Uploaded image for project: 'Core ReactOS'
  1. Core ReactOS
  2. CORE-11229

Irp use after free in i8042prt

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Fix Version/s: 0.4.2
    • Component/s: Drivers
    • Labels:
      None

      Description

      (..\ntoskrnl\mm\ARM3\sysldr.c:176) Loading: \SystemRoot\System32\drivers\i8042prt.sys at F37F4000 with 11 pages
       
      *** Fatal System Error: 0x000000d5
                             (0xF4544E88,0x00000000,0xF37F6F25,0x00000000)
       
      Driver at fault: 
      ***  i8042prt.sys - Address F37F6F25 base at F37F4000, DateStamp 57330f91
      .
      Break instruction exception - code 80000003 (first chance)
       
      A fatal system error has occurred.
      Debugger entered on first try; Bugcheck callbacks have not been invoked.
       
      A fatal system error has occurred.
       
      Connected to Windows Server 2003 3790 x86 compatible target at (Wed May 11 14:12:53.727 2016 (UTC + 2:00)), ptr64 FALSE
      Loading Kernel Symbols
      .............................
      Loading User Symbols
      ..
      *******************************************************************************
      *                                                                             *
      *                        Bugcheck Analysis                                    *
      *                                                                             *
      *******************************************************************************
       
      Use !analyze -v to get detailed debugging information.
       
      BugCheck D5, {f4544e88, 0, f37f6f25, 0}
       
      Probably caused by : i8042prt.sys ( i8042prt!i8042KbdInternalDeviceControl+645 )
       
