Windows Server Crashes when enabling MSMQ service
When I enable MSMQ service, the Windows Server crashes with
BSOD.
I collected a full memory dump by configuring HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\CrashDumpEnabled
= 1
Reproduce the issue, collected the dump file and after
analysis found as below.
========================================================================
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY
(fc)
An attempt was made to execute non-executable memory. The guilty driver
is on the stack trace (and is typically the current instruction
pointer).
When possible, the guilty driver's name (Unicode string) is
printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: 000007fa5afc40e0, Virtual address for the attempted
execute.
Arg2: 2ee000011baef025, PTE contents.
Arg3: fffff88004f1d500, (reserved)
Arg4: 0000000080000005, (reserved)
Debugging Details:
------------------
DEFAULT_BUCKET_ID:
WIN8_DRIVER_FAULT
BUGCHECK_STR: 0xFC
PROCESS_NAME:
mqsvc.exe
CURRENT_IRQL: 0
TRAP_FRAME:
fffff88004f1d500 -- (.trap 0xfffff88004f1d500)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000007fa5af9c950 rbx=0000000000000000
rcx=000000fb06e509a0
rdx=000000fb0a4be8d8 rsi=0000000000000000
rdi=0000000000000000
rip=000007fa5afc40e0 rsp=fffff88004f1d698
rbp=fffff88004f1d831
r8=fffffa8008449880 r9=0000000000000521 r10=fffffa8008b50640
r11=0000000000000006 r12=0000000000000000
r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up
ei pl nz na po nc
MQQM!operator
delete:
000007fa`5afc40e0
c20000 ret 0
Resetting default scope
LAST_CONTROL_TRANSFER:
from fffff8038e004f75 to fffff8038de73240
STACK_TEXT:
fffff880`04f1d328 fffff803`8e004f75 : 00000000`000000fc
000007fa`5afc40e0 2ee00001`1baef025 fffff880`04f1d500 : nt!KeBugCheckEx
fffff880`04f1d330 fffff803`8df2bf3c : fffff880`04f1d500
fffff803`8e24b3e9 00000000`00000244 fffff880`04f1d42c : nt! ??
::FNODOBFM::`string'+0x3337b
fffff880`04f1d370 fffff803`8deaddad : fffff880`04f1d440
00000000`c0000016 fffffa80`08e5bb00 fffffa80`08449880 : nt! ??
::FNODOBFM::`string'+0x332d3
fffff880`04f1d3c0 fffff803`8de70cee : 00000000`00000008
00000000`00000000 fffff880`009c4100 fffff880`04f1d500 : nt!MmAccessFault+0x3ed
fffff880`04f1d500 000007fa`5afc40e0 : fffff880`05bc7297
00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`04f1d698 fffff880`05bc7297 : 00000000`00000000
00000000`00000000 00000000`00000000 00000000`00000000 : MQQM!operator delete
fffff880`04f1d6a0 fffff880`05bc80d7 : 00000000`00000000
000000fb`0a4be8d8 00000000`00000000 00000000`00000000 :
mqac!ACCreateQueue+0xa77
fffff880`04f1d710 fffff803`8e2890a8 : fffffa80`084012b0
fffffa80`095b4850 fffffa80`00000521 00000000`00000000 :
mqac!ACDeviceControl+0x62b
fffff880`04f1d7b0 fffff803`8e248a23 : fffffa80`08b50604
00000000`00000003 00000000`00000000 fffffa80`08b50640 : nt!IopSynchronousServiceTail+0x158
fffff880`04f1d880 fffff803`8e262106 : 00000000`00000000
00000000`00000000 00000000`00000000 00000000`00000000 :
nt!IopXxxControlFile+0xde0
fffff880`04f1da20 fffff803`8de72253 : fffff880`04f1dad8
00000000`00000000 00000000`00000001 00000000`00000000 :
nt!NtDeviceIoControlFile+0x56
fffff880`04f1da90 000007fa`64442bda : 000007fa`5afc6302
00000000`00000000 00000000`00000000 00000000`00000000 :
nt!KiSystemServiceCopyEnd+0x13
000000fb`0a4be878 000007fa`5afc6302 : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 : ntdll!NtDeviceIoControlFile+0xa
000000fb`0a4be880 000007fa`5afc6ae1 : 000000fb`06e509a0
000000fb`0a4be950 000000fb`06e50c10 00000000`00000000 :
MQQM!ACCreateRemoteProxy+0xce
000000fb`0a4be900 000007fa`5b02bd6d : 000000fb`06e50c10
