Hi,
our Microsoft Windows Server 2012 R2 with Hyper-V crashed today.
According to the dumpfile it seems to be something with vhdmp.sys
Any idea what could have been causing this?
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {b500190637, ffffd001577c63b8, ffffd001577c5bc0, fffff801ccc12154}
Probably caused by : vhdmp.sys ( vhdmp!ExFreeToNPagedLookasideList+3c )
Followup: MachineOwner
---------
18: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 000000b500190637
Arg2: ffffd001577c63b8
Arg3: ffffd001577c5bc0
Arg4: fffff801ccc12154
Debugging Details:
------------------
EXCEPTION_RECORD: ffffd001577c63b8 -- (.exr 0xffffd001577c63b8)
ExceptionAddress: fffff801ccc12154 (vhdmp!ExFreeToNPagedLookasideList+0x000000000000003c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: ffffd001577c5bc0 -- (.cxr 0xffffd001577c5bc0;r)
rax=000000000840542f rbx=ffffe8005b4df080 rcx=ffffe8005a81d220
rdx=ffffe8005a81d220 rsi=ffffe8005b4de000 rdi=ffffe8005a81d220
rip=fffff801ccc12154 rsp=ffffd001577c65f0 rbp=ffffd001577c6670
r8=0000000000000001 r9=000000000000002f r10=fffff80284a065b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=ffffe8005c2d2440 r15=ffffe8005c2b94f0
iopl=0 nv up ei ng nz ac pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010292
vhdmp!ExFreeToNPagedLookasideList+0x3c:
fffff801`ccc12154 ff5338 call qword ptr [rbx+38h] ds:002b:ffffe800`5b4df0b8=????????????????
Last set context:
rax=000000000840542f rbx=ffffe8005b4df080 rcx=ffffe8005a81d220
rdx=ffffe8005a81d220 rsi=ffffe8005b4de000 rdi=ffffe8005a81d220
rip=fffff801ccc12154 rsp=ffffd001577c65f0 rbp=ffffd001577c6670
r8=0000000000000001 r9=000000000000002f r10=fffff80284a065b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=ffffe8005c2d2440 r15=ffffe8005c2b94f0
iopl=0 nv up ei ng nz ac pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010292
vhdmp!ExFreeToNPagedLookasideList+0x3c:
fffff801`ccc12154 ff5338 call qword ptr [rbx+38h] ds:002b:ffffe800`5b4df0b8=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT_SERVER
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80284dc4138
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
ffffffffffffffff
FOLLOWUP_IP:
vhdmp!ExFreeToNPagedLookasideList+3c
fffff801`ccc12154 ff5338 call qword ptr [rbx+38h]
FAULTING_IP:
vhdmp!ExFreeToNPagedLookasideList+3c
fffff801`ccc12154 ff5338 call qword ptr [rbx+38h]
BUGCHECK_STR: 0x24
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre
LAST_CONTROL_TRANSFER: from fffff801ccc3bd98 to fffff801ccc12154
STACK_TEXT:
ffffd001`577c65f0 fffff801`ccc3bd98 : ffffd001`577c6660 ffffe800`5b4de000 00000000`00000010 ffffc001`f9c91d00 : vhdmp!ExFreeToNPagedLookasideList+0x3c
ffffd001`577c6620 fffff802`84b0f378 : ffffe000`5d429810 ffffe000`5d429800 ffffe000`5d429adb ffffc001`f9c91da0 : vhdmp!VhdmpiCTFlushBuffersIOCompletion+0x18c
ffffd001`577c6690 fffff801`cb670130 : ffffe800`5eb64b00 00000000`00000001 ffffe800`5eb64bc8 ffffe000`5d429810 : nt!IopfCompleteRequest+0x588
ffffd001`577c67a0 fffff801`cb66ca58 : 00000000`00000000 ffffd001`577c6a40 ffffc002`01b57c30 00000000`00000048 : Ntfs!NtfsExtendedCompleteRequestInternal+0x150