      Followup: MachineOwner
      ---------
       
      nt!RtlpBreakWithStatusInstruction:
      8051fdf8 cc              int     3
      kd> kp
      ChildEBP RetAddr  
      f3826324 8047d078 nt!RtlpBreakWithStatusInstruction
      f3826354 8047d983 nt!KiBugCheckDebugBreak(unsigned long StatusCode = 3)+0x38 [c:\ros\reactos-clean\reactos\ntoskrnl\ke\bug.c @ 538]
      f38266f0 8047e050 nt!KeBugCheckWithTf(unsigned long BugCheckCode = 0x50, unsigned long BugCheckParameter1 = 0xf4544e88, unsigned long BugCheckParameter2 = 0, unsigned long BugCheckParameter3 = 0xf382684c, unsigned long BugCheckParameter4 = 0, struct _KTRAP_FRAME * TrapFrame = 0xf382684c)+0x553 [c:\ros\reactos-clean\reactos\ntoskrnl\ke\bug.c @ 1102]
      f3826710 8049f55a nt!KeBugCheckEx(unsigned long BugCheckCode = 0x50, unsigned long BugCheckParameter1 = 0xf4544e88, unsigned long BugCheckParameter2 = 0, unsigned long BugCheckParameter3 = 0xf382684c, unsigned long BugCheckParameter4 = 0)+0x20 [c:\ros\reactos-clean\reactos\ntoskrnl\ke\bug.c @ 1462]
      f38267ec 804c244b nt!MmArmAccessFault(unsigned char StoreInstruction = 0x00 '', void * Address = 0xf4544e88, char Mode = 0n0 '', void * TrapInformation = 0xf382684c)+0x7ca [c:\ros\reactos-clean\reactos\ntoskrnl\mm\arm3\pagfault.c @ 1860]
      f3826808 80504153 nt!MmAccessFault(unsigned char StoreInstruction = 0x00 '', void * Address = 0xf4544e88, char Mode = 0n0 '', void * TrapInformation = 0xf382684c)+0xdb [c:\ros\reactos-clean\reactos\ntoskrnl\mm\mmfault.c @ 251]
      f3826844 8040371f nt!KiTrap0EHandler(struct _KTRAP_FRAME * TrapFrame = 0xf382684c)+0x1f3 [c:\ros\reactos-clean\reactos\ntoskrnl\ke\i386\traphdlr.c @ 1281]
      f3826844 f37f6f25 nt!KiTrap0E+0x8f
      f38268e8 f37f6145 i8042prt!i8042KbdInternalDeviceControl(struct _DEVICE_OBJECT * DeviceObject = 0xf47aee38, struct _IRP * Irp = 0xf4544e70)+0x645 [c:\ros\reactos-clean\reactos\drivers\input\i8042prt\keyboard.c @ 741]
      f382690c 804679d5 i8042prt!i8042InternalDeviceControl(struct _DEVICE_OBJECT * DeviceObject = 0xf47aee38, struct _IRP * Irp = 0xf4544e70)+0x95 [c:\ros\reactos-clean\reactos\drivers\input\i8042prt\i8042prt.c @ 445]
      f3826948 f8a2c17d nt!IofCallDriver(struct _DEVICE_OBJECT * DeviceObject = 0xf47aee38, struct _IRP * Irp = 0xf4544e70)+0xc5 [c:\ros\reactos-clean\reactos\ntoskrnl\io\iomgr\irp.c @ 1529]
      f3826958 804679d5 kbdclass!ForwardIrpAndForget(struct _DEVICE_OBJECT * DeviceObject = 0xf4586ef0, struct _IRP * Irp = 0xf4544e70)+0x5d [c:\ros\reactos-clean\reactos\drivers\input\kbdclass\misc.c @ 68]
      f3826994 f8a2b049 nt!IofCallDriver(struct _DEVICE_OBJECT * DeviceObject = 0xf4586ef0, struct _IRP * Irp = 0xf4544e70)+0xc5 [c:\ros\reactos-clean\reactos\ntoskrnl\io\iomgr\irp.c @ 1529]
      f38269c4 f8a2af27 kbdclass!ConnectPortDriver(struct _DEVICE_OBJECT * PortDO = 0xf4586ef0, struct _DEVICE_OBJECT * ClassDO = 0xf3d90ef0)+0x89 [c:\ros\reactos-clean\reactos\drivers\input\kbdclass\kbdclass.c @ 549]
      f38269e4 8046fb48 kbdclass!ClassAddDevice(struct _DRIVER_OBJECT * DriverObject = 0xf3fb8f38, struct _DEVICE_OBJECT * Pdo = 0xf40f6f10)+0x1f7 [c:\ros\reactos-clean\reactos\drivers\input\kbdclass\kbdclass.c @ 701]
      f3826a10 80456649 nt!IopInitializeDevice(struct _DEVICE_NODE * DeviceNode = 0xf4120ed0, struct _DRIVER_OBJECT * DriverObject = 0xf3fb8f38)+0x108 [c:\ros\reactos-clean\reactos\ntoskrnl\io\pnpmgr\pnpmgr.c @ 588]
      f3826a64 8052121d nt!IopAttachFilterDriversCallback(unsigned short * ValueName = 0xf459cfc8, unsigned long ValueType = 1, void * ValueData = 0xf459cfac, unsigned long ValueLength = 0x12, void * Context = 0xf4120ed0, void * EntryContext = 0x00000000)+0x399 [c:\ros\reactos-clean\reactos\ntoskrnl\io\iomgr\driver.c @ 617]