00000000`00000000 000000fb`00000001 000000fb`06e985f0 :
MQQM!CQueueMgr::OpenRRQueue+0x185
000000fb`0a4be990 000007fa`5b02bf57 : 00000000`00000000
000000fb`0a4beaa1 00000000`00000000 000007fa`5b05ba57 :
MQQM!CAutoCloseNewRemoteReadCtxAndBind::CloseRRContext+0x1b5
000000fb`0a4bea20 000007fa`5afde2c3 : 00000000`00000000
000000fb`06dd455c 000000fb`06e50c10 00000000`00000001 :
MQQM!ImpersonateAndOpenRRQueue+0x17f
000000fb`0a4beb00 000007fa`5afde529 : 00000000`00000001
000000fb`06e50c10 00000000`00000001 000000fb`0a4bf2a8 :
MQQM!OpenQueueForRequest+0xf3
000000fb`0a4beb80 000007fa`5afb3052 : 000000fb`0a4bf020
000000fb`06dd6670 00000000`00000040 00000000`00000040 :
MQQM!qmcomm_v1_0_S_QMOpenQueue+0x1c9
000000fb`0a4bebf0 000007fa`61e94f6d : 000007fa`5af92a92
000000fb`0a4bf020 00000000`00000000 000000fb`0a4bf2a8 :
MQQM!qmcomm_R_QMOpenQueue_Thunk+0x2e
000000fb`0a4bec30 000007fa`61e9604d : 00000000`00000002
00000000`000001ab 000000fb`06dd54b0 00000000`00001060 :
RPCRT4!NdrStubCall2+0x9fd
000000fb`0a4bf270 000007fa`61e821a4 : 000000fb`06d55532
000000fb`00000001 00000000`00000182 000000fb`06dd6520 :
RPCRT4!NdrServerCall2+0x1d
000000fb`0a4bf2a0 000007fa`61e820bd : 00000001`00000000
000000fb`06dd54c0 000000fb`0a4bf4e0 00000001`00000000 : RPCRT4!DispatchToStubInCNoAvrf+0x14
000000fb`0a4bf2f0 000007fa`61e829b3 : 00000002`00000001
00000000`00000000 00000000`00000000 000007fa`61530000 :
RPCRT4!RPC_INTERFACE::DispatchToStubWorker+0x17d
000000fb`0a4bf490 000007fa`61e825fc : 00000000`000003a0
00000000`00000001 00000000`00000000 00000000`002f499c :
RPCRT4!LRPC_SCALL::DispatchRequest+0x91e
000000fb`0a4bf590 000007fa`61f14f32 : 000000fb`06dd6520
000000fb`06dd54e0 000000fb`06dd54e0 00000000`00000000 :
RPCRT4!LRPC_SCALL::HandleRequest+0x7d2
000000fb`0a4bf6e0 000007fa`61f14d08 : 00000000`00000000
000000fb`06dd6520 00000000`00000000 00000000`00000000 :
RPCRT4!LRPC_SASSOCIATION::HandleRequest+0x172
000000fb`0a4bf750 000007fa`61f11b63 : 000000fb`06d9cae0
000000fb`06dd4480 000000fb`0a4bf8c0 000000fb`06d9cae0 : RPCRT4!LRPC_ADDRESS::HandleRequest+0x128
000000fb`0a4bf7c0 000007fa`61e815eb : 00000000`00000000
000000fb`06da9530 000000fb`06d9cbe8 00000000`00000000 :
RPCRT4!LRPC_ADDRESS::ProcessIO+0xbfc
000000fb`0a4bf970 000007fa`64450656 : 000000fb`06dd40e0
00000000`00000000 000000fb`06d90210 000000fb`06dd4440 :
RPCRT4!LrpcIoComplete+0x97
000000fb`0a4bfa00 000007fa`644477d6 : 00000000`00000000
00000000`00000000 00000000`00000000 00000000`00000000 :
ntdll!TppAlpcpExecuteCallback+0x1f6
000000fb`0a4bfa70 000007fa`61841842 : 00000000`00000000
00000000`00000000 00000000`00000000 00000000`00000000 :
ntdll!TppWorkerThread+0x388
000000fb`0a4bfd10 000007fa`64480dfd : 00000000`00000000
00000000`00000000 00000000`00000000 00000000`00000000 :
KERNEL32!BaseThreadInitThunk+0x1a
000000fb`0a4bfd40 00000000`00000000 : 00000000`00000000
00000000`00000000 00000000`00000000 00000000`00000000 :
ntdll!RtlUserThreadStart+0x1d
STACK_COMMAND: kb
FOLLOWUP_IP:
mqac!ACCreateQueue+a77
fffff880`05bc7297 85c0 test eax,eax
SYMBOL_STACK_INDEX: 6
SYMBOL_NAME:
mqac!ACCreateQueue+a77
FOLLOWUP_NAME:
MachineOwner
MODULE_NAME: mqac
IMAGE_NAME: mqac.sys
DEBUG_FLR_IMAGE_TIMESTAMP:
5010abc2
BUCKET_ID_FUNC_OFFSET:
a77
FAILURE_BUCKET_ID:
0xFC_mqac!ACCreateQueue
BUCKET_ID:
0xFC_mqac!ACCreateQueue
Followup: MachineOwner
===========================================================================================================
This is the exact same issue as mentioned in https://support.microsoft.com/en-us/kb/2840622
Install the hotfix 2840622 to resolve this issue.
Hope this helps.