serious network problems

[Ruggerbugger]

I've had serious problems with my wireless card in my laptop today. Trying to log on to theuniversity network, it would get to just before the Windows logon and blue-screen with the following error:

PAGE_FAULT_IN_NONPAGED_AREA

STOP: 0x0000050 (0xFF931018, 0x00000008, 0xFF931018, 0x00000000)

If I disabled the wireless card, I could log into Windows and use the computer normally, I could also connect using a cable.

I removed the card in Device Manager to see if redetecting it would work, it didn't, but it did **** up my wireless network at home. I've set up the entire thing again now, but was wondering if anyone could guess what happened.

[Paul Adams]

Short answer:
Basically a STOP 0x50 error is a pool corruption caused by 3rd party kernel mode drivers.
It sounds like possibly the wireless driver could have been the culprit.


Long answer:
It's not always immediately obvious as to the cause - it is possible that the driver which Windows says tried to do something naughty was the victim of the corruption rather than the one that caused it.

Imagine 2 drivers resident in memory next to each other.
(For simplicity assume these memory addresses are decimal, so 4999 is followed by 5000 and not 4a00.)
Driver A resides owns memory range 0000-4999 and Driver B owns range 5000-9999.
Driver A starts to write to its memory space, and is badly coded so it doesn't do boundary checking - the code asks to write 1000 bytes starting at address 4500, overwriting the first 500 bytes of the pool owned by Driver B.
Driver B has previously written data in these addresses and expects the data to be of a certain format - it tries to work with the data it wrote, maybe it stored other memory addresses there, and now because it is garbage is behaves in an unexpected manner.

So Driver B asks Windows to do something it isn't permitted - accessing memory it doesn't own, calling a function with garbage arguments, whatever.
Errors that occur in kernel mode generate exceptions - blue screens of death - and these are designed to prevent further corruption of data as the system stability is now in question.


How to detect when the pool corruption occurs, and not when the result of the corruption causes a problem? Special Pool.

In essence this puts a write-protected "wall" between each pool allocation, so if a driver (Driver A in my example) tries to write outside of its allocation it would attempt to write over write-protected memory and cause an exception.

KB on enabling special pool for troubleshooting


Not much you can do "post mortem", even the memory dump won't give much more definite info - you would need to use special pool or driver verifier to have Windows "watch" the drivers carefully (perfomance hit expected) and stop when one is being badly behaved (that memory dump would tell you the thread/process that actually did the naughty deed with more accuracy).

If it wasn't the wireless driver it could have been any other kernel mode driver, or a filter driver such as a backup agent, firewall or AV which could be involved in every operation involving files or the network.

[Ruggerbugger]

Thanks Paul, very comprehensive. I'm going to keep an eye on things for know, as they seem to be working OK. Given the fact that the crash also occurs when I turned the wireless antenna back on after booting into windows, and trying to connect, I'm assuming the wireless driver was the culprit.

How much of a performance hit does special pool incur? What are the risks of using it?

[Paul Adams]

How much of a performance hit does special pool incur? What are the risks of using it?

Entirely dependent on what you run - there is a reason it's off by default though
No "risks" as such, it doesn't do anything except insert write-protected sections between pool allocations so that errors in drivers get trapped when they occur.

Windows by default is set up to do a fair bit of system performance monitoring, indexing and housekeeping for proactive tuning, but things like special pool, pool tagging, driver verifier, and manual memory dumps are reactive troubleshooting techniques when more detail is needed to isolate the root cause of a problem.

You could run defrag, a spyware search, a full virus scan, check for version updates for every piece of software every time you turn on your computer - but in the long run you don't gain much except slowing down your logon time and general system performance.
These tasks you just do when you need to - same as with messing about with the paged and nonpaged pool options.

[Ruggerbugger]

Update. I reinstalled the wireless chipset driver this time, and it seemed to have solved the problem. Until I tried to set up and connect to the VPN at Warwick. This immediately brought up the error again. Any ideas?

[Ruggerbugger]

bumpage...

Does anyone have an idea why I can access the wireless hotspots at uni and get on the net, but attempting to access the VPN causes the blue screen? I wouldn't be that bothered, but I use the First Class conferencing system for uni, and it won't work through the hotspot, only the VPN.