      f3826acc 80521da0 nt!RtlpCallQueryRegistryRoutine(struct _RTL_QUERY_REGISTRY_TABLE * QueryTable = 0xf3826bc8, struct _KEY_VALUE_FULL_INFORMATION * KeyValueInfo = 0xf459cf80, unsigned long * InfoSize = 0xf3826b14, void * Context = 0xf4120ed0, void * Environment = 0x00000000)+0x2dd [c:\ros\reactos-clean\reactos\sdk\lib\rtl\registry.c @ 282]
      f3826b34 80456815 nt!RtlQueryRegistryValues(unsigned long RelativeTo = 0x40000000, wchar_t * Path = 0x8000012c "--- memory read error at address 0x8000012c ---", struct _RTL_QUERY_REGISTRY_TABLE * QueryTable = 0xf3826bc8, void * Context = 0xf4120ed0, void * Environment = 0x00000000)+0x320 [c:\ros\reactos-clean\reactos\sdk\lib\rtl\registry.c @ 1185]
      f3826c10 8046e802 nt!IopAttachFilterDrivers(struct _DEVICE_NODE * DeviceNode = 0xf4120ed0, unsigned char Lower = 0x00 '')+0x195 [c:\ros\reactos-clean\reactos\ntoskrnl\io\iomgr\driver.c @ 690]
      f3826c58 80472a3e nt!PipCallDriverAddDevice(struct _DEVICE_NODE * DeviceNode = 0xf4120ed0, unsigned char LoadDriver = 0x00 '', struct _DRIVER_OBJECT * DriverObject = 0xf47f6f38)+0x2c2 [c:\ros\reactos-clean\reactos\ntoskrnl\io\pnpmgr\pnpinit.c @ 362]
      f3826c98 8046dfa4 nt!IopActionInitChildServices(struct _DEVICE_NODE * DeviceNode = 0xf4120ed0, void * Context = 0xf3c2ced0)+0x36e [c:\ros\reactos-clean\reactos\ntoskrnl\io\pnpmgr\pnpmgr.c @ 2863]
      f3826cc4 8046d1b4 nt!IopResetDevice(struct _PLUGPLAY_CONTROL_RESET_DEVICE_DATA * ResetDeviceData = 0x005cfe88)+0x1c4 [c:\ros\reactos-clean\reactos\ntoskrnl\io\pnpmgr\plugplay.c @ 767]
      f3826d00 805054ab nt!NtPlugPlayControl(_PLUGPLAY_CONTROL_CLASS PlugPlayControlClass = PlugPlayControlResetDevice (0x14), void * Buffer = 0x005cfe88, unsigned long BufferLength = 8)+0x254 [c:\ros\reactos-clean\reactos\ntoskrnl\io\pnpmgr\plugplay.c @ 1062]
      f3826d1c 80504b4f nt!KiSystemCallTrampoline(void * Handler = 0x8046cf60, void * Arguments = 0x005cfe78, unsigned long StackBytes = 0xc)+0x1b [c:\ros\reactos-clean\reactos\ntoskrnl\include\internal\i386\ke.h @ 742]
      f3826d5c 80403e43 nt!KiSystemServiceHandler(struct _KTRAP_FRAME * TrapFrame = 0xf3826d64, void * Arguments = 0x005cfe78)+0x22f [c:\ros\reactos-clean\reactos\ntoskrnl\ke\i386\traphdlr.c @ 1738]
      f3826d5c 7c92c65e nt!KiFastCallEntry+0x8c
      005cfe6c 7c9514fe ntdll!KiFastSystemCallRet
      005cfe70 004076b4 ntdll!ZwPlugPlayControl+0xc
      005cfe90 00407b7c smss!ResetDevice(wchar_t * DeviceId = 0x00220d2c "Root\*PNP0303\0000")+0x24 [c:\ros\reactos-clean\reactos\base\setup\usetup\interface\devinst.c @ 26]
      005cff28 00407dfd smss!InstallDriver(void * hInf = 0x00220840, void * hServices = 0x00000028, void * hDeviceKey = 0x0000003c, wchar_t * DeviceId = 0x00220d2c "Root\*PNP0303\0000", wchar_t * HardwareId = 0x0023bf74 "*PNP0303")+0x47c [c:\ros\reactos-clean\reactos\base\setup\usetup\interface\devinst.c @ 167]
      005cff8c 00408201 smss!InstallDevice(void * hInf = 0x00220840, void * hEnum = 0x00000024, void * hServices = 0x00000028, wchar_t * DeviceId = 0x00220d2c "Root\*PNP0303\0000")+0x21d [c:\ros\reactos-clean\reactos\base\setup\usetup\interface\devinst.c @ 255]
      005cffe4 0040825f smss!EventThread(void * lpParameter = 0x004bfe00)+0x251 [c:\ros\reactos-clean\reactos\base\setup\usetup\interface\devinst.c @ 394]
      005cfff4 00000000 smss!PnpEventThread(void * lpParameter = 0x004bfe00)+0xf [c:\ros\reactos-clean\reactos\base\setup\usetup\interface\devinst.c @ 416]

        Attachments

          Activity

            People

            • Assignee:
              ThFabba ThFabba
              Reporter:
              ThFabba ThFabba
            • Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: