069fbe8 0069fc08 00000000 nt!NtRaiseException+0x33
f771dd50 75b7b1c1 0069fbe8 0069fc08 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0069fff4 00000000 00000000 00000000 00000000 0x75b7b1c1

STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

FAILURE_BUCKET_ID: 0xF4_IOERR_C000000E_IMAGE_csrss.exe

BUCKET_ID: 0xF4_IOERR_C000000E_IMAGE_csrss.exe

Followup: MachineOwner

OSR_Community_User · March 26, 2007, 11:45am

Something failed an in-page because the device from which the critical
file is being paged has ceased to exist. This would happen if you
unplugged the drive, or if something made the OS think the disk had been
removed.

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

David_Wu · March 26, 2007, 12:44pm

Hi Tony,
Thank you for your answer. But I need a smoking gun from this memory dump file to show
something. So it would be much better if I can recover the exception and find which file
is being paged has ceased to exist. Is this possible to recover the exception and find some
more infomation?
In Irp pool, I did find one of irp which NTFS has been completed with C000000E during
paging read. But I can not prove if this IRP was compledted before the exception happen.

Here is irp info:
0: kd> !irp 85c3d1d8 1
Irp is active with 10 stacks 12 is current (= 00000000)
Mdl=85a99b60: No System Buffer: Thread 85a72ca4: Irp is completed. Pending has been returned
Flags = 00000901
ThreadListEntry.Flink = 85a72e80
ThreadListEntry.Blink = 85a72e80
IoStatus.Status = c000000e
IoStatus.Information = 00000000
RequestorMode = 00000001
Cancel = 00
CancelIrql = 0
ApcEnvironment = 00
UserIosb = 02490100
UserEvent = 85aee238
Overlay.AsynchronousParameters.UserApcRoutine = 00000000
Overlay.AsynchronousParameters.UserApcContext = 00000000
Overlay.AllocationSize = 00000000 - 00000000
CancelRoutine = 00000000
UserBuffer = 012a0000
&Tail.Overlay.DeviceQueueEntry = 85c3d218
Tail.Overlay.Thread = 85a72ca4 This thread is not valid thread addresss anymore.
Tail.Overlay.AuxiliaryBuffer = 804ecb57
Tail.Overlay.ListEntry.Flink = 80622b01
Tail.Overlay.ListEntry.Blink = 00000000
Tail.Overlay.CurrentStackLocation = 00000000
Tail.Overlay.OriginalFileObject = 85aed028 File object is still valid.
Tail.Apc = 00300012
Tail.CompletionKey = 00300012
cmd flg cl Device File Completion-Context
[0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[3, 0] 0 0 863869c0 00000000 f78c6376-8631de08
\Driver\Disk PartMgr!PmIoCompletion
Args: 00000000 00000000 00000000 00000000
[3, 0] 0 0 8631de08 00000000 f75a1962-8631aee8
\Driver\PartMgr ftdisk!FtpRefCountCompletionRoutine
Args: 00000000 00000000 00000000 00000000
[3, 0] 0 0 8631ae30 00000000 f748eebf-86183838
\Driver\Ftdisk Ntfs!NtfsSingleSyncCompletionRoutine
Args: 00000000 00000000 00000000 00000000
[3, 0] 0 0 86357340 00000000 00000000-00000000
\FileSystem\Ntfs
Args: 00000000 00000000 00000000 00000000

Does this irp mean something or not?

Thanks

Something failed an in-page because the device from which the critical
file is being paged has ceased to exist. This would happen if you
unplugged the drive, or if something made the OS think the disk had been
removed.

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

OSR_Community_User · March 26, 2007, 2:13pm

While the irp you found is likely involved, it won’t tell you very much.

I guess I don’t understand your issue at this point. The exception is
“in page error”. What I think you are trying to figure out is what
caused the exception, but that has nothing to do with the exception
itself - the error occurred and was reported back to the OS as an
exception. The unhandled exception caused the process to terminate, and
the termination detected that the given process is a critical process.

The question you are asking (“why did this fail”) is on its surface
because the device went away. Did the error log tell you anything
(“!errlog”). It isn’t likely but once in a while it does.

If you want, you can try to find the context record of the exception -
that should tell you which page in the image faulted. This will require
a manual search of the stack to look for the magic ES/DS selector values
(0x23) that are recorded and then verifying that you have the CONTEXT
record and not the KTRAP_FRAME.

It is not always possible to determine the actual cause of a crash from
a crash dump, as much as I wish that were not the case. A more
experienced person can glean further information from the crash dump,
but even the most experienced cannot tell you all of the machine’s
history from the state of memory at a single point in time (which is
what a crash dump represents.)

Have you verified that this is not a hardware problem? A drive that has
a loose connection can actually exhibit similar behavior.

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

David_Wu · March 26, 2007, 3:38pm

Hi Tony,
Thank you very much for your info.
Originally, I thought if I can recover the exception context and stack, I probablly can find which driver is the root cause of this problme. It seems I’m wrong. Evne if I recover the exception context and stack, I maybe still can’t find the real root cause of this problem.
As your suggestion, I’ll verify this is not a hardware poblme first.

Thanks

While the irp you found is likely involved, it won’t tell you very much.

I guess I don’t understand your issue at this point. The exception is
“in page error”. What I think you are trying to figure out is what
caused the exception, but that has nothing to do with the exception
itself - the error occurred and was reported back to the OS as an
exception. The unhandled exception caused the process to terminate, and
the termination detected that the given process is a critical process.

The question you are asking (“why did this fail”) is on its surface
because the device went away. Did the error log tell you anything
(“!errlog”). It isn’t likely but once in a while it does.

If you want, you can try to find the context record of the exception -
that should tell you which page in the image faulted. This will require
a manual search of the stack to look for the magic ES/DS selector values
(0x23) that are recorded and then verifying that you have the CONTEXT
record and not the KTRAP_FRAME.

It is not always possible to determine the actual cause of a crash from
a crash dump, as much as I wish that were not the case. A more
experienced person can glean further information from the crash dump,
but even the most experienced cannot tell you all of the machine’s
history from the state of memory at a single point in time (which is
what a crash dump represents.)

Have you verified that this is not a hardware problem? A drive that has
a loose connection can actually exhibit similar behavior.

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com