Expand Minimize

Bug Check 0x76: PROCESS_HAS_LOCKED_PAGES

The PROCESS_HAS_LOCKED_PAGES bug check has a value of 0x00000076. This bug check indicates that a driver failed to release locked pages after an I/O operation, or that it attempted to unlock pages that were already unlocked.

Important Info If You Have Received a STOP Code

bsod

If you received a blue screen error, or stop code, the computer has shut down abruptly to protect itself from data loss.

For information about how to recover from this error, see Resolving Blue Screen errors in Windows.

PROCESS_HAS_LOCKED_PAGES Parameters

The following parameters appear on the blue screen.

Parameter 1Parameter 2Parameter 3Parameter 4Cause of error

0x00

The pointer to the process object

The number of locked pages

The pointer to driver stacks (if they are enabled). Otherwise, this parameter is zero.

The process being terminated has locked memory pages. The driver must unlock any memory that it might have locked in a process, before the process terminates.

0x01

MDL specified by the driver

Current number of locked memory pages in that process

A pointer to driver stacks for that process (if they are enabled). Otherwise, this parameter is zero.

The driver is attempting to unlock process memory pages that are not locked.

 

Cause

The driver either failed to unlock pages that it locked (parameter 1 value is 0x0), or the driver is attempting to unlock pages that have not been locked or that have already been unlocked (parameter 1 value is 0x1).

Resolution

If the parameter 1 value is 0x0

First use the !search extension on the current process pointer throughout all of physical memory. This extension might find at least one memory descriptor list (MDL) that points to the current process. Next, use !search on each MDL that you find to obtain the I/O request packet (IRP) that points to the current process. From this IRP, you can identify which driver is leaking the pages.

Otherwise, you can detect which driver caused the error by editing the registry:

  1. In the \\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management registry key, create or edit the TrackLockedPages value, and then set it equal to DWORD 1.

  2. Restart the computer.

The system then saves stack traces, so you can easily identify the driver that caused the problem. If the driver causes the same error again, bug check 0xCB (DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS) is issued, and the name of the driver that causes this error is displayed on the blue screen and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.

If the parameter 1 value is 0x1

Examine the driver source code that locks and unlocks memory, and try to locate an instance where memory is unlocked without first being locked.

 

 

Send comments about this topic to Microsoft

Show:
© 2014 Microsoft