Ntfs crash
- From: yushang <yusunn@xxxxxxxxx>
- Date: Thu, 8 Oct 2009 03:30:02 -0700 (PDT)
Hi , could somebody analyze this stack trace for me , thanks in
advance
*** Fatal System Error: 0x00000050
(0xFA12A1C0,0x00000001,0xF98F5CEC,0x00000000)
Driver at fault:
*** Ntfs.sys - Address F98F5CEC base at F98F1000, DateStamp
48025be5
..
Break instruction exception - code 80000003 (first chance)
A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been
invoked.
A fatal system error has occurred.
Connected to Windows XP 2600 x86 compatible target at (Thu Oct 8
18:22:26.953 2
009 (GMT+8)), ptr64 FALSE
Loading Kernel Symbols
................................................................
......................................
Loading User Symbols
.................................................................
......................................
Loading unloaded module list
..............
*******************************************************************************
*
*
* Bugcheck
Analysis *
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fa12a1c0, 1, f98f5cec, 0}
*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: kernel32!pNlsUserInfo
***
***
***
*************************************************************************
*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: kernel32!pNlsUserInfo
***
***
***
*************************************************************************
Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonRead+b76 )
Followup: MachineOwner
---------
nt!RtlpBreakWithStatusInstruction:
804e4592 cc int 3
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck
Analysis *
*
*
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-
except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: fa12a1c0, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: f98f5cec, If non-zero, the instruction address which referenced
the bad me
mory
address.
Arg4: 00000000, (reserved)
Debugging Details:
------------------
*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: kernel32!pNlsUserInfo
***
***
***
*************************************************************************
*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: kernel32!pNlsUserInfo
***
***
***
*************************************************************************
WRITE_ADDRESS: fa12a1c0
FAULTING_IP:
Ntfs!NtfsCommonRead+b76
f98f5cec f3ab rep stos dword ptr es:[edi]
MM_INTERNAL_CODE: 0
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 48025be5
MODULE_NAME: Ntfs
FAULTING_MODULE: f98f1000 Ntfs
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: explorer.exe
TRAP_FRAME: f940f8cc -- (.trap 0xfffffffff940f8cc)
ErrCode = 00000002
eax=00000000 ebx=f940fa10 ecx=00000010 edx=00000040 esi=e1872d20
edi=fa12a1c0
eip=f98f5cec esp=f940f940 ebp=f940f9fc iopl=0 nv up ei pl nz
na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010202
Ntfs!NtfsCommonRead+0xb76:
f98f5cec f3ab rep stos dword ptr es:[edi]
Resetting default scope
LAST_CONTROL_TRANSFER: from 8053373f to 804e4592
STACK_TEXT:
f940f41c 8053373f 00000003 fa12a1c0 00000000 nt!
RtlpBreakWithStatusInstruction
f940f468 80534216 00000003 806f003c c03e84a8 nt!KiBugCheckDebugBreak
+0x19
f940f848 80534806 00000050 fa12a1c0 00000001 nt!KeBugCheck2+0x574
f940f868 805251a0 00000050 fa12a1c0 00000001 nt!KeBugCheckEx+0x1b
f940f8b4 804e2718 00000001 fa12a1c0 00000000 nt!MmAccessFault+0x6f5
f940f8b4 f98f5cec 00000001 fa12a1c0 00000000 nt!KiTrap0E+0xcc
f940f9fc f98f400a f940fa10 8198d008 00000001 Ntfs!NtfsCommonRead+0xb76
f940fbac 804e47f7 8188c770 8198d008 00040000 Ntfs!NtfsFsdRead+0x22d
f940fbbc 804fa5d8 00000000 81bd6330 81bd6340 nt!IopfCallDriver+0x31
f940fbd0 804fa5ff 8188c770 81bd6307 81bd6348 nt!IopPageReadInternal
+0xf4
f940fbf0 804fa264 81aadf28 81bd6368 81bd6348 nt!IoPageRead+0x1b
f940fc64 804eca6a 0c4898c0 dea00000 c037a800 nt!MiDispatchFault+0x274
f940fcb4 804f77f3 00000000 dea00000 00000000 nt!MmAccessFault+0x5bc
f940fcf4 804f13c4 dea00000 00000000 f940fe20 nt!MmCheckCachedPageState
+0x461
f940fd3c 804f154f 81a41898 f940fd7c 00001000 nt!CcMapAndRead+0x94
f940fdd0 8057624b 81aadf28 f940fe10 000000d0 nt!CcPinFileData+0x24a
f940fe44 f991e7c7 81aadf28 f940fe7c 000000d0 nt!CcPinRead+0xc4
f940fe6c f992dd8e 81853828 e1872d20 000401c0 Ntfs!NtfsPinStream+0x71
f940ff1c f992e038 81853828 e1872d20 000401c0 Ntfs!NtOfsPutData+0x275
f940ffac f992d6df 81853828 e15b9ee0 e105cc58 Ntfs!
