I asked our QA to inform me about any BSOD they ever encounter to verify if one of my drivers doesn’t cause it. Sometimes they give me a dump which seems to be caused by OS drivers itself. I wonder where to send such dumps. For example this one seems to be caused by usbhub.sys when trying to remove USBSTOR device. usbhub driver calls a function address stored in memory where is zero. Minidump is available, if anyone from MSFT cares.
Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [T:\error_reports\Michal\2005-02-16\Mini021605-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*e:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
Debug session time: Wed Feb 16 15:32:57 2005
System Uptime: 1 days 5:32:05.198
Loading Kernel Symbols
…
Loading unloaded module list
…
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {c0000005, 0, f8b79abc, f8b797b8}
Probably caused by : USBSTOR.SYS ( USBSTOR!USBSTOR_FdoRemoveDevice+ac )
Followup: MachineOwner
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but …
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
An exception code of 0x80000002 (STATUS_DATATYPE_MISALIGNMENT) indicates
that an unaligned data reference was encountered. The trap frame will
supply additional information.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 00000000, The address that the exception occurred at
Arg3: f8b79abc, Exception Record Address
Arg4: f8b797b8, Context Record Address
Debugging Details:
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at “0x%08lx” referenced memory at “0x%08lx”. The memory could not be “%s”.
FAULTING_IP:
+0
00000000 0000 add [eax],al
EXCEPTION_PARAMETER1: f8b79abc
CONTEXT: f8b797b8 – (.cxr fffffffff8b797b8)
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x7E
LAST_CONTROL_TRANSFER: from f887a6ff to 00000000
STACK_TEXT:
f8b79b80 f887a6ff 00000000 68627375 70646f52 0x0
f8b79bb0 f8881661 822035d8 82d6e9c8 8221f2b8 usbhub!USBH_PdoRemoveDevice+0x41
f8b79bd0 f887a952 82203690 8221f2b8 00000002 usbhub!USBH_PdoPnP+0x5b
f8b79bf4 f88781d8 01203690 8221f2b8 f8b79c28 usbhub!USBH_PdoDispatch+0x5a
f8b79c04 804e3d77 822035d8 8221f2b8 82267c80 usbhub!USBH_HubDispatch+0x48
f8b79c14 f8b10db4 82267bc8 82267c80 8221f2b8 nt!IopfCallDriver+0x31
f8b79c28 f8b12980 82267bc8 8221f2b8 8221f3b8 USBSTOR!USBSTOR_FdoRemoveDevice+0xac
f8b79c40 804e3d77 82267bc8 8221f2b8 f8b79ccc USBSTOR!USBSTOR_Pnp+0x4e
f8b79c50 805dd418 822035d8 822035d8 00000002 nt!IopfCallDriver+0x31
f8b79c7c 8061ad8c 82267bc8 f8b79ca8 00000000 nt!IopSynchronousCall+0xb7
f8b79cd0 80531935 822035d8 00000002 00000000 nt!IopRemoveDevice+0x93
f8b79cf8 8061bf03 e1e059c0 00000018 e13daad0 nt!IopRemoveLockedDeviceNode+0x160
f8b79d10 8061bf6f 822ae5c0 00000002 e13daad0 nt!IopDeleteLockedDeviceNode+0x34
f8b79d44 8061c01a 822035d8 023daad0 00000002 nt!IopDeleteLockedDeviceNodes+0x3f
f8b79d74 804e47fe 82e14eb0 00000000 82fc8da8 nt!IopDelayedRemoveWorker+0x4b
f8b79dac 8057dfed 82e14eb0 00000000 00000000 nt!ExpWorkerThread+0x100
f8b79ddc 804fa477 804e4729 00000001 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
FOLLOWUP_IP:
USBSTOR!USBSTOR_FdoRemoveDevice+ac
f8b10db4 ff760c push dword ptr [esi+0xc]
SYMBOL_STACK_INDEX: 6
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: USBSTOR!USBSTOR_FdoRemoveDevice+ac
MODULE_NAME: USBSTOR
IMAGE_NAME: USBSTOR.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 41107d6c
STACK_COMMAND: .cxr fffffffff8b797b8 ; kb
BUCKET_ID: 0x7E_USBSTOR!USBSTOR_FdoRemoveDevice+ac
Followup: MachineOwner
kd> u f887a6ff - 30 f887a6ff
usbhub!USBH_PdoRemoveDevice+0x11:
f887a6cf 57 push edi
f887a6d0 8b7d0c mov edi,[ebp+0xc]
f887a6d3 3bfb cmp edi,ebx
f887a6d5 895df8 mov [ebp-0x8],ebx
f887a6d8 895dfc mov [ebp-0x4],ebx
f887a6db 894508 mov [ebp+0x8],eax
f887a6de 895e08 mov [esi+0x8],ebx
f887a6e1 7431 jz usbhub!USBH_PdoRemoveDevice+0x56 (f887a714)
f887a6e3 0fb74e0c movzx ecx,word ptr [esi+0xc]
f887a6e7 51 push ecx
f887a6e8 50 push eax
f887a6e9 68526f6470 push 0x70646f52
f887a6ee 6875736268 push 0x68627375
f887a6f3 ffb70c020000 push dword ptr [edi+0x20c]
f887a6f9 ff972c020000 call dword ptr [edi+0x22c]
Best regards,
Michal Vodicka
UPEK, Inc.
[xxxxx@upek.com, http://www.upek.com]