Out of Non-Paged pool

WINDBG
1

Hi,

I have a situation where a BugCheck is reported - 41- MUST_SUCCEED_POOL_EMPTY

BugCheck 41, {1000, 691b, 16be, d7f29}
Arg1: 00001000, size of the request that could not be satisfied
Arg2: 0000691b, number of pages used of nonpaged pool
Arg3: 000016be, number of > PAGE_SIZE requests from nonpaged pool
Arg4: 000d7f29, number of pages available

This BugCheck signifies that the Non-Paged Pool is “not available” or “Excessive NonPaged Pool Usage”

!vm gives the following results
…

Available Pages: 884521 ( 3538084 Kb) << 884521* 4KB >>
ResAvail Pages: 991367 ( 3965468 Kb) << 991367* 4KB >>
Modified Pages: 527 ( 2108 Kb) << 527 * 4KB >>
NonPagedPool Usage: 32729 ( 130916 Kb) << 32729 * 4KB >>
NonPagedPool Max: 40387 ( 161548 Kb) << 40387 * 4KB >>
…

I dont fully understand the relationship between the Args of BugCheck and the !vm output.

3: kd> dd mmmaximumnonpagedpoolinbytes l1 -----> Maxsize of NonPaged Pool at taken from the registry at boottime
dd488a20 09dc3000
3: kd> ? 09dc3000
Evaluate expression: 165425152 = 09dc3000 ~157MB)

3: kd> dd mmsizeofnonpagedpoolinbytes l1 ----> Current Size of NonPAged Pool
dd488a90 06049000
3: kd> ? 06049000
Evaluate expression: 100962304 = 06049000 ~96MB

Also, since the pool tagging is Off, is there a way I can find out which kernel component is responsible for the leak/consumption?

The OS is - Windows 2000 Kernel Version 2195 (Service Pack 4) MP (4 procs) Free x86 compatible

Thanks
/Ashish

2

Let’s face it, nobody should be allocating must succeed pool anyway.
Try a “kv” as that will tell you who is allocating this memory.

Further, requesting 4KB of *non-paged must succeed pool* is almost
guaranteed to fail (as I recall, that’s the maximum size anyway…)

There is WAY too much non-paged pool allocated on this system. Try
“!poolused” and if that indicates pool tags are not enabled try enabling
pool tagging and repeat. Someone is hogging non-paged memory (128MB of
non-paged pool? That’s A LOT…) Must succeed is further limited -
again as I recall 4KB is the max anyway.

Regards,

Tony

Tony Mason

Consulting Partner

OSR Open Systems Resources, Inc.

http://www.osr.com http:</http:>

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Asheesh
Sent: Monday, March 21, 2005 8:48 AM
To: Kernel Debugging Interest List
Subject: [windbg] Out of Non-Paged pool

Hi,

I have a situation where a BugCheck is reported - 41-
MUST_SUCCEED_POOL_EMPTY

BugCheck 41, {1000, 691b, 16be, d7f29}

Arg1: 00001000, size of the request that could not be satisfied

Arg2: 0000691b, number of pages used of nonpaged pool

Arg3: 000016be, number of > PAGE_SIZE requests from nonpaged pool

Arg4: 000d7f29, number of pages available

This BugCheck signifies that the Non-Paged Pool is “not available” or
“Excessive NonPaged Pool Usage”

!vm gives the following results

…

Available Pages: 884521 ( 3538084 Kb) << 884521* 4KB >>

ResAvail Pages: 991367 ( 3965468 Kb) << 991367* 4KB >>

Modified Pages: 527 ( 2108 Kb) << 527 * 4KB >>

NonPagedPool Usage: 32729 ( 130916 Kb) << 32729 * 4KB >>

NonPagedPool Max: 40387 ( 161548 Kb) << 40387 * 4KB >>

…

I dont fully understand the relationship between the Args of BugCheck
and the !vm output.

