{"action":"closed","issue":{"url":"https://api.github.com/repos/openvswitch/ovs-issues/issues/83","labels_url":"https://api.github.com/repos/openvswitch/ovs-issues/issues/83/labels{/name}","comments_url":"https://api.github.com/repos/openvswitch/ovs-issues/issues/83/comments","events_url":"https://api.github.com/repos/openvswitch/ovs-issues/issues/83/events","html_url":"https://github.com/openvswitch/ovs-issues/issues/83","id":89296116,"number":83,"title":"datapath-windows: BSOD caused by duplicate IRP completion","user":{"login":"svinturis","id":8489740,"avatar_url":"https://avatars.githubusercontent.com/u/8489740?v=3","gravatar_id":"","url":"https://api.github.com/users/svinturis","html_url":"https://github.com/svinturis","followers_url":"https://api.github.com/users/svinturis/followers","following_url":"https://api.github.com/users/svinturis/following{/other_user}","gists_url":"https://api.github.com/users/svinturis/gists{/gist_id}","starred_url":"https://api.github.com/users/svinturis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/svinturis/subscriptions","organizations_url":"https://api.github.com/users/svinturis/orgs","repos_url":"https://api.github.com/users/svinturis/repos","events_url":"https://api.github.com/users/svinturis/events{/privacy}","received_events_url":"https://api.github.com/users/svinturis/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-06-18T13:37:05Z","updated_at":"2015-06-19T01:02:00Z","closed_at":"2015-06-19T01:02:00Z","body":"When trying to create a new VXLAN tunnel, the IRP that is received from the userspace is marked as pending and STATUS_PENDING should be returned. The problem is that STATUS_PENDING is not returned. Insted the IRP is wrongly completed. Because the IRP is unanswered the userspace is sending it again and then the IRP is completed again, which triggers the BSOD.\r\n\r\nThis issue was generated by a wrong merge to the master branch.\r\n\r\nHere is the stacktrace:\r\n\r\n    *******************************************************************************\r\n    *                                                                             *\r\n    *                        Bugcheck Analysis                                    *\r\n    *                                                                             *\r\n    *******************************************************************************\r\n    \r\n    PAGE_FAULT_IN_NONPAGED_AREA (50)\r\n    Invalid system memory was referenced.  This cannot be protected by try-except,\r\n    it must be protected by a Probe.  Typically the address is just plain bad or it\r\n    is pointing at freed memory.\r\n    Arguments:\r\n    Arg1: ffffd00029c5b444, memory referenced.\r\n    Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.\r\n    Arg3: fffff8000255b891, If non-zero, the instruction address which referenced the bad memory\r\n    \taddress.\r\n    Arg4: 0000000000000000, (reserved)\r\n    \r\n    Debugging Details:\r\n    ------------------\r\n    \r\n    \r\n    WRITE_ADDRESS:  ffffd00029c5b444 \r\n    \r\n    FAULTING_IP: \r\n    OVSExt!