Norton Antivirus & NO_MORE_IRP_STACK_LOCATIONS

NTDEV
1

I am getting the bugcheck NO_MORE_IRP_STACK_LOCATIONS with Norton
Antivirus 2003 running on Windows 2000 SP4.

My driver is a active TDI filter driver which gets loaded and attached
to Tcpip driver before Netbt. Without NAV2003 installed the system works
perfectly fine. When NAV2003 is installed, it installs a SYMTDI.sys driver,
which gets attached after Netbt TDI client has already opened a TDI provider
device.

Hence the filter driver is entering the insufficient stack location. Is
there a work around or anyone has faced similar problem with NAV2003.

The filter driver works fine with NAV2003 installed on windows XP.
Enough stack locations is created by Netbt in WinXP.

–
Regds

2

You must install your TDI filter before any TDI clients atach to the TDI
interface. Otherwise, the number of stack locations that the TDI clients
fetch (one-time only, at attach time) will not account for the additional
stack location required by your filter if it is insered later.

This is primarily an exercise in managing the load order of components.

Good luck,

Thomas F. Divine
http://www.pcausa.com

“Navin” wrote in message news:xxxxx@ntdev…
>
> I am getting the bugcheck NO_MORE_IRP_STACK_LOCATIONS with Norton
> Antivirus 2003 running on Windows 2000 SP4.
>
> My driver is a active TDI filter driver which gets loaded and attached
> to Tcpip driver before Netbt. Without NAV2003 installed the system works
> perfectly fine. When NAV2003 is installed, it installs a SYMTDI.sys
driver,
> which gets attached after Netbt TDI client has already opened a TDI
provider
> device.
>
> Hence the filter driver is entering the insufficient stack location.
Is
> there a work around or anyone has faced similar problem with NAV2003.
>
> The filter driver works fine with NAV2003 installed on windows XP.
> Enough stack locations is created by Netbt in WinXP.
>
> –
> Regds
>
>
>

3

If you read my post again, you will find that my driver is getting
loaded and attached before any other TDI client attaches to TDI interface.

Its Norton’s Tdi filter that is getting attached after, Netbt opens the
Tdi, resulting in insufficient stack location.

–
Regds

“Thomas F. Divine” wrote in message news:xxxxx@ntdev…
> You must install your TDI filter before any TDI clients atach to the TDI
> interface. Otherwise, the number of stack locations that the TDI clients
> fetch (one-time only, at attach time) will not account for the additional
> stack location required by your filter if it is insered later.
>
> This is primarily an exercise in managing the load order of components.
>
> Good luck,
>
> Thomas F. Divine
> http://www.pcausa.com
>
> “Navin” wrote in message news:xxxxx@ntdev…
> >
> > I am getting the bugcheck NO_MORE_IRP_STACK_LOCATIONS with Norton
> > Antivirus 2003 running on Windows 2000 SP4.
> >
> > My driver is a active TDI filter driver which gets loaded and
attached
> > to Tcpip driver before Netbt. Without NAV2003 installed the system works
> > perfectly fine. When NAV2003 is installed, it installs a SYMTDI.sys
> driver,
> > which gets attached after Netbt TDI client has already opened a TDI
> provider
> > device.
> >
> > Hence the filter driver is entering the insufficient stack location.
> Is
> > there a work around or anyone has faced similar problem with NAV2003.
> >
> > The filter driver works fine with NAV2003 installed on windows XP.
> > Enough stack locations is created by Netbt in WinXP.
> >
> > –
> > Regds
> >
> >
> >
>
>
>

4

How many drivers total are in the stack? Are you exceeding a total of 4
required irp stack locations?

D

This posting is provided “AS IS” with no warranties, and confers no
rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Navin
Sent: Thursday, March 04, 2004 10:25 AM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] Norton Antivirus & NO_MORE_IRP_STACK_LOCATIONS

If you read my post again, you will find that my driver is getting
loaded and attached before any other TDI client attaches to TDI
interface.

Its Norton’s Tdi filter that is getting attached after, Netbt opens
the
Tdi, resulting in insufficient stack location.

