Question about the structured exception handling

NTDEV
1

I have a question about the SEH in the kernel. See the following condition.

  1. An exception happened in a thread while holding the registry lock,
    nt!CmpRegistryLock
  2. In my driver I have an exception handler to handle the exception in step
    1
  3. After I handle the exception what will happen to the thread holding the
    registry lock? The OS will simply terminate the thread? Or the system will
    release the lock before terminating the thread?

The reason I ask this question is because of a customer issue. There is a
system BSOD (stope code 0x3b, SYSTEM_SERVICE_EXCEPTION) at our customer side
when our program tried to read the registry. The exception code is
0xC0000005 (EXCEPTION_ACCESS_VIOLATION). We hope that we can have an
exception handler in our driver to handle this exception to avoid the BSOD.
But we found from the customer crash dump that the registry lock,
nt!CmpRegistryLock, was holding by the crashed thread. We don't know if this
lock will be released or not if we handle the exception. Any help will be
appreciated.

The following is the crash stack.

7: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck
Analysis *
*
*
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80001293ce1, Address of the exception record for the exception
that caused the bugcheck
Arg3: fffffadc9db23150, Address of the context record for the exception that
caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:

Page ce04c not present in the dump file. Type ".hh dbgerr004" for details
Page ce114 not present in the dump file. Type ".hh dbgerr004" for details
PEB is paged out (Peb.Ldr = 000007fffffdf018). Type ".hh dbgerr001" for details PEB is paged out (Peb.Ldr = 000007fffffdf018). Type ".hh dbgerr001" for
details

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!HvpGetCellMapped+b8
fffff800`01293ce1 498b4608 mov rax,qword ptr [r14+8]

CONTEXT: fffffadc9db23150 -- (.cxr 0xfffffadc9db23150)
rax=0000000000000000 rbx=0000000000730075 rcx=fffffa80000af000
rdx=0000000000730075 rsi=fffffadce08c0170 rdi=fffffa80000a7320
rip=fffff80001293ce1 rsp=fffffadc9db23960 rbp=0000000000000000
r8=0000000000000000 r9=fffffadc9db23ad0 r10=fffffa80136f2b08
r11=0000000000000000 r12=0000000000000003 r13=0000000000000130
r14=0000000000002600 r15=fffffadce13aab70
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b
efl=00010206
nt!HvpGetCellMapped+0xb8:
fffff80001293ce1 498b4608 mov rax,qword ptr [r14+8] ds:002b:0000000000002608=????????????????
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x3B

PROCESS_NAME: MyApp.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff800012956ee to fffff80001293ce1

STACK_TEXT:
fffffadc9db23960 fffff800012956ee : fffffa80000a7320 0000000000000000
fffff980198d6e9c fffffadc9db23ac8 : nt!HvpGetCellMapped+0xb8
fffffadc9db239e0 fffff8000125ce66 : fffffa80000a7320 fffffadc9db23cf0
0000000000000000 fffffa80136f2b08 : nt!CmpGetValueKeyFromCache+0x1d0
fffffadc9db23a60 fffff80001277d58 : fffffa80136f2b08 fffffadc9db23b90
0000000000000001 000000002643bb40 : nt!CmEnumerateValueKey+0x966
fffffadc9db23b30 fffff8000102e33d : fffffadcdc224c20 fffffadc00000000
0000000000000001 000000002643bb40 : nt!NtEnumerateValueKey+0x292
fffffadc9db23c00 0000000077ef0b2a : 0000000000000000 0000000000000000
0000000000000000 0000000000000000 : nt!KiSystemServiceCopyEnd+0x3
000000002643bad8 0000000000000000 : 0000000000000000 0000000000000000
0000000000000000 0000000000000000 : 0x77ef0b2a

FOLLOWUP_IP:
nt!HvpGetCellMapped+b8
fffff800`01293ce1 498b4608 mov rax,qword ptr [r14+8]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!HvpGetCellMapped+b8

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4a7992a0

STACK_COMMAND: .cxr 0xfffffadc9db23150 ; kb

FAILURE_BUCKET_ID: X64_0x3B_nt!HvpGetCellMapped+b8

BUCKET_ID: X64_0x3B_nt!HvpGetCellMapped+b8

Followup: MachineOwner

7: kd> !locks
**** DUMP OF ALL RESOURCE OBJECTS ****
KD: Scanning for held locks....

Resource @ nt!CmpRegistryLock (0xfffff800011de220) Shared 1 owning
threads
Contention Count = 4
Threads: fffffadce13aab70-01<*>
KD: Scanning for held
locks................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
488021 total locks, 1 locks currently held

2

You need to spend the time to diagnose the actual problem rather than attempting to paper over it with an exception handler (which will, to save you some time, not be successful).

