1. #1
    x BlueRobot's Avatar
    Join Date
    May 2013
    Location
    Minkowski Space
    Posts
    1,651

    [Question] What's the frink and brink free-list?

    Hey everyone,

    I have a quick question, I've noticed a few bugchecks mention things like the frink and brink free-list address/chain (correct me if I'm wrong), and I was wondering what they meant? I've searched everywhere and haven't been able to find anything about them.

    Any answers will be appreciated.

    Thanks as always,

    Harry
    Machines Can Think

    Oxygen, Nature's paradox.


    • Ad Bot

      advertising
      Beep.

        
       

  2. #2
    Wrench97's Avatar
    Join Date
    Feb 2012
    Location
    S.E. Pennsylvania
    Posts
    2,520

    Re: [Question] What's the frink and brink free-list?

    Do you have an example dmp you can post?

  3. #3
    x BlueRobot's Avatar
    Join Date
    May 2013
    Location
    Minkowski Space
    Posts
    1,651

    Re: [Question] What's the frink and brink free-list?

    I do, I'll get the files. I think it's actually blink and flink.

    The Kaval folder (Kaval.zip) mentions something about the lists being corrupt, and this folder contains the two mentioned as parameters (061613-20592-01.zip).
    Last edited by x BlueRobot; 06-17-2013 at 04:01 PM. Reason: Added Folders
    Machines Can Think

    Oxygen, Nature's paradox.

  4. #4

    Join Date
    Mar 2012
    Posts
    469

    Re: [Question] What's the frink and brink free-list?

    The free list I believe is referring to the free page list, which is a linked list of unallocated memory blocks which have previously been used but are now available. Free pages are memory blocks that happens to still have data left over from when it was released by a process and has not been scrubbed with zeroes by Windows memory manager prior to being ready for use again.

    As for that particular example you gave, the corruption is because a byte in one of the freelist entries got overwritten with a '36'. That would be one of those "too late" scenarios where the culprit has already escaped. Driver Verifier helps quite often with pool fudging.
    x BlueRobot, jcgriff2, JMH and 3 others say thanks for this.

  5. #5
    x BlueRobot's Avatar
    Join Date
    May 2013
    Location
    Minkowski Space
    Posts
    1,651

    Re: [Question] What's the frink and brink free-list?

    Thanks Vir, I was able to find how what a free-list was, and thanks for explaining the corrupted bit.

    This Memory Management Glossary provides quite a good explanation for some of the memory related terminology.
    axe0 says thanks for this.
    Machines Can Think

    Oxygen, Nature's paradox.

  6. #6

    Re: [Question] What's the frink and brink free-list?

    To answer your original question with a technical answer, the "flink" and "blink" you were questioning describe a Forward Link and Backward Link in a linked list. Lots of structures in Windows use linked lists to keep track of things, especially the memory manager, but the FLink and the BLink are ways of validating that a linked list is still valid, what's around, etc. It can be useful for debugging, but that's what it means.
    tom982, jcgriff2, JMH and 3 others say thanks for this.
    MCTS Windows Internals, MCITP Server 2008 EA, MCTS MDT/BDD, MCSE/MCSA Server 2003, Server 2012, Windows 8

  7. #7

    Join Date
    Mar 2012
    Posts
    469

    Re: [Question] What's the frink and brink free-list?

    Quote Originally Posted by cluberti View Post
    To answer your original question with a technical answer, the "flink" and "blink" you were questioning describe a Forward Link and Backward Link in a linked list. Lots of structures in Windows use linked lists to keep track of things, especially the memory manager, but the FLink and the BLink are ways of validating that a linked list is still valid, what's around, etc. It can be useful for debugging, but that's what it means.
    I've been curious as to why the bugcheck description says that the Flink and Blink should be identical to the pool entry address itself, and not rather pointing to any other allocations below and above it in the list like what is expected in a double linked list:

    Code:
    Arg1: 0000000000000003, the pool freelist is corrupt.
    Arg2: fffff88002301350, the pool entry being checked.
    Arg3: fffff88002301350, the read back flink freelist value (should be the same as 2).
    Arg4: 36fff88002301350, the read back blink freelist value (should be the same as 2).

    The pool freelist is corrupt.

    (In a healthy list, the values of Parameters 2, 3, and 4 should be identical.)
    I assume that because they are free and therefore unused allocations that they shouldn't be chained in any way? But then that wouldn't make much of a list, would it?
    x BlueRobot and usasma say thanks for this.

  8. #8

    Re: [Question] What's the frink and brink free-list?

    If I remember correctly, this is the way a pool list entry is determined to be "free" and available for use. What you're seeing in that bugcheck scenario is that an address is on the free list (and thus should be available for allocation), but further basic checking for consistency says the address is actually coming back as non-free (it no longer has one address entry for the pool entry itself, and it's flink and blink). Something has either overrun, underrun, or simply sprayed into the wrong address range.
    Last edited by cluberti; 06-19-2013 at 11:40 AM.
    Vir Gnarus, x BlueRobot and JMH say thanks for this.
    MCTS Windows Internals, MCITP Server 2008 EA, MCTS MDT/BDD, MCSE/MCSA Server 2003, Server 2012, Windows 8

  9. #9

    Join Date
    Mar 2012
    Posts
    469

    Re: [Question] What's the frink and brink free-list?

    Ahh, that makes perfect sense. Thanks, Carl!

  10. #10
    x BlueRobot's Avatar
    Join Date
    May 2013
    Location
    Minkowski Space
    Posts
    1,651

    Re: [Question] What's the frink and brink free-list?

    Thanks for everyone input into this discussion, I managed to find another article related to Linked Lists, and it mentioned about Blink and Flink, I haven't managed to read through it all completely yet but it did look interesting and helpful.

    The NT Insider:Kernel-Mode Basics: Windows Linked Lists
    Vir Gnarus says thanks for this.
    Machines Can Think

    Oxygen, Nature's paradox.

  11. #11

    Join Date
    Apr 2013
    Posts
    30
    x BlueRobot says thanks for this.

Similar Threads

  1. VB question...
    By GZ in forum Programming
    Replies: 13
    Last Post: 06-03-2012, 08:21 PM

Log in

Log in