Windows Crash because Udecx.sys has NULL pointer using USB dynamic endpoint

  • Thread starter Thread starter brucepei
  • Start date Start date
B

brucepei

Guest
Hi,


I'm using UDECX to emulate a Virtual USB audio device. It requires to use Dynamic type endpoint creation along with UDE class extension.

Then I get a crash and Udecx.sys has a NULL pointer issue. Anyone could help?


System Uptime: 0 days 0:03:09.053

Break instruction exception - code 80000003 (first chance)

*******************************************************************************

* *

* You are seeing this message because you pressed either *

* CTRL+C (if you run console kernel debugger) or, *

* CTRL+BREAK (if you run GUI kernel debugger), *

* on your debugger machine's keyboard. *

* *

* THIS IS NOT A BUG OR A SYSTEM CRASH *

* *

* If you did not intend to break into the debugger, press the "g" key, then *

* press the "Enter" key now. This message might immediately reappear. If it *

* does, press "g" and "Enter" again. *

* *

*******************************************************************************

nt!DbgBreakPointWithStatus:

fffff801`4a681370 cc int 3

kd> g

KDTARGET: Refreshing KD connection



*** Fatal System Error: 0x0000010d

(0x0000000000000004,0x0000000000000000,0xFFFFF8014DB68139,0xFFFF998188651530)



Break instruction exception - code 80000003 (first chance)



A fatal system error has occurred.

Debugger entered on first try; Bugcheck callbacks have not been invoked.



A fatal system error has occurred.



For analysis of this file, run !analyze -v

nt!DbgBreakPointWithStatus:

fffff801`4a681370 cc int 3

kd> !analyze -v

Connected to Windows 10 18362 x64 target at (Sun Mar 29 13:02:41.250 2020 (UTC + 8:00)), ptr64 TRUE

Loading Kernel Symbols

...............................................................

................................................................

...............



Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.

Run !sym noisy before .reload to track down problems loading symbols.



....................................

Loading User Symbols



Loading unloaded module list

......

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************



WDF_VIOLATION (10d)

The Kernel-Mode Driver Framework was notified that Windows detected an error

in a framework-based driver. In general, the dump file will yield additional

information about the driver that caused this bug check.

Arguments:

Arg1: 0000000000000004, A NULL parameter was passed to a function that required a non-

NULL value. Use the "ln" debugger command with the value of

Parameter 3 as its argument to determine the function which

requires a non-NULL parameter.

Arg2: 0000000000000000, Reserved.

Arg3: fffff8014db68139, The caller's address.

Arg4: ffff998188651530, Reserved.



Debugging Details:

------------------





KEY_VALUES_STRING: 1





PROCESSES_ANALYSIS: 1



SERVICE_ANALYSIS: 1



STACKHASH_ANALYSIS: 1



TIMELINE_ANALYSIS: 1





DUMP_CLASS: 1



DUMP_QUALIFIER: 0



BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202



DUMP_TYPE: 0



BUGCHECK_P1: 4



BUGCHECK_P2: 0



BUGCHECK_P3: fffff8014db68139



BUGCHECK_P4: ffff998188651530



BUGCHECK_STR: 0x10D_4



CPU_COUNT: 1



CPU_MHZ: a98



CPU_VENDOR: GenuineIntel



CPU_FAMILY: 6



CPU_MODEL: 5e



CPU_STEPPING: 3



CPU_MICROCODE: 6,5e,3,0 (F,M,S,R) SIG: 0'00000000 (cache) 0'00000000 (init)



DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT



PROCESS_NAME: System



CURRENT_IRQL: 0



ANALYSIS_SESSION_HOST: PCSZPEIB01



ANALYSIS_SESSION_TIME: 03-29-2020 13:02:48.0320



ANALYSIS_VERSION: 10.0.18362.1 amd64fre



LAST_CONTROL_TRANSFER: from fffff8014a761522 to fffff8014a681370



STACK_TEXT:

fffffb03`889a8b98 fffff801`4a761522 : 00000000`00000004 00000000`00000003 fffffb03`889a8d00 fffff801`4a5d5b90 : nt!DbgBreakPointWithStatus

fffffb03`889a8ba0 fffff801`4a760c12 : 00000000`00000003 fffffb03`889a8d00 fffff801`4a68db60 00000000`0000010d : nt!KiBugCheckDebugBreak+0x12

