PH46644: CRASH IN IBMLB2.EXE, FAULTING MODULE NAME: NTDLL.DLL, EXCEPTION CODE: 0XC0000374

APAR status

• Closed as program error.

Error description

• Events reported in log files:
  
  Windows event log:
  Error 1000 (100) "Faulting application name: ibmlb2.exe,
  version: 0.0.0.0, time stamp: 0x61f81e6e
  
  Exception code: 0xc0000374
  Faulting application path:
  C:\Program Files\IBM\WebSphere\Edge\ULB\servers\bin\ibmlb2.exe
  
  LB ibmlb2.log:
  Warning: [os_pullup] should not have been reached on Windows
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  IBM WebSphere Network Deployment Load       *
  *                  Balancer for IPv4 and IPv6 users on         *
  *                  Windows operating systems                   *
  ****************************************************************
  * PROBLEM DESCRIPTION: The LB server.log indicates             *
  *                      "Communication with executor failed";   *
  *                      packets not forwarded, LB commands      *
  *                      fail.                                   *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  The executor module (ibmlb2) crashes. The Windows event log
  reports exception code 0xc0000374 with faulting application
  ibmlb2.exe. LB's ibmlb2.log contains the message "Warning:
  [os_pullup] should not have been reached on Windows". Packets
  not forwarded and LB commands fail after this issue occurs.
  Crash call stack contains ibmlb2 contains:
  os_memfree
  DEBUG_OS_MEMFREE
  lbfrag_pbuf_firstfragment
  lbsel_send
  lbtcpudp_pbuf_entry
  

Problem conclusion

• The problem occurs when LB has received fragmented packets for
  a cluster. The first fragment (which contains TCP headers
  necessary to select a server) arrived after other fragments.
  Previous fragments are stored, waiting for the first fragment
  to be process. At least one of the stored fragments was
  smaller than 40 bytes.
  
  The Load Balancer code checks to ensure that data contains the
  minimal necessary number of bytes. The smaller fragment did
  not meet the minimal size so the memory storage was released
  but references remained in the stored fragment table. After
  the first fragment was processed and the stored fragments are
  sentto the server, the previously released memory was released
  again which causing the crash.
  
  Code was modified to prevent minimum size check on fragments
  other than the first fragment and Windows specific LB code
  modified to correct return code data check function.
  
  Fix levels:
     8.5.5.22
     9.0.5.13
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WS EDGE LB IPV4

• Fixed component ID

  5724H8812

Applicable component levels