GetSecurityIdFromSecurityDescr
iptorUnsafe+0x1ce
f940fff0 f99247ea 81853828 e15baa88 000000bc Ntfs!
NtfsCacheSharedSecurityByDescr
iptor+0x70
f9410038 f9924ce0 81853828 e105cc58 81853828 Ntfs!
NtfsCacheSharedSecurityForCrea
te+0x92
f9410214 f9919b32 81853828 81aa9510 81aa9658 Ntfs!NtfsCreateNewFile
+0x29d
f9410468 f9916f2d 81853828 81aa9510 f94104c0 Ntfs!NtfsCommonCreate
+0x12ce
f941054c 804e47f7 8188c770 81aa9510 81aa9510 Ntfs!NtfsFsdCreate+0x1dc
f941055c 8056d712 81961158 81a6ea3c f9410704 nt!IopfCallDriver+0x31
f941063c 80564fec 81961170 00000000 81a6e998 nt!IopParseDevice+0xa12
f94106c4 805694da 00000000 f9410704 00000040 nt!ObpLookupObjectName
+0x56a
f9410718 8056dbeb 00000000 00000000 001c0101 nt!ObOpenObjectByName
+0xeb
f9410794 8056dcba 02a8ca60 c0100080 02a8ca00 nt!IopCreateFile+0x407
f94107f0 8056ddf0 02a8ca60 c0100080 02a8ca00 nt!IoCreateFile+0x8e
f9410830 804df7ec 02a8ca60 c0100080 02a8ca00 nt!NtCreateFile+0x30
f9410830 7c92e514 02a8ca60 c0100080 02a8ca00 nt!KiFastCallEntry+0xf8
02a8c9bc 7c92d0ba 7c8109b6 02a8ca60 c0100080 ntdll!KiFastSystemCallRet
02a8c9c0 7c8109b6 02a8ca60 c0100080 02a8ca00 ntdll!NtCreateFile+0xc
02a8ca58 77f47fef 00000000 c0000000 00000007 kernel32!CreateFileW
+0x35f
02a8cc9c 77f5a1ea 02a8ccf8 c0000000 00000007 SHLWAPI!CreateFileWrapW
+0x73
02a8ccd4 7d6a8570 02a8ccf8 00000002 00000080 SHLWAPI!
SHCreateStreamOnFileEx+0x48
02a8cf04 7d6a8c90 02a8d190 00000002 02a8d16c SHELL32!
CFSFolder::_OpenCreateStrea
m+0x50
02a8d134 7d75151c 001148a8 02a8d190 00000002 SHELL32!
CFSFolder::CreateStream+0x3
0
02a8d15c 7d75180c 001148a8 02a8d190 00000000 SHELL32!
CreateStreamOrStorage+0x5c
02a8d39c 7d7345c8 001148a8 02a8daf8 7d59d788 SHELL32!StgMakeUniqueName
+0x128
02a8dda4 7d5e5f7b 02ad8d18 02a8ddc0 00112cc0 SHELL32!
CNewMenu::InvokeCommand+0x2
6d
02a8de04 7d5e5ecd 00104548 02a8de24 00000000 SHELL32!
HDXA_LetHandlerProcessComma
ndEx+0xa5
02a8e094 7d6fe70f 00112cc0 02a8e3fc 20000000 SHELL32!
CDefFolderMenu::InvokeComma
nd+0x17f
02a8e0b0 7d675f0a 00155bc0 02a8e3fc 02a8e43c SHELL32!
CContextMenuOnContextMenuAr
ray::InvokeCommand+0x44
02a8e3e0 7d678eb1 00155bc0 02a8e3fc 77d29930 SHELL32!
CDefView::_InvokeContextMen
u+0xb0
02a8e6e8 7d67bce6 00155bc0 00000000 0000014c SHELL32!
CDefView::_DoContextMenuPop
up+0x37e
02a8e734 7d5d211e 00010011 00000000 00164a40 SHELL32!
CDefView::ContextMenu+0x1e4
02a8e8a8 7d5c2f88 0008011e 0000007b 00090170 SHELL32!CDefView::WndProc
+0x840
02a8e8ec 77d18734 0008011e 0000007b 00090170 SHELL32!
CDefView::s_WndProc+0x72
02a8e918 77d18816 7d5c2f32 0008011e 0000007b USER32!InternalCallWinProc
+0x28
02a8e980 77d28ea0 0009f278 7d5c2f32 0008011e USER32!
UserCallWinProcCheckWow+0x15
0
02a8e9d4 77d28eec 006107b8 0000007b 00090170 USER32!
DispatchClientMessage+0xa3
02a8e9fc 7c92e473 02a8ea0c 00000018 006107b8 USER32!__fnDWORD+0x24
02a8e9fc 804e3b1c 02a8ea0c 00000018 006107b8 ntdll!
KiUserCallbackDispatcher+0x13
f9410b18 80567b60 f9410bd4 f9410bd8 f9410ba8 nt!KiCallUserMode+0x4
f9410b74 bf813d86 00000002 f9410bb8 00000018 nt!KeUserModeCallback
+0x87
f9410bf8 bf813f1c bc6507b8 0000007b 00090170 win32k!SfnDWORD+0xa8
f9410c40 bf81410e 006507b8 0000007b 00090170 win32k!
xxxSendMessageToClient+0x176
f9410c8c bf80ecb1 bc6507b8 0000007b 00090170 win32k!
xxxSendMessageTimeout+0x1a6
f9410cb0 bf80b46c bc6507b8 0000007b 00090170 win32k!xxxSendMessage
+0x1b
f9410d14 bf80ec77 bc64f850 0000007b 00070174 win32k!
xxxRealDefWindowProc+0xaeb
f9410d2c bf820a45 bc64f850 0000007b 00070174 win32k!
xxxWrapRealDefWindowProc+0x1
6
f9410d48 bf80eebe bc64f850 0000007b 00070174 win32k!NtUserfnNCDESTROY
+0x27
f9410d80 804df7ec 00090170 0000007b 00070174 win32k!NtUserMessageCall
+0xae
f9410d80 7c92e514 00090170 0000007b 00070174 nt!KiFastCallEntry+0xf8
02a8e9fc 7c92e473 02a8ea0c 00000018 006107b8 ntdll!KiFastSystemCallRet
02a8e9fc 804e3b1c 02a8ea0c 00000018 006107b8 ntdll!
KiUserCallbackDispatcher+0x13
f9411058 80567b60 f9411114 f9411118 f94110e8 nt!KiCallUserMode+0x4
f94110b4 bf813d86 00000002 f94110f8 00000018 nt!KeUserModeCallback
+0x87
f9411138 bf813f1c bc64f850 0000007b 00070174 win32k!SfnDWORD+0xa8
f9411180 bf81410e 0064f850 0000007b 00070174 win32k!
xxxSendMessageToClient+0x176
f94111cc bf80ecb1 bc64f850 0000007b 00070174 win32k!
xxxSendMessageTimeout+0x1a6
f94111f0 bf80b46c bc64f850 0000007b 00070174 win32k!xxxSendMessage
+0x1b
STACK_COMMAND: kb
FOLLOWUP_IP:
Ntfs!NtfsCommonRead+b76
f98f5cec f3ab rep stos dword ptr es:[edi]
SYMBOL_STACK_INDEX: 6
SYMBOL_NAME: Ntfs!NtfsCommonRead+b76
FOLLOWUP_NAME: MachineOwner
FAILURE_BUCKET_ID: 0x50_Ntfs!NtfsCommonRead+b76
BUCKET_ID: 0x50_Ntfs!NtfsCommonRead+b76
Followup: MachineOwner
---------
.
- Prev by Date: Re: disabling postscript passthrough in printer plugin
- Next by Date: Re: Services and drivers that disable standby
- Previous by thread: CreateFile failures on device driver, fixes when changing ClassGui
- Next by thread: Re: Getting bugcheck SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
- Index(es):
Relevant Pages
|
