#186 Colinux Crashes using NDIS network mode

v0.7.x (release)
open
nobody
5
2015-02-17
2012-01-07
bob_wh
No

Hi:

I have been having problems with blue screen crashes when running colinux. They are usually memory corruptions, irql too high, corrupt page table list. The just started when I tried to get ndis bridge mode networking working on Portable Ubuntu which uses colinux. I never had any crashes when using the slirp mode networking. Also, I never have any crashes when colinux is not running. These crashes occur on WXP with all service packs and updates applied.

Many dumps had Kaspersky driver active at the time of crash.
Kaspersky support has analyzed the dump and say that their driver
Is not causing the problem. So to prove it, I uninstalled Kaspersky and used their clean up utility to removed all components, and registry items.
It still crashed with memory corruption but this time the active module was nt . The windbg output of this dump is:

-------------------------------------------------------------------------

Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini010212-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*DownstreamStore*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt
Built by: 2600.xpsp_sp3_gdr.111025-1629
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b240
Debug session time: Mon Jan 2 23:06:16.123 2012 (GMT-5)
System Uptime: 0 days 0:29:01.394
Loading Kernel Symbols
...........................................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {9ded4804, 2, 0, 804eb3b5}

Probably caused by : memory_corruption ( nt!MiDeletePte+15b )

Followup: MachineOwner
---------

kd> !Analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 9ded4804, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 804eb3b5, address which referenced memory

Debugging Details:
------------------

READ_ADDRESS: 9ded4804

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiDeletePte+15b
804eb3b5 8b420c mov eax,dword ptr [edx+0Ch]

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

TRAP_FRAME: f1c03aec -- (.trap fffffffff1c03aec)
ErrCode = 00000000
eax=038202ff ebx=c000430c ecx=012b5655 edx=9ded47f8 esi=835d2fe8 edi=000fffff
eip=804eb3b5 esp=f1c03b60 ebp=f1c03b84 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!MiDeletePte+0x15b:
804eb3b5 8b420c mov eax,dword ptr [edx+0Ch] ds:0023:9ded4804=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 804eb3b5 to 804e1892

STACK_TEXT:
f1c03aec 804eb3b5 badb0d00 9ded47f8 873c63e8 nt!KiTrap0E+0x233
f1c03b84 804eb6fe c000430c 010c3000 00000000 nt!MiDeletePte+0x15b
f1c03c48 804f1d7c e122a614 010c9fff 00000000 nt!MiDeleteVirtualAddresses+0x162
f1c03cf4 8057a7c3 860fcb80 861acd00 f1c03d64 nt!MiRemoveMappedView+0x212
f1c03d38 8057a86f 85f21218 85eb8ee8 00000000 nt!MiUnmapViewOfSection+0x12b
f1c03d54 804de7ec ffffffff 860fcb80 008beeec nt!NtUnmapViewOfSection+0x54
f1c03d54 7c90e514 ffffffff 860fcb80 008beeec nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
008beeec 00000000 00000000 00000000 00000000 0x7c90e514

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiDeletePte+15b
804eb3b5 8b420c mov eax,dword ptr [edx+0Ch]

