http://blogs.technet.com/windowsinternals/archive/tags/Mounia/default.aspxTags: Mouniaen-USCommunityServer 2.1 SP1 (Build: 61025.2)http://blogs.technet.com/windowsinternals/archive/2008/12/31/analyse-d-un-stop-7f.aspxWed, 31 Dec 2008 16:25:00 GMTd5e57398-b9ef-4490-9955-07cbb4e4a80d:3175025Mouniar0http://blogs.technet.com/windowsinternals/comments/3175025.aspxhttp://blogs.technet.com/windowsinternals/commentrss.aspx?PostID=3175025<P>Nous allons analyser ensemble un dump relatif à des problème de crash réguliers sur un serveur de fichiers.</P> <P>D’abord, regardons sur quel type de serveur le crash s’est produit : </P> <P>0: kd&gt; vertarget</P> <P>Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (4 procs) Free x86 compatible</P> <P>Product: Server, suite: TerminalServer SingleUserTS</P> <P>Built by: 3790.srv03_sp1_rtm.050324-1447</P> <P>Kernel base = 0x80800000 PsLoadedModuleList = 0x808af988</P> <P>Debug session time: Tue Oct 21 02:22:03.749 2008 (GMT+2)</P> <P><STRONG><FONT color=#ff0000>System Uptime: 6 days 7:23:43.156</FONT></STRONG></P> <P><STRONG><FONT color=#ff0000></FONT></STRONG></P> <P>Il s’agit donc d’un serveur 2003 en SP1, un premier plan d’action serait de le mettre à jour en SP2 :-)</P> <P>D’autre part, le serveur semble avoir tourné pendant 6 jours avant la génération du dump. </P> <P>Aussi, chaque crash ou stop est associé un code qui définie le type de problème rencontré, examinons le stop en question :</P> <P>0: kd&gt; .bugcheck</P> <P>Bugcheck code 0000007F</P> <P>Arguments 00000008 80042000 00000000 00000000</P> <P>C’est un stop 7F avec le paramètre&nbsp; 00000008 ….intéressant !!</P> <P>Les documents techniques qui détaillent ce type de stop, font référence à un problème de stack overflow :</P> <P><EM>“Bug Check 0x7F: UNEXPECTED_KERNEL_MODE_TRAP</EM></P> <P><EM>The UNEXPECTED_KERNEL_MODE_TRAP bug check has a value of 0x0000007F. This bug check indicates that the Intel CPU generated a trap and the kernel failed to catch this trap.</EM></P> <P><EM>This trap could be a bound trap (a trap the kernel is not permitted to catch) or a double fault (a fault that occurred while processing an earlier fault, which always results in a system failure).</EM></P> <BLOCKQUOTE> <P><EM>0x00000008, or Double Fault, indicates that an exception occurs during a call to the handler for a prior exception. Typically, the two exceptions are handled serially. However, there are several exceptions that cannot be handled serially, and in this situation the processor signals a double fault. There are two common causes of a double fault: <BR>A kernel stack overflow Or A hardware problem”</EM> </P></BLOCKQUOTE> <P>Ok, nous savons maintenant qu’il peut s’agir d’un stack overflow ..il va falloir se mettre sur le thread qui a causé le crash pour en savoir plus :</P> <P>0: kd&gt; .tss 0x28</P> <P>eax=854b8300 ebx=854b8310 ecx=00000003 edx=89756000 esi=89fc3f30 