_NlBufCopyAtTailUnsafe+31 [c:\\1.data\\cloudbase\\work\\git\\ovs\\datapath-windows\\ovsext\\netlink\\netlinkbuf.c @ 318]\r\n    fffff800`0255b891 f3a4            rep movs byte ptr [rdi],byte ptr [rsi]\r\n    \r\n    MM_INTERNAL_CODE:  0\r\n    \r\n    IMAGE_NAME:  OVSExt.sys\r\n    \r\n    DEBUG_FLR_IMAGE_TIMESTAMP:  5582c488\r\n    \r\n    MODULE_NAME: OVSExt\r\n    \r\n    FAULTING_MODULE: fffff80002546000 OVSExt\r\n    \r\n    DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT\r\n    \r\n    BUGCHECK_STR:  AV\r\n    \r\n    PROCESS_NAME:  System\r\n    \r\n    CURRENT_IRQL:  0\r\n    \r\n    ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre\r\n    \r\n    TRAP_FRAME:  ffffd000295e0660 -- (.trap 0xffffd000295e0660)\r\n    NOTE: The trap frame does not contain all registers.\r\n    Some register values may be zeroed or incorrect.\r\n    rax=0000000000000018 rbx=0000000000000000 rcx=0000000000000018\r\n    rdx=ffffd000295e08c0 rsi=0000000000000000 rdi=0000000000000000\r\n    rip=fffff8000255b891 rsp=ffffd000295e07f0 rbp=0000000000000080\r\n     r8=0000000000000018  r9=0000000000000068 r10=ffffe00000797010\r\n    r11=ffffc00003a50000 r12=0000000000000000 r13=0000000000000000\r\n    r14=0000000000000000 r15=0000000000000000\r\n    iopl=0         nv up ei ng nz na po nc\r\n    OVSExt!_NlBufCopyAtTailUnsafe+0x31:\r\n    fffff800`0255b891 f3a4            rep movs byte ptr [rdi],byte ptr [rsi]\r\n    Resetting default scope\r\n    \r\n    LAST_CONTROL_TRANSFER:  from fffff800ed64b7c6 to fffff800ed5c8c90\r\n    \r\n    STACK_TEXT:  \r\n    ffffd000`295dfcc8 fffff800`ed64b7c6 : 00000000`00000000 00000000`00000000 ffffd000`295dfe30 fffff800`ed570654 : nt!DbgBreakPointWithStatus\r\n    ffffd000`295dfcd0 fffff800`ed64b0d7 : 00000000`00000003 ffffd000`295dfe30 fffff800`ed5d00c0 ffffd000`295e0380 : nt!KiBugCheckDebugBreak+0x12\r\n    ffffd000`295dfd30 fffff800`ed5c21a4 : 00009e66`00000000 fffff800`0001b1ba 00000002`00000bec ffffd000`295e0690 : nt!KeBugCheck2+0x8ab\r\n    ffffd000`295e0440 fffff800`ed5db462 : 00000000`00000050 ffffd000`29c5b444 00000000`00000001 ffffd000`295e0660 : nt!KeBugCheckEx+0x104\r\n    ffffd000`295e0480 fffff800`ed4daffd : 00000000`00000001 ffffe000`03fd5400 ffffd000`295e0660 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x8ed2\r\n    ffffd000`295e0520 fffff800`ed5cc32f : 00000000`00000001 ffffe000`03fd5400 00000000`00000000 ffffd000`295e0660 : nt!MmAccessFault+0x7ed\r\n    ffffd000`295e0660 fffff800`0255b891 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffe000`0116b0af : nt!KiPageFault+0x12f\r\n    ffffd000`295e07f0 fffff800`0255b692 : ffffd000`295e0938 ffffd000`295e08c0 ffffd000`00000018 ffffd000`295e0838 : OVSExt!_NlBufCopyAtTailUnsafe+0x31 [c:\\1.data\\cloudbase\\work\\git\\ovs\\datapath-windows\\ovsext\\netlink\\netlinkbuf.c @ 318]\r\n    ffffd000`295e0820 fffff800`0255b06e : ffffd000`295e0938 ffffd000`295e08c0 ffffd000`00000018 00000000`00000180 : OVSExt!NlBufCopyAtTail+0xd2 [c:\\1.data\\cloudbase\\work\\git\\ovs\\datapath-windows\\ovsext\\netlink\\netlinkbuf.c @ 130]\r\n    ffffd000`295e0860 fffff800`0255aef2 : ffffd000`295e0938 ffffd000`295e08c0 00000000`00000018 00000000`00000000 : OVSExt!NlMsgPutTail+0x3e [c:\\1.data\\cloudbase\\work\\git\\ovs\\datapath-windows\\ovsext\\netlink\\netlink.c @ 182]\r\n    ffffd000`295e0890 fffff800`0256b538 : ffffd000`295e0938 ffffd000`29c50000 