fffffb03`889a8c00 fffff801`4a6795e7 : 00000000`0000000a 00000000`00000002 fffff801`4db68139 fffff801`4b740e12 : nt!KeBugCheck2+0x952

fffffb03`889a9300 fffff801`4b78b823 : 00000000`0000010d 00000000`00000004 00000000`00000000 fffff801`4db68139 : nt!KeBugCheckEx+0x107

fffffb03`889a9340 fffff801`4b78b8b4 : fffff801`4db68139 fffffb03`889a9510 ffff9981`8902cbc0 00000000`00000000 : Wdf01000!FxVerifierBugCheckWorker+0x1f [minkernel\wdf\framework\shared\object\fxverifierbugcheck.cpp @ 68]

fffffb03`889a9380 fffff801`4b74bb1f : 0000667e`77802458 00000000`00000019 fffff801`4db494c8 00000000`00000060 : Wdf01000!FxVerifierNullBugCheck+0x44 [minkernel\wdf\framework\shared\object\fxverifierbugcheck.cpp @ 102]

fffffb03`889a93c0 fffff801`4db68139 : 0000667e`77802458 ffff9981`8902cbc0 00000000`00000000 fffff801`00000000 : Wdf01000!imp_WdfObjectGetTypedContextWorker+0x1a54f [minkernel\wdf\framework\shared\object\handleapi.cpp @ 608]

fffffb03`889a9410 fffff801`4db67a93 : 0000667e`77966fd8 0000667e`77802458 00000000`00000040 fffffb03`889a9630 : udecx!UsbDevice_UcxEndpointAdd+0x4b1

fffffb03`889a95c0 fffff801`4db8d5ab : ffff9981`891af9e0 00000001`00000024 00000001`00000000 00000000`00000000 : udecx!EvtUcxUsbDeviceDefaultEndpointAdd+0x73

fffffb03`889a9600 fffff801`4dbf3373 : ffff9981`89827370 00000000`00000fa0 ffff9981`89827568 ffff9981`89827370 : ucx01000!DefaultEndpoint_Create+0xbb

fffffb03`889a96f0 fffff801`4dbecff0 : 00000000`00000fed fffffb03`889a97a8 00000000`00000004 fffffb03`889a97b0 : UsbHub3!HUBUCX_CreateDefaultEndpointInUCX+0x33

fffffb03`889a9730 fffff801`4dbd9db3 : 00000000`00000fed fffff801`4dbd9c4b 00000000`000010f6 fffff801`4dbd95cc : UsbHub3!HUBDSM_CreatingUCXDefaultEndpoint+0x10

fffffb03`889a9760 fffff801`4dbdb00a : ffff9981`00000fa0 00000000`00000fed fffffb03`00000fa0 fffff801`4dc33b50 : UsbHub3!HUBSM_ExecuteEntryFunctionsAndPushPopStateMachinesForCurrentState+0x4f

fffffb03`889a9800 fffff801`4dbda9a5 : ffff9981`00000fa0 00000000`00000f00 00000000`00000fd6 00000000`00000000 : UsbHub3!HUBSM_RunStateMachine+0x632

fffffb03`889a9890 fffff801`4dbd9640 : ffff9981`812820d0 00000000`00000000 00000000`00000bb8 fffffb03`889a9978 : UsbHub3!HUBSM_AddEvent+0x421

fffffb03`889a98e0 fffff801`4dbe01e6 : 00000000`00000004 fffffb03`889a9988 00000000`00000004 fffffb03`889a9990 : UsbHub3!HUBSM_AddDsmEvent+0x10

fffffb03`889a9910 fffff801`4dbd9db3 : 00000000`00000bc5 fffff801`4dbd9c4b 00000000`00000c22 00000000`00000001 : UsbHub3!HUBPSM20_ReleasingInterruptReferenceOnSuccessfulReset+0x26

fffffb03`889a9940 fffff801`4dbdb00a : ffff9981`00000bb8 00000000`00000bc5 fffffb03`00000bb8 fffff801`4dc332d0 : UsbHub3!HUBSM_ExecuteEntryFunctionsAndPushPopStateMachinesForCurrentState+0x4f