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4ea6ba87

SYMBOL_NAME: nt!MiDeletePte+15b

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_nt!MiDeletePte+15b

BUCKET_ID: 0xA_nt!MiDeletePte+15b

Followup: MachineOwner
---------

kd> lm
start end module name
804d7000 806ee580 nt (pdb symbols) DownstreamStore\ntoskrnl.pdb\C43A7F0B8DD34147BEE6D967BAC2A2FB2\ntoskrnl.pdb
806ef000 80702d00 hal (deferred)
bf000000 bf011600 dxg (deferred)
bf012000 bf04d000 ati2dvag (deferred)
bf04d000 bf07f000 ati2cqag (deferred)
bf07f000 bf0b1000 atikvmag (deferred)
bf0b1000 bf2e1440 ati3duag (deferred)
bf2e2000 bf376ba0 ativvaxx (deferred)
bf377000 bf3bde80 ATMFD (deferred)
bf800000 bf9c6000 win32k (deferred)
f1b3c000 f1b54000 linux (deferred)
f234c000 f238ce00 HTTP (deferred)
f25ed000 f2617180 kmixer (deferred)
f263b000 f264f480 wdmaud (deferred)
f2918000 f2927900 Cdfs (deferred)
f2ad8000 f2ae9520 PfModNT (deferred)
f2bb2000 f2c09600 srv (deferred)
f2cfa000 f2d26180 mrxdav (deferred)
f2d67000 f2d6b000 cpuz133_x32 (deferred)
f2e8f000 f2ea4880 irda (deferred)
f2f95000 f2faaa80 tfsnudf (deferred)
f3027000 f302a5e0 tfsnopio (deferred)
f303f000 f3042900 ndisuio (deferred)
f306b000 f3079d80 sysaudio (deferred)
f50eb000 f5102900 dump_atapi (deferred)
f512b000 f514ac40 ctsfm2k (deferred)
f514b000 f5176920 ctoss2k (deferred)
f5177000 f5308480 sbusb (deferred)
f532d000 f532f900 Dxapi (deferred)
f5331000 f5354180 Fastfat (deferred)
f536d000 f5372000 LVPr2Mon (deferred)
f53a5000 f5420000 Wdf01000 (deferred)
f5440000 f54af680 mrxsmb (deferred)
f54b0000 f54dae80 rdbss (deferred)
f54fb000 f5520500 ipnat (deferred)
f55aa000 f55de000 truecrypt (deferred)
f55de000 f55ff400 VBoxDrv (deferred)
f5600000 f5621d00 afd (deferred)
f5622000 f5659640 tcpip6 (deferred)
f565a000 f5681c00 netbt (deferred)
f5682000 f56da480 tcpip (deferred)
f56db000 f56ed600 ipsec (deferred)
f5700000 f5732000 UDFReadr (deferred)
f576c000 f578f000 DVDVRRdr_xp (deferred)
f57a1000 f57e9000 cdudf_xp (deferred)
f5809000 f5811780 tfsncofs (deferred)
f5829000 f5835de0 tfsnifs (deferred)
f5839000 f58423e0 drvnddm (deferred)
f68f1000 f68f3f80 mouhid (deferred)
f68f9000 f68fb880 hidusb (deferred)
f68fd000 f6900a60 TPHKDRV (deferred)
f6919000 f6976f00 update (deferred)
f6977000 f6990880 VBoxNetFlt (deferred)
f6991000 f69c0e80 rdpdr (deferred)
f69c1000 f69d7e00 VBoxNetAdp (deferred)
f69d8000 f69e8e00 psched (deferred)
f69e9000 f69ff580 ndiswan (deferred)
f6a04000 f6a06280 rasacd (deferred)
f6a28000 f6b4c140 AGRSM (deferred)
f6b4d000 f6b64940 aeaudio (deferred)
f6b65000 f6b88a80 portcls (deferred)
f6b89000 f6c16380 smwdm (deferred)
f6c17000 f6c34000 pwd_2k (deferred)
f6c34000 f6c56700 ks (deferred)
f6c57000 f6c6a900 parport (deferred)
f6c6b000 f6c7d000 LMouKE (deferred)
f6c7d000 f6ca3800 e100b325 (deferred)
f6ca4000 f6cc7200 USBPORT (deferred)
f6cc8000 f6cdbf00 VIDEOPRT (deferred)
f6cdc000 f6de2000 ati2mtag (deferred)
f6de2000 f6df0880 usbhub (deferred)
f6e22000 f6e2c000 NDProxy (deferred)
f6e42000 f6e4bf00 termdd (deferred)
f6e52000 f6e5a900 msgpc (deferred)
f6e62000 f6e6dd00 raspptp (deferred)
f6e72000 f6e7c200 raspppoe (deferred)
f717e000 f7180780 ibmpmdrv (deferred)
f7182000 f7185680 CmBatt (deferred)
f718a000 f718cc00 irenum (deferred)
f718e000 f7191d80 serenum (deferred)
f7192000 f7196000 L8042Kbd (deferred)
f7196000 f7199000 tunmp (deferred)
f7459000 f745cc80 mssmbios (pdb symbols) DownstreamStore\mssmbios.pdb\9940673F3B9A4BD682DF9D96A12A355C1\mssmbios.pdb
f749a000 f74b3c00 Mup (deferred)
f74b4000 f74c9980 snapman (deferred)
f74ca000 f74fdd40 timntr (deferred)
f74fe000 f752a980 NDIS (deferred)
f752b000 f75b7600 Ntfs (deferred)
f75b8000 f75ceb00 KSecDD (deferred)
f75cf000 f75e18c0 drvmcdb (deferred)
f75e2000 f75f3f00 sr (deferred)
f75f4000 f7613b00 fltmgr (deferred)
f7614000 f762b880 SCSIPORT (deferred)
f762c000 f7643900 atapi (deferred)
f7644000 f7662880 ftdisk (deferred)
f7663000 f7680580 pcmcia (deferred)
f7681000 f7691a80 pci (deferred)
f7692000 f76bfd80 ACPI (deferred)
f76e1000 f76ea180 isapnp (deferred)
f76f1000 f76fb580 MountMgr (deferred)
f7701000 f770dc80 VolSnap (deferred)
f7711000 f7719e00 disk (deferred)
f7721000 f772d180 CLASSPNP (deferred)
f7731000 f773b580 agp440 (deferred)
f7771000 f7779780 netbios (deferred)
f7791000 f7799900 VBoxUSBMon (deferred)
f77b1000 f77b9f00 ip6fw (deferred)
f77c1000 f77c9700 wanarp (deferred)
f77d1000 f77de000 WDFLDR (deferred)
f77f1000 f77fbe00 Fips (deferred)
f7801000 f780a000 HIDCLASS (deferred)
f78a1000 f78a9e00 intelppm (deferred)
f78b1000 f78c0000 AEIWLNDS (deferred)
f78c1000 f78cdd00 i8042prt (deferred)
f78d1000 f78df000 L8042mou (deferred)
f78e1000 f78f0c00 serial (deferred)
f78f1000 f78fb480 imapi (deferred)
f7901000 f7909c00 AFS2K (deferred)
f7911000 f791c000 Cdr4_xp (deferred)
f7921000 f7930600 cdrom (deferred)
f7931000 f793f100 redbook (deferred)
f7941000 f794fb00 drmk (deferred)
f7951000 f795d880 rasl2tp (deferred)
f7961000 f7967180 PCIIDEX (deferred)
f7969000 f796dd00 PartMgr (deferred)
f7971000 f7975a80 sparrow (deferred)
f7999000 f799d500 watchdog (deferred)
f79b1000 f79b6080 usbuhci (deferred)
f79b9000 f79c0600 usbehci (deferred)
f79c1000 f79c5300 usbohci (deferred)
f79c9000 f79cf000 kbdclass (deferred)
f79d1000 f79d6a00 mouclass (deferred)
f79d9000 f79e0000 fdc (deferred)
f79e1000 f79e8000 nscirda (deferred)
f79e9000 f79f0000 Cdralw2k (deferred)
f79f1000 f79f7000 GEARAspiWDM (deferred)
f79f9000 f79fdc80 rasirda (deferred)
f7a01000 f7a05a80 TDI (deferred)
f7a09000 f7a0d580 ptilink (deferred)
f7a11000 f7a15080 raspti (deferred)
f7a19000 f7a1f000 mmc_2K (deferred)
f7a31000 f7a38100 tifsfilt (deferred)
f7a39000 f7a3e980 ssrtln (deferred)
f7a41000 f7a46200 vga (deferred)
f7a49000 f7a50580 Modem (deferred)
f7a51000 f7a55a80 Msfs (deferred)
f7a59000 f7a60880 Npfs (deferred)
f7a61000 f7a66c00 tfsnboio (deferred)
f7a79000 f7a7f000 LUsbFilt (deferred)
f7a81000 f7a88000 Tppwr (deferred)
f7a89000 f7a8f000 TDSMAPI (deferred)
f7a91000 f7a99000 Smapint (deferred)
f7a99000 f7a9f180 HIDPARSE (deferred)
f7aa1000 f7aa8000 LHidFilt (deferred)
f7aa9000 f7ab1000 LMouFilt (deferred)
f7ab9000 f7abf700 USBSTOR (deferred)
f7ae1000 f7ae8d80 usbccgp (deferred)
f7af1000 f7af4000 BOOTVID (deferred)
f7af5000 f7af7800 compbatt (deferred)
f7af9000 f7afc780 BATTC (deferred)
f7afd000 f7affd80 ACPIEC (deferred)
f7b01000 f7b04d60 PxHelp20 (deferred)
f7bc9000 f7bcb900 ndistapi (deferred)
f7be1000 f7be2b80 kdcom (deferred)
f7be3000 f7be4100 WMILIB (deferred)
f7be5000 f7be6580 intelide (deferred)
f7be7000 f7be9000 speedfan (deferred)
f7bff000 f7c00880 tfsnpool (deferred)
f7c19000 f7c1a5a0 sscdbhk5 (deferred)
f7c1f000 f7c20100 swenum (deferred)
f7c21000 f7c22280 USBD (deferred)
f7c29000 f7c2af00 Fs_Rec (deferred)
f7c2b000 f7c2c080 Beep (deferred)
f7c2d000 f7c2e080 mnmdd (deferred)
f7c2f000 f7c30080 RDPCDD (deferred)
f7c63000 f7c64880 splitter (deferred)
f7c75000 f7c76a80 ParVdm (deferred)
f7c8f000 f7c90400 PMEMNT (deferred)
f7c91000 f7c92100 dump_WMILIB (deferred)
f7ca9000 f7ca9d80 OPRGHDLR (deferred)
f7caa000 f7caa680 giveio (deferred)
f7cb0000 f7cb0740 IBMBLDID (deferred)
f7cb5000 f7cb5b80 mbmiodrvr (deferred)
f7cd1000 f7cd1b80 Null (deferred)
f7d8c000 f7d8cd00 dxgthk (deferred)
f7de8000 f7de8fe0 tfsndrct (deferred)
f7dfc000 f7dfcc00 audstub (deferred)
f7e2f000 f7e2f860 tfsndres (deferred)

