locked
How to solve FCS + IBM ClearCase = BSOD RRS feed

  • Question

  • Hello all,

    I encoutered a ClearCase blue screen problem and I doubt that it is caused by FCS. If you have any suggestion, kindly give a hand, to see whether FCS is not compatible with the IBM driver mvfs50.sys or need patch to solve it, thanks.

    OS: Server 2003 R2 SP2 as teminal server

    Forefront Client Security 2006
    Client Version:  1.5.1972.0
    Engine Version: 1.1.6103.0
    Antivirus definition: 1.89.417.0
    Antispyware definition: 1.89.417.0

    Install IBM ClearCase Remote Client V7.0.1


    Symptom

    Server auto reboot several times in one day afternoon but return to normal after that. I doubt that it is caused by FCS MsMpEng.exe because we don't have Windows Defender/OneCare/MSE on the server.

     
    All blue screen situations initiated by mvfs50 were the same, invoked by MsMpEng.exe and MpFilter.sys was involved. MsMpEng.exe is the engine for Defender, OneCare, Forefront, and MSE. mvfs50.sys is a IBM ClearCase driver.


    We got 5 dump file with same error code,
    0000000A (0000006c d0000002 00000001 80a5e4a9)

    Use Windbg to analyze it

    1: kd> !analyze -v

    STACK_TEXT: 

    f57fe830 80a5e4a9 badb0d00 f57fe8b4 80829c72 nt!KiTrap0E+0x2a7

    f57fe8a0 8087cdcf 8952ae00 00000000 896314a0 hal!KeAcquireInStackQueuedSpinLockRaiseToSynch+0x19

    f57fe8c0 f4cf072a 00000038 00000001 00000000 nt!ExAcquireResourceExclusiveLite+0x21

    WARNING: Stack unwind information not available. Following frames may be wrong.

    f57fea24 808e2220 896314a0 00000001 00000002 mvfs50+0x2972a

    f57fea38 80819e48 896314a0 00000002 f57fead4 nt!FsRtlAcquireToCreateMappedSection+0x12

    f57fea68 f5882d9c f57feab0 f57feaac f57feaec nt!FsRtlCreateSectionForDataScan+0x5e

    f57feab4 f587e7a3 f57feafc f57fead4 f58a6475 MpFilter!MpCreateSection+0xdc

    f57feb50 f722fbc9 8a94abec 0110ff1c 00000018 MpFilter!MpMessage+0x309

    f57feb98 f723bd8e 8ac4dd00 0110ff1c 00000018 fltmgr!FltpFilterMessage+0x73

    f57febcc f722e6c1 8ac4dd00 89805a00 0110ff1c fltmgr!FltpMsgDeviceControl+0xa4

    f57fec10 f722ec09 8b4e9728 89805a30 89805a30 fltmgr!FltpMsgDispatch+0x87

    f57fec3c 8081df85 8b4e9728 89805a30 8ac65c00 fltmgr!FltpDispatch+0x33

    f57fec50 808f5511 89805aa0 8ac4dd00 89805a30 nt!IofCallDriver+0x45

    f57fec64 808f6299 8b4e9728 89805a30 8ac4dd00 nt!IopSynchronousServiceTail+0x10b

    f57fed00 808eede2 000003d4 00000000 00000000 nt!IopXxxControlFile+0x5e5

    f57fed34 808897cc 000003d4 00000000 00000000 nt!NtDeviceIoControlFile+0x2a

    f57fed34 7c82860c 000003d4 00000000 00000000 nt!KiFastCallEntry+0xfc

    0110fea0 00000000 00000000 00000000 00000000 0x7c82860c

     

    kd> !thread

    THREAD 8ac659f8  Cid 02e4.03f0  Teb: 7ff9b000 Win32Thread: 00000000 RUNNING on processor 1

    IRP List:

        89805a30: (0006,0094) Flags: 00000000  Mdl: 00000000

    Not impersonating

    DeviceMap                 e1003948

    Owning Process            8a8561c8       Image:         MsMpEng.exe

    Attached Process          N/A            Image:         N/A

    Wait Start TickCount      86693          Ticks: 0

    Context Switch Count      7902            

    UserTime                  00:00:04.718

    KernelTime                00:00:00.312

     

     


    Friday, August 27, 2010 7:04 AM

All replies

  • http://www-01.ibm.com/support/docview.wss?rs=727&uid=swg21312829
    http://www-01.ibm.com/support/docview.wss?uid=swg1PK68256
     

    A fix is available in ClearCase versions 7.0.0.4 and 7.0.1.3
    and 7.1

     

    We've seen a few cases on this all of them have been resolved by updating Clearcase.  Hopefully it does in your scenario as well.

     

     


    CSS Security Support Engineer (FCS/MBSA/WUA/Incident Response/FOPE) Check out my blog http://blogs.technet.com/kfalde or better yet check out http://technet.com/wiki and start contributing :)
    • Proposed as answer by Nick Gu - MSFT Thursday, September 2, 2010 2:14 AM
    Tuesday, August 31, 2010 1:52 PM