–
Regds

“Thomas F. Divine” wrote in message
news:xxxxx@ntdev…
> You must install your TDI filter before any TDI clients atach to the
TDI
> interface. Otherwise, the number of stack locations that the TDI
clients
> fetch (one-time only, at attach time) will not account for the
additional
> stack location required by your filter if it is insered later.
>
> This is primarily an exercise in managing the load order of
components.
>
> Good luck,
>
> Thomas F. Divine
> http://www.pcausa.com
>
> “Navin” wrote in message news:xxxxx@ntdev…
> >
> > I am getting the bugcheck NO_MORE_IRP_STACK_LOCATIONS with
Norton
> > Antivirus 2003 running on Windows 2000 SP4.
> >
> > My driver is a active TDI filter driver which gets loaded and
attached
> > to Tcpip driver before Netbt. Without NAV2003 installed the system
works
> > perfectly fine. When NAV2003 is installed, it installs a SYMTDI.sys
> driver,
> > which gets attached after Netbt TDI client has already opened a TDI
> provider
> > device.
> >
> > Hence the filter driver is entering the insufficient stack
location.
> Is
> > there a work around or anyone has faced similar problem with
NAV2003.
> >
> > The filter driver works fine with NAV2003 installed on windows
XP.
> > Enough stack locations is created by Netbt in WinXP.
> >
> > –
> > Regds
> >
> >
> >
>
>
>

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

Sorry I didn’t read more carefully.

Certainly some component is calculating stack size incorrectly.

Look at the DDK Help topic “Initializing a Device Object”. One thing that
you can do is bump the StackSize before calling IoAttachDeviceToDeviceStack.
Perhaps this would force higher-level components that attach later to add
another location. Worth a shot.

I seem to recall some registry setting that would cause NetBT to add extra
stack locations - but I cannot find it and may be mistaken.

You are probably already using IoSkipCurrentIrpStackLocation to work
around the issue temporarily.

If you cannot resolve this issue any other way, then you can consider using
“repeater IRPs”. In this approach you allocate an IRP of your own,
initialize it (carefully) from information in the runt IRP, and pass your
own IRP down. Unwind on the way back. Tedious.

Good luck,

Thomas F. Divine
http://www.pcausa.com

“Navin” wrote in message news:xxxxx@ntdev…
>
> If you read my post again, you will find that my driver is getting
> loaded and attached before any other TDI client attaches to TDI interface.
>
> Its Norton’s Tdi filter that is getting attached after, Netbt opens
the
> Tdi, resulting in insufficient stack location.
>
>
>
> –
> Regds
>
>
> “Thomas F. Divine” wrote in message
news:xxxxx@ntdev…
> > You must install your TDI filter before any TDI clients atach to the
TDI
> > interface. Otherwise, the number of stack locations that the TDI clients
> > fetch (one-time only, at attach time) will not account for the
additional
> > stack location required by your filter if it is insered later.
> >
> > This is primarily an exercise in managing the load order of components.
> >
> > Good luck,
> >
> > Thomas F. Divine
> > http://www.pcausa.com
> >
> > “Navin” wrote in message news:xxxxx@ntdev…
> > >
> > > I am getting the bugcheck NO_MORE_IRP_STACK_LOCATIONS with Norton
> > > Antivirus 2003 running on Windows 2000 SP4.
> > >
> > > My driver is a active TDI filter driver which gets loaded and
> attached
> > > to Tcpip driver before Netbt. Without NAV2003 installed the system
works
> > > perfectly fine. When NAV2003 is installed, it installs a SYMTDI.sys
> > driver,
> > > which gets attached after Netbt TDI client has already opened a TDI
> > provider
> > > device.
> > >
> > > Hence the filter driver is entering the insufficient stack
location.
> > Is
> > > there a work around or anyone has faced similar problem with NAV2003.
> > >
> > > The filter driver works fine with NAV2003 installed on windows XP.
> > > Enough stack locations is created by Netbt in WinXP.
> > >
> > > –
> > > Regds
> > >
> > >
> > >
> >
> >
> >
>
>
>

6

NAV changes the value:

HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\IrpStackSize

from it’s default to some lower value (4 or 6?).

This could well be causing your problem.

Deleting the key forces default behavior, or you can up it & reboot.

Good luck -

sm

-----Original Message-----
From: Doron Holan [mailto:xxxxx@windows.microsoft.com]
Sent: Thursday, March 04, 2004 10:49 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Norton Antivirus & NO_MORE_IRP_STACK_LOCATIONS

How many drivers total are in the stack? Are you exceeding a total of 4
required irp stack locations?

