PAGE_FAULT_IN_NONPAGED_AREA BSOD

NTDEV
1

Hi All,

I am trying to debug a BSOD with bug check PAGE_FAULT_IN_NONPAGED_AREA , does any one saw similar call stack , the problem is seems to happening in volsnap. os : 2008 32 bit. how do I find out which device caused this bug check ?

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: aaa27000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 818848d4, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:

READ_ADDRESS: aaa27000

FAULTING_IP:
nt!RtlCompareMemory+14
818848d4 f3a7 repe cmps dword ptr [esi],dword ptr es:[edi]

MM_INTERNAL_CODE: 0

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: System

CURRENT_IRQL: 0

TRAP_FRAME: a3d5ec7c – (.trap 0xffffffffa3d5ec7c)
ErrCode = 00000000
eax=875ee068 ebx=380ae000 ecx=00000002 edx=00000000 esi=8796fff8 edi=aaa27000
eip=818848d4 esp=a3d5ecf0 ebp=a3d5ed34 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!RtlCompareMemory+0x14:
818848d4 f3a7 repe cmps dword ptr [esi],dword ptr es:[edi]
Resetting default scope

LAST_CONTROL_TRANSFER: from 81896ab4 to 818acb9e

STACK_TEXT:
a3d5ec64 81896ab4 00000000 aaa27000 00000000 nt!MmAccessFault+0x158
a3d5ec64 818848d4 00000000 aaa27000 00000000 nt!KiTrap0E+0xdc
a3d5ecf4 82d1e8b1 8796f000 aaa26008 00001000 nt!RtlCompareMemory+0x14
a3d5ed34 82d1e90e 00001000 aaa26008 00000000 volsnap!VspCompareMemoryWithCopyIrp+0x143
a3d5ed4c 82d28237 86602558 86602590 00000000 volsnap!VspCompareMemoryForTableEntry+0x14
a3d5ed60 82d279bd 86602558 00000000 8726a3a8 volsnap!VspWriteVolumePhase22+0x13
a3d5ed7c 819e46d5 85abb528 fa522684 00000000 volsnap!VspWorkerThread+0x83
a3d5edc0 818cb6de 82d2793a 85b7dba8 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

STACK_COMMAND: kb

FOLLOWUP_IP:
volsnap!VspCompareMemoryWithCopyIrp+143
82d1e8b1 3b4508 cmp eax,dword ptr [ebp+8]

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: volsnap!VspCompareMemoryWithCopyIrp+143

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: volsnap

IMAGE_NAME: volsnap.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47918f92

FAILURE_BUCKET_ID: 0x50_volsnap!VspCompareMemoryWithCopyIrp+143

BUCKET_ID: 0x50_volsnap!VspCompareMemoryWithCopyIrp+143

Followup: MachineOwner

2

Is this problem persistent? If yes, you could try to to disable recently installed drivers.
Also using Driver Verifier may help. But I think you already know this stuff which I’ve advised you.

Igor Sharovar

3

Vijay Pothireddy wrote:

I am trying to debug a BSOD with bug check PAGE_FAULT_IN_NONPAGED_AREA
, does any one saw similar call stack , the problem is seems to
happening in volsnap. os : 2008 32 bit. how do I find out which device
caused this bug check ?

Well, the bug check was caused by Volsnap, which was trying to compare
two pages of memory, only it used a non-page-aligned address for one of
the pages, causing it to run off the end of the page.

Do you have a driver of your own in the storage stack, or a driver
messing with the page tables?

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

4

We have the driver in the storage stack, we attach to both volsnap and
volume,
does this have any thing to do with this issue ? this is happening only
when windows guest is running on ESX Servers.
we are not doing any memory paging it just a simple upper filter.

