Hi All,
We see intermittent interment BSOD in the windows-xp and following is
the output from “!analyze -v command” and straktrace .
6: kd> !analyze -v
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 00000000, The address that the exception occurred at
Arg3: ba227cb8, Exception Record Address
Arg4: ba2279b8, Context Record Address
Debugging Details:
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at “0x%08lx”
referenced memory at “0x%08lx”. The memory could not be “%s”.
FAULTING_IP:
+93
00000000 ?? ???
EXCEPTION_RECORD: ba227cb8 – (.exr 0xffffffffba227cb8)
ExceptionAddress: 00000000
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000000
Attempt to read from address 00000000
CONTEXT: ba2279b8 – (.cxr 0xffffffffba2279b8)
eax=00000000 ebx=889e5220 ecx=00000000 edx=00000000 esi=8054d0a0
edi=8821adc0
eip=00000000 esp=ba227d80 ebp=ba227dac iopl=0 nv up ei pl nz ac
po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010212
00000000 ?? ???
Resetting default scope
DEFAULT_BUCKET_ID: DRIVER_FAULT
PROCESS_NAME: System
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at “0x%08lx”
referenced memory at “0x%08lx”. The memory could not be “%s”.
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: 00000000
READ_ADDRESS: 00000000
FOLLOWUP_IP:
Ntfs!ExFreeToPagedLookasideList+27
f74137a2 c20800 ret 8
FAILED_INSTRUCTION_ADDRESS:
+27b952f01abdfdc
00000000 ?? ???
BUGCHECK_STR: 0x7E
LAST_CONTROL_TRANSFER: from 80528267 to 00000000
SYMBOL_ON_RAW_STACK: 1
STACK_ADDR_RAW_STACK_SYMBOL: ffffffffba22794c
STACK_COMMAND: dds BA22794C-0x20 ; kb
STACK_TEXT:
ba22792c 881c93b0
ba227930 000b686e
ba227934 00000000
ba227938 000c6000
ba22793c 00000000
ba227940 ba227b5c
ba227944 00000000
ba227948 f74137a2 Ntfs!ExFreeToPagedLookasideList+0x27
ba22794c 00000000
ba227950 889fdac0
ba227954 e281b998
ba227958 00000000
ba22795c 00000000
ba227960 e281b901
ba227964 0041363c
ba227968 ba227b5c
ba22796c f7413692 Ntfs!NtfsCompleteRequest+0xaa
ba227970 e281b998
ba227974 8819c0d0
ba227978 f7415413 Ntfs!NtfsCommonWrite+0x20ee
ba22797c 8819c0d0
ba227980 e1040ad0
ba227984 f741541e Ntfs!NtfsCommonWrite+0x20f9
ba227988 804eb814 nt!IoIsOperationSynchronous
ba22798c ba227b84
ba227990 889fdac0
ba227994 000c6000
ba227998 00000000
ba22799c e281bb30
ba2279a0 e281bb30
ba2279a4 e281bb30
ba2279a8 00000000
SYMBOL_NAME: Ntfs!ExFreeToPagedLookasideList+27
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 3d6de5c1
FAILURE_BUCKET_ID: 0x7E_NULL_IP_Ntfs!ExFreeToPagedLookasideList+27
BUCKET_ID: 0x7E_NULL_IP_Ntfs!ExFreeToPagedLookasideList+27
Followup: MachineOwner
6: kd> K
ChildEBP RetAddr
ba2277d4 805b0436 nt!KeBugCheckEx+0x19
ba2277ec 805b0488 nt!PspUnhandledExceptionInSystemThread+0x16
ba2277f4 8052951b nt!PspSystemThreadStartup+0x50
ba22781c 805357be nt!_except_handler3+0x4b
ba227840 80535790 nt!ExecuteHandler2+0x26
ba2278ec 804f9208 nt!ExecuteHandler+0x24
ba227c9c 80530dcd nt!KiDispatchException+0xa8
ba227d04 80530d7e nt!CommonDispatchException+0x4d
ba227d18 8053457c nt!Kei386EoiHelper+0x18e
ba227d7c 80528267 nt!SwapContext+0xcc
ba227dac 805b046c nt!ExpWorkerThread+0xed
ba227ddc 80534ad6 nt!PspSystemThreadStartup+0x34
00000000 00000000 nt!KiThreadStartup+0x16
Some light on the product we do have drivers that runs in the kernel
space. Please can someone through some-lights on the problem.
Thanks
~Umesh