From owner-freebsd-stable@FreeBSD.ORG  Wed Jan 29 21:37:18 2014
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id C786B21F;
 Wed, 29 Jan 2014 21:37:18 +0000 (UTC)
Received: from hergotha.csail.mit.edu
 (wollman-1-pt.tunnel.tserv4.nyc4.ipv6.he.net [IPv6:2001:470:1f06:ccb::2])
 (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by mx1.freebsd.org (Postfix) with ESMTPS id 803CF1826;
 Wed, 29 Jan 2014 21:37:18 +0000 (UTC)
Received: from hergotha.csail.mit.edu (localhost [127.0.0.1])
 by hergotha.csail.mit.edu (8.14.7/8.14.7) with ESMTP id s0TLbDKS006717;
 Wed, 29 Jan 2014 16:37:13 -0500 (EST)
 (envelope-from wollman@hergotha.csail.mit.edu)
Received: (from wollman@localhost)
 by hergotha.csail.mit.edu (8.14.7/8.14.4/Submit) id s0TLbD5G006716;
 Wed, 29 Jan 2014 16:37:13 -0500 (EST) (envelope-from wollman)
Date: Wed, 29 Jan 2014 16:37:13 -0500 (EST)
Message-Id: <201401292137.s0TLbD5G006716@hergotha.csail.mit.edu>
From: wollman@csail.mit.edu
To: hps@bitfrost.no
Subject: Heap overflow in mps(4) (was: Re: stable/9 mps(4) rev 254938 == BOOM!)
In-Reply-To: <52E94FC2.1010901@bitfrost.no>
References: <21225.19508.683025.581620@khavrinen.csail.mit.edu>
Organization: none
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.4.3
 (hergotha.csail.mit.edu [127.0.0.1]); Wed, 29 Jan 2014 16:37:13 -0500 (EST)
X-Spam-Status: No, score=-1.0 required=5.0 tests=ALL_TRUSTED
 autolearn=disabled version=3.3.2
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on
 hergotha.csail.mit.edu
Cc: freebsd-scsi@freebsd.org, ken@freebsd.org, scottl@freebsd.org,
 freebsd-stable@freebsd.org
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-stable>,
 <mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable/>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
 <mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 29 Jan 2014 21:37:18 -0000

In article <52E94FC2.1010901@bitfrost.no>, hps@bitfrost.no writes:
>To me this sounds like someone is writing outside their assigned area.
>
>options 	DEBUG_REDZONE

hselasky@ nails it!  The mps(4) changes in stable/9 r254938 reliably
cause a GPF during boot in non-debugging kernels, but adding
DEBUG_REDZONE is sufficient to prevent the fault.  Whichever heap
allocation is being overrun does *not* ever get freed: there are no
redzone messages on the console.  (It also boots much faster with the
new probing code, which is certainly a plus for debugging.)

I can confirm that the tip of stable/9 (r261256) also works with
DEBUG_REDZONE and fails without it.  Only trouble is that I need to do
performance testing, which DEBUG_REDZONE is not exactly going to help
with.

-GAWollman