edi=89756000</P> <P>eip=bae30bf7 esp=f78f7f88 ebp=f78f81b8 iopl=0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; nv up ei ng nz na pe nc</P> <P>cs=0008&nbsp; ss=0010&nbsp; ds=0023&nbsp; es=0023&nbsp; fs=0030&nbsp; gs=0000&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; efl=00010286</P> <P>q57xp32+0x9bf7:</P> <P>bae30bf7 53&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; push&nbsp;&nbsp;&nbsp; ebx</P> <P>0: kd&gt; .thread</P> <P>Implicit thread is now 8ab868d0</P> <P>0: kd&gt; !thread</P> <P>THREAD 8ab868d0&nbsp; Cid 0004.0048&nbsp; Teb: 00000000 Win32Thread: 00000000 RUNNING on processor 0</P> <P>IRP List:</P> <P>&nbsp;&nbsp;&nbsp; 859c0370: (0006,0220) Flags: 00000010&nbsp; Mdl: 00000000</P> <P>&nbsp;&nbsp;&nbsp; 85391008: (0006,0220) Flags: 00000884&nbsp; Mdl: 00000000</P> <P>&nbsp;&nbsp;&nbsp; 8a02af68: (0006,0094) Flags: 00000000&nbsp; Mdl: 00000000</P> <P>Not impersonating</P> <P>DeviceMap&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; d6402818</P> <P>Owning Process&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 8ab8a238&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Image:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; System</P> <P>Wait Start TickCount&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 34881482&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Ticks: 0</P> <P>Context Switch Count&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 21126271&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </P> <P>UserTime&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 00:00:00.000</P> <P>KernelTime&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 00:03:14.531</P> <P>Start Address nt!ExpWorkerThread (0x8083f671)</P> <P>Stack <FONT color=#ff0000>Init <B>f78fb000</B></FONT> Current f78f9150 Base f78fb000 <FONT color=#ff0000>Limit <B>f78f8000</B></FONT> Call 0</P> <P>Priority 12 BasePriority 12 PriorityDecrement 0</P> <P>ChildEBP RetAddr&nbsp; Args to Child&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </P> <P>00000000 bae30bf7 00000000 00000000 00000000 nt!_KiTrap08+0x75 (FPO: TSS 28:0) </P> <P>WARNING: Stack unwind information not available. Following frames may be wrong.</P> <P><B><FONT color=#ff0000>f78f81b8</FONT></B> bae29c53 89756000 89fc3f30 8975bf54 q57xp32+0x9bf7</P> <P>f78f8200 bae29edb 854b8310 f78f8278 f78f8248 q57xp32+0x2c53</P> <P>f78f8210 bae2a199 02756000 878032e0 897ef950 q57xp32+0x2edb</P> <P>f78f8248 f76ee804 00000001 f78f8278 00000000 q57xp32+0x3199</P> <P>f78f8260 80a7a24f 897ef850 00000000 86e62a20 NDIS!ndisMProcessSGList+0x90 </P> <P>f78f828c f76ee6fe 86e62a20 897ef850 878032c0 hal!HalBuildScatterGatherList+0x1c7 </P> <P>f78f82e4 f76d249d 8a3d5008 854b8310 862fe230 NDIS!ndisMAllocSGList+0xd9 </P> <P>f78f8300 ba782f37 89e90290 854b8310 89d16c48 NDIS!ndisMSendX+0x1a0 </P> <P>f78f8328 ba78223a 8a3d5008 854b8310 8638eae8 tcpip!IPRcvComplete+0x12d3</P> <P>f78f8350 ba782622 