IRQL not less or equal (bugcheck 0x0A)

Hi,

I am writing a file system driver supports removable media.Plug
and unplag more then five time in a short time on restart system get
crashes.

Crash analysis:


*******************************************************************************
*
*
* Bugcheck
Analysis *
*
*
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid)
address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0005a000, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation
(only on chips which support this level of status)
Arg4: 804fad30, address which referenced memory

Debugging Details:
------------------

*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: kernel32!pNlsUserInfo
***
***
***
*************************************************************************
*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: kernel32!pNlsUserInfo
***
***
***
*************************************************************************

WRITE_ADDRESS: 0005a000

CURRENT_IRQL: 1c

FAULTING_IP:
nt!KeWaitForSingleObject+186
804fad30 8939 mov dword ptr [ecx],edi

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: explorer.exe

TRAP_FRAME: f6948b1c -- (.trap 0xfffffffff6948b1c)
ErrCode = 00000002
eax=84633a7c ebx=84633a74 ecx=0005a000 edx=00000000 esi=84622330
edi=846223a0
eip=804fad30 esp=f6948b90 ebp=f6948bb0 iopl=0 nv up ei pl zr
na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010246
nt!KeWaitForSingleObject+0x186:
804fad30 8939 mov dword ptr [ecx],edi ds:
0023:0005a000=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 804f8afd to 8052a5d8

STACK_TEXT:
f69486d0 804f8afd 00000003 f6948a2c 00000000 nt!
RtlpBreakWithStatusInstruction
f694871c 804f96e8 00000003 0005a000 804fad30 nt!KiBugCheckDebugBreak
+0x19
f6948afc 805436d0 0000000a 0005a000 0000001c nt!KeBugCheck2+0x574
f6948afc 804fad30 0000000a 0005a000 0000001c nt!KiTrap0E+0x238
f6948bb0 8054591e 00000000 00000000 00000000 nt!KeWaitForSingleObject
+0x186
f6948bcc 804ed352 84622540 853f2e28 806e43b8 nt!
ExAcquireFastMutexUnsafe+0x1a
f6948c28 804f1327 8461e4d8 853f2e28 853f2e38 nt!FsRtlCancelNotify+0x52
f6948c40 80574529 853f2e28 84632850 84622330 nt!IoCancelIrp+0x65
f6948c68 805d0cb9 84622330 84893830 40010004 nt!IoCancelThreadIo+0x33
f6948cf0 805d0fbb 40010004 f6948d4c 804fecb1 nt!PspExitThread+0x403
f6948cfc 804fecb1 84893830 f6948d48 f6948d3c nt!PsExitSpecialApc+0x23
f6948d4c 80540677 00000001 00000000 f6948d64 nt!KiDeliverApc+0x1af
f6948d4c 7c90eb94 00000001 00000000 f6948d64 nt!KiServiceExit+0x59
0289fd2c 7c90e9ab 7c8094f2 00000006 0289fd58 ntdll!KiFastSystemCallRet
0289fd30 7c8094f2 00000006 0289fd58 00000001 ntdll!
ZwWaitForMultipleObjects+0xc
0289fdcc 77d4bbfe 00000006 0289fdf4 00000000 kernel32!
WaitForMultipleObjectsEx+0x12c
0289fe28 7c9f43d9 00000005 0289fe50 ffffffff USER32!
RealMsgWaitForMultipleObjectsEx+0x13e
0289ff4c 7ca3114e 77f7f5de 00000000 0272f1a8 SHELL32!
CChangeNotify::_MessagePump+0x3b
0289ff50 77f7f5de 00000000 0272f1a8 7c95ef68 SHELL32!
CChangeNotify::ThreadProc+0x1e
0289ffb4 7c80b50b 00000000 0272f1a8 7c95ef68 SHLWAPI!WrapperThreadProc
+0x94
0289ffec 00000000 77f7f56f 0272f4d4 00000000 kernel32!BaseThreadStart
+0x37


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KeWaitForSingleObject+186
804fad30 8939 mov dword ptr [ecx],edi

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: nt!KeWaitForSingleObject+186

