0 Replies Latest reply on Jul 26, 2011 11:53 PM by captainj1

    Windows7 BSOD tcpip.sys

    captainj1

      I use windows7 Enterprise K SP1 (Intel(R) Core2 Quad Q8400 @2.67Ghz, mem 3G)

       

      network adapter : INTEL(R) 82567LM-3 Gigabit Network Connection( Driver 2011-05-04,  11.12.36.0 )

       

       

      my computer reboot, and I check memory.dmp ( windows folder)

       

      it seems windows/drivers/tcpip.sys(WfpInspectReceiveControlShimV4) has problem

       

      every days 10 times occur ... and Problem place is same...

       

      minidump skydrive link
      https://skydrive.live.com/redir.aspx?cid=23cea6db63d0fd20&resid=23CEA6DB63D0FD20!125

       

      windbg
      Probably caused by : tcpip.sys ( tcpip+92708 )

       

      Followup: MachineOwner
      ---------

       

      0: kd> .symfix
      0: kd> .reload
      Loading Kernel Symbols
      ...............................................................
      ................................................................
      ..................
      Loading User Symbols
      Loading unloaded module list
      ......
      0: kd> !analyze -v
      *******************************************************************************
      *                                                                             *
      *                        Bugcheck Analysis                                    *
      *                                                                             *
      *******************************************************************************

       

      DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
      An attempt was made to access a pageable (or completely invalid) address at an
      interrupt request level (IRQL) that is too high.  This is usually
      caused by drivers using improper addresses.
      If kernel debugger is available get stack backtrace.
      Arguments:
      Arg1: 00000000, memory referenced
      Arg2: 00000002, IRQL
      Arg3: 00000000, value 0 = read operation, 1 = write operation
      Arg4: 8c4a9708, address which referenced memory

       

      Debugging Details:
      ------------------

       

      Unable to load image \SystemRoot\system32\DRIVERS\e1k6032.sys, Win32 error 0n2
      *** WARNING: Unable to verify timestamp for e1k6032.sys
      *** ERROR: Module load completed but symbols could not be loaded for e1k6032.sys

       

      READ_ADDRESS: GetPointerFromAddress: unable to read from 8316d828
      Unable to read MiSystemVaType memory at 8314dd80
      00000000

       

      CURRENT_IRQL:  2

       

      FAULTING_IP:
      tcpip!WfpInspectReceiveControlShimV4+1ea
      8c4a9708 8b00            mov     eax,dword ptr [eax]

       

      CUSTOMER_CRASH_COUNT:  1

       

      DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

       

      BUGCHECK_STR:  0xD1

       

      PROCESS_NAME:  System

       

      TRAP_FRAME:  8312d170 -- (.trap 0xffffffff8312d170)
      ErrCode = 00000000
      eax=00000000 ebx=86d87390 ecx=00005777 edx=00000001 esi=00000003 edi=00000002
      eip=8c4a9708 esp=8312d1e4 ebp=8312d460 iopl=0         nv up ei ng nz na po nc
      cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010282
      tcpip!WfpInspectReceiveControlShimV4+0x1ea:
      8c4a9708 8b00            mov     eax,dword ptr [eax]  ds:0023:00000000=????????
      Resetting default scope

       

      LAST_CONTROL_TRANSFER:  from 8c4a9708 to 83046c9b

       