Regards,
Vijay

From: “Tim Roberts”
Sent: Tuesday, September 29, 2009 10:48 PM
To: “Windows System Software Devs Interest List”
Subject: Re: [ntdev] PAGE_FAULT_IN_NONPAGED_AREA BSOD

> Vijay Pothireddy wrote:
>>
>> I am trying to debug a BSOD with bug check PAGE_FAULT_IN_NONPAGED_AREA
>> , does any one saw similar call stack , the problem is seems to
>> happening in volsnap. os : 2008 32 bit. how do I find out which device
>> caused this bug check ?
>
> Well, the bug check was caused by Volsnap, which was trying to compare
> two pages of memory, only it used a non-page-aligned address for one of
> the pages, causing it to run off the end of the page.
>
> Do you have a driver of your own in the storage stack, or a driver
> messing with the page tables?
>
> –
> Tim Roberts, xxxxx@probo.com
> Providenza & Boekelheide, Inc.
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

5

Hi,

Enabling special pool and recreating the bugcheck should help.

On Mon, Oct 26, 2009 at 3:46 PM, Vijay Pothireddy wrote:

> We have the driver in the storage stack, we attach to both volsnap and
> volume,
> does this have any thing to do with this issue ? this is happening only
> when windows guest is running on ESX Servers.
> we are not doing any memory paging it just a simple upper filter.
>
> Regards,
> Vijay
>
> --------------------------------------------------
> From: “Tim Roberts”
> Sent: Tuesday, September 29, 2009 10:48 PM
> To: “Windows System Software Devs Interest List”
> Subject: Re: [ntdev] PAGE_FAULT_IN_NONPAGED_AREA BSOD
>
>
> Vijay Pothireddy wrote:
>>
>>>
>>> I am trying to debug a BSOD with bug check PAGE_FAULT_IN_NONPAGED_AREA
>>> , does any one saw similar call stack , the problem is seems to
>>> happening in volsnap. os : 2008 32 bit. how do I find out which device
>>> caused this bug check ?
>>>
>>
>> Well, the bug check was caused by Volsnap, which was trying to compare
>> two pages of memory, only it used a non-page-aligned address for one of
>> the pages, causing it to run off the end of the page.
>>
>> Do you have a driver of your own in the storage stack, or a driver
>> messing with the page tables?
>>
>> –
>> Tim Roberts, xxxxx@probo.com
>> Providenza & Boekelheide, Inc.
>>
>>
>> —
>> NTDEV is sponsored by OSR
>>
>> For our schedule of WDF, WDM, debugging and other seminars visit:
>> http://www.osr.com/seminars
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http://www.osronline.com/page.cfm?name=ListServer
>>
>>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

–
Rahul Denkanikota

?Not everything that counts can be counted and not everything that can be
counted counts?

6

I have enabled it and I don’t see any difference in the call stack, the call stack is same and it shows volsnap caused the problem.

From: Rahul Denkanikota
Sent: Monday, October 26, 2009 4:09 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] PAGE_FAULT_IN_NONPAGED_AREA BSOD

Hi,

Enabling special pool and recreating the bugcheck should help.

On Mon, Oct 26, 2009 at 3:46 PM, Vijay Pothireddy wrote:

We have the driver in the storage stack, we attach to both volsnap and volume,
does this have any thing to do with this issue ? this is happening only when windows guest is running on ESX Servers.
we are not doing any memory paging it just a simple upper filter.

Regards,
Vijay

--------------------------------------------------
From: “Tim Roberts”
Sent: Tuesday, September 29, 2009 10:48 PM
To: “Windows System Software Devs Interest List”
Subject: Re: [ntdev] PAGE_FAULT_IN_NONPAGED_AREA BSOD

Vijay Pothireddy wrote:

I am trying to debug a BSOD with bug check PAGE_FAULT_IN_NONPAGED_AREA
, does any one saw similar call stack , the problem is seems to
happening in volsnap. os : 2008 32 bit. how do I find out which device
caused this bug check ?

Well, the bug check was caused by Volsnap, which was trying to compare
two pages of memory, only it used a non-page-aligned address for one of
the pages, causing it to run off the end of the page.

Do you have a driver of your own in the storage stack, or a driver
messing with the page tables?

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit: http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

–
Rahul Denkanikota

?Not everything that counts can be counted and not everything that can be counted counts?
— NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer