Question
136 views

MULTIPLE_IRP_COMPLETE_REQUEST Windows 8.1

DannyBurger asked on
I updated to Windows 8.1 a few weeks ago and beginning this morning my laptop has been showing me a BSOD with the message MULTIPLE_IRP_COMPLETE_REQUEST before restarting. The only solutions I have been able to find involve a bug related to LogMeIn Hamachi, a program that is not and has never been installed on my computer. Please help.
2 people had this question

Abuse history


The answered status icon Answer
Patrick Barker replied on

It did, thanks very much! This is actually a very interesting issue we have here as it appears to be widespread, so your post is actually the first analysis I am doing of it. I will blog about it later.


The attached DMP file is of the MULTIPLE_IRP_COMPLETE_REQUESTS (44) bug check.

This indicates that a driver has tried to request an IRP be completed that is already complete.

3: kd> kv
Child-SP          RetAddr           : Args to Child                                                           : Call Site
ffffd000`207bb8e8 fffff803`43c08b4b : 00000000`00000044 ffffe000`01587ac0 00000000`00000f8a 00000000`00000000 : nt!KeBugCheckEx
ffffd000`207bb8f0 fffff800`02cd4389 : ffffffff`ffffffff ffffe000`02499000 ffffe000`0249a0e0 ffffe000`70627375 : nt! ?? ::FNODOBFM::`string'+0x2a9ab
ffffd000`207bba00 fffff800`02cd391d : fffff780`00000302 ffffe000`04f7401c ffffe000`0249a0e0 ffffe000`024991a0 : USBPORT!USBPORT_Core_iCompleteDoneTransfer+0x979
ffffd000`207bbba0 fffff800`02cd33b8 : ffffe000`04f74154 ffffe000`0249a178 ffffe000`024991a0 00001db8`00001e00 : USBPORT!USBPORT_Core_iIrpCsqCompleteDoneTransfer+0x21d
ffffd000`207bbc00 fffff800`02cd312e : 00000000`00001000 ffffe000`02499050 ffffd000`207bbd02 000007fc`ebee715f : USBPORT!USBPORT_Core_UsbIocDpc_Worker+0x238
ffffd000`207bbc70 fffff803`43adad10 : ffffd000`207bbdf0 fffff803`43a80000 ffffd000`207bbeb0 00000000`00000f44 : USBPORT!USBPORT_Xdpc_Worker_IocDpc+0x1fe
ffffd000`207bbcf0 fffff803`43ada9f0 : 00000000`00000000 ffffd000`20788180 00000000`00000000 ffffd000`2557cb00 : nt!KiExecuteAllDpcs+0x1b0
ffffd000`207bbe40 fffff803`43bd0dd5 : 00000000`00000000 ffffd000`20788180 ffffd000`25051b00 ffffd000`20ae1500 : nt!KiRetireDpcList+0xd0
ffffd000`207bbfb0 fffff803`43bd0bd9 : 00000018`c75da040 fffff803`43bd0baf 00000000`00000000 00000018`c75da388 : nt!KxRetireDpcList+0x5 (TrapFrame @ ffffd000`207bbe70)
ffffd000`25051a40 fffff803`43bd2e45 : 00000018`c75da040 fffff803`43bcead3 00000000`00000001 00000000`00000000 : nt!KiDispatchInterruptContinue
ffffd000`25051a70 fffff803`43bcead3 : 00000000`00000001 00000000`00000000 ffffe000`01523210 ffffe000`01523210 : nt!KiDpcInterruptBypass+0x25
ffffd000`25051a80 00000018`c76f0399 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiChainedDispatch+0x173 (TrapFrame @ ffffd000`25051a80)
00000018`c5cccfc0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00000018`c76f0399


^^ Pretty interesting call stack! As we move up, we can see that it calls to retire the DPC list, and then it makes a call to execute all DPCs. We then call into the USBPORT driver and have a few worker routines going on, which inevitably call into the bug check. I have seen many threads like this, so I assume it's a bug with perhaps a new Windows Update KB, or an issue when updating from 8.1 > latest Service Pack (update).


-- FAILURE_BUCKET_ID:  0x44_IMAGE_ACPI


We can see that by default, WinDbg notes that the cause of the crash was the Advanced Configuration and Power Interface (ACPI). Essentially, in its simplest terms, it brings power management under the control of the operating system, as opposed to the previous BIOS-central system which relied on platform-specific firmware to determine power management and configuration policy.