      STACK_TEXT: 
      8312d170 8c4a9708 badb0d00 00000001 8312d1c4 nt!KiTrap0E+0x2cf
      8312d460 8c4aabcb 00000011 00000303 00007757 tcpip!WfpInspectReceiveControlShimV4+0x1ea
      8312d4b8 8c4a9ad2 861fa4a8 00000002 00000011 tcpip!InetInspectReceiveControlMessage+0x170
      8312d518 8c4a9a16 8645d410 86488000 86488000 tcpip!UdpReceiveControlMessages+0xa5
      8312d52c 8c4aa992 8312d53c 86b863c0 8645d410 tcpip!UdpNlClientReceiveControlMessage+0x1b
      8312d544 8c4a9308 8c50211c 86488000 86b8c02c tcpip!IppDeliverControlToProtocol+0x47
      8312d638 8c4405d6 86b8c02c 86488000 00000000 tcpip!Icmpv4pHandleError+0x284
      8312d668 8c48a140 86488000 c000023e 00000000 tcpip!Icmpv4ReceiveDatagrams+0x261
      8312d694 8c489ab6 8c501edc 8312d6e8 c000023e tcpip!IppDeliverListToProtocol+0x1e
      8312d6b4 8c487e78 8c501da0 00000001 8312d6e8 tcpip!IppProcessDeliverList+0x2a
      8312d70c 8c48995f 8c501da0 00000001 00000000 tcpip!IppReceiveHeaderBatch+0x1fb
      8312d7a0 8c497d8c 86d74bf8 00000000 00000001 tcpip!IpFlcReceivePackets+0xbe5
      8312d81c 8c4923be 86d75cf8 86b863c0 00000000 tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x746
      8312d850 83062068 86b863c0 ab03ec33 864434c8 tcpip!FlReceiveNetBufferListChainCalloutRoutine+0x11e
      8312d8b8 8c49252c 8c4922a0 8312d8e0 00000000 nt!KeExpandKernelStackAndCalloutEx+0x132
      8312d8f4 8c25418d 86d75c02 86b86300 00000000 tcpip!FlReceiveNetBufferListChain+0x7c
      8312d92c 8c2425be 86d84aa8 86b863c0 00000000 ndis!ndisMIndicateNetBufferListsToOpen+0x188
      8312d954 8c2424b2 00000000 86b863c0 8688a0e0 ndis!ndisIndicateSortedNetBufferLists+0x4a
      8312dad0 8c1edc1d 8688a0e0 00000000 00000000 ndis!ndisMDispatchReceiveNetBufferLists+0x129
      8312daec 8c242553 8688a0e0 86b863c0 00000000 ndis!ndisMTopReceiveNetBufferLists+0x2d
      8312db14 8c1edc78 8688a0e0 86b863c0 00000000 ndis!ndisMIndicateReceiveNetBufferListsInternal+0x62
      8312db3c 94e9e83d 8688a0e0 86b863c0 00000000 ndis!NdisMIndicateReceiveNetBufferLists+0x52
      WARNING: Stack unwind information not available. Following frames may be wrong.
      8312db64 94e9e90b 869eb000 86b863c0 00000002 e1k6032+0x1783d
      8312db98 94e957d4 019eb000 869ec400 00000000 e1k6032+0x1790b
      8312dbbc 94e95e5d 869eb000 00000000 8312dc40 e1k6032+0xe7d4
      8312dbf4 94e95ec4 00000005 00000004 00000000 e1k6032+0xee5d
      8312dc10 8c242892 869eb000 00000000 00000000 e1k6032+0xeec4
      8312dc50 8c1eda0f 869cfb4c 009cfa38 00000000 ndis!ndisMiniportDpc+0xda
      8312dc78 83063975 869cfb4c 869cfa38 00000000 ndis!ndisInterruptDpc+0xaf
      8312dcd4 830637d8 83130d20 8313a340 00000000 nt!KiExecuteAllDpcs+0xf9
      8312dd20 830635f8 00000000 0000000e 00000000 nt!KiRetireDpcList+0xd5
      8312dd24 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x38

       


      STACK_COMMAND:  kb

       

      FOLLOWUP_IP:
      tcpip!WfpInspectReceiveControlShimV4+1ea
      8c4a9708 8b00            mov     eax,dword ptr [eax]

       

      SYMBOL_STACK_INDEX:  1

       

      SYMBOL_NAME:  tcpip!WfpInspectReceiveControlShimV4+1ea

       

      FOLLOWUP_NAME:  MachineOwner

       

      MODULE_NAME: tcpip

       

      IMAGE_NAME:  tcpip.sys

       

      DEBUG_FLR_IMAGE_TIMESTAMP:  4db4d9fc

       

      FAILURE_BUCKET_ID:  0xD1_tcpip!WfpInspectReceiveControlShimV4+1ea

       

      BUCKET_ID:  0xD1_tcpip!WfpInspectReceiveControlShimV4+1ea

       

      Followup: MachineOwner
      ---------

       