D

This posting is provided “AS IS” with no warranties, and confers no
rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Navin
Sent: Thursday, March 04, 2004 10:25 AM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] Norton Antivirus & NO_MORE_IRP_STACK_LOCATIONS

If you read my post again, you will find that my driver is getting
loaded and attached before any other TDI client attaches to TDI
interface.

Its Norton’s Tdi filter that is getting attached after, Netbt opens
the
Tdi, resulting in insufficient stack location.

–
Regds

“Thomas F. Divine” wrote in message
news:xxxxx@ntdev…
> You must install your TDI filter before any TDI clients atach to the
TDI
> interface. Otherwise, the number of stack locations that the TDI
clients
> fetch (one-time only, at attach time) will not account for the
additional
> stack location required by your filter if it is insered later.
>
> This is primarily an exercise in managing the load order of
components.
>
> Good luck,
>
> Thomas F. Divine
> http://www.pcausa.com
>
> “Navin” wrote in message news:xxxxx@ntdev…
> >
> > I am getting the bugcheck NO_MORE_IRP_STACK_LOCATIONS with
Norton
> > Antivirus 2003 running on Windows 2000 SP4.
> >
> > My driver is a active TDI filter driver which gets loaded and
attached
> > to Tcpip driver before Netbt. Without NAV2003 installed the system
works
> > perfectly fine. When NAV2003 is installed, it installs a SYMTDI.sys
> driver,
> > which gets attached after Netbt TDI client has already opened a TDI
> provider
> > device.
> >
> > Hence the filter driver is entering the insufficient stack
location.
> Is
> > there a work around or anyone has faced similar problem with
NAV2003.
> >
> > The filter driver works fine with NAV2003 installed on windows
XP.
> > Enough stack locations is created by Netbt in WinXP.
> >
> > –
> > Regds
> >
> >
> >
>
>
>

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@softek.fujitsu.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

7

Looks like this would be a specific step to insure that similar products
would fail to work properly.

Thomas F. Divine
http://www.ndis.com

“McDowell, Steve” wrote in message
news:xxxxx@ntdev…
NAV changes the value:

HKEY_LOCAL_MACHINE
SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\IrpStackSize

from it’s default to some lower value (4 or 6?).

This could well be causing your problem.

Deleting the key forces default behavior, or you can up it & reboot.

Good luck -

sm

-----Original Message-----
From: Doron Holan [mailto:xxxxx@windows.microsoft.com]
Sent: Thursday, March 04, 2004 10:49 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Norton Antivirus & NO_MORE_IRP_STACK_LOCATIONS

How many drivers total are in the stack? Are you exceeding a total of 4
required irp stack locations?

D

This posting is provided “AS IS” with no warranties, and confers no
rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Navin
Sent: Thursday, March 04, 2004 10:25 AM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] Norton Antivirus & NO_MORE_IRP_STACK_LOCATIONS

If you read my post again, you will find that my driver is getting
loaded and attached before any other TDI client attaches to TDI
interface.

Its Norton’s Tdi filter that is getting attached after, Netbt opens
the
Tdi, resulting in insufficient stack location.

–
Regds

“Thomas F. Divine” wrote in message
news:xxxxx@ntdev…
> You must install your TDI filter before any TDI clients atach to the
TDI
> interface. Otherwise, the number of stack locations that the TDI
clients
> fetch (one-time only, at attach time) will not account for the
additional
> stack location required by your filter if it is insered later.
>
> This is primarily an exercise in managing the load order of
components.
>
> Good luck,
>
> Thomas F. Divine
> http://www.pcausa.com
>
> “Navin” wrote in message news:xxxxx@ntdev…
> >
> > I am getting the bugcheck NO_MORE_IRP_STACK_LOCATIONS with
Norton
> > Antivirus 2003 running on Windows 2000 SP4.
> >
> > My driver is a active TDI filter driver which gets loaded and
attached
> > to Tcpip driver before Netbt. Without NAV2003 installed the system
works
> > perfectly fine. When NAV2003 is installed, it installs a SYMTDI.sys
> driver,
> > which gets attached after Netbt TDI client has already opened a TDI
> provider
> > device.
> >
> > Hence the filter driver is entering the insufficient stack
location.
> Is
> > there a work around or anyone has faced similar problem with
NAV2003.
> >
> > The filter driver works fine with NAV2003 installed on windows
XP.
> > Enough stack locations is created by Netbt in WinXP.
> >
> > –
> > Regds
> >
> >
> >
>
>
>

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@softek.fujitsu.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

8

The Irp is created with only 3 stack locations. The driver stack looks like
below.