8638ea02 f78f8402 00000001 tcpip!IPRcvComplete+0x5d6</P> <P>f78f848c ba783c01 ba7bbbb8 862fe2a4 862fe230 tcpip!IPRcvComplete+0x9be</P> <P>f78f84fc ba783da0 f3b3f555 00000002 875d30c0 tcpip!IPRcvComplete+0x1f9d</P> <P>f78f8524 ba784478 00000001 00000000 00000002 tcpip!IPRcvComplete+0x213c</P> <P>f78f8558 bab209ac 875d3008 89443364 89d2d540 tcpip!IPRcvComplete+0x2814</P> <P>f78f857c bab29a46 89e8e000 89429058 89e8e000 msiscsi+0x99ac</P> <P>f78f8624 bab2c101 01429058 84f25502 84f2552c msiscsi+0x12a46</P> <P>f78f8644 bab1a435 808a5180 84f25502 00000000 msiscsi+0x15101</P> <P>f78f866c bab036ca 8a02b65c 89e8e000 f78f8698 msiscsi+0x3435</P> <P>f78f867c bab03afc 897c31a0 84f2552c 884b7d28 iscsiprt!RaCallMiniportStartIo+0x1e </P> <P>f78f8698 bab0c182 84f2552c 870a48a0 89d17e18 iscsiprt!RaidAdapterPostScatterGatherExecute+0x5e </P> <P>f78f86b8 bab07823 00000000 00000001 00000000 iscsiprt!RaUnitStartIo+0xc4 </P> <P>f78f86d8 bab0b575 89d17e18 014b7d28 00000000 iscsiprt!RaidStartIoPacket+0x49 </P> <P>f78f86fc bab0c8a6 89d17d30 884b7d28 84c6d270 iscsiprt!RaidUnitSubmitRequest+0x63 </P> <P>f78f8718 bab06844 89d17d30 884b7d28 f78f873c iscsiprt!RaUnitScsiIrp+0x92 </P> <P>f78f8728 8083f9d0 89d17c78 884b7d28 89e8caa0 iscsiprt!RaDriverScsiIrp+0x2a </P> <P>f78f873c f7409440 884b7d28 884b7dfc 884b7d28 nt!IofCallDriver+0x45 </P> <P>f78f8764 f74094e0 89cfba88 884b7d28 884b7d28 mpio!MPIOReadWrite+0x19e </P> <P>f78f8830 f7409b34 89cfba88 84c6d1f0 884b7dd8 mpio!MPIOPdoHandleRequest+0x76 </P> <P>f78f8848 f7408945 89cfbb40 884b7d28 884b7d28 mpio!MPIOPdoInternalDeviceControl+0x3c </P> <P>f78f8870 f740916f 89cfba88 89cfbd78 01000000 mpio!MPIOPdoCommonDeviceControl+0x1fb </P> <P>f78f8890 f74062ef 89cfba88 884b7d28 f78f88b4 mpio!MPIOPdoDispatch+0x8f </P> <P>f78f88a0 8083f9d0 89cfba88 884b7d28 84f25480 mpio!MPIOGlobalDispatch+0x19 </P> <P>f78f88b4 f7139a20 84f25480 68d0e000 f78f88f8 nt!IofCallDriver+0x45 </P> <P>f78f88c4 f7139635 84f25480 89419b70 85a52e2c CLASSPNP!SubmitTransferPacket+0xbb </P> <P>f78f88f8 f7139712 00000000 00001000 85a52e50 CLASSPNP!ServiceTransferRequest+0x1e4 </P> <P>f78f891c 8083f9d0 89419ab8 00000000 8ab96b38 CLASSPNP!ClassReadWrite+0x159 </P> <P>f78f8930 f74d80cf 8756c3a8 85a52e50 f78f8954 nt!IofCallDriver+0x45 </P> <P>f78f8940 8083f9d0 893e7780 85a52cc0 85a52cc0 PartMgr+0x10cf</P> <P>f78f8954 f73b4802 890bd008 8756c3a8 89595d08 nt!IofCallDriver+0x45 </P> <P>La, il n’y a pas de doute, nous somme bien en présence d’un beau <B>“stack overflow”.</B></P> <P>En effet, chaque thread a le droit à un espace limité pour gérer la stack.</P> <P>Ici la limite est à f78fb000&nbsp; (on commence la stack à à l’adresse f78f8000 ) : Stack Init f78fb000 Current f78f9150 Base f78fb000 Limit f78f8000</P> <P>Le dernier appel a été fait à l’adresse f78f81b8 ;&nbsp; par conséquent l’appel d’après aurait utiliser de la mémoire et dépasser ainsi la limite du f78f8000 d’où le stack overflow et le crash.