Unloaded modules:
f7db2000 f7db3000 drmkaud.sys
f2698000 f26a5000 DMusic.sys
f2618000 f263b000 aec.sys
f2830000 f283e000 swmidi.sys
f7c6f000 f7c71000 splitter.sys
f77e1000 f77ef000 swmidi.sys
f7781000 f778a000 processr.sys
f7a31000 f7a36000 Cdaudio.SYS
f719e000 f71a1000 Sfloppy.SYS
f7a29000 f7a2e000 Flpydisk.SYS

I am using the stable snapshot of colinux dated 2/16/11
Linux version 2.6.33.7-co-0.7.9 (hn@hn-dt) (gcc version 4.4.1 [gcc-4_4-branch revision 150839] (SUSE Linux) ) #1 PREEMPT Wed Feb 16 23:51:21 UTC 2011

The linux config file:

kernel=vmlinux
ro
initrd=initrd.gz
setcobd=async
cobd0="F:\P_Ubuntu\Portable_Ubuntu_V4\images\rootfs.img"
cofs0="F:\P_Ubuntu\Portable_Ubuntu_V4"
cofs1="C:\DOCUME~1\RANGER~1\LOCALS~1\Temp"
root=/dev/cobd0
cobd1="C:\DOCUME~1\RANGER~1\LOCALS~1\Temp\swap.img"
hdc=\Device\Cdrom0
cofs2=c:\ exec0="F:\P_Ubuntu\Portable_Ubuntu_V4\pulseaudio\pulseaudio.exe"
mem=384
eth0=ndis-bridge,"Local Area Connection",00:ff:75:39:D3:C2

This crash is fairly easy to create immediately when using XEMACS for editing. However, it takes longer to crash if you are just surfing the web.