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 41107b0d

FAILURE_BUCKET_ID: 0xA_VRF_nt!KeWaitForSingleObject+186

BUCKET_ID: 0xA_VRF_nt!KeWaitForSingleObject+186

Followup: MachineOwner
---------

0: kd> !thread
THREAD 84622330 Cid 05f4.0634 Teb: 7ffd7000 Win32Thread: 00000000
RUNNING on processor 0
IRP List:
84d4ae28: (0006,01d8) Flags: 40000000 Mdl: 00000000
853f2e28: (0006,01d8) Flags: 40000000 Mdl: 00000000
8545ce28: (0006,01d8) Flags: 40000000 Mdl: 00000000
8553ae28: (0006,01d8) Flags: 40000000 Mdl: 00000000
852cee28: (0006,01d8) Flags: 40000000 Mdl: 00000000
85504e28: (0006,01d8) Flags: 40000000 Mdl: 00000000
85032e28: (0006,01d8) Flags: 40000000 Mdl: 00000000
Not impersonating
DeviceMap e1943ea8
Owning Process 84632850 Image: explorer.exe
Attached Process N/A Image: N/A
Wait Start TickCount 110728 Ticks: 0
Context Switch Count 1266 LargeStack
UserTime 00:00:00.062
KernelTime 00:00:00.750
Win32 Start Address SHLWAPI!WrapperThreadProc (0x77f7f56f)
Start Address kernel32!BaseThreadStartThunk (0x7c810856)
Stack Init f6949000 Current f6948b6c Base f6949000 Limit f6945000 Call
0
Priority 16 BasePriority 8 PriorityDecrement 0 DecrementCount 0
ChildEBP RetAddr Args to Child
f69486d0 804f8afd 00000003 f6948a2c 00000000 nt!
RtlpBreakWithStatusInstruction (FPO: [1,0,0])
f694871c 804f96e8 00000003 0005a000 804fad30 nt!KiBugCheckDebugBreak
+0x19 (FPO: [Non-Fpo])
f6948afc 805436d0 0000000a 0005a000 0000001c nt!KeBugCheck2+0x574
(FPO: [6,242,4])
f6948afc 804fad30 0000000a 0005a000 0000001c nt!KiTrap0E+0x238 (FPO:
[0,0] TrapFrame @ f6948b1c)
f6948bb0 8054591e 00000000 00000000 00000000 nt!KeWaitForSingleObject
+0x186 (FPO: [5,5,4])
f6948bcc 804ed352 84622540 853f2e28 806e43b8 nt!
ExAcquireFastMutexUnsafe+0x1a (FPO: [0,0,0])
f6948c28 804f1327 8461e4d8 853f2e28 853f2e38 nt!FsRtlCancelNotify+0x52
(FPO: [Non-Fpo])
f6948c40 80574529 853f2e28 84632850 84622330 nt!IoCancelIrp+0x65 (FPO:
[1,1,4])
f6948c68 805d0cb9 84622330 84893830 40010004 nt!IoCancelThreadIo+0x33
(FPO: [1,4,4])
f6948cf0 805d0fbb 40010004 f6948d4c 804fecb1 nt!PspExitThread+0x403
(FPO: [Non-Fpo])
f6948cfc 804fecb1 84893830 f6948d48 f6948d3c nt!PsExitSpecialApc+0x23
(FPO: [5,0,0])
f6948d4c 80540677 00000001 00000000 f6948d64 nt!KiDeliverApc+0x1af
(FPO: [3,10,0])
f6948d4c 7c90eb94 00000001 00000000 f6948d64 nt!KiServiceExit+0x59
(FPO: [0,0] TrapFrame @ f6948d64)
0289fd2c 7c90e9ab 7c8094f2 00000006 0289fd58 ntdll!KiFastSystemCallRet
(FPO: [0,0,0])
0289fd30 7c8094f2 00000006 0289fd58 00000001 ntdll!
ZwWaitForMultipleObjects+0xc (FPO: [5,0,0])
0289fdcc 77d4bbfe 00000006 0289fdf4 00000000 kernel32!
WaitForMultipleObjectsEx+0x12c (FPO: [Non-Fpo])
0289fe28 7c9f43d9 00000005 0289fe50 ffffffff USER32!
RealMsgWaitForMultipleObjectsEx+0x13e (FPO: [5,13,4])
0289ff4c 7ca3114e 77f7f5de 00000000 0272f1a8 SHELL32!
CChangeNotify::_MessagePump+0x3b (FPO: [0,63,4])
0289ff50 77f7f5de 00000000 0272f1a8 7c95ef68 SHELL32!
CChangeNotify::ThreadProc+0x1e (FPO: [1,0,0])
0289ffb4 7c80b50b 00000000 0272f1a8 7c95ef68 SHLWAPI!WrapperThreadProc
+0x94 (FPO: [1,19,4])
0289ffec 00000000 77f7f56f 0272f4d4 00000000 kernel32!BaseThreadStart
+0x37 (FPO: [Non-Fpo])


0: kd> !irp 853f2e28
Irp is active with 10 stacks 10 is current (= 0x853f2fdc)
No Mdl: No System Buffer: Thread 84622330: Irp stack trace.
cmd flg cl Device File Completion-Context
[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[ 0, 0] 0 10 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[ c, 2] 0 1 8461e4d8 84714288 00000000-00000000 pending
8461e4d8: is not a device object

Args: 00000020 00000017 00000000 00000000
.

Relevant Pages

  • Ntfs crash
    ... Debugger entered on first try; ... Use!analyze -v to get detailed debugging information. ... *** In order for this command to work properly, ... *** must point to .pdb files that have full type information. ...
    (microsoft.public.development.device.drivers)
  • Re: DRIVER_IRQL_NOT_LESS_OR_EQUAL error in IM Driver
    ... If kernel debugger is available get stack backtrace. ... *** Your debugger is not using the correct symbols ... *** In order for this command to work properly, ... *** must point to .pdb files that have full type information. ...
    (microsoft.public.development.device.drivers)
  • Re: DRIVER_IRQL_NOT_LESS_OR_EQUAL error in IM Driver
    ... I am getting the error given below in my intermediate driver. ... If kernel debugger is available get stack backtrace. ... *** In order for this command to work properly, ... *** must point to .pdb files that have full type information. ...
    (microsoft.public.development.device.drivers)
  • Re: driver_irql_less_or_equal - Driver causes crash
    ... *** Your debugger is not using the correct symbols ... *** In order for this command to work properly, your symbol path ... *** must point to .pdb files that have full type information. ...
    (microsoft.public.development.device.drivers)
  • Re: driver_irql_less_or_equal - Driver causes crash
    ... *** Your debugger is not using the correct symbols ... *** In order for this command to work properly, your symbol path ... *** must point to .pdb files that have full type information. ...
    (microsoft.public.development.device.drivers)
Loading