3: kd> dd mmmaximumnonpagedpoolinbytes l1 -----> Maxsize of NonPaged
Pool at taken from the registry at boottime
dd488a20 09dc3000
3: kd> ? 09dc3000
Evaluate expression: 165425152 = 09dc3000 ~157MB)

3: kd> dd mmsizeofnonpagedpoolinbytes l1 ----> Current Size of
NonPAged Pool
dd488a90 06049000
3: kd> ? 06049000
Evaluate expression: 100962304 = 06049000 ~96MB

Also, since the pool tagging is Off, is there a way I can find out which
kernel component is responsible for the leak/consumption?

The OS is - Windows 2000 Kernel Version 2195 (Service Pack 4) MP (4
procs) Free x86 compatible

Thanks

/Ashish

You are currently subscribed to windbg as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

The stack looks like

ChildEBP RetAddr Args to Child
f0c7b5ec dd46fca8 00000002 00001000 00000000 nt!MiAllocatePoolPages+0x4e
f0c7b624 dd41f354 00000002 00000000 20707249 nt!ExAllocatePoolWithTag+0x428
f0c7b654 f5c03446 fa7219e8 000001d8 fb9bd190 nt!IoMakeAssociatedIrp+0xd4
WARNING: Stack unwind information not available. Following frames may be wrong.
f0c7b6a8 f5c032f4 fde06d08 fb9fd920 fa7219e8 Ntfs!NtfsRaiseStatus+0x2929
f0c7b86c f5c02fed fde06d08 fa7219e8 e26bc5d8 Ntfs!NtfsRaiseStatus+0x27d7
f0c7ba84 f5c00083 fde06d08 fa7219e8 00000001 Ntfs!NtfsRaiseStatus+0x24d0
f0c7bb20 dd41e0bf fb9bd0c0 fa7219e8 fa711968 Ntfs!NtfsAcquireSharedFcb+0x49c
f0c7bb34 f3d2b480 fa6eab20 fa7219e8 dd41e0bf nt!IopfCallDriver+0x35
f0c7bb68 dd44408d fa8d9c48 fdd92e00 fdd92de0 SYMEVENT+0x6480
f0c7bbb0 dd44dc8f 00000000 c4960000 c0624b00 nt!MiDispatchFault+0x25b
f0c7bc0c dd44a33c 00000000 c4960000 00000000 nt!MmAccessFault+0x853
f0c7bc4c dd40d6ae c4960000 00000000 00000000 nt!MmCheckCachedPageState+0x346
f0c7bd0c dd413573 fbe23548 dd47ad40 fbe20da0 nt!CcPerformReadAhead+0x218
f0c7bd78 dd4176f1 fbe23548 00000000 00000000 nt!CcWorkerThread+0x16d
f0c7bda8 dd4595bc fbe23548 00000000 00000000 nt!ExpWorkerThread+0xaf
f0c7bddc dd46e656 dd417642 00000000 00000000 nt!PspSystemThreadStartup+0x54
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

unfortunately, i dont have a live system were it can be reproduced. It is just a crash-dump file.

/ashish
“Tony Mason” wrote in message news:xxxxx@windbg…
Let’s face it, nobody should be allocating must succeed pool anyway. Try a “kv” as that will tell you who is allocating this memory.

Further, requesting 4KB of non-paged must succeed pool is almost guaranteed to fail (as I recall, that’s the maximum size anyway.)

There is WAY too much non-paged pool allocated on this system. Try “!poolused” and if that indicates pool tags are not enabled try enabling pool tagging and repeat. Someone is hogging non-paged memory (128MB of non-paged pool? That’s A LOT.) Must succeed is further limited - again as I recall 4KB is the max anyway.

Regards,

Tony

Tony Mason

Consulting Partner

OSR Open Systems Resources, Inc.

http://www.osr.com

------------------------------------------------------------------------------

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Asheesh
Sent: Monday, March 21, 2005 8:48 AM
To: Kernel Debugging Interest List
Subject: [windbg] Out of Non-Paged pool

Hi,

I have a situation where a BugCheck is reported - 41- MUST_SUCCEED_POOL_EMPTY

BugCheck 41, {1000, 691b, 16be, d7f29}

Arg1: 00001000, size of the request that could not be satisfied

Arg2: 0000691b, number of pages used of nonpaged pool

Arg3: 000016be, number of > PAGE_SIZE requests from nonpaged pool

Arg4: 000d7f29, number of pages available

This BugCheck signifies that the Non-Paged Pool is “not available” or “Excessive NonPaged Pool Usage”

