Project

General

Profile

Actions

Bug #5504

open

crash: kernel heap corruption detected

Added by Gernot Strasser almost 9 years ago. Updated 8 months ago.

Status:
New
Priority:
Normal
Assignee:
-
Category:
-
Start date:
2015-01-01
Due date:
% Done:

0%

Estimated time:
Difficulty:
Medium
Tags:
needs-triage
Gerrit CR:
External Bug:

Description

running Smartos on latests bits i got a crashdump while scrubbing a pool containing filesystems with big blocks:

kernel memory allocator : buffer freed to wrong cache
buffer was allocated from zio_data_buf_131072,
caller attempting free to zio_data_buf_28672

more details see screenshot at http://images.inside-irc.net/image/IMG_3795%201-1evo5xz9b6b.jpg
crash dump available as well.
thx


Related issues

Related to illumos gate - Bug #15431: Corner-case: pool import vs. pool taskq can cause panicNewDan McDonald

Actions
Has duplicate illumos gate - Bug #9196: zfs panic with 144 vdevs in zpoolDuplicate2018-02-24

Actions
Actions #1

Updated by Gernot Strasser almost 9 years ago

Multiple crashes on different systems have now happened to me, any takers?

kernel memory allocator:
buffer freed to wrong cache
buffer was allocated from zio_data_buf_8192,
caller attempting free to zio_data_buf_1048576.
buffer=ffffff019de4e000 bufctl=ffffff07e7f520e8 cache: zio_data_buf_1048576

panic[cpu3]/thread=ffffff002e017c40:
kernel heap corruption detected

ffffff002e017a50 fffffffffba28cd4 ()
ffffff002e017ab0 genunix:kmem_slab_free+c1 ()
ffffff002e017b20 genunix:kmem_magazine_destroy+6e ()
ffffff002e017b60 genunix:kmem_depot_ws_reap+5d ()
ffffff002e017c20 genunix:taskq_thread+2d0 ()
ffffff002e017c30 unix:thread_start+8 ()

Where can I upload a crash dump ?

Actions #3

Updated by Marcel Telka about 1 year ago

  • Related to Bug #9196: zfs panic with 144 vdevs in zpool added
Actions #4

Updated by Marcel Telka about 1 year ago

I encountered the same (or very similar) panic today:

> ::status
debugging crash dump vmcore.12 (64-bit) from server
operating system: 5.11 illumos-8b26092d55 (i86pc)
build version: heads/master-0-g8b26092d55-dirty

image uuid: a7b4199f-0037-c512-b612-8794e6860b23
panic message: BAD TRAP: type=e (#pf Page fault) rp=fffffe003c817970 addr=90de3 occurred in module "genunix" due to an illegal access to a user address
dump content: kernel pages only
> ::stack
kmem_slab_free+0x71(fffffe2ca840d008, fffffe2291c17000)
kmem_magazine_destroy+0xa7(fffffe2ca840d008, fffffe2dcbe6d080, 1f)
kmem_depot_ws_reap+0x65(fffffe2ca840d008)
taskq_thread+0x2cd(fffffe2ca6d75c68)
thread_start+0xb()
>

This is with illumos-gate built on 2022-11-14.

Actions #5

Updated by Marcel Telka 8 months ago

One more similar panic today:

> ::status
debugging crash dump vmcore.14 (64-bit) from server
operating system: 5.11 illumos-fcfad32eae (i86pc)
build version: heads/master-0-gfcfad32eae-dirty

image uuid: 4ada2d21-d00b-6bd0-d238-f8268c94ae8f
panic message: BAD TRAP: type=d (#gp General protection) rp=fffffe003c817870 addr=fffffe2d555e02b0
dump content: kernel pages only
> ::stack
vmem_hash_delete+0x58(fffffe2c9ea5c000, fffffe236f480000, 1000)
vmem_xfree+0x4b(fffffe2c9ea5c000, fffffe236f480000, 1000)
vmem_free+0x1a(fffffe2c9ea5c000, fffffe236f480000, 1000)
kmem_slab_destroy+0x87(fffffe2ca83f0008, fffffe2d555e02b0)
kmem_slab_free+0x2d7(fffffe2ca83f0008, fffffe236f480000)
kmem_magazine_destroy+0xa7(fffffe2ca83f0008, fffffe2d13e23000, 1f)
kmem_depot_ws_reap+0x65(fffffe2ca83f0008)
taskq_thread+0x2cd(fffffe2ca6d87c68)
thread_start+0xb()
>

Actions #6

Updated by Marcel Telka 8 months ago

  • Has duplicate Bug #9196: zfs panic with 144 vdevs in zpool added
Actions #7

Updated by Marcel Telka 8 months ago

  • Related to deleted (Bug #9196: zfs panic with 144 vdevs in zpool)
Actions #8

Updated by Marcel Telka 8 months ago

  • Related to Bug #15431: Corner-case: pool import vs. pool taskq can cause panic added
Actions #9

Updated by Marcel Telka 8 months ago

I suspect #15431 could be related.

Actions

Also available in: Atom PDF