  1. NetBt
  2. SYMTDI
  3. MyDriver
  4. Tcpip

No matter what the dependencies or tag values are in the registry, I can
not get the SYMTDI (Symantec TDI) to attach to Tcpip before my driver is
attached.

Under WinXP the Irp is created with much higher stack so it is no problem.

here is the !irp

Irp is active with 3 stacks 0 is current (= 0x810f02e0)
Mdl = 80c7c008 Thread 000000b8: Irp stack trace.
cmd flg cl Device File Completion-Context
[f, 7] 0 e0 810f02e0 80138ac8 bc7c6f80-858c5ee8 Success Error Cancel
\Driver\ISTrans SYMTDI!rHeapFree
Args: 000000b8 00000000 00000000 00000000
[f, 7] 0 e0 85075140 80138ac8 beca4320-87bba008 Success Error Cancel
\Driver\SYMTDI netbt!SendCompletion
Args: 00000089 00000000 00000000 00000000
[f, 7] 0 e0 8298a1f0 86970ca8 bec79ec1-bc8068dc Success Error Cancel
\Driver\NetBT rdbss!RxTdiRequestCompletion
Args: 00000085 00000000 00000000 00000000

–
Regds

“Doron Holan” wrote in message
news:xxxxx@ntdev…
How many drivers total are in the stack? Are you exceeding a total of 4
required irp stack locations?

D

This posting is provided “AS IS” with no warranties, and confers no
rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Navin
Sent: Thursday, March 04, 2004 10:25 AM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] Norton Antivirus & NO_MORE_IRP_STACK_LOCATIONS

If you read my post again, you will find that my driver is getting
loaded and attached before any other TDI client attaches to TDI
interface.

Its Norton’s Tdi filter that is getting attached after, Netbt opens
the
Tdi, resulting in insufficient stack location.

–
Regds

“Thomas F. Divine” wrote in message
news:xxxxx@ntdev…
> You must install your TDI filter before any TDI clients atach to the
TDI
> interface. Otherwise, the number of stack locations that the TDI
clients
> fetch (one-time only, at attach time) will not account for the
additional
> stack location required by your filter if it is insered later.
>
> This is primarily an exercise in managing the load order of
components.
>
> Good luck,
>
> Thomas F. Divine
> http://www.pcausa.com
>
> “Navin” wrote in message news:xxxxx@ntdev…
> >
> > I am getting the bugcheck NO_MORE_IRP_STACK_LOCATIONS with
Norton
> > Antivirus 2003 running on Windows 2000 SP4.
> >
> > My driver is a active TDI filter driver which gets loaded and
attached
> > to Tcpip driver before Netbt. Without NAV2003 installed the system
works
> > perfectly fine. When NAV2003 is installed, it installs a SYMTDI.sys
> driver,
> > which gets attached after Netbt TDI client has already opened a TDI
> provider
> > device.
> >
> > Hence the filter driver is entering the insufficient stack
location.
> Is
> > there a work around or anyone has faced similar problem with
NAV2003.
> >
> > The filter driver works fine with NAV2003 installed on windows
XP.
> > Enough stack locations is created by Netbt in WinXP.
> >
> > –
> > Regds
> >
> >
> >
>
>
>

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

9

> Certainly some component is calculating stack size incorrectly.

Look at the DDK Help topic “Initializing a Device Object”. One thing that
you can do is bump the StackSize before calling
IoAttachDeviceToDeviceStack.
Perhaps this would force higher-level components that attach later to add
another location. Worth a shot.

Did not work. I attempted as per your suggestion.

I seem to recall some registry setting that would cause NetBT to add extra
stack locations - but I cannot find it and may be mistaken.

Didn’t work either.

You are probably already using IoSkipCurrentIrpStackLocation to work
around the issue temporarily.