  • S

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Michael Zhu
Sent: Monday, March 22, 2010 7:30 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Question about the structured exception handling

I have a question about the SEH in the kernel. See the following condition.

  1. An exception happened in a thread while holding the registry lock, nt!CmpRegistryLock
  2. In my driver I have an exception handler to handle the exception in step 1
  3. After I handle the exception what will happen to the thread holding the registry lock? The OS will simply terminate the thread? Or the system will release the lock before terminating the thread?

The reason I ask this question is because of a customer issue. There is a system BSOD (stope code 0x3b, SYSTEM_SERVICE_EXCEPTION) at our customer side when our program tried to read the registry. The exception code is 0xC0000005 (EXCEPTION_ACCESS_VIOLATION). We hope that we can have an exception handler in our driver to handle this exception to avoid the BSOD. But we found from the customer crash dump that the registry lock, nt!CmpRegistryLock, was holding by the crashed thread. We don't know if this lock will be released or not if we handle the exception. Any help will be appreciated.

The following is the crash stack.

7: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80001293ce1, Address of the exception record for the exception that caused the bugcheck
Arg3: fffffadc9db23150, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:

Page ce04c not present in the dump file. Type ".hh dbgerr004" for details
Page ce114 not present in the dump file. Type ".hh dbgerr004" for details
PEB is paged out (Peb.Ldr = 000007fffffdf018). Type ".hh dbgerr001" for details PEB is paged out (Peb.Ldr = 000007fffffdf018). Type ".hh dbgerr001" for details

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!HvpGetCellMapped+b8
fffff800`01293ce1 498b4608 mov rax,qword ptr [r14+8]

CONTEXT: fffffadc9db23150 -- (.cxr 0xfffffadc9db23150)
rax=0000000000000000 rbx=0000000000730075 rcx=fffffa80000af000
rdx=0000000000730075 rsi=fffffadce08c0170 rdi=fffffa80000a7320
rip=fffff80001293ce1 rsp=fffffadc9db23960 rbp=0000000000000000
r8=0000000000000000 r9=fffffadc9db23ad0 r10=fffffa80136f2b08
r11=0000000000000000 r12=0000000000000003 r13=0000000000000130
r14=0000000000002600 r15=fffffadce13aab70
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!HvpGetCellMapped+0xb8:
fffff80001293ce1 498b4608 mov rax,qword ptr [r14+8] ds:002b:0000000000002608=????????????????
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x3B

PROCESS_NAME: MyApp.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff800012956ee to fffff80001293ce1

STACK_TEXT:
fffffadc9db23960 fffff800012956ee : fffffa80000a7320 0000000000000000 fffff980198d6e9c fffffadc9db23ac8 : nt!HvpGetCellMapped+0xb8
fffffadc9db239e0 fffff8000125ce66 : fffffa80000a7320 fffffadc9db23cf0 0000000000000000 fffffa80136f2b08 : nt!CmpGetValueKeyFromCache+0x1d0
fffffadc9db23a60 fffff80001277d58 : fffffa80136f2b08 fffffadc9db23b90 0000000000000001 000000002643bb40 : nt!CmEnumerateValueKey+0x966
fffffadc9db23b30 fffff8000102e33d : fffffadcdc224c20 fffffadc00000000 0000000000000001 000000002643bb40 : nt!NtEnumerateValueKey+0x292
fffffadc9db23c00 0000000077ef0b2a : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiSystemServiceCopyEnd+0x3
000000002643bad8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x77ef0b2a

FOLLOWUP_IP:
nt!HvpGetCellMapped+b8
fffff800`01293ce1 498b4608 mov rax,qword ptr [r14+8]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!HvpGetCellMapped+b8

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4a7992a0

STACK_COMMAND: .cxr 0xfffffadc9db23150 ; kb

FAILURE_BUCKET_ID: X64_0x3B_nt!HvpGetCellMapped+b8

BUCKET_ID: X64_0x3B_nt!HvpGetCellMapped+b8

Followup: MachineOwner

7: kd> !locks
**** DUMP OF ALL RESOURCE OBJECTS ****
KD: Scanning for held locks....

Resource @ nt!CmpRegistryLock (0xfffff800011de220) Shared 1 owning threads
Contention Count = 4
Threads: fffffadce13aab70-01<*>
KD: Scanning for held locks................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
488021 total locks, 1 locks currently held

--- NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and other seminars visit: OSR Seminars – OSR To unsubscribe, visit the List Server section of OSR Online at ListServer/Forum

3

>registry. The exception code is 0xC0000005 (EXCEPTION_ACCESS_VIOLATION). We hope that

we can have an exception handler in our driver to handle this exception to avoid the BSOD.

Please fix the bug instead.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com