[Winpcap-bugs] WinPcap 4.1.1 - BSOD

Thu Nov 12 12:22:33 PST 2009

I analyzed the stack trace that you sent below, and it's definitely a NULL pointer dereference, that should not happen (in the sense that such pointer should not be null, it comes from the OS itself). In order to further investigate the problem, however, I need to have a kernel memory dump, so that I can get a look at the variables on the stack...

Have a nice day
GV

  ----- Original Message ----- 
  From: Boaz Brickner 
  To: winpcap-bugs at winpcap.org 
  Sent: Thursday, November 12, 2009 11:03 AM
  Subject: [Winpcap-bugs] WinPcap 4.1.1 - BSOD

  Hi,

  I'm working on a new wrapper for WinPcap in .Net call Pcap.Net.
  I've recently tried to upgrade Pcap.Net project (http://pcapdotnet.codeplex.com) to WinPcap 4.1.1 to support Windows 7 (I've used WinPcap 4.0.2 before).

  When I run my different unit tests that use all kinds of WinPcap's features while using my network drive, I'm getting a Blue Screen Of Death (BSOD) - Windows Crash.
  I've managed to get BSOD both on Windows 7 Professional 64 bit and on Windows XP SP3 32 bit (two different computer systems).
  Before I've upgraded to WinPcap 4.1.1 I've never got a BSOD (Windows XP SP3).

  It seems this BSOD is caused by WinPcap's npf driver.

  At first I thought this problem is caused by Windows 7 or a combination of Windows 7 and WinPcap.
  After I've seen that this problem also appears on my Windows XP that never experienced this problem before, I believe this is not the case and it is caused by WinPcap 4.1.1 alone.

  Since a full reboot is needed after the BSOD appears, I'm having a hard time figuring out what exactly causes this problem.

  If you want to try and recreate this problem you are welcome to use WinPcap 4.1.1 and download the latest source from Pcap.Net project site (changeset 30721):

  http://pcapdotnet.codeplex.com/SourceControl/ListDownloadableCommits.aspx

  If you're having troubles compiling and running the unit tests using Visual Studio Team Suite 2008 SP1, you are welcome to contact me and I'll try to help you with it. Sometimes more than one run of all the unit tests may be needed to cause the crash and you might need to do use your network drive (by downloading a file for example) to make the BSOD appear.

  Also see my post on Windows 7 forums:
  http://www.sevenforums.com/crashes-debugging/37276-bsod-windows-7-professional-64-bit.html

  Details from Windows 7 mini dump (note that npf.sys is specifically referenced):

  IRQL_NOT_LESS_OR_EQUAL (a)
  An attempt was made to access a pageable (or completely invalid) address at an
  interrupt request level (IRQL) that is too high.  This is usually
  caused by drivers using improper addresses.
  If a kernel debugger is available get the stack backtrace.
  Arguments:
  Arg1: 0000000000003178, memory referenced
  Arg2: 0000000000000002, IRQL
  Arg3: 0000000000000001, bitfield :
      bit 0 : value 0 = read operation, 1 = write operation
      bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
  Arg4: fffff80003eccb75, address which referenced memory

  Debugging Details:
  ------------------

  WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800040fa0e0
   0000000000003178 

  CURRENT_IRQL:  2

  FAULTING_IP: 
  nt!KeAcquireSpinLockRaiseToDpc+55
  fffff800`03eccb75 f0480fba2900    lock bts qword ptr [rcx],0

  CUSTOMER_CRASH_COUNT:  1

  DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

  BUGCHECK_STR:  0xA

  PROCESS_NAME:  VSTestHost.exe

  TRAP_FRAME:  fffff8800909b7b0 -- (.trap 0xfffff8800909b7b0)
  NOTE: The trap frame does not contain all registers.
  Some register values may be zeroed or incorrect.
  rax=0000000000000002 rbx=0000000000000000 rcx=0000000000003178
  rdx=0000000000000085 rsi=0000000000000000 rdi=0000000000000000
  rip=fffff80003eccb75 rsp=fffff8800909b940 rbp=0000000000003178
   r8=0000000000000065  r9=0000000000000000 r10=0000000000000000
  r11=fffff8800909b980 r12=0000000000000000 r13=0000000000000000
  r14=0000000000000000 r15=0000000000000000
  iopl=0         nv up ei pl nz na po nc
  nt!KeAcquireSpinLockRaiseToDpc+0x55:
  fffff800`03eccb75 f0480fba2900    lock bts qword ptr [rcx],0 ds:00000000`00003178=????????????????
  Resetting default scope

  LAST_CONTROL_TRANSFER:  from fffff80003ec3469 to fffff80003ec3f00

  STACK_TEXT:  
  fffff880`0909b668 fffff800`03ec3469 : 00000000`0000000a 00000000`00003178 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
  fffff880`0909b670 fffff800`03ec20e0 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff800`03eca1a2 : nt!KiBugCheckDispatch+0x69
  fffff880`0909b7b0 fffff800`03eccb75 : fffffa80`03e5c3f0 00000000`08004870 00000000`00000001 fffffa80`06a57900 : nt!KiPageFault+0x260
  fffff880`0909b940 fffff880`05c02ef5 : fffffa80`0677d990 00000000`00000000 fffffa80`0677d8c0 00000000`00000000 : nt!KeAcquireSpinLockRaiseToDpc+0x55
  fffff880`0909b990 fffffa80`0677d990 : 00000000`00000000 fffffa80`0677d8c0 00000000`00000000 fffffa80`0677d8c0 : npf+0x2ef5
  fffff880`0909b998 00000000`00000000 : fffffa80`0677d8c0 00000000`00000000 fffffa80`0677d8c0 fffff880`05c03edf : 0xfffffa80`0677d990

  STACK_COMMAND:  kb

  FOLLOWUP_IP: 
  npf+2ef5
  fffff880`05c02ef5 ??              ???

  SYMBOL_STACK_INDEX:  4

  SYMBOL_NAME:  npf+2ef5

  FOLLOWUP_NAME:  MachineOwner

  MODULE_NAME: npf

  IMAGE_NAME:  npf.sys

  DEBUG_FLR_IMAGE_TIMESTAMP:  4addfab3

  FAILURE_BUCKET_ID:  X64_0xA_npf+2ef5

------------------------------------------------------------------------------

  _______________________________________________
  Winpcap-bugs mailing list
  Winpcap-bugs at winpcap.org
  https://www.winpcap.org/mailman/listinfo/winpcap-bugs
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-bugs/attachments/20091112/0212d2b7/attachment-0001.htm 