RES: Windows 2008 x64 Hang

WINDBG
1

Thanks Mark! I tried this command and got the following output. This output shows that there are 127 threads waiting for this ERESOURCE.

Resource @ 0xfffffa80106f68a0 Exclusively owned
Contention Count = 5383961
NumberOfExclusiveWaiters = 63
Threads: fffffa8016292bb0-01<*>
Threads Waiting On Exclusive Access:
fffffa8015d50060 fffffa8016058340 fffffa80135c3060 fffffa80144a8810
fffffa80160c78e0 fffffa8012f8cbb0 fffffa8013280bb0 fffffa8015af6060
fffffa8013f39680 fffffa8013e24060 fffffa80103ae060 fffffa8013c16bb0
fffffa8015f15060 fffffa80107bbbb0 fffffa8015adcbb0 fffffa80143da060
fffffa80124d4bb0 fffffa8013342780 fffffa800fa67bb0 fffffa80158f1bb0
fffffa80158f6bb0 fffffa801460a560 fffffa8014767bb0 fffffa801184ebb0
fffffa80120f9bb0 fffffa80147f3bb0 fffffa8016201060 fffffa80126f2ac0
fffffa800f958bb0 fffffa80159ed6f0 fffffa8013018bb0 fffffa801486e610
fffffa8011f5dbb0 fffffa8015642bb0 fffffa8012ff7bb0 fffffa80146f06a0
fffffa80140e5060 fffffa801527d4c0 fffffa8011a40060 fffffa8011f8fac0
fffffa801392d360 fffffa801184a060 fffffa8014cdabb0 fffffa8013f4b060
fffffa8014116060 fffffa80143b5bb0 fffffa8014931bb0 fffffa8013dc5bb0
fffffa8015b2dbb0 fffffa8014525bb0 fffffa80131f7bb0 fffffa8013d51850
fffffa80143143e0 fffffa80162272b0 fffffa800ca66bb0 fffffa8010831640
fffffa80167a5840 fffffa80120366b0 fffffa8015688060 fffffa8014fcd060
fffffa8013a29bb0 fffffa8015745060 fffffa801151ebb0

From this output I think that the thread *fffffa8016292bb0* is the owner of the ERESOURCE lock. Looking into this thread I found that it belongs to an Outlook process and has the following call stack.

7: kd> !thread fffffa8016292bb0
THREAD fffffa8016292bb0 Cid 6b80.2380 Teb: 000000007efdb000 Win32Thread: fffff900c212a010 WAIT: (WrResource) KernelMode Non-Alertable
fffffa801205bb90 SynchronizationEvent
fffffa8016292c68 NotificationTimer
Not impersonating
DeviceMap fffff8801c8005d0
Owning Process fffffa80169a8310 Image: OUTLOOK.EXE
Attached Process N/A Image: N/A
Wait Start TickCount 40535270 Ticks: 161 (0:00:00:02.511)
Context Switch Count 206804 LargeStack
UserTime 00:00:30.466
KernelTime 00:00:13.821
Win32 Start Address 0x000000002f4a9b10
Stack Init fffffa607d44bdb0 Current fffffa607d44b320
Base fffffa607d44c000 Limit fffffa607d43a000 Call 0
Priority 14 BasePriority 10 PriorityDecrement 3 IoPriority 2 PagePriority 5
Child-SP RetAddr : Args to Child : Call Site
fffffa607d44b360 fffff800018a46fa : 0000000000000000 0000000000000004 fffffa6001966180 0000000000000000 : nt!KiSwapContext+0x7f
fffffa607d44b4a0 fffff8000189935b : 000005c000000002 fffffa8016292bb0 fffffa8000000002 fffffa800000000b : nt!KiSwapThread+0x13a
fffffa607d44b510 fffff800018ce43a : fffffa8000000000 fffffa800000001b 0000000000000000 fffffa8016292b00 : nt!KeWaitForSingleObject+0x2cb
fffffa607d44b5a0 fffff800018acf70 : fffffffffd9da600 fffffa80104d7b50 fffff900c0000e20 0000000000000000 : nt!ExpWaitForResource+0xda
fffffa607d44b600 fffff960001ff1c3 : 0000000000000000 0000000000000001 0000000000000000 fffff96000160501 : nt!ExEnterCriticalRegionAndAcquireResourceExclusive+0xb0
fffffa607d44b650 fffff96000a42876 : 0000000000000001 fffffa607d44bc20 fffff900c1eec010 0000000000000000 : win32k!EngAcquireSemaphore+0xf
fffffa607d44b680 0000000000000001 : fffffa607d44bc20 fffff900c1eec010 0000000000000000 0000000000000002 : vdtw30!EnsurePlentyOfFreeObjectRecords+0x26
fffffa607d44b688 fffffa607d44bc20 : fffff900c1eec010 0000000000000000 0000000000000002 fffff960001ff1c3 : 0x1
fffffa607d44b690 fffff900c1eec010 : 0000000000000000 0000000000000002 fffff960001ff1c3 0000000000006b80 : 0xfffffa607d44bc20 fffffa607d44b698 0000000000000000 : 0000000000000002 fffff960001ff1c3 0000000000006b80 0000000000000001 : 0xfffff900c1eec010

Maybe it is a deadlock. I could enable the driver verifier to use the !deadlock extension. What do you think?

Thanks again!

-George

2

Using Driver Verifier couldn’t hurt (it may leave a mark, but it won’t
hurt ;>). Are you looked at the Event Log to see if you have network,
disk, or application errors? Something unusual is going on.

–Mark Cariddi
OSR, Open Systems Resources, Inc.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of George Luiz
Bittencourt
Sent: Thursday, December 03, 2009 11:46 AM
To: Kernel Debugging Interest List
Subject: RES: [windbg] Windows 2008 x64 Hang

Thanks Mark! I tried this command and got the following output. This
output shows that there are 127 threads waiting for this ERESOURCE.

Resource @ 0xfffffa80106f68a0 Exclusively owned
Contention Count = 5383961
NumberOfExclusiveWaiters = 63
Threads: fffffa8016292bb0-01<*>
Threads Waiting On Exclusive Access:
fffffa8015d50060 fffffa8016058340
fffffa80135c3060 fffffa80144a8810
fffffa80160c78e0 fffffa8012f8cbb0
fffffa8013280bb0 fffffa8015af6060
fffffa8013f39680 fffffa8013e24060
fffffa80103ae060 fffffa8013c16bb0
fffffa8015f15060 fffffa80107bbbb0
fffffa8015adcbb0 fffffa80143da060
fffffa80124d4bb0 fffffa8013342780
fffffa800fa67bb0 fffffa80158f1bb0
fffffa80158f6bb0 fffffa801460a560
fffffa8014767bb0 fffffa801184ebb0
fffffa80120f9bb0 fffffa80147f3bb0
fffffa8016201060 fffffa80126f2ac0
fffffa800f958bb0 fffffa80159ed6f0
fffffa8013018bb0 fffffa801486e610
fffffa8011f5dbb0 fffffa8015642bb0
fffffa8012ff7bb0 fffffa80146f06a0
fffffa80140e5060 fffffa801527d4c0
fffffa8011a40060 fffffa8011f8fac0
fffffa801392d360 fffffa801184a060
fffffa8014cdabb0 fffffa8013f4b060
fffffa8014116060 fffffa80143b5bb0
fffffa8014931bb0 fffffa8013dc5bb0
fffffa8015b2dbb0 fffffa8014525bb0
fffffa80131f7bb0 fffffa8013d51850
fffffa80143143e0 fffffa80162272b0
fffffa800ca66bb0 fffffa8010831640
fffffa80167a5840 fffffa80120366b0
fffffa8015688060 fffffa8014fcd060
fffffa8013a29bb0 fffffa8015745060
fffffa801151ebb0

From this output I think that the thread *fffffa8016292bb0* is the owner
of the ERESOURCE lock. Looking into this thread I found that it belongs
to an Outlook process and has the following call stack.

