Memory Leak in FSrt Occurs When a Program Makes a Call to the CreateFile Function (817435)


The information in this article applies to:

  • Microsoft Windows NT Advanced Server 4.0
  • Microsoft Windows NT Server 4.0
  • Microsoft Windows NT Server, Enterprise Edition
  • Microsoft Windows NT Workstation 4.0

SYMPTOMS

When a program calls an instance of the CreateFile Win32 API function that passes an incorrect (or otherwise nonfunctional) network location, a memory leak in File System Run Time (FSrt) allocations may occur. This may decrease system performance and cause the system to stop responding (hang).

CAUSE

When a program calls an instance of CreateFile that passes an incorrect network location, this may generate a slow leak in the FSrt tag. This leak occurs because the IOCompleteRequest function is not called, and therefore the IRP_CONTEXT function leaks system memory. As a result, non-paged memory in the FSrt tag is not released as expected.

RESOLUTION

A supported fix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Apply it only to computers that are experiencing this specific problem.

To resolve this problem, contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information about support costs, visit the following Microsoft Web site:

http://support.microsoft.com/default.aspx?scid=fh;EN-US;CNTACTMS

NOTE: In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel. 
   Date         Time   Version         Size    File name  
   -----------------------------------------------------
   14-Apr-2003  04:45  4.0.1381.7215   80,784  Mup.sys
Note Because of file dependencies, this hotfix requires Microsoft Windows NT 4.0 Service Pack 6a.

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

MORE INFORMATION

To detect this leak, use Performance Monitor to determine whether the Object Counter Memory: Pool Nonpaged Bytes value increases abnormally over time. To verify that the Pool Nonpaged Bytes leak occurs in FSrt, use Pool Monitor (Poolmon.exe). For additional information about Pool Monitor, click the following article number to view the article in the Microsoft Knowledge Base:

177415 How to Use Memory Pool Monitor (Poolmon.exe) to Troubleshoot Kernel Mode Memory Leaks

Modification Type:MinorLast Reviewed:9/27/2005
Keywords:kbHotfixServer kbQFE kbQFE kbfix kbbug KB817435 kbAudDeveloper
©2004 Microsoft Corporation. All rights reserved.