Since this is a memory corruption the program/driver active at the time of the crash is the victim of the corruption and it is likely some other driver/program caused it, in this case colinux.

========================================================
Update:

I added /nopae to boot.ini as suggested in the Colinux-users list. It still crashes with PFN_list_corrupt.
I attached a zip of these 2 mini-dump files to this case. I have a total of 17 mini-dumps with this problem.
Can you suggest what to do to get the information that you need to solve this memory corruption problem.
This problem is currently holding up the next release of Portable Ubuntu.

Thanks for your help.
Regards
Bob Wheater

Discussion

  • bob_wh

    bob_wh - 2012-01-07

    2 crash minidumps compressed in zip format

     
  • bob_wh

    bob_wh - 2012-01-08

    The !analyze -v output for the first minidump is included in the orginal case submission.

    The !analyze -v output for the second minidump is show below:

    Microsoft (R) Windows Debugger Version 6.6.0007.5
    Copyright (c) Microsoft Corporation. All rights reserved.

    Loading Dump File [C:\WINDOWS\Minidump\Mini010612-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: srv*DownstreamStore*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
    Product: WinNt
    Built by: 2600.xpsp_sp3_gdr.111025-1629
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b240
    Debug session time: Fri Jan 6 23:37:49.580 2012 (GMT-5)
    System Uptime: 0 days 1:53:27.340
    Loading Kernel Symbols
    ................................................................................................................................................................................................
    Loading User Symbols
    Loading unloaded module list
    .................
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 4E, {99, 0, 0, 0}

    Unable to load image \SystemRoot\system32\DRIVERS\klif.sys, Win32 error 2
    *** WARNING: Unable to verify timestamp for klif.sys
    *** ERROR: Module load completed but symbols could not be loaded for klif.sys
    Probably caused by : klif.sys ( klif+31eb1 )

    Followup: MachineOwner
    ---------

    kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    PFN_LIST_CORRUPT (4e)
    Typically caused by drivers passing bad memory descriptor lists (ie: calling
    MmUnlockPages twice with the same list, etc). If a kernel debugger is
    available get the stack trace.
    Arguments:
    Arg1: 00000099, A PTE or PFN is corrupt
    Arg2: 00000000, page frame number
    Arg3: 00000000, current page state
    Arg4: 00000000, 0

    Debugging Details:
    ------------------

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x4E

    LAST_CONTROL_TRANSFER: from 80524edd to 80533846

    STACK_TEXT:
    f08a1b10 80524edd 0000004e 00000099 00000000 nt!KeBugCheckEx+0x1b
    f08a1b50 804eb6fe c0004340 010d0000 00000000 nt!MiDeletePte+0x3e8
    f08a1c14 804f1d7c e1dc3550 010e3fff 00000000 nt!MiDeleteVirtualAddresses+0x162
    f08a1cc0 8057a7c3 85ded4b8 87293a38 f08a1d44 nt!MiRemoveMappedView+0x212
    f08a1d04 8057a86f 872e2320 85a69960 00000000 nt!MiUnmapViewOfSection+0x12b
    f08a1d20 f435aeb1 ffffffff 85ded4b8 f08a1d64 nt!NtUnmapViewOfSection+0x54
    WARNING: Stack unwind information not available. Following frames may be wrong.
    f08a1d54 804de7ec ffffffff 010d0000 008be2f4 klif+0x31eb1
    f08a1d54 7c90e514 ffffffff 010d0000 008be2f4 nt!KiFastCallEntry+0xf8
    008be2f4 00000000 00000000 00000000 00000000 0x7c90e514

    STACK_COMMAND: kb

    FOLLOWUP_IP:
    klif+31eb1
    f435aeb1 ?? ???

    SYMBOL_STACK_INDEX: 6

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: klif

    IMAGE_NAME: klif.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 4daeb84f

    SYMBOL_NAME: klif+31eb1

    FAILURE_BUCKET_ID: 0x4E_klif+31eb1

    BUCKET_ID: 0x4E_klif+31eb1

    Followup: MachineOwner
    ---------

    =====================================================================

    I also tried it with pcap-bridge:

    config:
    kernel=vmlinux
    ro
    initrd=initrd.gz
    setcobd=async
    cobd0="F:\P_Ubuntu\Portable_Ubuntu_V4\images\rootfs.img"
    cofs0="F:\P_Ubuntu\Portable_Ubuntu_V4"
    cofs1="C:\DOCUME~1\RANGER~1\LOCALS~1\Temp"
    root=/dev/cobd0
    cobd1="C:\DOCUME~1\RANGER~1\LOCALS~1\Temp\swap.img"
    hdc=\Device\Cdrom0
    cofs2=c:\ exec0="F:\P_Ubuntu\Portable_Ubuntu_V4\pulseaudio\pulseaudio.exe"
    mem=384
    eth0=pcap-bridge,"Local Area Connection",00:ff:75:39:D3:C2

    !analyze - v output:

    Microsoft (R) Windows Debugger Version 6.6.0007.5
    Copyright (c) Microsoft Corporation. All rights reserved.

