New
#1
BSOD when Idle, ntkrnlmp.exe
This is a dump straight out of WinDbg but I need help diagnosing it. I would like to do more but I'm about to go to work, so hopefully this will get you somewhere. I also have about 5 other bsod's as well.
I realize there is a tool for this but I wanted to post this before I leave for work.
In the zip: Minidumps.
Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\050613-20250-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: C:\Symbols
Executable search path is: C:\Windows
Windows 7 Kernel Version 7601 (Service Pack 1) UP Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0xfffff800`02e1a000 PsLoadedModuleList = 0xfffff800`0305fe90
Debug session time: Mon May 6 05:25:08.264 2013 (UTC - 4:00)
System Uptime: 0 days 9:49:41.726
Loading Kernel Symbols
...............................................................
................................................................
.......................................
Loading User Symbols
Loading unloaded module list
.................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff880083b3598, fffff880083b2df0, fffff80002e7b008}
Probably caused by : ntkrnlmp.exe ( nt!ExpCheckForIoPriorityBoost+5c )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff880083b3598
Arg3: fffff880083b2df0
Arg4: fffff80002e7b008
Debugging Details:
------------------
EXCEPTION_RECORD: fffff880083b3598 -- (.exr 0xfffff880083b3598)
ExceptionAddress: fffff80002e7b008 (nt!ExpCheckForIoPriorityBoost+0x000000000000005c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff880083b2df0 -- (.cxr 0xfffff880083b2df0)
rax=fffff880083b3808 rbx=fffffa8006a3caf0 rcx=fffffa8006a3caf0
rdx=0000000000000002 rsi=0000000000000000 rdi=668015031a4a9c04
rip=fffff80002e7b008 rsp=fffff880083b37d0 rbp=0000000000000001
r8=0000000000000702 r9=0000000000000000 r10=fffffa8004b35350
r11=000000000000000b r12=0000000000000000 r13=fffff8000300ce80
r14=0000000000000002 r15=0000000000010224
iopl=0 nv up di pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010002
nt!ExpCheckForIoPriorityBoost+0x5c:
fffff800`02e7b008 8b8748040000 mov eax,dword ptr [rdi+448h] ds:002b:66801503`1a4aa04c=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030cb0e8
GetUlongFromAddress: unable to read from fffff800030cb198
ffffffffffffffff
FOLLOWUP_IP:
nt!ExpCheckForIoPriorityBoost+5c
fffff800`02e7b008 8b8748040000 mov eax,dword ptr [rdi+448h]
FAULTING_IP:
nt!ExpCheckForIoPriorityBoost+5c
fffff800`02e7b008 8b8748040000 mov eax,dword ptr [rdi+448h]
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff80002e7b1bd to fffff80002e7b008
STACK_TEXT:
fffff880`083b37d0 fffff800`02e7b1bd : fffffa80`06a3caf0 00000000`00000001 00000000`00000000 fffff800`0300ce80 : nt!ExpCheckForIoPriorityBoost+0x5c
fffff880`083b3810 fffff800`02ea05cc : ffffffff`ffb3b4c0 16cffd5d`4faca061 fffffa80`06a3caf0 00000000`00000000 : nt!ExpWaitForResource+0x8d
fffff880`083b3880 fffff880`0141d8bb : 00000000`c00000d8 00000000`00000001 00000000`00000000 fffff8a0`016772b0 : nt!ExAcquireResourceExclusiveLite+0x14f
fffff880`083b38f0 fffff880`014b8de3 : fffffa80`06f9bba0 fffff8a0`01678940 fffff8a0`037bc882 00000000`00000001 : Ntfs!NtfsAcquireFcbWithPaging+0x13b
fffff880`083b3950 fffff880`014b6fd2 : fffffa80`06f9bba0 fffffa80`04b35350 fffff8a0`00201140 00000000`00000701 : Ntfs!NtfsFindPrefixHashEntry+0xabe
fffff880`083b3a80 fffff880`014b4911 : fffffa80`06f9bba0 fffffa80`05d20c10 fffff880`083b3c50 fffff880`083b3ca0 : Ntfs!NtfsFindStartingNode+0x452
fffff880`083b3b50 fffff880`0141da3d : fffffa80`06f9bba0 fffffa80`05d20c10 fffff880`0686b4a0 fffffa80`044f3b00 : Ntfs!NtfsCommonCreate+0x3e1
fffff880`083b3d30 fffff800`02e92157 : fffff880`0686b410 01ce49e9`4cf84a75 00000000`0021850f 00000880`00000860 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`083b3d60 fffff800`02e92111 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KySwitchKernelStackCallout+0x27
fffff880`0686b2e0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ExpCheckForIoPriorityBoost+5c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce7951a
STACK_COMMAND: .cxr 0xfffff880083b2df0 ; kb
FAILURE_BUCKET_ID: X64_0x24_nt!ExpCheckForIoPriorityBoost+5c
BUCKET_ID: X64_0x24_nt!ExpCheckForIoPriorityBoost+5c
Followup: MachineOwner
---------
Last edited by FireBall517; 07 May 2013 at 23:44.