I got a dump and it shows as following.
I don’t know where was wrong, the !analyze -v says RESOURCE_NOT_OWNED, but the !locks -v 0x8673ea34 says the resource is owned by the target thread…
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
RESOURCE_NOT_OWNED (e3)
A thread tried to release a resource it did not own.
Arguments:
Arg1: 8673ea34, Address of resource
Arg2: 865fed48, Address of thread
Arg3: 88382888, Address of owner table if there is one
Arg4: 00000003
Debugging Details:
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xE3
PROCESS_NAME: System
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from 83f2008f to 83ebc110
STACK_TEXT:
807e1694 83f2008f 00000003 3b1e4ef2 00000065 nt!RtlpBreakWithStatusInstruction
807e16e4 83f20b8d 00000003 883828a0 8673ea34 nt!KiBugCheckDebugBreak+0x1c
807e1aa8 83ebb752 000000e3 8673ea34 865fed48 nt!KeBugCheck2+0x68b
807e1afc 83ebb50e 865fed48 8c58856e 00000001 nt!ExpReleaseResourceForThreadLite+0x23e
807e1b04 8c58856e 00000001 888e3368 807e1ba8 nt!ExReleaseResourceLite+0xf
807e1b14 83e7732e 888e3368 83e772fe 3b1e43be KSkernel!KsReleaseFromReadAhead+0x5e [f:\newgit\kernelsec\driver\kernelsec\kernelsec\kscachemanagercallback.c @ 108]
807e1b1c 83e772fe 3b1e43be 885866f8 885866f8 nt!CcPerformReadAhead+0x2f0
807e1ba8 83edb354 888d4178 3b1e4416 865de340 nt!CcPerformReadAhead+0x2c5
807e1c00 83ebeaab 865de340 00000000 865fed48 nt!CcWorkerThread+0x18d
807e1c50 84049f64 00000000 3b1e4486 00000000 nt!ExpWorkerThread+0x10d
807e1c90 83ef2219 83ebe99e 00000000 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
STACK_COMMAND: kb
FOLLOWUP_IP:
KSkernel!KsReleaseFromReadAhead+5e [f:\newgit\kernelsec\driver\kernelsec\kernelsec\kscachemanagercallback.c @ 108]
8c58856e 8be5 mov esp,ebp
FAULTING_SOURCE_CODE:
104: // else
105: {
106: ExReleaseResourceLite( scb->Header.Resource );
107: }
108: }
SYMBOL_STACK_INDEX: 5
SYMBOL_NAME: KSkernel!KsReleaseFromReadAhead+5e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: KSkernel
IMAGE_NAME: KSkernel.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 548e943c
FAILURE_BUCKET_ID: 0xE3_KSkernel!KsReleaseFromReadAhead+5e
BUCKET_ID: 0xE3_KSkernel!KsReleaseFromReadAhead+5e
Followup: MachineOwner
kd> !locks -v 0x8673ea34
Resource @ 0x8673ea34 Shared 2 owning threads
Threads: 887a5a5b-01<*> *** Actual Thread 887a5a58
THREAD 887a5a58 Cid 0998.09c8 Teb: 7ffdf000 Win32Thread: ffaa7618 ???