      0: kd> lmvm tcpip
      start    end        module name
      8c417000 8c561000   tcpip      (pdb symbols)          C:\Program Files\Debugging Tools for Windows (x86)\sym\tcpip.pdb\A901DC422DD44E01984D8CE7063969792\tcpip.pdb
          Loaded symbol image file: tcpip.sys
          Mapped memory image file: C:\Program Files\Debugging Tools for Windows (x86)\sym\tcpip.sys\4DB4D9FC14a000\tcpip.sys
          Image path: \SystemRoot\System32\drivers\tcpip.sys
          Image name: tcpip.sys
          Timestamp:        Mon Apr 25 11:18:36 2011 (4DB4D9FC)
          CheckSum:         00146627
          ImageSize:        0014A000
          File version:     6.1.7601.17603
          Product version:  6.1.7601.17603
          File flags:       0 (Mask 3F)
          File OS:          40004 NT Win32
          File type:        3.6 Driver
          File date:        00000000.00000000
          Translations:     0409.04b0
          CompanyName:      Microsoft Corporation
          ProductName:      Microsoft® Windows® Operating System
          InternalName:     tcpip.sys
          OriginalFilename: tcpip.sys
          ProductVersion:   6.1.7601.17603
          FileVersion:      6.1.7601.17603 (win7sp1_gdr.110424-1504)
          FileDescription:  TCP/IP Driver
          LegalCopyright:   ⓒ Microsoft Corporation. All rights reserved.
      0: kd> !analyze v
      *******************************************************************************
      *                                                                             *
      *                        Bugcheck Analysis                                    *
      *                                                                             *
      *******************************************************************************

       

      Use !analyze -v to get detailed debugging information.

       

      BugCheck D1, {0, 2, 0, 8c4a9708}

       

      Probably caused by : tcpip.sys ( tcpip!WfpInspectReceiveControlShimV4+1ea )

       

      Followup: MachineOwner
      ---------

       

      #######################################################################################

       

      I have update latest Intel(R) Network Connections 16.3.48.0 driver, when 2011-07-20
      and Samsung Update Plus Utility says all Driver is updated.


      2011-07-24 Crash occured, problem place is differ

       

      Probably caused by : tcpip.sys ( tcpip+7764c )
      tcpip!INETADDR_SETSOCKADDR+22
      Probably caused by : tcpip.sys ( tcpip+7764c )

       

      new minidump(minidump_20110726) skydrive link
      https://skydrive.live.com/?cid=23cea6db63d0fd20&sc=documents&id=23CEA6DB63D0FD20%21127#
      .....
      0: kd> !analyze -v
      *******************************************************************************
      *                                                                             *
      *                        Bugcheck Analysis                                    *
      *                                                                             *
      *******************************************************************************

       

      DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
      An attempt was made to access a pageable (or completely invalid) address at an
      interrupt request level (IRQL) that is too high.  This is usually
      caused by drivers using improper addresses.
      If kernel debugger is available get stack backtrace.
      Arguments:
      Arg1: 00000000, memory referenced
      Arg2: 00000002, IRQL
      Arg3: 00000000, value 0 = read operation, 1 = write operation
      Arg4: 8c48c64c, address which referenced memory

       

      Debugging Details:
      ------------------

       

      *** ERROR: Module load completed but symbols could not be loaded for e1k6232.sys

       

      READ_ADDRESS:  00000000

       

      CURRENT_IRQL:  2

       

      FAULTING_IP:
      tcpip!INETADDR_SETSOCKADDR+22
      8c48c64c 8b00            mov     eax,dword ptr [eax]

       

      DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

       

      BUGCHECK_STR:  0xD1

       

      PROCESS_NAME:  System

       

      TRAP_FRAME:  831703b8 -- (.trap 0xffffffff831703b8)
      ErrCode = 00000000
      eax=00000000 ebx=867b4a40 ecx=00000000 edx=00000022 esi=864870e4 edi=83170484
      eip=8c48c64c esp=8317042c ebp=83170430 iopl=0         nv up ei ng nz ac pe cy
      cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010297
      tcpip!INETADDR_SETSOCKADDR+0x22:
      8c48c64c 8b00            mov     eax,dword ptr [eax]  ds:0023:00000000=????????
      Resetting default scope

       

      LAST_CONTROL_TRANSFER:  from 8c48c64c to 83089c9b

       

