memory_corruption - one more dump report

NTFSD
1

while writing the last post,
I got another dump.
Attached:

Microsoft (R) Windows Debugger Version 6.6.0003.5
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: SRV*C:\Program Files\Debugging Tools for Windows\WebSymbols*Symbol information
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Sat Aug 26 23:18:28.984 2006 (GMT+2)
System Uptime: 0 days 1:09:21.592
Loading Kernel Symbols
..........................................................................................................................................
Loading User Symbols
Loading unloaded module list
.........
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {8f, 144f4, ffffffff, 0}

Probably caused by : memory_corruption ( nt!MmZeroPageThread+130 )

Followup: MachineOwner

kd> !analyze -v
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000008f, The free or zeroed page listhead is corrupt
Arg2: 000144f4, new page
Arg3: ffffffff, old page
Arg4: 00000000, 0

Debugging Details:

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x4E

LAST_CONTROL_TRANSFER: from 805282e1 to 805371aa

STACK_TEXT:
f8b8a800 805282e1 0000004e 0000008f 000144f4 nt!KeBugCheckEx+0x1b
f8b8a840 806ad2bd 83116da8 00000000 00000044 nt!MmZeroPageThread+0x130
f8b8adac 80574128 80087000 00000000 00000000 nt!Phase1Initialization+0x1287
f8b8addc 804efc81 806ae7cb 80087000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MmZeroPageThread+130
805282e1 cc int 3

FAULTING_SOURCE_CODE:

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!MmZeroPageThread+130

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 42250f77

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0x4E_nt!MmZeroPageThread+130

BUCKET_ID: 0x4E_nt!MmZeroPageThread+130

Followup: MachineOwner

2

Review all your MDL operations, and especially the partial MDLs if you use
it.

Partial MDL must be destroyed before its master MDL, this is a law.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From:
To: “Windows File Systems Devs Interest List”
Sent: Sunday, August 27, 2006 12:40 AM
Subject: [ntfsd] memory_corruption - one more dump report

> while writing the last post,
> I got another dump.
> Attached:
>
> -----------------------------------------------------------------------------
-
> Microsoft (R) Windows Debugger Version 6.6.0003.5
> Copyright (c) Microsoft Corporation. All rights reserved.
>
>
> Loading Dump File [C:\WINDOWS\MEMORY.DMP]
> Kernel Complete Dump File: Full address space is available
>
> Symbol search path is: SRVC:\Program Files\Debugging Tools for
Windows\WebSymbolshttp://msdl.microsoft.com/download/symbols
> Executable search path is:
> Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
> Product: WinNt, suite: TerminalServer SingleUserTS
> Built by: 2600.xpsp_sp2_gdr.050301-1519
> Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
> Debug session time: Sat Aug 26 23:18:28.984 2006 (GMT+2)
> System Uptime: 0 days 1:09:21.592
> Loading Kernel Symbols
>
…
…
> Loading User Symbols
> Loading unloaded module list
> …
> ERROR: FindPlugIns 8007007b
>

>

> * Bugcheck Analysis

>

>
*
>
> Use !analyze -v to get detailed debugging information.
>
> BugCheck 4E, {8f, 144f4, ffffffff, 0}
>
> Probably caused by : memory_corruption ( nt!MmZeroPageThread+130 )
>
> Followup: MachineOwner
> ---------
>
> kd> !analyze -v
> ERROR: FindPlugIns 8007007b
>

>

> * Bugcheck Analysis

>

>
*
>
> PFN_LIST_CORRUPT (4e)
> Typically caused by drivers passing bad memory descriptor lists (ie: calling
> MmUnlockPages twice with the same list, etc). If a kernel debugger is
> available get the stack trace.
> Arguments:
> Arg1: 0000008f, The free or zeroed page listhead is corrupt
> Arg2: 000144f4, new page
> Arg3: ffffffff, old page
> Arg4: 00000000, 0
>
> Debugging Details:
> ------------------
>
>
> DEFAULT_BUCKET_ID: DRIVER_FAULT
>
> BUGCHECK_STR: 0x4E
>
> LAST_CONTROL_TRANSFER: from 805282e1 to 805371aa
>
> STACK_TEXT:
> f8b8a800 805282e1 0000004e 0000008f 000144f4 nt!KeBugCheckEx+0x1b
> f8b8a840 806ad2bd 83116da8 00000000 00000044 nt!MmZeroPageThread+0x130
> f8b8adac 80574128 80087000 00000000 00000000 nt!Phase1Initialization+0x1287
> f8b8addc 804efc81 806ae7cb 80087000 00000000 nt!PspSystemThreadStartup+0x34
> 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
>
>
> STACK_COMMAND: kb
>
> FOLLOWUP_IP:
> nt!MmZeroPageThread+130
> 805282e1 cc int 3
>
> FAULTING_SOURCE_CODE:
>
>
> SYMBOL_STACK_INDEX: 1
>
> FOLLOWUP_NAME: MachineOwner
>
> SYMBOL_NAME: nt!MmZeroPageThread+130
>
> MODULE_NAME: nt
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 42250f77
>
> IMAGE_NAME: memory_corruption
>
> FAILURE_BUCKET_ID: 0x4E_nt!MmZeroPageThread+130
>
> BUCKET_ID: 0x4E_nt!MmZeroPageThread+130
>
> Followup: MachineOwner
> ---------
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Hi,
I didn’t write this code.
It just happen on my computer.
Thanks,
TestGames

4

This group is for developers of file systems and file systems filters.

wrote in message news:xxxxx@ntfsd…
> Hi,
> I didn’t write this code.
> It just happen on my computer.
> Thanks,
> TestGames
>

5

Memory corruption problems are extremely difficult to identify and
resolve. The only thing you can do (given that none of the drivers on
the system are yours) is to continue as you have been doing - try to
turn off various drivers.

Far less likely, but always possible, is that you have a hardware
related problem. Can you confirm that you have parity and/or ecc
memory? Have you looked at the event log to see if there are any
issues/errors reported?

Assuming it is driver related, you’ll need to try to identify the likely
culprit by elimination - by the time the system crashes, the damage is
long since done.

As Max indicated, this type of problem is usually an indicator that
there is an MDL handling bug in a driver.

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Saturday, August 26, 2006 2:55 PM
To: ntfsd redirect
Subject: RE:[ntfsd] memory_corruption - one more dump report

Hi,
I didn’t write this code.
It just happen on my computer.
Thanks,
TestGames

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com