    Loading Dump File [C:\WINDOWS\Minidump\Mini010812-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: srv*DownstreamStore*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
    Product: WinNt
    Built by: 2600.xpsp_sp3_gdr.111025-1629
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b240
    Debug session time: Sun Jan 8 16:08:45.580 2012 (GMT-5)
    System Uptime: 0 days 0:41:22.813
    Loading Kernel Symbols
    ..................................................................................................................................................................................................
    Loading User Symbols
    Loading unloaded module list
    .............
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 4E, {99, 0, 0, 0}

    Unable to load image \SystemRoot\system32\DRIVERS\klif.sys, Win32 error 2
    *** WARNING: Unable to verify timestamp for klif.sys
    *** ERROR: Module load completed but symbols could not be loaded for klif.sys
    Probably caused by : klif.sys ( klif+31eb1 )

    Followup: MachineOwner
    ---------

    kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    PFN_LIST_CORRUPT (4e)
    Typically caused by drivers passing bad memory descriptor lists (ie: calling
    MmUnlockPages twice with the same list, etc). If a kernel debugger is
    available get the stack trace.
    Arguments:
    Arg1: 00000099, A PTE or PFN is corrupt
    Arg2: 00000000, page frame number
    Arg3: 00000000, current page state
    Arg4: 00000000, 0

    Debugging Details:
    ------------------

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x4E

    LAST_CONTROL_TRANSFER: from 80524edd to 80533846

    STACK_TEXT:
    f0efab10 80524edd 0000004e 00000099 00000000 nt!KeBugCheckEx+0x1b
    f0efab50 804eb6fe c0004340 010d0000 00000000 nt!MiDeletePte+0x3e8
    f0efac14 804f1d7c e3cf0220 010e3fff 00000000 nt!MiDeleteVirtualAddresses+0x162
    f0efacc0 8057a7c3 859a1920 85bdb958 f0efad44 nt!MiRemoveMappedView+0x212
    f0efad04 8057a86f 860b1080 86fbf188 00000000 nt!MiUnmapViewOfSection+0x12b
    f0efad20 f4ed6eb1 ffffffff 859a1920 f0efad64 nt!NtUnmapViewOfSection+0x54
    WARNING: Stack unwind information not available. Following frames may be wrong.
    f0efad54 804de7ec ffffffff 010d0000 008be2f4 klif+0x31eb1
    f0efad54 7c90e514 ffffffff 010d0000 008be2f4 nt!KiFastCallEntry+0xf8
    008be2f4 00000000 00000000 00000000 00000000 0x7c90e514

    STACK_COMMAND: kb

    FOLLOWUP_IP:
    klif+31eb1
    f4ed6eb1 ?? ???

    SYMBOL_STACK_INDEX: 6

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: klif

    IMAGE_NAME: klif.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 4daeb84f

    SYMBOL_NAME: klif+31eb1

    FAILURE_BUCKET_ID: 0x4E_klif+31eb1

    BUCKET_ID: 0x4E_klif+31eb1

    Followup: MachineOwner
    ---------

    I did check the memory usage before the crash and the swap file is being used.

    regards,
    Bob

     
  • bob_wh

    bob_wh - 2012-01-15

    I tried removing the setcobd=async from the configuration and It took longer to cause the crash. I was able to run xemac, xterm, firefox with 5 tabs, open office write and open office calc without a crash. Then I started firefox on windows side and it crashed when I opened the second tab.

    The configuration and windbg is given below:

    kernel=vmlinux
    ro
    initrd=initrd.gz
    cobd0="F:\P_Ubuntu\Portable_Ubuntu_V4\images\rootfs.img"
    cofs0="F:\P_Ubuntu\Portable_Ubuntu_V4"
    cofs1="C:\DOCUME~1\RANGER~1\LOCALS~1\Temp"
    root=/dev/cobd0
    cobd1="C:\DOCUME~1\RANGER~1\LOCALS~1\Temp\swap.img"
    hdc=\Device\Cdrom0
    cofs2=c:\ exec0="F:\P_Ubuntu\Portable_Ubuntu_V4\pulseaudio\pulseaudio.exe"
    mem=384
    eth0=pcap-bridge,"Local Area Connection",00:ff:75:39:D3:C2
    ==================================================
    Microsoft (R) Windows Debugger Version 6.6.0007.5
    Copyright (c) Microsoft Corporation. All rights reserved.

    Loading Dump File [C:\WINDOWS\Minidump\Mini010912-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: srv*DownstreamStore*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
    Product: WinNt
    Built by: 2600.xpsp_sp3_gdr.111025-1629
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b240
    Debug session time: Mon Jan 9 23:24:48.689 2012 (GMT-5)
    System Uptime: 0 days 9:31:15.661
    Loading Kernel Symbols
    ....................................................................................................................................................................................................
    Loading User Symbols
    Loading unloaded module list
    ..............
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 4E, {99, 0, 0, 0}

    Unable to load image \SystemRoot\system32\DRIVERS\klif.sys, Win32 error 2
    *** WARNING: Unable to verify timestamp for klif.sys
    *** ERROR: Module load completed but symbols could not be loaded for klif.sys
    Probably caused by : klif.sys ( klif+31eb1 )

    Followup: MachineOwner
    ---------

    kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    PFN_LIST_CORRUPT (4e)
    Typically caused by drivers passing bad memory descriptor lists (ie: calling
    MmUnlockPages twice with the same list, etc). If a kernel debugger is
    available get the stack trace.
    Arguments:
    Arg1: 00000099, A PTE or PFN is corrupt
    Arg2: 00000000, page frame number
    Arg3: 00000000, current page state
    Arg4: 00000000, 0

    Debugging Details:
    ------------------

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x4E

    LAST_CONTROL_TRANSFER: from 80524edd to 80533846

    STACK_TEXT:
    f020bb10 80524edd 0000004e 00000099 00000000 nt!KeBugCheckEx+0x1b
    f020bb50 804eb6fe c0004340 010d0000 00000000 nt!MiDeletePte+0x3e8
    f020bc14 804f1d7c e31da6b0 010e3fff 00000000 nt!MiDeleteVirtualAddresses+0x162
    f020bcc0 8057a7c3 860dc020 872cc390 f020bd44 nt!MiRemoveMappedView+0x212
    f020bd04 8057a86f 85d16f70 87290320 00000000 nt!MiUnmapViewOfSection+0x12b
    f020bd20 f422eeb1 ffffffff 860dc020 f020bd64 nt!NtUnmapViewOfSection+0x54
    WARNING: Stack unwind information not available. Following frames may be wrong.
    f020bd54 804de7ec ffffffff 010d0000 008be2f4 klif+0x31eb1
    f020bd54 7c90e514 ffffffff 010d0000 008be2f4 nt!KiFastCallEntry+0xf8
    008be2f4 00000000 00000000 00000000 00000000 0x7c90e514

    STACK_COMMAND: kb

    FOLLOWUP_IP:
    klif+31eb1
    f422eeb1 ?? ???

    SYMBOL_STACK_INDEX: 6

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: klif

    IMAGE_NAME: klif.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 4daeb84f

    SYMBOL_NAME: klif+31eb1

    FAILURE_BUCKET_ID: 0x4E_klif+31eb1

    BUCKET_ID: 0x4E_klif+31eb1

    Followup: MachineOwner
    ---------

     
  • bob_wh

    bob_wh - 2012-01-15

    Updated 01/15/12:

    Adding the /noexecute=alwaysoff/nopae has no effect. it still crashes. The same nopae kernel that
    was executing before is still executing this time. Prior to setting /noexecute=alwaysoff/nopae the registry had pae off: HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Session Manager/Memory Management/PhysicalAddressExtension=0. So pae is off even when the boot.ini has /noexecute=optin on my system. My hardware does NOT support DEP and memory is only 1 gb.

    The boot ini contents, colinux.conf, and windbg is given below:

    [boot loader]
    timeout=30
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=alwaysoff/nopae /bootlog
    -------------------------------------
    kernel=vmlinux
    ro
    initrd=initrd.gz
    cobd0="F:\P_Ubuntu\Portable_Ubuntu_V4\images\rootfs.img"
    cofs0="F:\P_Ubuntu\Portable_Ubuntu_V4"
    cofs1="C:\DOCUME~1\RANGER~1\LOCALS~1\Temp"
    root=/dev/cobd0
    cobd1="C:\DOCUME~1\RANGER~1\LOCALS~1\Temp\swap.img"
    hdc=\Device\Cdrom0
    cofs2=c:\ exec0="F:\P_Ubuntu\Portable_Ubuntu_V4\pulseaudio\pulseaudio.exe"
    mem=384
    eth0=pcap-bridge,"Local Area Connection",00:ff:75:39:D3:C2
    --------------------------------------------------------------------------------------------------------
    Microsoft (R) Windows Debugger Version 6.6.0007.5
    Copyright (c) Microsoft Corporation. All rights reserved.

    Loading Dump File [C:\WINDOWS\Minidump\Mini011412-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: srv*DownstreamStore*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
    Product: WinNt
    Built by: 2600.xpsp_sp3_gdr.111025-1629
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b240
    Debug session time: Sat Jan 14 23:29:16.924 2012 (GMT-5)
    System Uptime: 0 days 0:29:40.595
    Loading Kernel Symbols
    ...................................................................................................................................................................................................
    Loading User Symbols
    Loading unloaded module list
    ..............
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 4E, {99, 0, 0, 0}

    Unable to load image \SystemRoot\system32\DRIVERS\klif.sys, Win32 error 2
    *** WARNING: Unable to verify timestamp for klif.sys
    *** ERROR: Module load completed but symbols could not be loaded for klif.sys
    Probably caused by : klif.sys ( klif+31eb1 )

    Followup: MachineOwner
    ---------

    kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    PFN_LIST_CORRUPT (4e)
    Typically caused by drivers passing bad memory descriptor lists (ie: calling
    MmUnlockPages twice with the same list, etc). If a kernel debugger is
    available get the stack trace.
    Arguments:
    Arg1: 00000099, A PTE or PFN is corrupt
    Arg2: 00000000, page frame number
    Arg3: 00000000, current page state
    Arg4: 00000000, 0

