My work computer recently crashed with a BSOD just after inserting a USB 3.0 memory stick.
Considering the circumstances I suspected that a USB driver bug caused the crash.
Checked Event Viewer and found:
Log Name: System Source: Microsoft-Windows-WER-SystemErrorReporting Event ID: 1001 Task Category: None Level: Error Keywords: Classic Description: The computer has rebooted from a bugcheck. The bugcheck was: 0x0000007e (0xffffffffc0000005, 0xfffff88001e685fe, 0xfffff8800394e5a8, 0xfffff8800394de00). A dump was saved in: C:\Windows\MEMORY.DMP.
Examined the memory dump with WinDbg (x64).
Checked for details about the crash with:
!analyze -v
Part of the result:
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Arguments: Arg1: ffffffffc0000005, The exception code that was not handled Arg2: fffff88001e685fe, The address that the exception occurred at Arg3: fffff8800394e5a8, Exception Record Address Arg4: fffff8800394de00, Context Record Address Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: iusb3hub+235fe fffff880`01e685fe 4c8b00 mov r8,qword ptr [rax] EXCEPTION_RECORD: fffff8800394e5a8 -- (.exr 0xfffff8800394e5a8) ExceptionAddress: fffff88001e685fe (iusb3hub+0x00000000000235fe) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: 0000000000000000 Attempt to read from address 0000000000000000 MODULE_NAME: iusb3hub IMAGE_NAME: iusb3hub.sys
Examined the call stack with:
kp
Result:
Child-SP RetAddr Call Site fffff880`0394d5d8 fffff800`0344cf24 nt!KeBugCheckEx fffff880`0394d5e0 fffff800`0340a745 nt!PspUnhandledExceptionInSystemThread+0x24 fffff880`0394d620 fffff800`03101cb4 nt! ?? ::NNGAKEGL::`string'+0x21dc fffff880`0394d650 fffff800`0310172d nt!_C_specific_handler+0x8c fffff880`0394d6c0 fffff800`03100505 nt!RtlpExecuteHandlerForException+0xd fffff880`0394d6f0 fffff800`03111a05 nt!RtlDispatchException+0x415 fffff880`0394ddd0 fffff800`030d5a82 nt!KiDispatchException+0x135 fffff880`0394e470 fffff800`030d45fa nt!KiExceptionDispatch+0xc2 fffff880`0394e650 fffff880`01e685fe nt!KiPageFault+0x23a fffff880`0394e7e0 fffff880`01e4a2b6 iusb3hub+0x235fe fffff880`0394e840 fffff880`01e4a055 iusb3hub+0x52b6 fffff880`0394e8b0 fffff880`01e4a7fd iusb3hub+0x5055 fffff880`0394e920 fffff880`01e5c9a7 iusb3hub+0x57fd fffff880`0394e980 fffff880`01e5c3e4 iusb3hub+0x179a7 fffff880`0394ea90 fffff880`01e69b3b iusb3hub+0x173e4 fffff880`0394eb10 fffff800`033d2413 iusb3hub+0x24b3b fffff880`0394eb40 fffff800`030df355 nt!IopProcessWorkItem+0x23 fffff880`0394eb70 fffff800`03371236 nt!ExpWorkerThread+0x111 fffff880`0394ec00 fffff800`030c7706 nt!PspSystemThreadStartup+0x5a fffff880`0394ec40 00000000`00000000 nt!KxStartSystemThread+0x16
Apparently iusb3hub.sys caused an access violation by reading from address 0 (null pointer bug).
Examined information about the iusb3hub driver with:
lmv m iusb3hub
Result:
start end module name fffff880`01e45000 fffff880`01eaa000 iusb3hub (no symbols) Loaded symbol image file: iusb3hub.sys Image path: \SystemRoot\system32\DRIVERS\iusb3hub.sys Image name: iusb3hub.sys Timestamp: Fri Dec 18 16:59:07 2015 (56742D4B) CheckSum: 0006D07A ImageSize: 00065000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Noticed that the driver was more than 1 year old.
Found details about “Intel(R) USB 3.0 Root Hub” in Device Manager.
Decided to search for an updated driver.
Installed and ran Intel Driver Update Utility, which found a newer USB 3.0 driver (5.0.0.32)
Installed the updated driver and rebooted the system.
Hoping that this will prevent the computer from crashing in the future.