</P> <P>Voici les détails de consommation de la stack au moment du Stop:</P> <P>&nbsp; Module&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Stack Usage Percentage</P> <P>fltMgr&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 280&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2</P> <P>volsnap&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 584&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 5</P> <P><FONT color=#ff0000>Ntfs&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 4844&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 42</FONT></P> <P>iscsiprt&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 188&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2</P> <P>NDIS&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 140&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1</P> <P>msiscsi&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 276&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2</P> <P>q57xp32&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 144&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1</P> <P>CLASSPNP&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 104&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1</P> <P>mfetdik&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 144&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1</P> <P>hal&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 44&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0</P> <P>dmio&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 328&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 3</P> <P>tcpip&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 600&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 5</P> <P>mpio&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 356&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 3</P> <P>PartMgr&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 16&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0</P> <P>mfehidk&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 660&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 6</P> <P>nt&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1988&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 17</P> <P>df2k&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 848&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 7</P> <P>Nous constatons que Ntfs utilise 42% de celle-ci ce qui est beaucoup. Maintenant si l’on regarde attentivement la stack nous allons constater que c’est le driver df2k.sys qui est réentrant dans le file system.</P> <P>0: kd&gt; kv 100</P> <P>ChildEBP RetAddr&nbsp; Args to Child&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </P> <P>00000000 bae30bf7 00000000 00000000 00000000 nt!_KiTrap08+0x75 </P> <P>WARNING: Stack unwind information not available. Following frames may be wrong.