BSOD: SYSTEM_SERVICE_EXCEPTION (3b) triggered by file preview via QuickLook.exe on Win11 24H2

未关闭
  • 哪里不对？
#1,977 2 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 4 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
25/100
Issue 类型
缺陷
描述清晰度
需要澄清
活跃度
冷清
技术栈
csharp
领域
desktop, operating-systems

调研方向

首先查看附带的转储文件 080526-32734-01.dmp 及其 !analyze -v 输出，然后跟踪 QuickLook.exe 通过 NtReadFile 以及 issue 中列出的 Filter Manager fast I/O 调用所经过的文件读取路径。在确定 kernel 崩溃的原因，并建立可靠的修复方案或范围严格限定的诊断路径后，该 issue 即完成。

由索引模型根据 Issue 内容生成。

描述

Describe the bug
QuickLook v4.5.0 (UWP) triggered a full system crash (BSOD) with SYSTEM_SERVICE_EXCEPTION (3b) while reading a file via the Fast I/O path. The crash occurred inside the Windows kernel at nt!ExpAcquireResourceSharedLite, where the CPU encountered an illegal instruction ( STATUS_ILLEGAL_INSTRUCTION, 0xC000001D). The debugger flagged IP_IN_PAGED_CODE, indicating the kernel code page at the crash site was either corrupted or unexpectedly paged out. The call stack shows the crash originated from QuickLook's file read operation going through the Filter Manager (FLTMGR) Fast I/O read path, ultimately causing a kernel-mode resource acquisition failure that brought down the entire system.

To Reproduce
This appears to be a difficult-to-reproduce timing- or state-dependent kernel crash, not a simple UI action. The crash occurred after the system had been running for 8 days 17 hours. Based on the call stack, the trigger path is:

  1. Have QuickLook running (likely in the background, previewing files).
  2. QuickLook attempts to read a file via NtReadFile → Fast I/O path through the Filter Manager (FLTMGR!FltpFastIoRead).
  3. The kernel enters FsRtlCopyRead → ExAcquireResourceSharedLite → ExpAcquireResourceSharedLite where the BSOD occurs.

Note: I was unable to reproduce on demand; the crash seems to require prolonged system uptime or interaction with a specific file-system filter driver.

Expected behavior
QuickLook should never cause a kernel-mode crash. File read operations invoked by a user-mode application should fail gracefully (returning an error to the calling process) rather than triggering a bugcheck that halts the entire OS.

Desktop (please complete the following information):

  • OS Version: Windows 11 24H2 (Kernel 10.0.26100.8894, x64)
  • QuickLook Version: 4.5.0 (UWP from Microsoft Store)

Screenshots and Exception Log

Kernel dump analysis (!analyze -v) summary:

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.

Arg1: 00000000c000001d ← STATUS_ILLEGAL_INSTRUCTION
Arg2: fffff800ed321912 ← nt!ExpAcquireResourceSharedLite+0x132
Arg3: ffff8080ae6e48f0
Arg4: 0000000000000000

FAILURE_BUCKET_ID: 0x3B_C000001D_nt!ExpAcquireResourceSharedLite
PROCESS_NAME: QuickLook.exe
IP_IN_PAGED_CODE: nt!ExpAcquireResourceSharedLite+0x132

Call stack (bottom to top):
nt!KiSystemServiceCopyEnd
nt!NtReadFile
nt!IopReadFile
FLTMGR!FltpFastIoRead
FLTMGR!FltpPassThroughFastIo
FLTMGR!FltpPerformFastIoCall
nt!FsRtlCopyRead
nt!ExAcquireResourceSharedLite
nt!ExpAcquireResourceSharedLite ← CRASH (illegal instruction)

Full dump file (080526-32734-01.dmp) and complete analysis log are available on request.

080526-32734-01.dmp

主要语言
C#
星标
25.6k
派生
1.4k
平均合并
4 天 8 分钟
30 天内合并 PR
3

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 有 Pull Request 模板
  • 没有贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

QL-Win/QuickLook 的其他 Issue

查看 QL-Win/QuickLook 的全部 Issue

相似的 Issue

更多 C# Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。