      STACK_TEXT: 
      831703b8 8c48c64c badb0d00 00000022 867b4a40 nt!KiTrap0E+0x2cf
      83170430 8c49eb74 00000002 8317048c 00000000 tcpip!INETADDR_SETSOCKADDR+0x22
      8317044c 8c4a7b21 00000002 00000000 8317048c tcpip!InetSetSockAddr+0x31
      831704ac 8c4a7a16 8645f410 86487000 86487000 tcpip!UdpReceiveControlMessages+0xf4
      831704c0 8c4a8992 831704d0 86a4c8c8 8645f410 tcpip!UdpNlClientReceiveControlMessage+0x1b
      831704d8 8c4a7308 8c50011c 86487000 86c2b0ac tcpip!IppDeliverControlToProtocol+0x47
      831705cc 8c43e5d6 86c2b0ac 86487000 00000000 tcpip!Icmpv4pHandleError+0x284
      831705fc 8c488140 86487000 c000023e 00000000 tcpip!Icmpv4ReceiveDatagrams+0x261
      83170628 8c487ab6 8c4ffedc 8317067c c000023e tcpip!IppDeliverListToProtocol+0x1e
      83170648 8c485e78 8c4ffda0 00000001 8317067c tcpip!IppProcessDeliverList+0x2a
      831706a0 8c48795f 8c4ffda0 00000001 00000000 tcpip!IppReceiveHeaderBatch+0x1fb
      83170734 8c495d8c 869263f8 00000000 00000001 tcpip!IpFlcReceivePackets+0xbe5
      831707b0 8c4903be 86a64a78 86a4c8c8 00000000 tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x746
      831707e4 830a5068 86a4c8c8 ab06007e 864855e8 tcpip!FlReceiveNetBufferListChainCalloutRoutine+0x11e
      8317084c 8c49052c 8c4902a0 83170874 00000000 nt!KeExpandKernelStackAndCalloutEx+0x132
      83170888 8c27618d 86a64a02 86a4c800 00000000 tcpip!FlReceiveNetBufferListChain+0x7c
      831708c0 8c2645be 86a79008 86a4c8c8 00000000 ndis!ndisMIndicateNetBufferListsToOpen+0x188
      831708e8 8c2644b2 00000000 86a4c8c8 867e60e0 ndis!ndisIndicateSortedNetBufferLists+0x4a
      83170a64 8c20fc1d 867e60e0 00000000 00000000 ndis!ndisMDispatchReceiveNetBufferLists+0x129
      83170a80 8c264553 867e60e0 86a4c8c8 00000000 ndis!ndisMTopReceiveNetBufferLists+0x2d
      83170aa8 8c20fc78 867e60e0 86a4c8c8 00000000 ndis!ndisMIndicateReceiveNetBufferListsInternal+0x62
      83170ad0 95686c61 867e60e0 86a4c8c8 00000000 ndis!NdisMIndicateReceiveNetBufferLists+0x52
      WARNING: Stack unwind information not available. Following frames may be wrong.
      83170af8 95686db9 869ba000 86a4c8c8 00000002 e1k6232+0x26c61
      83170b38 9567ad3b 019ba000 869bd540 83170c40 e1k6232+0x26db9
      83170bb4 9567a9b4 869ba000 00000000 83170c40 e1k6232+0x1ad3b
      83170bf4 9567af14 869ba000 00000000 00000000 e1k6232+0x1a9b4
      83170c10 8c264892 869ba000 00000000 00000000 e1k6232+0x1af14
      83170c50 8c20fa0f 869ec29c 009ec188 00000000 ndis!ndisMiniportDpc+0xda
      83170c78 830a6975 869ec29c 869ec188 00000000 ndis!ndisInterruptDpc+0xaf
      83170cd4 830a67d8 83173d20 8317d340 00000000 nt!KiExecuteAllDpcs+0xf9
      83170d20 830a65f8 00000000 0000000e 00000000 nt!KiRetireDpcList+0xd5
      83170d24 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x38

       


      STACK_COMMAND:  kb

       

      FOLLOWUP_IP:
      tcpip!INETADDR_SETSOCKADDR+22
      8c48c64c 8b00            mov     eax,dword ptr [eax]

       

      SYMBOL_STACK_INDEX:  1

       

      SYMBOL_NAME:  tcpip!INETADDR_SETSOCKADDR+22

       

      FOLLOWUP_NAME:  MachineOwner

       

      MODULE_NAME: tcpip

       

      IMAGE_NAME:  tcpip.sys

       

      DEBUG_FLR_IMAGE_TIMESTAMP:  4db4d9fc

       

      FAILURE_BUCKET_ID:  0xD1_tcpip!INETADDR_SETSOCKADDR+22

       

      BUCKET_ID:  0xD1_tcpip!INETADDR_SETSOCKADDR+22

       

      Followup: MachineOwner
      ---------