</P> <P><B><FONT color=#ff0000>f78f81b8</FONT></B> bae29c53 89756000 89fc3f30 8975bf54 q57xp32+0x9bf7</P> <P>f78f8200 bae29edb 854b8310 f78f8278 f78f8248 q57xp32+0x2c53</P> <P>f78f8210 bae2a199 02756000 878032e0 897ef950 q57xp32+0x2edb</P> <P>f78f8248 f76ee804 00000001 f78f8278 00000000 q57xp32+0x3199</P> <P>f78f8260 80a7a24f 897ef850 00000000 86e62a20 NDIS!ndisMProcessSGList+0x90 </P> <P>f78f828c f76ee6fe 86e62a20 897ef850 878032c0 hal!HalBuildScatterGatherList+0x1c7 </P> <P>f78f82e4 f76d249d 8a3d5008 854b8310 862fe230 NDIS!ndisMAllocSGList+0xd9 </P> <P>f78f8300 ba782f37 89e90290 854b8310 89d16c48 NDIS!ndisMSendX+0x1a0 </P> <P>f78f8328 ba78223a 8a3d5008 854b8310 8638eae8 tcpip!IPRcvComplete+0x12d3</P> <P>f78f8350 ba782622 8638ea02 f78f8402 00000001 tcpip!IPRcvComplete+0x5d6</P> <P>f78f848c ba783c01 ba7bbbb8 862fe2a4 862fe230 tcpip!IPRcvComplete+0x9be</P> <P>f78f84fc ba783da0 f3b3f555 00000002 875d30c0 tcpip!IPRcvComplete+0x1f9d</P> <P>f78f8524 ba784478 00000001 00000000 00000002 tcpip!IPRcvComplete+0x213c</P> <P>f78f8558 bab209ac 875d3008 89443364 89d2d540 tcpip!IPRcvComplete+0x2814</P> <P>f78f857c bab29a46 89e8e000 89429058 89e8e000 msiscsi+0x99ac</P> <P>f78f8624 bab2c101 01429058 84f25502 84f2552c msiscsi+0x12a46</P> <P>f78f8644 bab1a435 808a5180 84f25502 00000000 msiscsi+0x15101</P> <P>f78f866c bab036ca 8a02b65c 89e8e000 f78f8698 msiscsi+0x3435</P> <P>f78f867c bab03afc 897c31a0 84f2552c 884b7d28 iscsiprt!RaCallMiniportStartIo+0x1e </P> <P>f78f8698 bab0c182 84f2552c 870a48a0 89d17e18 iscsiprt!RaidAdapterPostScatterGatherExecute+0x5e </P> <P>f78f86b8 bab07823 00000000 00000001 00000000 iscsiprt!RaUnitStartIo+0xc4 </P> <P>f78f86d8 bab0b575 89d17e18 014b7d28 00000000 iscsiprt!RaidStartIoPacket+0x49 </P> <P>f78f86fc bab0c8a6 89d17d30 884b7d28 84c6d270 iscsiprt!RaidUnitSubmitRequest+0x63 </P> <P>f78f8718 bab06844 89d17d30 884b7d28 f78f873c iscsiprt!RaUnitScsiIrp+0x92 </P> <P>f78f8728 8083f9d0 89d17c78 884b7d28 89e8caa0 iscsiprt!RaDriverScsiIrp+0x2a </P> <P>f78f873c f7409440 884b7d28 884b7dfc 884b7d28 nt!IofCallDriver+0x45 </P> <P>f78f8764 f74094e0 89cfba88 884b7d28 884b7d28 mpio!MPIOReadWrite+0x19e </P> <P>f78f8830 f7409b34 89cfba88 84c6d1f0 884b7dd8 mpio!MPIOPdoHandleRequest+0x76 </P> <P>f78f8848 f7408945 89cfbb40 884b7d28 884b7d28 mpio!MPIOPdoInternalDeviceControl+0x3c </P> <P>f78f8870 f740916f 89cfba88 89cfbd78 01000000 mpio!MPIOPdoCommonDeviceControl+0x1fb </P> <P>f78f8890 f74062ef 89cfba88 884b7d28 f78f88b4 mpio!MPIOPdoDispatch+0x8f </P> <P>f78f88a0 8083f9d0 89cfba88 884b7d28 84f25480 mpio!MPIOGlobalDispatch+0x19 </P> <P>f78f88b4 f7139a20 84f25480 68d0e000 f78f88f8 nt!IofCallDriver+0x45 </P> <P>f78f88c4 f7139635 84f25480 89419b70 85a52e2c CLASSPNP!SubmitTransferPacket+0xbb </P> <P>f78f88f8 f7139712 00000000 00001000 85a52e50 CLASSPNP!ServiceTransferRequest+0x1e4 </P> <P>f78f891c 8083f9d0 89419ab8 00000000 8ab96b38 CLASSPNP!ClassReadWrite+0x159 </P> <P>f78f8930 f74d80cf 8756c3a8 85a52e50 f78f8954 nt!IofCallDriver+0x45 </P> <P>f78f8940 8083f9d0 893e7780 85a52cc0 85a52cc0 PartMgr+0x10cf</P> <P>f78f8954 f73b4802 890bd008 8756c3a8 89595d08 nt!IofCallDriver+0x45 </P> <P>f78f899c f73cdfa3 8756c3a8 010bd008 04000000 dmio!voldiskiostart+0x482 </P> <P>f78f89ec f73bf8dc 8756c3a8 f78f8a44 f78f8a38 dmio!vol_subdisksio_start+0x107 </P> <P>f78f8a5c f73b5e2c 8712c408 00000001 00000001 dmio!volkiostart+0x32c </P> <P>f78f8a88 f73b85e2 88dc1a60 85a52cc0 8ab50418 dmio!volrdwr+0xa0 </P> <P>f78f8a9c 8083f9d0 88dc1a60 85a52cc0 85a52e98 dmio!volread+0x58 </P> <P>f78f8ab0 f73899c4 8ab2d248 88db7af0 88d246d0 nt!IofCallDriver+0x45 </P> <P>f78f8ac8 8083f9d0 88d246d0 85a52cc0 85a52cc0 volsnap+0x19c4</P> <P>f78f8adc f70d9881 88db7a38 88db7af0 88ba5c98 nt!IofCallDriver+0x45 </P> <P><B><FONT color=#ff0000>f78f8b34 f70dae17 88db7a38 85a52cc0 85a52cc0 df2k+0x6881</FONT></B></P> <P><B><FONT color=#ff0000>f78f8b5c f701d0ce f78f8e40 f78f8d40 f701c702 df2k+0x7e17</FONT></B></P> <P>f78f8b68 f701c702 f78f8e40 88db7a38 9c09a000 Ntfs!NtfsSingleAsync+0x91 </P> <P>f78f8d40 f701a75e f78f8e40 85a52cc0 88ba5c98 Ntfs!NtfsNonCachedIo+0x2db </P> <P>f78f8e2c f701d8de f78f8e40 85a52cc0 00000001 Ntfs!NtfsCommonRead+0xaf5 </P> <P>f78f8fd8 8083f9d0 88be6718 85a52cc0 85a52cc0 Ntfs!NtfsFsdRead+0x113 </P> <P>f78f8fec f7117b43 88f2aae8 85a52cc0 88eeb008 nt!IofCallDriver+0x45 </P> <P>f78f9010 f7117d03 f78f9030 88f2aae8 00000000 fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b </P> <P>f78f9048 8083f9d0 88f2aae8 85a52cc0 88db7af0 fltMgr!FltpDispatch+0x11f </P> <P>f78f905c f70d8ab1 89944588 89944640 88fcd5c0 nt!IofCallDriver+0x45 </P> <P><B><FONT color=#ff0000>f78f9100 f70dae17 89944588 85a52cc0 85a52ebc df2k+0x5ab1</FONT></B></P> <P><B><FONT color=#ff0000>f78f9128 ba9efa40 88d1da08 89705218 88bed008 df2k+0x7e17</FONT></B></P> <P>f78f913c 8083f9d0 88aacf10 85a52cc0 85a52cc0 SYMEVENT!SYMEvent_AllocVMData+0x5f00</P> <P>f78f9150 f7117d36 0010e000 8a0d1768 00000000 nt!IofCallDriver+0x45 </P> <P>f78f917c 8083f9d0 88d1da08 85a52cc0 85a52cc0 fltMgr!FltpDispatch+0x152 </P> <P>f78f9190 8082f0de 83e86308 8ab868d0 83e862f8 nt!IofCallDriver+0x45 </P> <P>f78f91a8 8082f17c 88f04f0c 83e86330 83e86310 nt!IoPageRead+0x109 </P> <P>f78f922c 80849ce5 00000001 c16ce000 c0305b38 nt!MiDispatchFault+0xd2a </P> <P>f78f9288 8082fd4f 00000000 c16ce000 00000000 nt!MmAccessFault+0x64a </P> <P>f78f92b8 80845b53 c16ce000 00000000 f78f93e4 nt!MmCheckCachedPageState+0x48e </P> <P>f78f9300 80845d5a 88ba5b60 f78f9340 00001000 nt!CcMapAndRead+0x93 </P> <P>f78f9394 8092f599 88f04f90 f78f93d4 00001000 nt!CcPinFileData+0x24a </P> <P>f78f9408 f7054d25 88f04f90 f78f9440 00001000 nt!CcPinRead+0xc4 </P> <P>f78f9430 f704842b 84f7a168 88ba5c98 0010e000 Ntfs!NtfsPinStream+0x76 </P> <P>f78f945c f7049751 84f7a168 88be67f8 00870000 Ntfs!NtfsMapOrPinPageInBitmap+0x9d </P> <P>f78f94d8 f704851f 84f7a168 88be67f8 0087312e Ntfs!NtfsAllocateBitmapRun+0x4b </P> <P>f78f9614 f7040136 