0

I'm trying to get a clue why our server has suddenly crashed. According to this it could happen when some kernel code tried to close an invalid handle or a protected handle.

Any direction to understand what kind handle could cause this?

Below are the info from windbg and windows recovery window.

This is a report from windbg:

Loading Dump File [C:\TEMP\022015-48594-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*c:\debuggers*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\debuggers*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (12 procs) Free x64
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 7601.18229.amd64fre.win7sp1_gdr.130801-1533
Machine Name:
Kernel base = 0xfffff800`0181e000 PsLoadedModuleList = 0xfffff800`01a616d0
Debug session time: Fri Feb 20 10:20:29.194 2015 (UTC - 6:00)
System Uptime: 0 days 20:15:34.826
Loading Kernel Symbols
...............................................................
................................................................
.............
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 93, {a58, 0, 0, 0}

Probably caused by : srv2.sys ( srv2!SrvCloseFile+1d1 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

INVALID_KERNEL_HANDLE (93)
This message occurs if kernel code attempts to close or reference a handle
that is not a valid handle.  Only invalid or protected handles passed to NtClose
will cause this bugcheck, unless bad handle detection is enabled.
Arguments:
Arg1: 0000000000000a58, The handle that NtClose was called with
Arg2: 0000000000000000, A protected handle was closed.
Arg3: 0000000000000000
Arg4: 0000000000000000, The error occurred closing an invalid kernel handle.

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT_SERVER

BUGCHECK_STR:  0x93

PROCESS_NAME:  System

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre

LAST_CONTROL_TRANSFER:  from fffff80001afee1f to fffff80001893b80

STACK_TEXT:  
fffff880`0946b888 fffff800`01afee1f : 00000000`00000093 00000000`00000a58 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff880`0946b890 fffff800`01b8c604 : 00000000`00000a58 fffffa80`2d5d6990 fffff8a0`00001ad0 00000000`00000a58 : nt! ?? ::NNGAKEGL::`string'+0x31e71
fffff880`0946b920 fffff800`01892e13 : fffffa80`2f1fab50 fffff880`0946b9f0 ffffffff`ffffffff 00000000`000001a0 : nt!ObpCloseHandle+0x94
fffff880`0946b970 fffff800`0188f3d0 : fffff880`05a032c1 fffffa80`2e0697a0 fffff8a0`0734d7f0 ffffffff`ffffffff : nt!KiSystemServiceCopyEnd+0x13
fffff880`0946bb08 fffff880`05a032c1 : fffffa80`2e0697a0 fffff8a0`0734d7f0 ffffffff`ffffffff fffffa80`2e0697a0 : nt!KiServiceLinkage
fffff880`0946bb10 fffff880`05a28f08 : 00000000`00000000 fffffa80`2df46e20 fffff780`00000320 fffffa80`2f02bce0 : srv2!SrvCloseFile+0x1d1
fffff880`0946bbd0 fffff880`05a285d0 : fffffa80`2f02ba00 fffffa80`00000000 fffff880`05a22110 fffffa80`30b1b010 : srv2!Smb2ExecuteClose+0x98
fffff880`0946bc80 fffff880`05a2839a : 00000000`0000000f 00000000`00000006 fffffa80`6aca9310 fffffa80`2f02ba40 : srv2!SrvProcessPacket+0xa0
fffff880`0946bcc0 fffff800`01b31bae : 00000000`0000206c fffffa80`2f1fab50 00000000`00000080 fffffa80`2d5d6990 : srv2!SrvProcWorkerThread+0x15a
fffff880`0946bd40 fffff800`018848c6 : fffff800`01a0ee80 fffffa80`2f1fab50 fffff800`01a1ccc0 00000008`00000008 : nt!PspSystemThreadStartup+0x5a
fffff880`0946bd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
srv2!SrvCloseFile+1d1
fffff880`05a032c1 48837f1000      cmp     qword ptr [rdi+10h],0

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  srv2!SrvCloseFile+1d1

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: srv2

IMAGE_NAME:  srv2.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4dba2b0a

IMAGE_VERSION:  6.1.7601.17608

FAILURE_BUCKET_ID:  X64_0x93_srv2!SrvCloseFile+1d1

BUCKET_ID:  X64_0x93_srv2!SrvCloseFile+1d1

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0x93_srv2!srvclosefile+1d1

FAILURE_ID_HASH:  {2ed283b0-a827-9f52-d1e7-a37c5d171413}

Followup: MachineOwner
---------

This is the message after the server has recovered:

Problem signature:
  Problem Event Name:   BlueScreen
  OS Version:   6.1.7601.2.1.0.274.10
  Locale ID:    1033

Additional information about the problem:

  BCCode:   93
  BCP1: 0000000000000A58
  BCP2: 0000000000000000
  BCP3: 0000000000000000
  BCP4: 0000000000000000
  OS Version:   6_1_7601
  Service Pack: 1_0
  Product:  274_3
theateist
  • 163
  • 1
  • 2
  • 6
  • 1
    It was caused by a driver attempting invalid memory at a IRQ that wasn't valid. The driver in question is listed int he supplied information. Be sure you have all updates installed. – Ramhound Feb 20 '15 at 21:06
  • I am going to guess its [this](https://kc.mcafee.com/corporate/index?page=content&id=KB69563) issue so update your system. – Ramhound Feb 20 '15 at 21:08
  • srv2.sys is there to deal with SMB - start with updating your network adapter(s) drivers. How many times has it done this? Is it doing it repeatedly? – techie007 Feb 20 '15 at 21:32
  • @Ƭᴇcʜιᴇ007, yesterday we had a weird thing: from some computers we could run application from shared folder but from others, identical to first ones, we couldn't. Today we had the BSOD. I'm not sure if this is related but... So, this was the first time it did it. – theateist Feb 20 '15 at 22:00
  • well if you were having trouble accessing the shares, and this error is related to networking and share connections then you either have a faulty network adapter driver, a faulty network adapter, or a faulty network. :) With the details you've provided, it's impossible for us to say. – techie007 Feb 20 '15 at 22:04
  • this is the latest srv2.sys I can find: http://support2.microsoft.com/kb/3002301/en-us Maybe it also fixes your issue. – magicandre1981 Feb 21 '15 at 07:25

0 Answers0