Where ever possible I am. However the filter driver being an “active”
filter driver, there are very few places where I can do that.

If you cannot resolve this issue any other way, then you can consider
using
“repeater IRPs”. In this approach you allocate an IRP of your own,
initialize it (carefully) from information in the runt IRP, and pass your
own IRP down. Unwind on the way back. Tedious.

I guess this is the only thing left to do. I am already feeling the pain
inflicted by bad SYMTDI programmers.

10

Oops missed one more driver in the stack, “rdbss.sys”

–
Regds
“Navin” wrote in message news:xxxxx@ntdev…
> The Irp is created with only 3 stack locations. The driver stack looks
like
> below.
>
> 1. NetBt
> 2. SYMTDI
> 3. MyDriver
> 4. Tcpip
>
>
> No matter what the dependencies or tag values are in the registry, I can
> not get the SYMTDI (Symantec TDI) to attach to Tcpip before my driver is
> attached.
>
> Under WinXP the Irp is created with much higher stack so it is no problem.
>
> here is the !irp
>
> Irp is active with 3 stacks 0 is current (= 0x810f02e0)
> Mdl = 80c7c008 Thread 000000b8: Irp stack trace.
> cmd flg cl Device File Completion-Context
> [f, 7] 0 e0 810f02e0 80138ac8 bc7c6f80-858c5ee8 Success Error Cancel
> \Driver\ISTrans SYMTDI!rHeapFree
> Args: 000000b8 00000000 00000000 00000000
> [f, 7] 0 e0 85075140 80138ac8 beca4320-87bba008 Success Error Cancel
> \Driver\SYMTDI netbt!SendCompletion
> Args: 00000089 00000000 00000000 00000000
> [f, 7] 0 e0 8298a1f0 86970ca8 bec79ec1-bc8068dc Success Error Cancel
> \Driver\NetBT rdbss!RxTdiRequestCompletion
> Args: 00000085 00000000 00000000 00000000
>
> –
> Regds
>
>
> “Doron Holan” wrote in message
> news:xxxxx@ntdev…
> How many drivers total are in the stack? Are you exceeding a total of 4
> required irp stack locations?
>
> D
>
> This posting is provided “AS IS” with no warranties, and confers no
> rights
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Navin
> Sent: Thursday, March 04, 2004 10:25 AM
> To: Windows System Software Devs Interest List
> Subject: Re:[ntdev] Norton Antivirus & NO_MORE_IRP_STACK_LOCATIONS
>
>
> If you read my post again, you will find that my driver is getting
> loaded and attached before any other TDI client attaches to TDI
> interface.
>
> Its Norton’s Tdi filter that is getting attached after, Netbt opens
> the
> Tdi, resulting in insufficient stack location.
>
>
>
> –
> Regds
>
>
> “Thomas F. Divine” wrote in message
> news:xxxxx@ntdev…
> > You must install your TDI filter before any TDI clients atach to the
> TDI
> > interface. Otherwise, the number of stack locations that the TDI
> clients
> > fetch (one-time only, at attach time) will not account for the
> additional
> > stack location required by your filter if it is insered later.
> >
> > This is primarily an exercise in managing the load order of
> components.
> >
> > Good luck,
> >
> > Thomas F. Divine
> > http://www.pcausa.com
> >
> > “Navin” wrote in message news:xxxxx@ntdev…
> > >
> > > I am getting the bugcheck NO_MORE_IRP_STACK_LOCATIONS with
> Norton
> > > Antivirus 2003 running on Windows 2000 SP4.
> > >
> > > My driver is a active TDI filter driver which gets loaded and
> attached
> > > to Tcpip driver before Netbt. Without NAV2003 installed the system
> works
> > > perfectly fine. When NAV2003 is installed, it installs a SYMTDI.sys
> > driver,
> > > which gets attached after Netbt TDI client has already opened a TDI
> > provider
> > > device.
> > >
> > > Hence the filter driver is entering the insufficient stack
> location.
> > Is
> > > there a work around or anyone has faced similar problem with
> NAV2003.
> > >
> > > The filter driver works fine with NAV2003 installed on windows
> XP.
> > > Enough stack locations is created by Netbt in WinXP.
> > >
> > > –
> > > Regds
> > >
> > >
> > >
> >
> >
> >
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>