Heap overflow in mps(4) (was: Re: stable/9 mps(4) rev 254938 == BOOM!)

[Garrett Wollman]

<<On Wed, 29 Jan 2014 15:15:14 -0700, "Kenneth D. Merry" <ken at freebsd.org> said:

> Hmm.  What does vmstat -m show for the mps malloc bucket?

          mps   237  1996K       -     1005  512,1024,2048

One of these is probably getting corrupted:

       USBdev    44    23K       -       44  512,1024
          USB    75   154K       -       78  512,4096

(The 512 and 1024 would ultimately come out of the same page for
either malloc type.)

> Are you booting off of the controller?

Yes, all the storage controllers in this machine are mps.  (There's
SATA on the motherboard but it's not wired to anything.)

> How many drives do you have in the system, and how many of them are SAS vs.
> SATA?

98 drives, of which 92 are dual-pathed, all SAS, for a total of 198
da(4) instances.

Thanks for taking a look... I'm happy to try adding some additional
debugging if it would be helpful.

-GAWollman