O
Ollie4735
Hi we have a virtual server running on a Hyper-V which keeps crashing and we can't seem to figure out what's causing it.
Here is the memory dump.
--------------------------------------------------------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff4dac660af59, ffffd0803d442c90, 0}
Probably caused by : win32kbase.sys ( win32kbase!HMChangeOwnerThread+49 )
Followup: MachineOwner
---------
!analyze -v Output
5: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff4dac660af59, Address of the instruction which caused the bugcheck
Arg3: ffffd0803d442c90, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 401
BUILD_VERSION_STRING: 14393.2828.amd64fre.rs1_release_inmarket.190216-1457
SYSTEM_MANUFACTURER: Microsoft Corporation
VIRTUAL_MACHINE: HyperV
SYSTEM_PRODUCT_NAME: Virtual Machine
SYSTEM_SKU: None
SYSTEM_VERSION: Hyper-V UEFI Release v1.0
BIOS_VENDOR: Microsoft Corporation
BIOS_VERSION: Hyper-V UEFI Release v1.0
BIOS_DATE: 11/26/2012
BASEBOARD_MANUFACTURER: Microsoft Corporation
BASEBOARD_PRODUCT: Virtual Machine
BASEBOARD_VERSION: Hyper-V UEFI Release v1.0
DUMP_TYPE: 1
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff4dac660af59
BUGCHECK_P3: ffffd0803d442c90
BUGCHECK_P4: 0
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
FAULTING_IP:
win32kbase!HMChangeOwnerThread+49
fffff4da`c660af59 488b8870010000 mov rcx,qword ptr [rax+170h]
CONTEXT: ffffd0803d442c90 -- (.cxr 0xffffd0803d442c90)
rax=0000000000000000 rbx=fffff48ac1c4a440 rcx=fffff48ac1c4a440
rdx=0000000000000000 rsi=0000000000000000 rdi=fffff48ac06e56d0
rip=fffff4dac660af59 rsp=ffffd0803d443680 rbp=fffff4dac6692e4c
r8=fffff48ac0007010 r9=fffff48ac0410938 r10=7fffa801d3747840
r11=7ffffffffffffffc r12=0000000000000001 r13=0000000000000000
r14=0000007f45f33000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
win32kbase!HMChangeOwnerThread+0x49:
fffff4da`c660af59 488b8870010000 mov rcx,qword ptr [rax+170h] ds:002b:00000000`00000170=????????????????
Resetting default scope
CPU_COUNT: 8
CPU_MHZ: a28
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 3e
CPU_STEPPING: 4
CPU_MICROCODE: 6,3e,4,0 (F,M,S,R) SIG: FFFFFFFF'00000000 (cache) FFFFFFFF'00000000 (init)
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: csrss.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: FS1
ANALYSIS_SESSION_TIME: 04-16-2019 16:53:13.0279
ANALYSIS_VERSION: 10.0.17763.132 amd64fre
LAST_CONTROL_TRANSFER: from fffff4dac65ce292 to fffff4dac660af59
STACK_TEXT:
ffffd080`3d443680 fffff4da`c65ce292 : fffff48a`c0410938 fffff48a`c06e56d0 00000000`00000000 0000007f`45f33000 : win32kbase!HMChangeOwnerThread+0x49
ffffd080`3d4436b0 fffff4da`c65a68c6 : ffffd080`3d443780 fffff4da`c66b03a0 fffff48a`c06e56d0 00000000`00000000 : win32kbase!MarkThreadsObjects+0x82
ffffd080`3d4436e0 fffff4da`c65a73e6 : 00000000`00000001 fffff48a`c06e56d0 00000000`00000000 fffff48a`c06e56d0 : win32kbase!xxxDestroyThreadInfo+0x5ba
ffffd080`3d443850 fffff4da`c62f8b94 : 00000000`00000000 00000000`00000001 ffffe280`0794c080 00000000`00000001 : win32kbase!UserThreadCallout+0x296
ffffd080`3d4438a0 fffff4da`c65b2397 : ffffd080`3d4439f8 fffff802`37d8e400 ffffa801`cd275160 ffffffff`800065f0 : win32kfull!W32pThreadCallout+0x54
ffffd080`3d4438d0 fffff802`37f715d7 : ffffd080`3d4439f8 fffff802`37d8e400 ffffd080`3d443980 00000000`00000000 : win32kbase!W32CalloutDispatch+0x147
ffffd080`3d443910 fffff802`37f9f821 : 00000000`00000000 ffffd080`3d443980 00000000`00000000 00000000`00000000 : nt!ExCallCallBack+0x37
ffffd080`3d443940 fffff802`37e91902 : 00000000`00000000 ffffe280`0794c080 00000000`00000000 ffffe280`00397080 : nt!PspExitThread+0x3e9
ffffd080`3d443a80 fffff802`37e91800 : ffffe280`0794c080 00000000`00000000 ffffe280`0794c080 00000000`00000000 : nt!PspTerminateThreadByPointer+0x96
ffffd080`3d443ac0 fffff802`37bfe403 : ffffe280`0794c080 ffffd080`3d443b80 00000000`00000000 ffffe28f`fe1276f0 : nt!NtTerminateThread+0x44
ffffd080`3d443b00 00007ffb`80cc6564 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
0000007f`461bf768 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffb`80cc6564
THREAD_SHA1_HASH_MOD_FUNC: 9c78c52b302a4ede55b99ec9ba9cad5b89900bdf
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 4d7c469b9c9432ce01d132b699944e3f2395581d
THREAD_SHA1_HASH_MOD: 5f674a06a6cc525acf0570b4c25dfcfdc237d3ac
FOLLOWUP_IP:
win32kbase!HMChangeOwnerThread+49
fffff4da`c660af59 488b8870010000 mov rcx,qword ptr [rax+170h]
FAULT_INSTR_CODE: 70888b48
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: win32kbase!HMChangeOwnerThread+49
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32kbase
IMAGE_NAME: win32kbase.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 5bd13431
IMAGE_VERSION: 10.0.14393.2608
STACK_COMMAND: .cxr 0xffffd0803d442c90 ; kb
BUCKET_ID_FUNC_OFFSET: 49
FAILURE_BUCKET_ID: 0x3B_win32kbase!HMChangeOwnerThread
BUCKET_ID: 0x3B_win32kbase!HMChangeOwnerThread
PRIMARY_PROBLEM_CLASS: 0x3B_win32kbase!HMChangeOwnerThread
TARGET_TIME: 2019-04-16T15:33:05.000Z
OSBUILD: 14393
OSSERVICEPACK: 0
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 144
PRODUCT_TYPE: 3
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 Server TerminalServer DataCenter
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2019-02-17 01:56:01
BUILDDATESTAMP_STR: 190216-1457
BUILDLAB_STR: rs1_release_inmarket
BUILDOSVER_STR: 10.0.14393.2828.amd64fre.rs1_release_inmarket.190216-1457
ANALYSIS_SESSION_ELAPSED_TIME: 753
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x3b_win32kbase!hmchangeownerthread
FAILURE_ID_HASH: {1eae2e18-8d71-cfb9-bae0-7ed3c0e1d54a}
Followup: MachineOwner
---------
Continue reading...
Here is the memory dump.
--------------------------------------------------------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff4dac660af59, ffffd0803d442c90, 0}
Probably caused by : win32kbase.sys ( win32kbase!HMChangeOwnerThread+49 )
Followup: MachineOwner
---------
!analyze -v Output
5: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff4dac660af59, Address of the instruction which caused the bugcheck
Arg3: ffffd0803d442c90, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 401
BUILD_VERSION_STRING: 14393.2828.amd64fre.rs1_release_inmarket.190216-1457
SYSTEM_MANUFACTURER: Microsoft Corporation
VIRTUAL_MACHINE: HyperV
SYSTEM_PRODUCT_NAME: Virtual Machine
SYSTEM_SKU: None
SYSTEM_VERSION: Hyper-V UEFI Release v1.0
BIOS_VENDOR: Microsoft Corporation
BIOS_VERSION: Hyper-V UEFI Release v1.0
BIOS_DATE: 11/26/2012
BASEBOARD_MANUFACTURER: Microsoft Corporation
BASEBOARD_PRODUCT: Virtual Machine
BASEBOARD_VERSION: Hyper-V UEFI Release v1.0
DUMP_TYPE: 1
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff4dac660af59
BUGCHECK_P3: ffffd0803d442c90
BUGCHECK_P4: 0
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
FAULTING_IP:
win32kbase!HMChangeOwnerThread+49
fffff4da`c660af59 488b8870010000 mov rcx,qword ptr [rax+170h]
CONTEXT: ffffd0803d442c90 -- (.cxr 0xffffd0803d442c90)
rax=0000000000000000 rbx=fffff48ac1c4a440 rcx=fffff48ac1c4a440
rdx=0000000000000000 rsi=0000000000000000 rdi=fffff48ac06e56d0
rip=fffff4dac660af59 rsp=ffffd0803d443680 rbp=fffff4dac6692e4c
r8=fffff48ac0007010 r9=fffff48ac0410938 r10=7fffa801d3747840
r11=7ffffffffffffffc r12=0000000000000001 r13=0000000000000000
r14=0000007f45f33000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
win32kbase!HMChangeOwnerThread+0x49:
fffff4da`c660af59 488b8870010000 mov rcx,qword ptr [rax+170h] ds:002b:00000000`00000170=????????????????
