|
|
|
Question : Blue screen error - Probably caused by : ntoskrnl.exe ( nt!ExFreePoolWithTag+436 ) ??? - 2003 ent ed.
|
|
Hi we got a blue screen on a 2003 server.
How can we track down what is causing the error?
As follows:
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [H:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: H:\Debugging_2003_server\Symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) UP Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 3790.srv03_sp1_rtm.050324-1447
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a8e48
Debug session time: Tue Feb 6 17:00:32.534 2007 (GMT+1)
System Uptime: 0 days 5:43:18.453
Loading Kernel Symbols
................................................................................................................
Loading User Symbols
Loading unloaded module list
..
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C2, {7, 121a, 320033, e205dbf8}
Probably caused by : ntoskrnl.exe ( nt!ExFreePoolWithTag+436 )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000007, Attempt to free pool which was already freed
Arg2: 0000121a, (reserved)
Arg3: 00320033, Memory contents of the pool block
Arg4: e205dbf8, Address of the block of pool being deallocated
Debugging Details:
------------------
POOL_ADDRESS: e205dbf8 Paged pool
FREED_POOL_TAG: NtFU
BUGCHECK_STR: 0xc2_7_NtFU
DEFAULT_BUCKET_ID: DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 1
LAST_CONTROL_TRANSFER: from 80896586 to 80875d0e
STACK_TEXT:
f78beb20 80896586 000000c2 00000007 0000121a nt!KeBugCheckEx+0x1b
f78beb84 f71bef58 e205dbf8 00000000 e10ee0d0 nt!ExFreePoolWithTag+0x436
f78beb98 f719b4e5 89232b68 f78bebb4 89232b68 Ntfs!NtfsDeleteLcb+0xae
f78bebe0 f71c80a8 89232b68 8968b7f8 e1e77a10 Ntfs!NtfsTeardownFromLcb+0x11f
f78bec38 f719ef5d 89232b68 e1e77ad8 00000000 Ntfs!NtfsTeardownStructures+0x12c
f78bec64 f71cc5ae 89232b68 e1e77ad8 00000000 Ntfs!NtfsDecrementCloseCounts+0xa9
f78becec f71cef67 89232b68 e1e77ad8 e1e77a10 Ntfs!NtfsCommonClose+0x3a1
f78bed80 808203bd 00000000 00000000 8979a8d0 Ntfs!NtfsFspClose+0xe2
f78bedac 80905d2c 00000000 00000000 00000000 nt!ExpWorkerThread+0xeb
f78beddc 80828499 80820300 00000000 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExFreePoolWithTag+436
80896586 cc int 3
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 42435e33
SYMBOL_NAME: nt!ExFreePoolWithTag+436
FAILURE_BUCKET_ID: 0xc2_7_NtFU_nt!ExFreePoolWithTag+436
BUCKET_ID: 0xc2_7_NtFU_nt!ExFreePoolWithTag+436
Followup: MachineOwner
---------
|
Answer : Blue screen error - Probably caused by : ntoskrnl.exe ( nt!ExFreePoolWithTag+436 ) ??? - 2003 ent ed.
|
|
From the stack trace of your debug, the culprit is ram. Run memtest to stress test the ram.
Stack Trace of first dump
>>>
f78beb20 80896586 000000c2 00000007 0000121a nt!KeBugCheckEx+0x1b
f78beb84 f71bef58 e205dbf8 00000000 e10ee0d0 nt!ExFreePoolWithTag+0x436 <--- Crash at Memory Management is related to hardware problem (probably it is RAM)
f78beb98 f719b4e5 89232b68 f78bebb4 89232b68 Ntfs!NtfsDeleteLcb+0xae
>>>
Stack Trace of second dump
>>>
adf2fbe4 808553d1 0000008e c0000005 808960cd nt!KeBugCheckEx+0x1b
adf2ffa8 80823dca adf2ffc4 00000000 adf30018 nt!KiDispatchException+0x3a2 <-- Crash at Dispatcher is usually related to hardware error (probably it is ram problem)
adf30010 80823d7e adf300c4 808960cd badb0d00 nt!CommonDispatchException+0x4a
adf300c4 80895b90 897c4030 80a6ea90 00000000 nt!Kei386EoiHelper+0x182
>>>
|
|
|
|
|
|
|
