[RESOLVED] Win2008R2 SP1: STOP 0x27 in rdbss!RxPurgeRelatedFobxs+186

  • Article

Status: Resolved

Update 120130: Closing the loop on this: the KB (2624677) for this is now available through Microsoft Support, the public release is scheduled for this February.

Update 111116: Sonny found the issue using instrumentation/private and got it fixed. The KB for this is going to be released in a near-future HTP.

Sonny sent me this STOP 0x27 in rdbss, occurring on a Win2008R2 SP1 machine under stress. We are currently in investigation phase. Updates will follow as appropriate. In the meantime, let me know when you are having this too!

FAILURE_BUCKET_ID: X64_0x27_rdbss!RxPurgeRelatedFobxs+186

00 fffff880`08d16650 fffff880`013e1ec1 rdbss!RxPurgeRelatedFobxs+0x186
01 fffff880`08d166e0 fffff880`013b1684 rdbss!RxCommonSetInformation+0x1d1
02 fffff880`08d16770 fffff880`013ceb44 rdbss!RxFsdCommonDispatch+0x870
03 fffff880`08d16860 fffff880`011e92cc rdbss!RxFsdDispatch+0x224
04 fffff880`08d168d0 fffff880`01cf0271 mrxsmb!MRxSmbFsdDispatch+0xc0
05 fffff880`08d16910 fffff880`01cee138 mup!MupiCallUncProvider+0x161
06 fffff880`08d16980 fffff880`01cf1820 mup!MupStateMachine+0x128
07 fffff880`08d169d0 fffff880`014016af mup!MupSetInformationFile+0x1b0
08 fffff880`08d16a30 fffff800`019a8743 fltmgr!FltpDispatch+0x9f
09 fffff880`08d16a90 fffff800`016c8f93 nt!NtSetInformationFile+0x91f
0a fffff880`08d16bb0 00000000`776c158a nt!KiSystemServiceCopyEnd+0x13

This particular machine has rdbss version:

    Image name: rdbss.sys
    Timestamp: Sat Nov 20 10:27:51 2010 (4CE79497)
    CheckSum: 0004D76F
    ImageSize: 00051000
    Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4

The problem is caused by a list corruption. Usually, first the customer sees degrading performance caused by a lock convoy, eventually resulting in a hang and then in this crash.

To see additional build information for drivers, such as file/product version, set DisablePagingExecutive to 1, as this will ensure that the resource headers for the driver images are not paged out, and thus are available in a dump.

STOPs like this are generally best further troubleshot using WPP tracing for the Redirector.