84f7a168 88be67f8 87342a00 Ntfs!NtfsAllocateClusters+0x9fd </P> <P>f78f96d4 f7047e53 84f7a168 87342a00 00000020 Ntfs!NtfsAllocateAttribute+0x156 </P> <P>f78f9774 f704835c 84f7a168 d6650468 00000020 Ntfs!NtfsCreateNonresidentWithValue+0xde </P> <P>f78f9874 f706e627 84f7a168 d6650468 d1911898 Ntfs!NtfsConvertToNonresident+0x2ec </P> <P>f78f99cc f7076cc4 84f7a168 d6650468 00000240 Ntfs!NtfsChangeAttributeValue+0x467 </P> <P>f78f9ab8 f7071d04 84f7a168 d6650468 000fe6ad Ntfs!NtfsAddToAttributeList+0x177 </P> <P>f78f9ca0 f7047a50 84f7a168 d6650530 f78f9cd0 Ntfs!NtfsAddAttributeAllocation+0xf71 </P> <P>f78f9d64 f70845ef 84f7a168 8523cc68 d6650530 Ntfs!NtfsAddAllocation+0x397 </P> <P>f78f9e74 f7041c94 84f7a168 8523cc68 859c0370 Ntfs!NtfsSetAllocationInfo+0x3dd </P> <P>f78f9ee0 f701d2fb 84f7a168 859c0370 00000000 Ntfs!NtfsCommonSetInformation+0x48c </P> <P>f78f9f48 8083f9d0 88be6718 859c0370 859c0370 Ntfs!NtfsFsdSetInformation+0xa3 </P> <P>f78f9f5c f7117b43 88f2aae8 859c0370 88eeb008 nt!IofCallDriver+0x45 </P> <P>f78f9f80 f7117d03 f78f9fa0 88f2aae8 00000000 fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b </P> <P>f78f9fb8 8083f9d0 88f2aae8 859c0370 88db7af0 fltMgr!FltpDispatch+0x11f </P> <P>f78f9fcc f70d8ab1 89944588 89944640 f78fa0e8 nt!IofCallDriver+0x45 </P> <P><B><FONT color=#ff0000>f78fa070 f70dae17 89944588 859c0370 859c056c df2k+0x5ab1</FONT></B></P> <P><B><FONT color=#ff0000>f78fa098 ba9ef7b1 859c056c 859c0590 f78fa0e8 df2k+0x7e17</FONT></B></P> <P>f78fa0b0 ba9f8d68 89944588 00000000 f78fa0e8 SYMEVENT!SYMEvent_AllocVMData+0x5c71</P> <P>f78fa0cc ba9ef91b f78fa0e8 8082b0b9 ba9ef9e3 SYMEVENT!EventObjectCreate+0xba8</P> <P>f78fa10c 8083f9d0 88aacf10 859c0370 859c0370 SYMEVENT!SYMEvent_AllocVMData+0x5ddb</P> <P>f78fa120 f7117b43 88d1da08 859c0370 88bed008 nt!IofCallDriver+0x45 </P> <P>f78fa144 f7117d03 f78fa164 88d1da08 00000000 fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b </P> <P>f78fa17c 8083f9d0 88d1da08 859c0370 859c0370 fltMgr!FltpDispatch+0x11f </P> <P>f78fa190 8098911f 85391008 84c497a0 f78fa434 nt!IofCallDriver+0x45 </P> <P>f78fa1c8 f707e07c 0123cc68 00000013 85391018 nt!IoSetInformation+0x1c2 </P> <P>f78fa1f4 f706c7b7 84c497a0 85391008 d66506b8 Ntfs!NtfsCompleteLargeAllocation+0x40 </P> <P>f78fa3f4 f70531e5 84c497a0 85391008 f78fa434 Ntfs!NtfsCommonCreate+0x1472 </P> <P>f78fa4f8 8083f9d0 88be6718 85391008 85391008 Ntfs!NtfsFsdCreate+0x17d </P> <P>f78fa50c f7117b43 00000000 85391008 85391198 nt!IofCallDriver+0x45 </P> <P>f78fa530 f71255af f78fa550 88f2aae8 00000000 fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b </P> <P>f78fa56c 8083f9d0 88f2aae8 85391008 853911d8 fltMgr!FltpCreate+0x23b </P> <P>f78fa580 f70da51c 8081fd79 899446b0 899446f4 nt!IofCallDriver+0x45 </P> <P><B><FONT color=#ff0000>f78fa5b0 f70d942b 899446b0 85391008 00000000 df2k+0x751c</FONT></B></P> <P><B><FONT color=#ff0000>f78fa5e4 f70d8fed 89944640 85391008 89944588 