IRP List:
866bd9a8: (0006,01d8) Flags: 00060900 Mdl: 00000000
Not impersonating
DeviceMap 90425c30
Owning Process 887a5d40 Image: WINWORD.EXE
Attached Process N/A Image: N/A
Wait Start TickCount 7408 Ticks: 11 (0:00:00:00.171)
Context Switch Count 365
UserTime 00:00:00.031
KernelTime 00:00:01.326
Win32 Start Address 0x2f2710ec
Stack Init 9a13eed0 Current 9a13e830 Base 9a13f000 Limit 9a13c000 Call 0
Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5
ChildEBP RetAddr
9a13e848 83eb86c7 nt!KiSwapContext+0x26 (FPO: [Uses EBP] [0,0,4])
9a13e87c 83e78d58 nt!KiExitDispatcher+0x140
9a13e8b4 83eb8493 nt!KiInsertQueue+0xf6
9a13e8d0 83edb497 nt!ExQueueWorkItem+0x44
9a13e8e8 83e7680e nt!CcPostWorkQueue+0x67 (FPO: [0,0,3])
9a13e91c 840a50c3 nt!CcScheduleReadAhead+0x28c
9a13e94c 8c57f2e6 nt!CcCopyRead+0x13b
9a13ea44 8c57e994 KSkernel!KsCommonRead+0x826 (FPO: [Non-Fpo]) (CONV: stdcall) [f:\newgit\kernelsec\driver\kernelsec\kernelsec\ksreadcallback.c @ 452]
9a13ea6c 8a655aeb KSkernel!KsPreReadBuffers+0x104 (FPO: [Non-Fpo]) (CONV: stdcall) [f:\newgit\kernelsec\driver\kernelsec\kernelsec\ksreadcallback.c @ 73]
9a13ead8 8a6589f0 fltmgr!FltpPerformPreCallbacks+0x34d (FPO: [Non-Fpo])
9a13eaf0 8a658f01 fltmgr!FltpPassThroughInternal+0x40 (FPO: [Non-Fpo])
9a13eb14 8a6593ba fltmgr!FltpPassThrough+0x203 (FPO: [Non-Fpo])
9a13eb44 83e78593 fltmgr!FltpDispatch+0xb4 (FPO: [Non-Fpo])
9a13eb5c 8406b98f nt!IofCallDriver+0x63
9a13eb7c 840a42de nt!IopSynchronousServiceTail+0x1f8
9a13ec08 83e7f1ea nt!NtReadFile+0x644
9a13ec08 777970b4 nt!KiFastCallEntry+0x12a (FPO: [0,3] TrapFrame @ 9a13ec34)
WARNING: Frame IP not in any known module. Following frames may be wrong.
002c75c8 00000000 0x777970b4
865fed4b-01<*> *** Actual Thread 865fed48
THREAD 865fed48 Cid 0004.0028 Teb: 00000000 Win32Thread: 00000000 RUNNING on processor 0
Not impersonating
DeviceMap 8b608950
Owning Process 865d78e8 Image: System
Attached Process N/A Image: N/A
Wait Start TickCount 7415 Ticks: 4 (0:00:00:00.062)
Context Switch Count 1378
UserTime 00:00:00.000
KernelTime 00:00:00.436
Win32 Start Address nt!ExpWorkerThread (0x83ebe99e)
Stack Init 807e1ed0 Current 807e0e08 Base 807e2000 Limit 807df000 Call 0
Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
ChildEBP RetAddr
807e1694 83f2008f nt!RtlpBreakWithStatusInstruction (FPO: [1,0,0])
807e16e4 83f20b8d nt!KiBugCheckDebugBreak+0x1c
807e1aa8 83ebb752 nt!KeBugCheck2+0x68b
807e1afc 83ebb50e nt!ExpReleaseResourceForThreadLite+0x23e
807e1b04 8c58856e nt!ExReleaseResourceLite+0xf (FPO: [0,0,0])
807e1b14 83e7732e KSkernel!KsReleaseFromReadAhead+0x5e (FPO: [Non-Fpo]) (CONV: stdcall) [f:\newgit\kernelsec\driver\kernelsec\kernelsec\kscachemanagercallback.c @ 108]
807e1b1c 83e772fe nt!CcPerformReadAhead+0x2f0 (FPO: [SEH])
807e1ba8 83edb354 nt!CcPerformReadAhead+0x2c5
807e1c00 83ebeaab nt!CcWorkerThread+0x18d
807e1c50 84049f64 nt!ExpWorkerThread+0x10d
807e1c90 83ef2219 nt!PspSystemThreadStartup+0x9e
00000000 00000000 nt!KiThreadStartup+0x19
1 total locks, 1 locks currently held