BSOD on Vista and virtualized Debian 4.0r2

[Marian Hello]

Hello,

I'am not sure if it's issue with latest set of Vista update, but I started to have problems with Virtualbox 1.6.2 running virtualized Debian 4.0r2 (I didn't have them a week ago).

When I start Debian, I see normal booting procedure, but at some point it crashes Vista to BSOD (page_fault_in_non_paged_area).

Windbg (!analyze -v, !thread) I shows me following:

Probably caused by : volsnap.sys ( volsnap+c90e )

1: kd> !analyze -v *

• *
• Bugcheck Analysis *
• *

*

PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: 9c51c001, memory referenced. Arg2: 00000000, value 0 = read operation, 1 = write operation. Arg3: 81c9dc74, If non-zero, the instruction address which referenced the bad memory

address.

Arg4: 00000000, (reserved)

Debugging Details:

---

READ_ADDRESS: GetPointerFromAddress: unable to read from 81d81868 Unable to read MiSystemVaType memory at 81d61420

9c51c001

FAULTING_IP: ntRtlCompareMemory+14 81c9dc74 f3a7 repe cmps dword ptr [esi],dword ptr es:[edi]

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: System

CURRENT_IRQL: 0

TRAP_FRAME: 88dcbc7c -- (.trap 0xffffffff88dcbc7c) ErrCode = 00000000 eax=879dbf78 ebx=3ab94001 ecx=000017ff edx=00000000 esi=87cb4001 edi=9c51c001 eip=81c9dc74 esp=88dcbcf0 ebp=88dcbd34 iopl=0 nv up ei pl nz na pe cy cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010207 ntRtlCompareMemory+0x14: 81c9dc74 f3a7 repe cmps dword ptr [esi],dword ptr es:[edi] Resetting default scope

LAST_CONTROL_TRANSFER: from 81ca4bb4 to 81cef155

STACK_TEXT: 88dcbc64 81ca4bb4 00000000 9c51c001 00000000 ntMmAccessFault+0x10a 88dcbc64 81c9dc74 00000000 9c51c001 00000000 nt!KiTrap0E+0xdc 88dcbcf4 87f298b1 87cb4001 9c51c001 00005fff ntRtlCompareMemory+0x14 88dcbd34 87f2990e 00005fff 9c51c001 00000000 volsnapVspCompareMemoryWithCopyIrp+0x143 88dcbd4c 87f33237 87531238 87531270 00000000 volsnapVspCompareMemoryForTableEntry+0x14 88dcbd60 87f329bd 87531238 00000000 85043678 volsnap!VspWriteVolumePhase22+0x13 88dcbd7c 81e1fa1c 84fba378 d3187b75 00000000 volsnapVspWorkerThread+0x83 88dcbdc0 81c78a3e 87f3293a 850469b8 00000000 ntPspSystemThreadStartup+0x9d 00000000 00000000 00000000 00000000 00000000 ntKiThreadStartup+0x16

STACK_COMMAND: kb

FOLLOWUP_IP: volsnapVspCompareMemoryWithCopyIrp+143 87f298b1 3b4508 cmp eax,dword ptr [ebp+8]

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: volsnapVspCompareMemoryWithCopyIrp+143

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: volsnap

IMAGE_NAME: volsnap.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47918f92

FAILURE_BUCKET_ID: 0x50_volsnapVspCompareMemoryWithCopyIrp+143

BUCKET_ID: 0x50_volsnapVspCompareMemoryWithCopyIrp+143

Followup: MachineOwner

---

1: kd> !thread GetPointerFromAddress: unable to read from 81d8186c THREAD 85043678 Cid 0004.00ec Teb: 00000000 Win32Thread: 00000000 RUNNING on processor 1 Not impersonating GetUlongFromAddress: unable to read from 81d59394 Owning Process 0 Image: <Unknown> Attached Process 8405fa58 Image: System ffdf0000: Unable to get shared data Wait Start TickCount 101876 Context Switch Count 11802 ReadMemory error: Cannot get ntKeMaximumIncrement value. UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address volsnapVspWorkerThread (0x87f3293a) Stack Init 88dcc000 Current 88dcbca0 Base 88dcc000 Limit 88dc9000 Call 0 Priority 8 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5 ChildEBP RetAddr Args to Child 88dcbc64 81ca4bb4 00000000 9c51c001 00000000 ntMmAccessFault+0x10a 88dcbc64 81c9dc74 00000000 9c51c001 00000000 nt!KiTrap0E+0xdc (FPO: [0,0] TrapFrame @ 88dcbc7c) 88dcbcf4 87f298b1 87cb4001 9c51c001 00005fff ntRtlCompareMemory+0x14 (FPO: [3,0,0]) 88dcbd34 87f2990e 00005fff 9c51c001 00000000 volsnapVspCompareMemoryWithCopyIrp+0x143 (FPO: [Non-Fpo]) 88dcbd4c 87f33237 87531238 87531270 00000000 volsnapVspCompareMemoryForTableEntry+0x14 (FPO: [Non-Fpo]) 88dcbd60 87f329bd 87531238 00000000 85043678 volsnap!VspWriteVolumePhase22+0x13 (FPO: [Non-Fpo]) 88dcbd7c 81e1fa1c 84fba378 d3187b75 00000000 volsnapVspWorkerThread+0x83 (FPO: [Non-Fpo]) 88dcbdc0 81c78a3e 87f3293a 850469b8 00000000 ntPspSystemThreadStartup+0x9d 00000000 00000000 00000000 00000000 00000000 ntKiThreadStartup+0x16

[Sander van Leeuwen]

Kind of a strange bsod. Do you have some file system encryption/compression enabled?

[Marian Hello]

I fixed this issue, by rollbacking to last working snapshot. I played with virtualbox in Linux and I've used Windows vdi. Probably linux version did some bad changes to vdi.

[Sander van Leeuwen]

I was under the impression that your *host* Vista blue screened while running a Debian guest. Now you seem to suggest it was a Vista guest.

Anyway, when you have snapshots, you really shouldn't let another copy of VirtualBox use the base vdi of the guest. That can indeed completely mess up your guest.