PFN LIST CORRUPT BSOD while running Chrome

[Johnny_B]

Hi,

I'm using Sandboxie 5.20 and I've got four or five BSOD in the past one or two months while running Google Chrome on Windows 7 Pro x64.
I usually put the computer to sleep and leave Chrome (with many tabs) open and sandboxed, the BSODs didn't occur when the computer resumed from sleep though. I also checked the memory using memtest86 and there were no errors.

Not sure if it's related, but if so, the following information extracted from the last crash dump might help you fix a bug.

Code: Select all

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 0000000000130ab2, page frame number
Arg3: 0000000000000000, current page state
Arg4: 000000000012d332, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  chrome.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff8000355452c to fffff800034c1440

STACK_TEXT:  
fffff880`1266cde8 fffff800`0355452c : 00000000`0000004e 00000000`00000099 00000000`00130ab2 00000000`00000000 : nt!KeBugCheckEx
fffff880`1266cdf0 fffff800`03470f32 : 00000000`00000000 fffff681`14c4ad48 00000000`00000002 00000000`00000001 : nt!MiBadShareCount+0x4c
fffff880`1266ce30 fffff800`03492c03 : fffffa80`13a0a9b0 fffff700`00017b79 0000007f`fffffff8 fffff8a0`19ff0438 : nt! ?? ::FNODOBFM::`string'+0x2d29a
fffff880`1266cec0 fffff800`03493cd5 : fffffa80`13a0a9b0 fffffa80`00000000 fffff880`00014c18 fffff800`00000000 : nt!MiDeleteAddressesInWorkingSet+0x307
fffff880`1266d770 fffff800`0379a614 : fffff8a0`10f6f9e0 fffff880`1266dae0 fffffa80`16770950 fffffa80`16770950 : nt!MmCleanProcessAddressSpace+0x95
fffff880`1266d7c0 fffff800`0377f11d : fffffa80`c0000005 00000000`00000001 000007ff`fff12000 fffffa80`132aa640 : nt!PspExitThread+0x944
fffff880`1266d880 fffff800`034b5544 : 00000000`00000000 fffff800`037e5149 fffff880`1266db60 fffffa80`123a7070 : nt!PsExitSpecialApc+0x1d
fffff880`1266d8b0 fffff800`0350d240 : 00000000`ffffffff fffff880`1266d930 fffff800`0377f090 00000000`00000001 : nt!KiDeliverApc+0x2e4
fffff880`1266d930 fffff800`034c0777 : 00000000`00000000 0000007f`ffffffff 00000000`06cefb00 00000980`00000000 : nt!KiInitiateUserApc+0x70
fffff880`1266da70 00000000`00030b99 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`090df4b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x30b99


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+4c
fffff800`0355452c cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  589c915d

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

Followup: MachineOwner
---------

Thank you!

[Barb@Invincea]

Hello Johnny_B ,

Does the issue occur in a new Sandbox with default settings?
Do you have any Antivirus software installed?
Does Chrome work fine without Sandboxie involved?

If you provide the full memory dump, I will pass it along to the devs so that they can review it. It is typically found under C:\windows --> Memory.dmp)
Please upload it to a file hosting site and provide us the link so that we can download it.

Regards
Barb.-

[Johnny_B]

Does the issue occur in a new Sandbox with default settings?

I'll have to test and see how it goes, the BSODs happened weeks apart.

I use two sandboxes most of the time. In each one I run Chrome using a different user profile. In the [WebBrowser] sandbox I run Chrome (with some add-ons installed) for general web browsing. In the [MailBrowser] sandbox I run Chrome (different Chrome user profile with no add-ons) and I use it for web mail.

These are the settings (and I just noticed that the [WebBrowser] one doesn't have the qWave template enabled probably because I copied the settings from an older one):

Code: Select all

[WebBrowser]

ConfigLevel=7
AutoRecover=y
Template=AutoRecoverIgnore
Template=Firefox_Phishing_DirectAccess
Template=LingerPrograms
Template=BlockPorts
RecoverFolder=%Desktop%
RecoverFolder=%Favorites%
RecoverFolder=%Personal%
RecoverFolder=%{374DE290-123F-4565-9164-39C4925E467B}%
Enabled=y
BoxNameTitle=n
BorderColor=#0000FF
CopyLimitKb=49152
CopyLimitSilent=y
DropAdminRights=y
AutoDelete=y
NeverDelete=n
LeaderProcess=chrome.exe
OpenFilePath=%Local AppData%\Google\Chrome\User Data\Profile 3\Favicons
OpenFilePath=%Local AppData%\Google\Chrome\User Data\Profile 3\Favicons-journal
OpenFilePath=%Local AppData%\Google\Chrome\User Data\Profile 3\Bookmarks

[MailBrowser]

ConfigLevel=7
AutoRecover=y
Template=qWave
Template=AutoRecoverIgnore
Template=Firefox_Phishing_DirectAccess
Template=LingerPrograms
Template=BlockPorts
RecoverFolder=%Desktop%
RecoverFolder=%Favorites%
RecoverFolder=%Personal%
RecoverFolder=%{374DE290-123F-4565-9164-39C4925E467B}%
Enabled=y
BoxNameTitle=n
BorderColor=#0000FF
CopyLimitKb=49152
CopyLimitSilent=y
DropAdminRights=y
AutoDelete=y
NeverDelete=n
LeaderProcess=chrome.exe
OpenFilePath=%Local AppData%\Google\Chrome\User Data\Profile 1\Favicons-journal
OpenFilePath=%Local AppData%\Google\Chrome\User Data\Profile 1\Favicons
OpenFilePath=%Local AppData%\Google\Chrome\User Data\Profile 1\Bookmarks

Do you have any Antivirus software installed?

I use Comodo Internet Security 8.4.0.5076 (having just the antivirus and firewall components enabled).

Does Chrome work fine without Sandboxie involved?

It seems like it. After the last BSOD I started using Chrome without Sandboxie for accesing my web mail, for web browsing I've switched to Firefox and I'm using it with Sandboxie.

One more thing that I've noticed is that sometimes when I was running Chrome using Sandboxie in both the [MailBrowser] and [WebBrowser] sandboxes, some of the opened tabs would suddenly die and display the "aw snap something went wrong while displaying this webpage" message.

I don't have the memory dump file anymore. I've deleted it after extracting the information I've posted before.

Thank you very much for your help!

[Barb@Invincea]

Hello Johnny_B ,

The devs will need the dmp file in order to review this issue, as the information posted before does not show anything related to Sandboxie.
If/when the crash occurs again, please send us a link to the dmp file and they will review it.

Regarding the Qwave template, not enabling it will cause Chrome to crash (but not to BSOD, as far as we are aware). Here's a related topic:
viewtopic.php?f=11&t=24613

Regards,
Barb.-