7: kd> !thread fffffa8016292bb0
THREAD fffffa8016292bb0 Cid 6b80.2380 Teb: 000000007efdb000
Win32Thread: fffff900c212a010 WAIT: (WrResource) KernelMode
Non-Alertable
fffffa801205bb90 SynchronizationEvent
fffffa8016292c68 NotificationTimer
Not impersonating
DeviceMap fffff8801c8005d0
Owning Process fffffa80169a8310 Image:
OUTLOOK.EXE
Attached Process N/A Image: N/A
Wait Start TickCount 40535270 Ticks: 161 (0:00:00:02.511)
Context Switch Count 206804 LargeStack
UserTime 00:00:30.466
KernelTime 00:00:13.821
Win32 Start Address 0x000000002f4a9b10
Stack Init fffffa607d44bdb0 Current fffffa607d44b320
Base fffffa607d44c000 Limit fffffa607d43a000 Call 0
Priority 14 BasePriority 10 PriorityDecrement 3 IoPriority 2
PagePriority 5
Child-SP RetAddr : Args to Child
: Call Site
fffffa607d44b360 fffff800018a46fa : 0000000000000000 0000000000000004 fffffa6001966180 0000000000000000 :
nt!KiSwapContext+0x7f
fffffa607d44b4a0 fffff8000189935b : 000005c000000002 fffffa8016292bb0 fffffa8000000002 fffffa800000000b :
nt!KiSwapThread+0x13a
fffffa607d44b510 fffff800018ce43a : fffffa8000000000 fffffa800000001b 0000000000000000 fffffa8016292b00 :
nt!KeWaitForSingleObject+0x2cb
fffffa607d44b5a0 fffff800018acf70 : fffffffffd9da600 fffffa80104d7b50 fffff900c0000e20 0000000000000000 :
nt!ExpWaitForResource+0xda
fffffa607d44b600 fffff960001ff1c3 : 0000000000000000 0000000000000001 0000000000000000 fffff96000160501 :
nt!ExEnterCriticalRegionAndAcquireResourceExclusive+0xb0
fffffa607d44b650 fffff96000a42876 : 0000000000000001 fffffa607d44bc20 fffff900c1eec010 0000000000000000 :
win32k!EngAcquireSemaphore+0xf
fffffa607d44b680 0000000000000001 : fffffa607d44bc20 fffff900c1eec010 0000000000000000 0000000000000002 :
vdtw30!EnsurePlentyOfFreeObjectRecords+0x26
fffffa607d44b688 fffffa607d44bc20 : fffff900c1eec010 0000000000000000 0000000000000002 fffff960001ff1c3 : 0x1
fffffa607d44b690 fffff900c1eec010 : 0000000000000000 0000000000000002 fffff960001ff1c3 0000000000006b80 :
0xfffffa607d44bc20 fffffa607d44b698 0000000000000000 : 0000000000000002
fffff960001ff1c3 0000000000006b80 0000000000000001 : 0xfffff900c1eec010

Maybe it is a deadlock. I could enable the driver verifier to use the
!deadlock extension. What do you think?

Thanks again!

-George

WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

3

The thread that owns this resource is waiting for a different resource, so
I’d scan the rest of the !locks output to see what lock thread
fffffa8016292bb0 is waiting on and who owns it.

-scott

–
Scott Noone
Consulting Associate
OSR Open Systems Resources, Inc.
http://www.osronline.com

“George Luiz Bittencourt” wrote in message
news:xxxxx@windbg…
Thanks Mark! I tried this command and got the following output. This output
shows that there are 127 threads waiting for this ERESOURCE.

Resource @ 0xfffffa80106f68a0 Exclusively owned
Contention Count = 5383961
NumberOfExclusiveWaiters = 63
Threads: fffffa8016292bb0-01<*>
Threads Waiting On Exclusive Access:
fffffa8015d50060 fffffa8016058340 fffffa80135c3060
fffffa80144a8810
fffffa80160c78e0 fffffa8012f8cbb0 fffffa8013280bb0
fffffa8015af6060
fffffa8013f39680 fffffa8013e24060 fffffa80103ae060
fffffa8013c16bb0
fffffa8015f15060 fffffa80107bbbb0 fffffa8015adcbb0
fffffa80143da060
fffffa80124d4bb0 fffffa8013342780 fffffa800fa67bb0
fffffa80158f1bb0
fffffa80158f6bb0 fffffa801460a560 fffffa8014767bb0
fffffa801184ebb0
fffffa80120f9bb0 fffffa80147f3bb0 fffffa8016201060
fffffa80126f2ac0
fffffa800f958bb0 fffffa80159ed6f0 fffffa8013018bb0
fffffa801486e610
fffffa8011f5dbb0 fffffa8015642bb0 fffffa8012ff7bb0
fffffa80146f06a0
fffffa80140e5060 fffffa801527d4c0 fffffa8011a40060
fffffa8011f8fac0
fffffa801392d360 fffffa801184a060 fffffa8014cdabb0
fffffa8013f4b060
fffffa8014116060 fffffa80143b5bb0 fffffa8014931bb0
fffffa8013dc5bb0
fffffa8015b2dbb0 fffffa8014525bb0 fffffa80131f7bb0
fffffa8013d51850
fffffa80143143e0 fffffa80162272b0 fffffa800ca66bb0
fffffa8010831640
fffffa80167a5840 fffffa80120366b0 fffffa8015688060
fffffa8014fcd060
fffffa8013a29bb0 fffffa8015745060 fffffa801151ebb0