ffffd001`577c67d0 fffff801`cb65ca89 : ffffe800`5eb64bc8 ffffd001`577c6a40 00000000`00000000 ffffe800`5eb64bc8 : Ntfs!NtfsCommonWrite+0x2e2d
ffffd001`577c6a00 fffff802`84ac3adb : fffff801`cb65d424 fffff801`cb65c860 ffffe800`5eb64bc8 ffffe800`5f705040 : Ntfs!NtfsFspDispatch+0x229
ffffd001`577c6b50 fffff802`84b3f794 : 00000000`00000000 ffffe800`5f705040 ffffe800`5f705040 ffffe000`57455900 : nt!ExpWorkerThread+0x293
ffffd001`577c6c00 fffff802`84bca5c6 : ffffd001`54600180 ffffe800`5f705040 ffffe800`5f74e540 00000000`00000246 : nt!PspSystemThreadStartup+0x58
ffffd001`577c6c60 00000000`00000000 : ffffd001`577c7000 ffffd001`577c1000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: vhdmp!ExFreeToNPagedLookasideList+3c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: vhdmp
IMAGE_NAME: vhdmp.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 52e848da
IMAGE_VERSION: 6.3.9600.16521
STACK_COMMAND: .cxr 0xffffd001577c5bc0 ; kb
BUCKET_ID_FUNC_OFFSET: 3c
FAILURE_BUCKET_ID: 0x24_vhdmp!ExFreeToNPagedLookasideList
BUCKET_ID: 0x24_vhdmp!ExFreeToNPagedLookasideList
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x24_vhdmp!exfreetonpagedlookasidelist
FAILURE_ID_HASH: {9c4ed974-e3f7-aed7-e34e-cf68671dc0ce}
Followup: MachineOwner
---------
18: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 000000b500190637
Arg2: ffffd001577c63b8
Arg3: ffffd001577c5bc0
Arg4: fffff801ccc12154
Debugging Details:
------------------
EXCEPTION_RECORD: ffffd001577c63b8 -- (.exr 0xffffd001577c63b8)
ExceptionAddress: fffff801ccc12154 (vhdmp!ExFreeToNPagedLookasideList+0x000000000000003c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: ffffd001577c5bc0 -- (.cxr 0xffffd001577c5bc0;r)
rax=000000000840542f rbx=ffffe8005b4df080 rcx=ffffe8005a81d220
rdx=ffffe8005a81d220 rsi=ffffe8005b4de000 rdi=ffffe8005a81d220
rip=fffff801ccc12154 rsp=ffffd001577c65f0 rbp=ffffd001577c6670
r8=0000000000000001 r9=000000000000002f r10=fffff80284a065b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=ffffe8005c2d2440 r15=ffffe8005c2b94f0
iopl=0 nv up ei ng nz ac pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010292
vhdmp!ExFreeToNPagedLookasideList+0x3c:
fffff801`ccc12154 ff5338 call qword ptr [rbx+38h] ds:002b:ffffe800`5b4df0b8=????????????????
Last set context:
rax=000000000840542f rbx=ffffe8005b4df080 rcx=ffffe8005a81d220
rdx=ffffe8005a81d220 rsi=ffffe8005b4de000 rdi=ffffe8005a81d220
rip=fffff801ccc12154 rsp=ffffd001577c65f0 rbp=ffffd001577c6670
r8=0000000000000001 r9=000000000000002f r10=fffff80284a065b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=ffffe8005c2d2440 r15=ffffe8005c2b94f0
iopl=0 nv up ei ng nz ac pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010292
vhdmp!ExFreeToNPagedLookasideList+0x3c:
fffff801`ccc12154 ff5338 call qword ptr [rbx+38h] ds:002b:ffffe800`5b4df0b8=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT_SERVER
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: ffffffffffffffff
FOLLOWUP_IP:
vhdmp!ExFreeToNPagedLookasideList+3c
fffff801`ccc12154 ff5338 call qword ptr [rbx+38h]
FAULTING_IP:
vhdmp!ExFreeToNPagedLookasideList+3c
fffff801`ccc12154 ff5338 call qword ptr [rbx+38h]
BUGCHECK_STR: 0x24
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre
LAST_CONTROL_TRANSFER: from fffff801ccc3bd98 to fffff801ccc12154
STACK_TEXT:
ffffd001`577c65f0 fffff801`ccc3bd98 : ffffd001`577c6660 ffffe800`5b4de000 00000000`00000010 ffffc001`f9c91d00 : vhdmp!ExFreeToNPagedLookasideList+0x3c
ffffd001`577c6620 fffff802`84b0f378 : ffffe000`5d429810 ffffe000`5d429800 ffffe000`5d429adb ffffc001`f9c91da0 : vhdmp!VhdmpiCTFlushBuffersIOCompletion+0x18c
ffffd001`577c6690 fffff801`cb670130 : ffffe800`5eb64b00 00000000`00000001 ffffe800`5eb64bc8 ffffe000`5d429810 : nt!IopfCompleteRequest+0x588
ffffd001`577c67a0 fffff801`cb66ca58 : 00000000`00000000 ffffd001`577c6a40 ffffc002`01b57c30 00000000`00000048 : Ntfs!NtfsExtendedCompleteRequestInternal+0x150
ffffd001`577c67d0 fffff801`cb65ca89 : ffffe800`5eb64bc8 ffffd001`577c6a40 00000000`00000000 ffffe800`5eb64bc8 : Ntfs!NtfsCommonWrite+0x2e2d
ffffd001`577c6a00 fffff802`84ac3adb : fffff801`cb65d424 fffff801`cb65c860 ffffe800`5eb64bc8 ffffe800`5f705040 : Ntfs!NtfsFspDispatch+0x229
ffffd001`577c6b50 fffff802`84b3f794 : 00000000`00000000 ffffe800`5f705040 ffffe800`5f705040 ffffe000`57455900 : nt!ExpWorkerThread+0x293
ffffd001`577c6c00 fffff802`84bca5c6 : ffffd001`54600180 ffffe800`5f705040 ffffe800`5f74e540 00000000`00000246 : nt!PspSystemThreadStartup+0x58
ffffd001`577c6c60 00000000`00000000 : ffffd001`577c7000 ffffd001`577c1000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: vhdmp!ExFreeToNPagedLookasideList+3c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: vhdmp
IMAGE_NAME: vhdmp.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 52e848da
IMAGE_VERSION: 6.3.9600.16521
STACK_COMMAND: .cxr 0xffffd001577c5bc0 ; kb
BUCKET_ID_FUNC_OFFSET: 3c
FAILURE_BUCKET_ID: 0x24_vhdmp!ExFreeToNPagedLookasideList
BUCKET_ID: 0x24_vhdmp!ExFreeToNPagedLookasideList
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x24_vhdmp!exfreetonpagedlookasidelist
FAILURE_ID_HASH: {9c4ed974-e3f7-aed7-e34e-cf68671dc0ce}
Followup: MachineOwner
---------
18: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 000000b500190637
Arg2: ffffd001577c63b8
Arg3: ffffd001577c5bc0
Arg4: fffff801ccc12154
Debugging Details:
------------------
EXCEPTION_RECORD: ffffd001577c63b8 -- (.exr 0xffffd001577c63b8)
ExceptionAddress: fffff801ccc12154 (vhdmp!ExFreeToNPagedLookasideList+0x000000000000003c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: ffffd001577c5bc0 -- (.cxr 0xffffd001577c5bc0;r)
rax=000000000840542f rbx=ffffe8005b4df080 rcx=ffffe8005a81d220
rdx=ffffe8005a81d220 rsi=ffffe8005b4de000 rdi=ffffe8005a81d220
rip=fffff801ccc12154 rsp=ffffd001577c65f0 rbp=ffffd001577c6670
r8=0000000000000001 r9=000000000000002f r10=fffff80284a065b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=ffffe8005c2d2440 r15=ffffe8005c2b94f0
iopl=0 nv up ei ng nz ac pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010292
vhdmp!ExFreeToNPagedLookasideList+0x3c:
fffff801`ccc12154 ff5338 call qword ptr [rbx+38h] ds:002b:ffffe800`5b4df0b8=????????????????