df2k+0x642b</FONT></B></P> <P><B><FONT color=#ff0000>f78fa690 f70dae17 89944588 85391008 853911e0 df2k+0x5fed</FONT></B></P> <P>f78fa6b8 ba9ef8a1 853911e0 85391204 f78fa718 df2k+0x7e17</P> <P>f78fa6e0 ba9f8d58 89944588 00000000 f78fa718 SYMEVENT!SYMEvent_AllocVMData+0x5d61</P> <P>f78fa6fc ba9ef91b f78fa718 8082b0b9 ba9ef9e3 SYMEVENT!EventObjectCreate+0xb98</P> <P>f78fa73c 8083f9d0 88aacf10 85391008 85391008 SYMEVENT!SYMEvent_AllocVMData+0x5ddb</P> <P>f78fa750 f7117b43 00000000 85391008 85391204 nt!IofCallDriver+0x45 </P> <P>f78fa774 f71255af f78fa794 88d1da08 00000000 fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b </P> <P>f78fa7b0 8083f9d0 88d1da08 85391008 85391008 fltMgr!FltpCreate+0x23b </P> <P>f78fa7c4 8092e269 f78fa96c 88dc1a48 00000000 nt!IofCallDriver+0x45 </P> <P>f78fa8ac 80936caa 88dc1a60 00000000 88e62860 nt!IopParseDevice+0xa35 </P> <P>f78fa92c 80936aa5 00000000 f78fa96c 00000240 nt!ObpLookupObjectName+0x5a9 </P> <P>f78fa980 80936f27 00000000 00000000 00000100 nt!ObOpenObjectByName+0xea </P> <P>f78fa9fc 80936ff8 8a2f22e4 0012019f f78fab7c nt!IopCreateFile+0x447 </P> <P>f78faa58 8092ed98 8a2f22e4 0012019f f78fab7c nt!IoCreateFile+0xa3 </P> <P>f78faa98 80834d3f 8a2f22e4 0012019f f78fab7c nt!NtCreateFile+0x30 </P> <P>f78faa98 8083c1ec 8a2f22e4 0012019f f78fab7c nt!KiFastCallEntry+0xfc </P> <P>f78fab3c f7396acb 8a2f22e4 0012019f f78fab7c nt!ZwCreateFile+0x11 </P> <P>f78fabc4 f739c6f7 8a2f22d0 00000001 f78fabec volsnap+0xeacb</P> <P>f78fabf8 f73a5d5d 86a966e0 12c00000 00000000 volsnap+0x146f7</P> <P>f78fad50 f73945e5 8aa020d8 851a5798 8ab868d0 volsnap+0x1dd5d</P> <P>f78fad6c 809180a0 875603d0 88eb2ab8 808b70dc volsnap+0xc5e5</P> <P>f78fad80 8083f72e 875603d0 00000000 8ab868d0 nt!IopProcessWorkItem+0x13 </P> <P>f78fadac 8092ccff 875603d0 00000000 00000000 nt!ExpWorkerThread+0xeb </P> <P><B><FONT color=#ff0000>f78faddc</FONT></B> 80841a96 8083f671 00000001 00000000 nt!PspSystemThreadStartup+0x2e </P> <P>00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16 </P> <P>La stack contient aussi plusieurs occurrences du module SYMEVENT qui est connu pour causer des problèmes de stack overflow</P> <P><I><U></U></I></P> <P>La solution au problème rencontré passera par:</P> <P>- Désinstallation ou mise à jour du composant Df2K.sys</P> <P>- Suivi des recommandations de Symantec pour la partie Symevent : <A href="http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2002071208532048?Open&amp;src=w" mce_href="http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2002071208532048?Open&amp;src=w">http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2002071208532048?Open&amp;src=w</A></P> <P><FONT size=2>&nbsp;<FONT face=Arial><STRONG>Mounia</STRONG></FONT></FONT></P> <P><FONT size=2 face=Arial><STRONG>Windows Core Technical Lead</STRONG></FONT></P><img src="http://blogs.technet.com/aggbug.aspx?PostID=3175025" width="1" height="1">NT DebuggingMounia