    Debugging Details:
    ------------------

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x4E

    LAST_CONTROL_TRANSFER: from 80524edd to 80533846

    STACK_TEXT:
    f0ca9b10 80524edd 0000004e 00000099 00000000 nt!KeBugCheckEx+0x1b
    f0ca9b50 804eb6fe c0004340 010d0000 00000000 nt!MiDeletePte+0x3e8
    f0ca9c14 804f1d7c e1e892d0 010e3fff 00000000 nt!MiDeleteVirtualAddresses+0x162
    f0ca9cc0 8057a7c3 85612b50 85ee34f8 f0ca9d44 nt!MiRemoveMappedView+0x212
    f0ca9d04 8057a86f 85cae260 86e6c248 00000000 nt!MiUnmapViewOfSection+0x12b
    f0ca9d20 f41eeeb1 ffffffff 85612b50 f0ca9d64 nt!NtUnmapViewOfSection+0x54
    WARNING: Stack unwind information not available. Following frames may be wrong.
    f0ca9d54 804de7ec ffffffff 010d0000 008be2f4 klif+0x31eb1
    f0ca9d54 7c90e514 ffffffff 010d0000 008be2f4 nt!KiFastCallEntry+0xf8
    008be2f4 00000000 00000000 00000000 00000000 0x7c90e514

    STACK_COMMAND: kb

    FOLLOWUP_IP:
    klif+31eb1
    f41eeeb1 ?? ???

    SYMBOL_STACK_INDEX: 6

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: klif

    IMAGE_NAME: klif.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 4daeb84f

    SYMBOL_NAME: klif+31eb1

    FAILURE_BUCKET_ID: 0x4E_klif+31eb1

    BUCKET_ID: 0x4E_klif+31eb1

    Followup: MachineOwner
    ---------

     
  • bob_wh

    bob_wh - 2012-01-16

    update on 01/16/12:

    I tried lowering the memory parameter in the config file from 384 to 256 and it took about the same amount of time crash. The boot ini, config, windbg output is shown below:
    -----------------------------------
    [boot loader]
    timeout=30
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=alwaysoff/nopae /bootlog
    ---------------------------------------------------------------
    kernel=vmlinux
    ro
    initrd=initrd.gz
    cobd0="F:\P_Ubuntu\Portable_Ubuntu_V4\images\rootfs.img"
    cofs0="F:\P_Ubuntu\Portable_Ubuntu_V4"
    cofs1="C:\DOCUME~1\RANGER~1\LOCALS~1\Temp"
    root=/dev/cobd0
    cobd1="C:\DOCUME~1\RANGER~1\LOCALS~1\Temp\swap.img"
    hdc=\Device\Cdrom0
    cofs2=c:\ exec0="F:\P_Ubuntu\Portable_Ubuntu_V4\pulseaudio\pulseaudio.exe"
    mem=256
    eth0=pcap-bridge,"Local Area Connection",00:ff:75:39:D3:C2
    ------------------------------------------------------------
    Microsoft (R) Windows Debugger Version 6.6.0007.5
    Copyright (c) Microsoft Corporation. All rights reserved.

    Loading Dump File [C:\WINDOWS\Minidump\Mini011512-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: srv*DownstreamStore*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
    Product: WinNt
    Built by: 2600.xpsp_sp3_gdr.111025-1629
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b240
    Debug session time: Sun Jan 15 15:17:47.125 2012 (GMT-5)
    System Uptime: 0 days 1:22:42.707
    Loading Kernel Symbols
    ..................................................................................................................................................................................................
    Loading User Symbols
    Loading unloaded module list
    ...............
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 4E, {99, 85f79, 4, 0}

    Unable to load image \SystemRoot\system32\DRIVERS\klif.sys, Win32 error 2
    *** WARNING: Unable to verify timestamp for klif.sys
    *** ERROR: Module load completed but symbols could not be loaded for klif.sys
    Probably caused by : klif.sys ( klif+31eb1 )

    Followup: MachineOwner
    ---------

    kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    PFN_LIST_CORRUPT (4e)
    Typically caused by drivers passing bad memory descriptor lists (ie: calling
    MmUnlockPages twice with the same list, etc). If a kernel debugger is
    available get the stack trace.
    Arguments:
    Arg1: 00000099, A PTE or PFN is corrupt
    Arg2: 00085f79, page frame number
    Arg3: 00000004, current page state
    Arg4: 00000000, 0

    Debugging Details:
    ------------------

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x4E

    LAST_CONTROL_TRANSFER: from 80524edd to 80533846

    STACK_TEXT:
    efed6b10 80524edd 0000004e 00000099 00085f79 nt!KeBugCheckEx+0x1b
    efed6b50 804eb6fe c0004300 010c0000 00000000 nt!MiDeletePte+0x3e8
    efed6c14 804f1d7c e1eb3860 010c8fff 00000000 nt!MiDeleteVirtualAddresses+0x162
    efed6cc0 8057a7c3 86ff5848 85c872d0 efed6d44 nt!MiRemoveMappedView+0x212
    efed6d04 8057a86f 85b96860 85c01dc8 00000000 nt!MiUnmapViewOfSection+0x12b
    efed6d20 f3ddfeb1 ffffffff 86ff5848 efed6d64 nt!NtUnmapViewOfSection+0x54
    WARNING: Stack unwind information not available. Following frames may be wrong.
    efed6d54 804de7ec ffffffff 010c0000 008beeec klif+0x31eb1
    efed6d54 7c90e514 ffffffff 010c0000 008beeec nt!KiFastCallEntry+0xf8
    008beeec 00000000 00000000 00000000 00000000 0x7c90e514

    STACK_COMMAND: kb

    FOLLOWUP_IP:
    klif+31eb1
    f3ddfeb1 ?? ???