Last set context:
rax=000000000840542f rbx=ffffe8005b4df080 rcx=ffffe8005a81d220
rdx=ffffe8005a81d220 rsi=ffffe8005b4de000 rdi=ffffe8005a81d220
rip=fffff801ccc12154 rsp=ffffd001577c65f0 rbp=ffffd001577c6670
r8=0000000000000001 r9=000000000000002f r10=fffff80284a065b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=ffffe8005c2d2440 r15=ffffe8005c2b94f0
iopl=0 nv up ei ng nz ac pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010292
vhdmp!ExFreeToNPagedLookasideList+0x3c:
fffff801`ccc12154 ff5338 call qword ptr [rbx+38h] ds:002b:ffffe800`5b4df0b8=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT_SERVER
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: ffffffffffffffff
FOLLOWUP_IP:
vhdmp!ExFreeToNPagedLookasideList+3c
fffff801`ccc12154 ff5338 call qword ptr [rbx+38h]
FAULTING_IP:
vhdmp!ExFreeToNPagedLookasideList+3c
fffff801`ccc12154 ff5338 call qword ptr [rbx+38h]
BUGCHECK_STR: 0x24
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre
LAST_CONTROL_TRANSFER: from fffff801ccc3bd98 to fffff801ccc12154
STACK_TEXT:
ffffd001`577c65f0 fffff801`ccc3bd98 : ffffd001`577c6660 ffffe800`5b4de000 00000000`00000010 ffffc001`f9c91d00 : vhdmp!ExFreeToNPagedLookasideList+0x3c
ffffd001`577c6620 fffff802`84b0f378 : ffffe000`5d429810 ffffe000`5d429800 ffffe000`5d429adb ffffc001`f9c91da0 : vhdmp!VhdmpiCTFlushBuffersIOCompletion+0x18c
ffffd001`577c6690 fffff801`cb670130 : ffffe800`5eb64b00 00000000`00000001 ffffe800`5eb64bc8 ffffe000`5d429810 : nt!IopfCompleteRequest+0x588
ffffd001`577c67a0 fffff801`cb66ca58 : 00000000`00000000 ffffd001`577c6a40 ffffc002`01b57c30 00000000`00000048 : Ntfs!NtfsExtendedCompleteRequestInternal+0x150
ffffd001`577c67d0 fffff801`cb65ca89 : ffffe800`5eb64bc8 ffffd001`577c6a40 00000000`00000000 ffffe800`5eb64bc8 : Ntfs!NtfsCommonWrite+0x2e2d
ffffd001`577c6a00 fffff802`84ac3adb : fffff801`cb65d424 fffff801`cb65c860 ffffe800`5eb64bc8 ffffe800`5f705040 : Ntfs!NtfsFspDispatch+0x229
ffffd001`577c6b50 fffff802`84b3f794 : 00000000`00000000 ffffe800`5f705040 ffffe800`5f705040 ffffe000`57455900 : nt!ExpWorkerThread+0x293
ffffd001`577c6c00 fffff802`84bca5c6 : ffffd001`54600180 ffffe800`5f705040 ffffe800`5f74e540 00000000`00000246 : nt!PspSystemThreadStartup+0x58
ffffd001`577c6c60 00000000`00000000 : ffffd001`577c7000 ffffd001`577c1000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: vhdmp!ExFreeToNPagedLookasideList+3c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: vhdmp
IMAGE_NAME: vhdmp.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 52e848da
IMAGE_VERSION: 6.3.9600.16521
STACK_COMMAND: .cxr 0xffffd001577c5bc0 ; kb
BUCKET_ID_FUNC_OFFSET: 3c
FAILURE_BUCKET_ID: 0x24_vhdmp!ExFreeToNPagedLookasideList
BUCKET_ID: 0x24_vhdmp!ExFreeToNPagedLookasideList
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x24_vhdmp!exfreetonpagedlookasidelist
FAILURE_ID_HASH: {9c4ed974-e3f7-aed7-e34e-cf68671dc0ce}
Followup: MachineOwner
---------
18: kd> lmvm vhdmp
start end module name
fffff801`ccc09000 fffff801`ccc98000 vhdmp (pdb symbols) c:\symbols\vhdmp.pdb\264A69A11D4744DDAE6F46BEFACB46EC1\vhdmp.pdb
Loaded symbol image file: vhdmp.sys
Mapped memory image file: c:\symbols\vhdmp.sys\52E848DA8f000\vhdmp.sys
Image path: \SystemRoot\System32\drivers\vhdmp.sys
Image name: vhdmp.sys
Timestamp: Wed Jan 29 01:18:34 2014 (52E848DA)
CheckSum: 00092FA0
ImageSize: 0008F000
File version: 6.3.9600.16521
Product version: 6.3.9600.16521
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.7 Driver
File date: 00000000.00000000
Translations: 0000.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: vhdmp.sys
OriginalFilename: vhdmp.sys
ProductVersion: 6.3.9600.16521
FileVersion: 6.3.9600.16521 (winblue_gdr.140128-1545)
FileDescription: VHD Miniport Driver
LegalCopyright: © Microsoft Corporation. All rights reserved.