Huge paged pool allocation with tag LS2s, from what?

Question

Process Explorer is showing odd memory usage patterns under "virtual size" for various programs, and the paged pool usage is high. Running poolmon, there is a single nonpaged allocation under the LS2s tag, weighing in at 293050257170759991(!) bytes, which is almost certainly in error. There are also about 69 million paged pool allocations totalling about 4.3 gigs under the same tag.

While the tag isn't listed explicitly, the tag of "LS??" is defined as "LM server allocations" under the pooltag list. Running a string search, this sequence comes up in srv2.sys, among other similar tags. I've installed the latest hotfix for that driver, but I'm still seeing the same patterns. Any idea where to go from here?

Answer 1

Pooltag LS2s is used for SMB2. Taken from the pooltag.txt from Windows debugger:

LS2s - srv2.sys     -     SMB2 session

You can use xperf/WPA to tarce the callstack of the allocation and look if this helps:

Defrag Tools: #48 - WPT - Memory Analysis - Pool

http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-48-WPT-Memory-Analysis-Pool