Random restarts 2003 Pool_corruption

[Matt_Corran]

Hi All,

I've got two brand new 2003 HP servers, each identical builds with Citrix Presentation Server 4.5 on them. Once these servers moved from being testing to production with full load both servers, at seperate times restarted without warning or obvious error.

Have checked the memory crash dump file and get the below result:

I suspect its got to do with a printing driver conflict since printing is a common trouble with Citirx however don't have any evidence to blame printes.

Would appecitate any suggestions or resolutions people could make.
================================================
WARNING: Whitespace at start of path element

Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\local cache*

Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer
Built by: 3790.srv03_sp2_gdr.070304-2240
Kernel base = 0x80800000 PsLoadedModuleList = 0x808af9c8
Debug session time: Fri Oct 26 17:14:23.108 2007 (GMT+11)
System Uptime: 0 days 16:52:20.277
Loading Kernel Symbols
..................................................................................
Loading User Symbols
Loading unloaded module list
**********************************************
* *
* Bugcheck Analysis *
* *
**********************************************
Use !analyze -v to get detailed debugging information.
BugCheck 7E, {c0000005, 8089c4bb, f715ebd4, f715e8d0}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+1d7 )
Followup: Pool_corruption
---------

0: kd> !analyze -v
*********************************************
* Bugcheck Analysis *
* *
*********************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8089c4bb, The address that the exception occurred at
Arg3: f715ebd4, Exception Record Address
Arg4: f715e8d0, Context Record Address

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!ExDeferredFreePool+1d7
8089c4bb 8937 mov dword ptr [edi],esi

EXCEPTION_RECORD: f715ebd4 -- (.exr 0xfffffffff715ebd4)
ExceptionAddress: 8089c4bb (nt!ExDeferredFreePool+0x000001d7)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 00000000
Attempt to write to address 00000000

CONTEXT: f715e8d0 -- (.cxr 0xfffffffff715e8d0)
eax=e6d91330 ebx=00000004 ecx=000001ff edx=e6d91000 esi=00000000 edi=00000000
eip=8089c4bb esp=f715ec9c ebp=f715ecd4 iopl=0 nv up ei ng nz ac pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010297
nt!ExDeferredFreePool+0x1d7:
8089c4bb 8937 mov dword ptr [edi],esi ds:0023:00000000=????????
Resetting default scope

PROCESS_NAME: System

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

WRITE_ADDRESS: 00000000

BUGCHECK_STR: 0x7E

DEFAULT_BUCKET_ID: NULL_DEREFERENCE

LAST_CONTROL_TRANSFER: from 8089c5a0 to 8089c4bb

STACK_TEXT:
f715ecd4 8089c5a0 8a3bb0c0 00000000 e5a02828 nt!ExDeferredFreePool+0x1d7
f715ed2c 80912f28 e7b22618 00000000 808ad2c0 nt!ExFreePoolWithTag+0x57f
f715ed48 80912fe1 e5a02828 e57e3560 f715ed80 nt!CmpCleanUpKcbValueCache+0x3d
f715ed58 80827551 e5a02828 00000000 8a3873f0 nt!CmpCleanUpKcbCacheWithLock+0x14
f715ed80 8082db08 00000000 00000000 8a3873f0 nt!CmpDelayCloseWorker+0x25b
f715edac 80920833 00000000 00000000 00000000 nt!ExpWorkerThread+0xeb
f715eddc 8083fe9f 8082da4b 00000001 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

FOLLOWUP_IP:
nt!ExDeferredFreePool+1d7
8089c4bb 8937 mov dword ptr [edi],esi

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!ExDeferredFreePool+1d7
FOLLOWUP_NAME: Pool_corruption
IMAGE_NAME: Pool_Corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: Pool_Corruption
STACK_COMMAND: .cxr 0xfffffffff715e8d0 ; kb
FAILURE_BUCKET_ID: 0x7E_nt!ExDeferredFreePool+1d7
BUCKET_ID: 0x7E_nt!ExDeferredFreePool+1d7
Followup: Pool_corruption
---------

================================================

Many thanks,
Matthew

 

[PBNinja101]

I belive you have a faulty driver somewhere, most likely video/graphics driver try updating them as they are the common faults.

Simon

 

[Matt_Corran]

Graphics drivers already latest from HP.

Hi Simon,

Thanks however have alreay got latest graphics drivers from HP. Driver version dated April 2006 though.

Also...
1st sever restarted at 2pm, 2nd sever restarted at 4pm. It gives the impression who ever caused it (without them knowing it) re-connected to the 2nd sever and tried again, I'm thinking printing but have nothing to proove this.

I hope my posting of the debug was complete, ie including symbols...

Regards
Matt

 

[PBNinja101]

ok mate, Try reinstalling your printers connected onto the servers, make sure that when u reinstall. You unistall everything before you install again.

Simon