    SYMBOL_STACK_INDEX: 6

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: klif

    IMAGE_NAME: klif.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 4daeb84f

    SYMBOL_NAME: klif+31eb1

    FAILURE_BUCKET_ID: 0x4E_klif+31eb1

    BUCKET_ID: 0x4E_klif+31eb1

    Followup: MachineOwner
    ---------

     
  • bob_wh

    bob_wh - 2012-01-22

    updated 01/22/2012:

    I tried using SLIRP as the network and it still crashes with memory corruption. This leads me to suspect that networking plays no part in this particular problem. It takes longer to crash using Slirp is a slower networking mode that the other networking modes that I have tried.

    colinux config file:

    kernel=vmlinux
    ro
    initrd=initrd.gz
    cobd0="F:\P_Ubuntu\Portable_Ubuntu_V4\images\rootfs.img"
    cofs0="F:\P_Ubuntu\Portable_Ubuntu_V4"
    cofs1="C:\DOCUME~1\RANGER~1\LOCALS~1\Temp"
    root=/dev/cobd0
    cobd1="C:\DOCUME~1\RANGER~1\LOCALS~1\Temp\swap.img"
    hdc=\Device\Cdrom0
    cofs2=c:\ exec0="F:\P_Ubuntu\Portable_Ubuntu_V4\pulseaudio\pulseaudio.exe"
    mem=384
    eth0=slirp,00:ff:75:39:D3:C1

    windbg output:

    Microsoft (R) Windows Debugger Version 6.6.0007.5
    Copyright (c) Microsoft Corporation. All rights reserved.

    Loading Dump File [C:\WINDOWS\Minidump\Mini012212-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: srv*DownstreamStore*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
    Product: WinNt
    Built by: 2600.xpsp_sp3_gdr.111025-1629
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b240
    Debug session time: Sat Jan 21 23:57:18.529 2012 (GMT-5)
    System Uptime: 0 days 8:58:49.128
    Loading Kernel Symbols
    .................................................................................................................................................................................................
    Loading User Symbols
    Loading unloaded module list
    ................
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1A, {41284, 10c0001, 5805, c0503000}

    Unable to load image \SystemRoot\system32\DRIVERS\klif.sys, Win32 error 2
    *** WARNING: Unable to verify timestamp for klif.sys
    *** ERROR: Module load completed but symbols could not be loaded for klif.sys
    Probably caused by : klif.sys ( klif+31eb1 )

    Followup: MachineOwner
    ---------

    kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
    Arguments:
    Arg1: 00041284, A PTE or the working set list is corrupt.
    Arg2: 010c0001
    Arg3: 00005805
    Arg4: c0503000

    Debugging Details:
    ------------------

    BUGCHECK_STR: 0x1a_41284

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    LAST_CONTROL_TRANSFER: from 80525056 to 80533846

    STACK_TEXT:
    ef61bae8 80525056 0000001a 00041284 010c0001 nt!KeBugCheckEx+0x1b
    ef61bb20 804eb407 00005805 010c0000 c0300010 nt!MiLocateWsle+0xc0
    ef61bb50 804eb6fe c0004300 010c0000 00000000 nt!MiDeletePte+0x1bb
    ef61bc14 804f1d7c e3b85890 010c9fff 00000000 nt!MiDeleteVirtualAddresses+0x162
    ef61bcc0 8057a7c3 85e65780 85f20820 ef61bd44 nt!MiRemoveMappedView+0x212
    ef61bd04 8057a86f 86b47128 850b6170 00000000 nt!MiUnmapViewOfSection+0x12b
    ef61bd20 f37caeb1 ffffffff 85e65780 ef61bd64 nt!NtUnmapViewOfSection+0x54
    WARNING: Stack unwind information not available. Following frames may be wrong.
    ef61bd54 804de7ec ffffffff 010c0000 008beeec klif+0x31eb1
    ef61bd54 7c90e514 ffffffff 010c0000 008beeec nt!KiFastCallEntry+0xf8
    008beeec 00000000 00000000 00000000 00000000 0x7c90e514

    STACK_COMMAND: kb

    FOLLOWUP_IP:
    klif+31eb1
    f37caeb1 ?? ???

    SYMBOL_STACK_INDEX: 7

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: klif

    IMAGE_NAME: klif.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 4daeb84f

    SYMBOL_NAME: klif+31eb1

    FAILURE_BUCKET_ID: 0x1a_41284_klif+31eb1

    BUCKET_ID: 0x1a_41284_klif+31eb1

    Followup: MachineOwner
    ---------