-- ADDITIONAL_DEBUG_TEXT:  USB\VID_0CF3&PID_3004

^^ WinDbg provides us with a Vendor/Product ID, which we can sift through a database to find out which device this specifically is. 0CF3 regarding a Vendor ID falls under Atheros Communications, Inc. Specifically, regarding its Product ID, 3004 is not listed, but 3000, 30002, and 3005 are all related to Bluetooth (from Atheros).

Interestingly enough, in the crash dump itself, this is mentioned -- OVERLAPPED_MODULE: Address regions for 'bthport' and 'bthport.sys' overlap

bthport.sys is the Bluetooth Bus driver.

Right, so the summary so far is that we appear to possibly be having a Bluetooth related driver (appearing to be from Atheros) causing issues. Let's look forward more to confirm or deny this:

------------------------

3: kd> !irp ffffe00001587ac0 1
Irp is active with 8 stacks 7 is current (= 0xffffe00001587d40)
 No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  
Flags = 00000000
ThreadListEntry.Flink = ffffe00001587ae0
ThreadListEntry.Blink = ffffe00001587ae0
IoStatus.Status = 00000000
IoStatus.Information = 00000000
RequestorMode = 00000000
Cancel = 00
CancelIrql = 0
ApcEnvironment = 00
UserIosb = 00000000
UserEvent = 00000000
Overlay.AsynchronousParameters.UserApcRoutine = 00000000
Overlay.AsynchronousParameters.UserApcContext = 00000000
Overlay.AllocationSize = 00000000 - 00000000
CancelRoutine = 00000000   
UserBuffer = 00000000
&Tail.Overlay.DeviceQueueEntry = ffffe00001587b38
Tail.Overlay.Thread = 00000000
Tail.Overlay.AuxiliaryBuffer = 00000000
Tail.Overlay.ListEntry.Flink = 00000000
Tail.Overlay.ListEntry.Blink = 00000000
Tail.Overlay.CurrentStackLocation = ffffe00001587d40
Tail.Overlay.OriginalFileObject = 00000000
Tail.Apc = 00000000
Tail.CompletionKey = 00000000
     cmd  flg cl Device   File     Completion-Context
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
*** ERROR: Module load completed but symbols could not be loaded for btfilter.sys
>[  f, 0]   0 e1 ffffe000033f1050 00000000 fffff8000415d460-ffffe00001660180 Success Error Cancel pending
           \Driver\usbohci    btfilter
            Args: ffffe00003831910 00000000 00220003 00000000
 [  f, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: ffffe00003831910 00000000 00220003 00000000

^^ Excellent, so from the above we can see that btfilter.sys is mentioned. btfilter.sys is the Atheros Bluetooth driver.

3: kd> !devstack ffffe000033f1050
  !DevObj   !DrvObj            !DevExt   ObjectName
  ffffe000031b4b80 *** ERROR: Module load completed but symbols could not be loaded for usbfilter.sys
 \Driver\usbfilter  ffffe000031b4cd0  
  ffffe000026ab050  \Driver\usbhub     ffffe000026ab1a0  0000003a
  ffffe000031b5bf0  \Driver\usbfilter  ffffe000031b5d40  
  ffffe000031cfe50  \Driver\ACPI       ffffe00000f94b90  
> ffffe000033f1050  \Driver\usbohci    ffffe000033f11a0  USBPDO-2
!DevNode ffffe0000336a130 :
  DeviceInst is "USB\ROOT_HUB\4&301d4ea9&0"
  ServiceName is "usbhub"

^^ Here's where we can see mention of ACPI, and other USB related drivers (even the root hub of USB).

---------------------

Overall, it appears that the Atheros Bluetooth driver is not completing (or in an IRP completion state), but rather remaining PENDING, etc.

I will need to debug this further on my own and with other cases, but this seems pretty solid right now. With this said:

1. Ensure all of your USB drivers are up to date via the manufacturers website (so in your case as you appear to have a Samsung system, you'd go here - http://www.samsung.com/us/support/downloads).

2. Ensure all of your Bluetooth drivers (Atheros specifically) are up to date as well via Samsung's website.

3. If you are still crashing after the above, please uninstall PACE Anti-Piracy InterLok software ASAP for troubleshooting purposes.

Regards,

Patrick

Debugger/Reverse Engineer.
Be the first person to mark this helpful

Abuse history


progress