Resetting default scope
CPU_COUNT: 8
CPU_MHZ: a28
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 3e
CPU_STEPPING: 4
CPU_MICROCODE: 6,3e,4,0 (F,M,S,R) SIG: FFFFFFFF'00000000 (cache) FFFFFFFF'00000000 (init)
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: csrss.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: FS1
ANALYSIS_SESSION_TIME: 04-16-2019 16:53:13.0279
ANALYSIS_VERSION: 10.0.17763.132 amd64fre
LAST_CONTROL_TRANSFER: from fffff4dac65ce292 to fffff4dac660af59
STACK_TEXT:
ffffd080`3d443680 fffff4da`c65ce292 : fffff48a`c0410938 fffff48a`c06e56d0 00000000`00000000 0000007f`45f33000 : win32kbase!HMChangeOwnerThread+0x49
ffffd080`3d4436b0 fffff4da`c65a68c6 : ffffd080`3d443780 fffff4da`c66b03a0 fffff48a`c06e56d0 00000000`00000000 : win32kbase!MarkThreadsObjects+0x82
ffffd080`3d4436e0 fffff4da`c65a73e6 : 00000000`00000001 fffff48a`c06e56d0 00000000`00000000 fffff48a`c06e56d0 : win32kbase!xxxDestroyThreadInfo+0x5ba
ffffd080`3d443850 fffff4da`c62f8b94 : 00000000`00000000 00000000`00000001 ffffe280`0794c080 00000000`00000001 : win32kbase!UserThreadCallout+0x296
ffffd080`3d4438a0 fffff4da`c65b2397 : ffffd080`3d4439f8 fffff802`37d8e400 ffffa801`cd275160 ffffffff`800065f0 : win32kfull!W32pThreadCallout+0x54
ffffd080`3d4438d0 fffff802`37f715d7 : ffffd080`3d4439f8 fffff802`37d8e400 ffffd080`3d443980 00000000`00000000 : win32kbase!W32CalloutDispatch+0x147
ffffd080`3d443910 fffff802`37f9f821 : 00000000`00000000 ffffd080`3d443980 00000000`00000000 00000000`00000000 : nt!ExCallCallBack+0x37
ffffd080`3d443940 fffff802`37e91902 : 00000000`00000000 ffffe280`0794c080 00000000`00000000 ffffe280`00397080 : nt!PspExitThread+0x3e9
ffffd080`3d443a80 fffff802`37e91800 : ffffe280`0794c080 00000000`00000000 ffffe280`0794c080 00000000`00000000 : nt!PspTerminateThreadByPointer+0x96
ffffd080`3d443ac0 fffff802`37bfe403 : ffffe280`0794c080 ffffd080`3d443b80 00000000`00000000 ffffe28f`fe1276f0 : nt!NtTerminateThread+0x44
ffffd080`3d443b00 00007ffb`80cc6564 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
0000007f`461bf768 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffb`80cc6564
THREAD_SHA1_HASH_MOD_FUNC: 9c78c52b302a4ede55b99ec9ba9cad5b89900bdf
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 4d7c469b9c9432ce01d132b699944e3f2395581d
THREAD_SHA1_HASH_MOD: 5f674a06a6cc525acf0570b4c25dfcfdc237d3ac
FOLLOWUP_IP:
win32kbase!HMChangeOwnerThread+49
fffff4da`c660af59 488b8870010000 mov rcx,qword ptr [rax+170h]
FAULT_INSTR_CODE: 70888b48
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: win32kbase!HMChangeOwnerThread+49
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32kbase
IMAGE_NAME: win32kbase.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 5bd13431
IMAGE_VERSION: 10.0.14393.2608
STACK_COMMAND: .cxr 0xffffd0803d442c90 ; kb
BUCKET_ID_FUNC_OFFSET: 49
FAILURE_BUCKET_ID: 0x3B_win32kbase!HMChangeOwnerThread
BUCKET_ID: 0x3B_win32kbase!HMChangeOwnerThread
PRIMARY_PROBLEM_CLASS: 0x3B_win32kbase!HMChangeOwnerThread
TARGET_TIME: 2019-04-16T15:33:05.000Z
OSBUILD: 14393
OSSERVICEPACK: 0
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 144
PRODUCT_TYPE: 3
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 Server TerminalServer DataCenter
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2019-02-17 01:56:01
BUILDDATESTAMP_STR: 190216-1457
BUILDLAB_STR: rs1_release_inmarket
BUILDOSVER_STR: 10.0.14393.2828.amd64fre.rs1_release_inmarket.190216-1457
ANALYSIS_SESSION_ELAPSED_TIME: 753
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x3b_win32kbase!hmchangeownerthread
FAILURE_ID_HASH: {1eae2e18-8d71-cfb9-bae0-7ed3c0e1d54a}
Followup: MachineOwner
---------
Continue reading...