!vm gives the following results

…

Available Pages: 884521 ( 3538084 Kb) << 884521* 4KB >>

ResAvail Pages: 991367 ( 3965468 Kb) << 991367* 4KB >>

Modified Pages: 527 ( 2108 Kb) << 527 * 4KB >>

NonPagedPool Usage: 32729 ( 130916 Kb) << 32729 * 4KB >>

NonPagedPool Max: 40387 ( 161548 Kb) << 40387 * 4KB >>

…

I dont fully understand the relationship between the Args of BugCheck and the !vm output.

3: kd> dd mmmaximumnonpagedpoolinbytes l1 -----> Maxsize of NonPaged Pool at taken from the registry at boottime
dd488a20 09dc3000
3: kd> ? 09dc3000
Evaluate expression: 165425152 = 09dc3000 ~157MB)

3: kd> dd mmsizeofnonpagedpoolinbytes l1 ----> Current Size of NonPAged Pool
dd488a90 06049000
3: kd> ? 06049000
Evaluate expression: 100962304 = 06049000 ~96MB

Also, since the pool tagging is Off, is there a way I can find out which kernel component is responsible for the leak/consumption?

The OS is - Windows 2000 Kernel Version 2195 (Service Pack 4) MP (4 procs) Free x86 compatible

Thanks

/Ashish

—
You are currently subscribed to windbg as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

First thing: get the symbols cleaned up. The symbols for the OS look
right, but the NTFS symbols are clearly wrong (you are running off
export symbols to get offsets like this). That might give you a bit
more information.

Note: your system IS running tight up against the edge. 128MB of
non-paged pool is already allocated - as reported by “!vm”. I don’t
recall if that’s the limit in W2K (it went up to ~192MB at some point,
but I suspect that might have been XP) but given your crash I wouldn’t
be surprised. No matter, that is a LOT of non-paged pool. Try looking
for memory leaks (of course pool tracking is probably disabled in your
crash scenario). I suspect someone is leaking memory…

Now, of course we can discuss why it is fundamentally unfair that your
system can have d7f29 free pages (3622998016 bytes) and still not have
enough to satisfy a page allocation, but it has to do with the scarcity
of space in the OS address space, not with scarcity of physical memory.

Bottom line: figure out where the rest of your memory is being used.
SOMEONE has used quite a lot of memory. Download PoolTag and have
someone run it on that system; next time it crashes you’ll at least be
able to type “!poolused” and get a better idea of where all of your
non-paged pool is being consumed.

Regards,

Tony

Tony Mason

Consulting Partner

OSR Open Systems Resources, Inc.

http://www.osr.com http:</http:>

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Asheesh
Sent: Tuesday, March 22, 2005 8:02 AM
To: Kernel Debugging Interest List
Subject: Re:[windbg] Out of Non-Paged pool

The stack looks like

ChildEBP RetAddr Args to Child
f0c7b5ec dd46fca8 00000002 00001000 00000000 nt!MiAllocatePoolPages+0x4e
f0c7b624 dd41f354 00000002 00000000 20707249
nt!ExAllocatePoolWithTag+0x428
f0c7b654 f5c03446 fa7219e8 000001d8 fb9bd190 nt!IoMakeAssociatedIrp+0xd4
WARNING: Stack unwind information not available. Following frames may be
wrong.
f0c7b6a8 f5c032f4 fde06d08 fb9fd920 fa7219e8 Ntfs!NtfsRaiseStatus+0x2929
f0c7b86c f5c02fed fde06d08 fa7219e8 e26bc5d8 Ntfs!NtfsRaiseStatus+0x27d7
f0c7ba84 f5c00083 fde06d08 fa7219e8 00000001 Ntfs!NtfsRaiseStatus+0x24d0
f0c7bb20 dd41e0bf fb9bd0c0 fa7219e8 fa711968
Ntfs!NtfsAcquireSharedFcb+0x49c
f0c7bb34 f3d2b480 fa6eab20 fa7219e8 dd41e0bf nt!IopfCallDriver+0x35
f0c7bb68 dd44408d fa8d9c48 fdd92e00 fdd92de0 SYMEVENT+0x6480
f0c7bbb0 dd44dc8f 00000000 c4960000 c0624b00 nt!MiDispatchFault+0x25b
f0c7bc0c dd44a33c 00000000 c4960000 00000000 nt!MmAccessFault+0x853
f0c7bc4c dd40d6ae c4960000 00000000 00000000
nt!MmCheckCachedPageState+0x346
f0c7bd0c dd413573 fbe23548 dd47ad40 fbe20da0 nt!CcPerformReadAhead+0x218
f0c7bd78 dd4176f1 fbe23548 00000000 00000000 nt!CcWorkerThread+0x16d
f0c7bda8 dd4595bc fbe23548 00000000 00000000 nt!ExpWorkerThread+0xaf
f0c7bddc dd46e656 dd417642 00000000 00000000
nt!PspSystemThreadStartup+0x54
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

unfortunately, i dont have a live system were it can be reproduced. It
is just a crash-dump file.

/ashish

“Tony Mason” wrote in message
news:xxxxx@windbg…

Let’s face it, nobody should be allocating must succeed pool
anyway. Try a “kv” as that will tell you who is allocating this memory.

Further, requesting 4KB of non-paged must succeed pool is
almost guaranteed to fail (as I recall, that’s the maximum size
anyway…)

There is WAY too much non-paged pool allocated on this system.
Try “!poolused” and if that indicates pool tags are not enabled try
enabling pool tagging and repeat. Someone is hogging non-paged memory
(128MB of non-paged pool? That’s A LOT…) Must succeed is further
limited - again as I recall 4KB is the max anyway.

Regards,

Tony

Tony Mason

Consulting Partner

OSR Open Systems Resources, Inc.

http://www.osr.com http:</http:>

________________________________

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Asheesh
Sent: Monday, March 21, 2005 8:48 AM
To: Kernel Debugging Interest List
Subject: [windbg] Out of Non-Paged pool

Hi,

I have a situation where a BugCheck is reported - 41-
MUST_SUCCEED_POOL_EMPTY

BugCheck 41, {1000, 691b, 16be, d7f29}

Arg1: 00001000, size of the request that could not be satisfied

Arg2: 0000691b, number of pages used of nonpaged pool

Arg3: 000016be, number of > PAGE_SIZE requests from nonpaged
pool

Arg4: 000d7f29, number of pages available

This BugCheck signifies that the Non-Paged Pool is “not
available” or “Excessive NonPaged Pool Usage”

!vm gives the following results

…

Available Pages: 884521 ( 3538084 Kb) << 884521* 4KB >>

ResAvail Pages: 991367 ( 3965468 Kb) << 991367* 4KB >>

Modified Pages: 527 ( 2108 Kb) << 527 * 4KB >>

NonPagedPool Usage: 32729 ( 130916 Kb) << 32729 * 4KB >>

NonPagedPool Max: 40387 ( 161548 Kb) << 40387 * 4KB >>

…

I dont fully understand the relationship between the Args of
BugCheck and the !vm output.

3: kd> dd mmmaximumnonpagedpoolinbytes l1 -----> Maxsize of
NonPaged Pool at taken from the registry at boottime
dd488a20 09dc3000
3: kd> ? 09dc3000
Evaluate expression: 165425152 = 09dc3000 ~157MB)

3: kd> dd mmsizeofnonpagedpoolinbytes l1 ----> Current Size
of NonPAged Pool
dd488a90 06049000
3: kd> ? 06049000
Evaluate expression: 100962304 = 06049000 ~96MB

Also, since the pool tagging is Off, is there a way I can find
out which kernel component is responsible for the leak/consumption?

The OS is - Windows 2000 Kernel Version 2195 (Service Pack 4) MP
(4 procs) Free x86 compatible

Thanks

/Ashish

—
You are currently subscribed to windbg as: unknown lmsubst tag
argument: ‘’
To unsubscribe send a blank email to
xxxxx@lists.osr.com

—
You are currently subscribed to windbg as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com