ffffd000`00010002 ffffd000`00000068 : OVSExt!NlFillOvsMsg+0x102 [c:\\1.data\\cloudbase\\work\\git\\ovs\\datapath-windows\\ovsext\\netlink\\netlink.c @ 69]\r\n    ffffd000`295e08f0 fffff800`0256ed87 : ffffe000`0116b010 ffffe000`02c26e00 ffffd000`29c5b444 fffff800`00010000 : OVSExt!OvsCreateMsgFromVport+0xa8 [c:\\1.data\\cloudbase\\work\\git\\ovs\\datapath-windows\\ovsext\\vport.c @ 1772]\r\n    ffffd000`295e09c0 fffff800`02564e4a : ffffe000`0378bdd0 00000000`00000000 ffffd000`295e0ae0 00000000`00000000 : OVSExt!OvsTunnelVportPendingInit+0x457 [c:\\1.data\\cloudbase\\work\\git\\ovs\\datapath-windows\\ovsext\\vport.c @ 2643]\r\n    ffffd000`295e0ac0 fffff800`025654d9 : ffffe000`01d23260 fffff800`0256e930 ffffe000`0378bdd0 ffffffff`00000000 : OVSExt!OvsTunnelFilterCompleteRequest+0x3a [c:\\1.data\\cloudbase\\work\\git\\ovs\\datapath-windows\\ovsext\\tunnelfilter.c @ 1034]\r\n    ffffd000`295e0b00 fffff800`02565971 : fffff800`0257aac0 ffffd000`295e0bd8 ffffe000`03fd5400 ffffffff`00000000 : OVSExt!OvsTunnelFilterRequestListProcess+0x2c9 [c:\\1.data\\cloudbase\\work\\git\\ovs\\datapath-windows\\ovsext\\tunnelfilter.c @ 1126]\r\n    ffffd000`295e0b80 fffff800`ed559664 : fffff800`0257aac0 ffffffff`ffffffff ffffffff`ffffffff ffffffff`ffffffff : OVSExt!OvsTunnelFilterThreadProc+0x151 [c:\\1.data\\cloudbase\\work\\git\\ovs\\datapath-windows\\ovsext\\tunnelfilter.c @ 1182]\r\n    ffffd000`295e0c00 fffff800`ed5c86c6 : ffffd000`20b40180 ffffe000`03fd5400 ffffe000`04043080 ffffffff`ffffffff : nt!PspSystemThreadStartup+0x58\r\n    ffffd000`295e0c60 00000000`00000000 : ffffd000`295e1000 ffffd000`295db000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16\r\n    \r\n    \r\n    STACK_COMMAND:  kb\r\n    \r\n    FOLLOWUP_IP: \r\n    OVSExt!_NlBufCopyAtTailUnsafe+31 [c:\\1.data\\cloudbase\\work\\git\\ovs\\datapath-windows\\ovsext\\netlink\\netlinkbuf.c @ 318]\r\n    fffff800`0255b891 f3a4            rep movs byte ptr [rdi],byte ptr [rsi]\r\n    \r\n    FAULTING_SOURCE_LINE:  c:\\1.data\\cloudbase\\work\\git\\ovs\\datapath-windows\\ovsext\\netlink\\netlinkbuf.c\r\n    \r\n    FAULTING_SOURCE_FILE:  c:\\1.data\\cloudbase\\work\\git\\ovs\\datapath-windows\\ovsext\\netlink\\netlinkbuf.c\r\n    \r\n    FAULTING_SOURCE_LINE_NUMBER:  318\r\n    \r\n    FAULTING_SOURCE_CODE:  \r\n       314: static __inline VOID\r\n       315: _NlBufCopyAtTailUnsafe(PNL_BUFFER nlBuf, PCHAR data, UINT32 len)\r\n       316: {\r\n       317:     if (data) {\r\n    >  318:         RtlCopyMemory(nlBuf->tail, data, len);\r\n       319:     } else {\r\n       320:         RtlZeroMemory(nlBuf->tail, len);\r\n       321:     }\r\n       322: \r\n       323:     nlBuf->tail += len;\r\n    \r\n    \r\n    SYMBOL_STACK_INDEX:  7\r\n    \r\n    SYMBOL_NAME:  OVSExt!_NlBufCopyAtTailUnsafe+31\r\n    \r\n    FOLLOWUP_NAME:  MachineOwner\r\n    \r\n    BUCKET_ID_FUNC_OFFSET:  31\r\n    \r\n    FAILURE_BUCKET_ID:  AV_OVSExt!_NlBufCopyAtTailUnsafe\r\n    \r\n    BUCKET_ID:  AV_OVSExt!_NlBufCopyAtTailUnsafe\r\n    \r\n    ANALYSIS_SOURCE:  KM\r\n    \r\n    FAILURE_ID_HASH_STRING:  km:av_ovsext!_nlbufcopyattailunsafe\r\n    \r\n    FAILURE_ID_HASH:  {a020d6ee-21e4-8563-8e69-b5aa16c05c9e}\r\n    \r\n    Followup: MachineOwner\r\n    ---------\r\n    "}}