Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

Bugcheck in MPIO.sys when passing IOCTL_MPIO_PASS_THROUGH_PATH on Windows Server 2012 and 64-bit Windows 8


View products that this article applies to.

Symptoms

Consider the following scenario:

You have a Windows Server 2012 or a 64-bit Windows 8 system. When a 32-bit application calls DeviceIoControl() and passes the control code IOCTL_MPIO_PASS_THROUGH_PATH, a bugcheck error can occur.

The bugcheck generated in this scenario is "DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION (d6). N bytes of memory was allocated and more than N bytes are being referenced."


↑ Back to the top


Cause

A buffer overflow can occur in kernel mode leading to a system crash when a 32-bit application running on 64-bit Windows 8 or Windows Server 2012 passes the control code IOCTL_MPIO_PASS_THROUGH_PATH to DeviceIoControl() and the input or output buffer sizes exceeds the size of the MPIO_PASS_THROUGH_PATH data structure.

↑ Back to the top


Resolution

Workaround #1 - Compile the application as a 64-bit application

Workaround #2 - Correct the input and output buffer sizes to equal the size of the MPIO_PASS_THROUGH_PATH data sctructure passed to the API

↑ Back to the top


More Information

Below is the crashing stack in kernel mode:

1: kd> k
Child-SP          RetAddr           Call Site
fffff880`07763d18 fffff801`96058d6d nt!KeBugCheckEx
fffff880`07763d20 fffff801`95f25d6f nt!MiSystemFault+0x114d0d
fffff880`07763dc0 fffff801`95ee87ee nt!MmAccessFault+0x54f
fffff880`07763f00 fffff880`017e1ef4 nt!KiPageFault+0x16e
fffff880`07764098 fffff880`017e1330 mpio!memcpy+0xb4
fffff880`077640a0 fffff880`017cbc4e mpio!MPLIBSendDeviceIoControlSynchronous+0x1b8
fffff880`07764110 fffff880`017ca3cb mpio!MPIOPdoHandleRequest+0xfe6
fffff880`077643a0 fffff880`017c9f5c mpio!MPIOPdoCommonDeviceControl+0x43f
fffff880`07764400 fffff801`964add76 mpio!MPIOPdoDispatch+0x1a4
(Inline Function) --------`-------- nt!IopfCallDriver+0x63
fffff880`07764450 fffff880`0202cc68 nt!IovCallDriver+0x3e6
fffff880`077644a0 fffff880`0200d971 CLASSPNP!ClassDeviceControl+0x298
fffff880`07764650 fffff880`0202d6cd disk!DiskDeviceControl+0x121
fffff880`077646d0 fffff801`964add76 CLASSPNP!ClassDeviceControlDispatch+0x2d
(Inline Function) --------`-------- nt!IopfCallDriver+0x63
fffff880`07764700 fffff880`01618a13 nt!IovCallDriver+0x3e6
fffff880`07764750 fffff801`964add76 partmgr!PmFilterDeviceControl+0xc3
(Inline Function) --------`-------- nt!IopfCallDriver+0x63
fffff880`077647a0 fffff801`963294cf nt!IovCallDriver+0x3e6
fffff880`077647f0 fffff801`963290e9 nt!RawReadWriteDeviceControl+0xa3
fffff880`07764830 fffff801`964add76 nt!RawDispatch+0x89
(Inline Function) --------`-------- nt!IopfCallDriver+0x63
fffff880`07764890 fffff880`00b790ee nt!IovCallDriver+0x3e6
fffff880`077648e0 fffff801`964add76 fltmgr!FltpDispatch+0xee
(Inline Function) --------`-------- nt!IopfCallDriver+0x63
fffff880`07764940 fffff801`962cf2ff nt!IovCallDriver+0x3e6
(Inline Function) --------`-------- nt!IoCallDriverWithTracing+0x20
(Inline Function) --------`-------- nt!IopCallDriverReference+0xa5
(Inline Function) --------`-------- nt!IopSynchronousServiceTail+0x142
fffff880`07764990 fffff801`962cfc86 nt!IopXxxControlFile+0x7dd
fffff880`07764b20 fffff801`95ee9d53 nt!NtDeviceIoControlFile+0x56
fffff880`07764b90 00000000`76f42ad2 nt!KiSystemServiceCopyEnd+0x13
00000000`0008ee28 00000000`76f42717 wow64cpu!CpupSyscallStub+0x2
00000000`0008ee30 00000000`76f5c4f6 wow64cpu!DeviceIoctlFileFault+0x31
00000000`0008eee0 00000000`76f5b8f5 wow64!RunCpuSimulation+0xa
00000000`0008ef30 000007fa`93bca107 wow64!Wow64LdrpInitialize+0x435
00000000`0008f470 000007fa`93bb216a ntdll!LdrpInitializeProcess+0x1521
00000000`0008f770 000007fa`93ba32ae ntdll!_LdrpInitialize+0xee9a
00000000`0008f7e0 00000000`00000000 ntdll!LdrInitializeThunk+0xe

Here are the relevant links describing the IOCTL, API, and data structures from MSDN:

http://msdn.microsoft.com/en-us/library/aa363216(v=VS.85).aspx
http://msdn.microsoft.com/en-us/library/windows/hardware/ff562411(v=vs.85).aspx
http://msdn.microsoft.com/en-us/library/windows/hardware/ff560492(v=vs.85).aspx

↑ Back to the top


Keywords: kb

↑ Back to the top

Article Info
Article ID : 2809247
Revision : 1
Created on : 1/7/2017
Published on : 2/11/2013
Exists online : False
Views : 508