Re: Win2003 SP1 BSOD - STOP 0xab - DIAGNOSIS


2: kd> !analyze -v

SESSION_HAS_VALID_POOL_ON_EXIT (ab)
Caused by a session driver not freeing its pool allocations prior to a
session unload. This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll or a video driver.
Arguments:
Arg1: 00000002, session ID
Arg2: 00000040, number of paged pool bytes that are leaking
Arg3: 00000000, number of nonpaged pool bytes that are leaking
Arg4: 00000002, total number of paged and nonpaged allocations that are
leaking.
nonpaged allocations are in the upper half of this word,
paged allocations are in the lower half of this word.

Debugging Details:
------------------
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xAB
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 8092ed37 to 808275b7

STACK_TEXT:
f5267c24 8092ed37 000000ab 00000002 00000040 nt!KeBugCheckEx+0x1b
f5267c68 809ab017 8a082208 8a082208 00000000
nt!MiCheckSessionPoolAllocations+0x107
f5267ce8 8084c303 8a082208 00000000 896b1020
nt!MiDereferenceSessionFinal+0x183
f5267d04 8094b811 8a082208 896b1020 896b1260
nt!MmCleanProcessAddressSpace+0x6b
f5267d8c 8094b965 00000000 00000000 896b1020 nt!PspExitThread+0x5f1
f5267da4 80948e96 896b1020 00000000 00000001
nt!PspTerminateThreadByPointer+0x4b
f5267ddc 8088d642 bf92b850 8979ceb0 00000000
nt!PspSystemThreadStartup+0x3c
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


FOLLOWUP_IP:
nt!MiCheckSessionPoolAllocations+107
8092ed37 5f pop edi

SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: nt!MiCheckSessionPoolAllocations+107
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 42798839
STACK_COMMAND: kb
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: 0xAB_nt!MiCheckSessionPoolAllocations+107
BUCKET_ID: 0xAB_nt!MiCheckSessionPoolAllocations+107

Followup: MachineOwner
---------

2: kd> !poolused 8
Sorting by Session Tag

Pool Used:
NonPaged Paged
Tag Allocs Used Allocs Used
Gtvp 0 0 2 64 UNKNOWN pooltag 'Gtvp',
please update pooltag.txt
TOTAL 0 0 2 64




Matthew Chapman wrote:
> *I looked at this some more and I believe that I have
> it figured out. It is related to font linking support
> for non-Roman glyphs. Specifically, the allocation
> that is leaking is due to UMPDOBJ::bAllocFontLinks in
> win32k.sys. I'm not sure where that memory is meant
> to be freed, but it obviously isn't in all cases.
>
> This is how to reproduce the BSOD on a clean Windows
> Server 2003 SP1 installation:
>
> * Enable Terminal Server (Add/Remove Programs)
> * Enable "Install files for East Asian languages"
> (Regional and Language Options)
> * Install Microsoft Word Viewer, or Word itself
> (For some reason I haven't been able to reproduce
> the bug with WordPad)
> * Add a printer (any driver)
>
> * Log in remotely via a TS session
> * Open and print the test document
> http://www.cse.unsw.edu.au/~matthewc/files/tahoma.doc
> (This contains "This is a test." in the Tahoma font,
> you should be able to create your own version. You
> do not need to actually include any non-Roman
> character. Why Tahoma? Tahoma has font linking
> enabled in the registry by default.)
> * Log out
> (The bugcheck is triggered at session exit)
>
> Some dump analysis is again included below.
>
> Note that this is not fixed by KB901150 (which fixes
> another font-related leak).
>
> Is this sufficient information for someone at MS to
> log a bug report?
>
> Matt
>
> ---
>
> 0: kd> !analyze -v
> *******************************************************************************
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> *******************************************************************************
>
> SESSION_HAS_VALID_POOL_ON_EXIT (ab)
> Caused by a session driver not freeing its pool allocations prior to
> a
> session unload. This indicates a bug in win32k.sys, atmfd.dll,
> rdpdd.dll or a video driver.
> Arguments:
> Arg1: 00000012, session ID
> Arg2: 000001e0, number of paged pool bytes that are leaking
> Arg3: 00000000, number of nonpaged pool bytes that are leaking
> Arg4: 00000014, total number of paged and nonpaged allocations that
> are leaking. nonpaged allocations are in the upper half of
> this word,
> paged allocations are in the lower half of this word.
>
> [...]
>
> 0: kd> !poolused 8
> Sorting by Session Tag
>
> Pool Used:
> NonPaged Paged
> Tag Allocs Used Allocs Used
> Gump 0 0 20 480
> TOTAL 0 0 20 480 *



--
CCN
------------------------------------------------------------------------
Posted via http://www.mcse.ms
------------------------------------------------------------------------
View this thread: http://www.mcse.ms/message1832749.html

.

Relevant Pages

  • Re: W2k3 blue screen
    ... how van i recognize which driver is failing or what to do to fix the problem? ... Sorting by Session Tag ... Pool Used: ... total number of paged and nonpaged allocations that are leaking. ...
    (microsoft.public.windows.server.general)
  • Finding a memory pool corruption - win xp checked - poolval
    ... I try to find a memory corruption of my driver. ... Verifier with pool checking and all other flags ... Is there a debugger command for analyzing the pool allocations of the ...
    (microsoft.public.development.device.drivers)
  • RE: 2003 SBS stalling randomly
    ... A memory leak occurs in an application using the Volume Shadow Copy Service ... Poolmon displays data that the ... The data is grouped by pool allocation tag. ... Press P twice to display allocations from only the paged pool. ...
    (microsoft.public.windows.server.sbs)
  • Re: Slow Response for ASP.NET page
    ... the application pool level. ... application went down any session state was lost. ... On the Recycling tab, ... That causes the JITted assemblies to unload ...
    (microsoft.public.dotnet.framework.aspnet)
  • ASP.NET High memory usage
    ... We also grouped low level sites into 2 application pool. ... The main object is kept in session, and we also have some more tiny ... How can we measure the total session memory consumption for a worker ... Will it help us to have a session state server & web gardening? ...
    (microsoft.public.dotnet.framework.performance)
Loading