fffffb03`889a99e0 fffff801`4dbda558 : ffff9981`00000bb8 00000000`00000c00 00000000`00000c01 fffff801`4dc33201 : UsbHub3!HUBSM_RunStateMachine+0x632

fffffb03`889a9a70 fffff801`4db93c57 : ffff9981`812821e0 ffff9981`880bc900 ffff9981`880bc9d0 ffff9981`8124daf0 : UsbHub3!HUBSM_EvtSmWorkItem+0x48

fffffb03`889a9aa0 fffff801`4db93d39 : ffff9981`8902c220 ffff9981`880bc9d0 00000000`00000000 fffff801`4db93d30 : ucx01000!Controller_ForwardProgressWorkItemCallback+0x5b

fffffb03`889a9ad0 fffff801`4a51fba2 : 00000000`00000000 ffff9981`81c06040 ffff9981`00000000 fffff804`cac68480 : ucx01000!Controller_ForwardProgressWorkItemWdmCallback+0x9

fffffb03`889a9b00 fffff801`4a575095 : ffff9981`8124daf0 ffff9981`818c2480 fffff801`4a51fb10 00000000`0000000c : nt!IopProcessWorkItem+0x92

fffffb03`889a9b70 fffff801`4a5e27a5 : ffff9981`818c2480 00000000`00000080 ffff9981`8127f300 0000240d`b19b3dfe : nt!ExpWorkerThread+0x105

fffffb03`889a9c10 fffff801`4a680b2a : fffff801`496b6180 ffff9981`818c2480 fffff801`4a5e2750 00000000`00000000 : nt!PspSystemThreadStartup+0x55

fffffb03`889a9c60 00000000`00000000 : fffffb03`889aa000 fffffb03`889a4000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x2a





THREAD_SHA1_HASH_MOD_FUNC: b0a83e3e0b5825cf249e55a1c6edd750f3e11ab5



THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 5466d4c73e9ebb8c7b8023f6c1ae85ac583e0b1b



THREAD_SHA1_HASH_MOD: dec394c79534cd7606f1ae6ce766d868cd3a360a



FOLLOWUP_IP:

udecx!UsbDevice_UcxEndpointAdd+4b1

fffff801`4db68139 4c8bf8 mov r15,rax



FAULT_INSTR_CODE: 45f88b4c



SYMBOL_STACK_INDEX: 7



SYMBOL_NAME: udecx!UsbDevice_UcxEndpointAdd+4b1



FOLLOWUP_NAME: MachineOwner



MODULE_NAME: udecx



IMAGE_NAME: udecx.sys



DEBUG_FLR_IMAGE_TIMESTAMP: 3ea0b3d7



STACK_COMMAND: .thread ; .cxr ; kb



BUCKET_ID_FUNC_OFFSET: 4b1



FAILURE_BUCKET_ID: 0x10D_4_udecx!UsbDevice_UcxEndpointAdd



BUCKET_ID: 0x10D_4_udecx!UsbDevice_UcxEndpointAdd



PRIMARY_PROBLEM_CLASS: 0x10D_4_udecx!UsbDevice_UcxEndpointAdd



TARGET_TIME: 2020-03-29T05:02:30.000Z



OSBUILD: 18362



OSSERVICEPACK: 0



SERVICEPACK_NUMBER: 0



OS_REVISION: 0



SUITE_MASK: 272



PRODUCT_TYPE: 1



OSPLATFORM_TYPE: x64



OSNAME: Windows 10



OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS



OS_LOCALE:



USER_LCID: 0



OSBUILD_TIMESTAMP: 1972-08-22 08:24:00



BUILDDATESTAMP_STR: 190318-1202



BUILDLAB_STR: 19h1_release



BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202



ANALYSIS_SESSION_ELAPSED_TIME: 5d7d4



ANALYSIS_SOURCE: KM



FAILURE_ID_HASH_STRING: km:0x10d_4_udecx!usbdevice_ucxendpointadd



FAILURE_ID_HASH: {e32a0be1-eb20-2e03-cbb6-af35a775a8ce}



Followup: MachineOwner

---------



kd> ln fffff8014db68139

Browse module

Set bu breakpoint



(fffff801`4db67c88) udecx!UsbDevice_UcxEndpointAdd+0x4b1 | (fffff801`4db683b0) udecx!UsbDevice_UdeUsbDeviceCleanup

kd> kp

Continue reading...
 
Back
Top