From this output I think that the thread fffffa8016292bb0 is the owner of
the ERESOURCE lock. Looking into this thread I found that it belongs to an
Outlook process and has the following call stack.

7: kd> !thread fffffa8016292bb0
THREAD fffffa8016292bb0 Cid 6b80.2380 Teb: 000000007efdb000 Win32Thread:
fffff900c212a010 WAIT: (WrResource) KernelMode Non-Alertable
fffffa801205bb90 SynchronizationEvent
fffffa8016292c68 NotificationTimer
Not impersonating
DeviceMap fffff8801c8005d0
Owning Process fffffa80169a8310 Image: OUTLOOK.EXE
Attached Process N/A Image: N/A
Wait Start TickCount 40535270 Ticks: 161 (0:00:00:02.511)
Context Switch Count 206804 LargeStack
UserTime 00:00:30.466
KernelTime 00:00:13.821
Win32 Start Address 0x000000002f4a9b10
Stack Init fffffa607d44bdb0 Current fffffa607d44b320
Base fffffa607d44c000 Limit fffffa607d43a000 Call 0
Priority 14 BasePriority 10 PriorityDecrement 3 IoPriority 2 PagePriority 5
Child-SP RetAddr : Args to Child
: Call Site
fffffa607d44b360 fffff800018a46fa : 0000000000000000 0000000000000004
fffffa6001966180 0000000000000000 : nt!KiSwapContext+0x7f
fffffa607d44b4a0 fffff8000189935b : 000005c000000002 fffffa8016292bb0
fffffa8000000002 fffffa800000000b : nt!KiSwapThread+0x13a
fffffa607d44b510 fffff800018ce43a : fffffa8000000000 fffffa800000001b
0000000000000000 fffffa8016292b00 : nt!KeWaitForSingleObject+0x2cb
fffffa607d44b5a0 fffff800018acf70 : fffffffffd9da600 fffffa80104d7b50
fffff900c0000e20 0000000000000000 : nt!ExpWaitForResource+0xda
fffffa607d44b600 fffff960001ff1c3 : 0000000000000000 0000000000000001
0000000000000000 fffff96000160501 :
nt!ExEnterCriticalRegionAndAcquireResourceExclusive+0xb0
fffffa607d44b650 fffff96000a42876 : 0000000000000001 fffffa607d44bc20
fffff900c1eec010 0000000000000000 : win32k!EngAcquireSemaphore+0xf
fffffa607d44b680 0000000000000001 : fffffa607d44bc20 fffff900c1eec010
0000000000000000 0000000000000002 :
vdtw30!EnsurePlentyOfFreeObjectRecords+0x26
fffffa607d44b688 fffffa607d44bc20 : fffff900c1eec010 0000000000000000
0000000000000002 fffff960001ff1c3 : 0x1
fffffa607d44b690 fffff900c1eec010 : 0000000000000000 0000000000000002
fffff960001ff1c3 0000000000006b80 : 0xfffffa607d44bc20<br>fffffa607d44b698 0000000000000000 : 0000000000000002 fffff960001ff1c3 <br>0000000000006b80 0000000000000001 : 0xfffff900c1eec010

Maybe it is a deadlock. I could enable the driver verifier to use the
!deadlock extension. What do you think?

Thanks again!

-George