illumos gate

Multiple crashes on different systems have now happened to me, any takers?

kernel memory allocator:
buffer freed to wrong cache
buffer was allocated from zio_data_buf_8192,
caller attempting free to zio_data_buf_1048576.
buffer=ffffff019de4e000 bufctl=ffffff07e7f520e8 cache: zio_data_buf_1048576

panic[cpu3]/thread=ffffff002e017c40:
kernel heap corruption detected

ffffff002e017a50 fffffffffba28cd4 ()
ffffff002e017ab0 genunix:kmem_slab_free+c1 ()
ffffff002e017b20 genunix:kmem_magazine_destroy+6e ()
ffffff002e017b60 genunix:kmem_depot_ws_reap+5d ()
ffffff002e017c20 genunix:taskq_thread+2d0 ()
ffffff002e017c30 unix:thread_start+8 ()

Where can I upload a crash dump ?

Issue seems identical to http://www.listbox.com/member/archive/182191/2015/01/sort/time_rev/page/1/entry/11:84/20150126102848:0193750E-A570-11E4-93E5-83F5155B1524/

I encountered the same (or very similar) panic today:

> ::status
debugging crash dump vmcore.12 (64-bit) from server
operating system: 5.11 illumos-8b26092d55 (i86pc)
build version: heads/master-0-g8b26092d55-dirty

image uuid: a7b4199f-0037-c512-b612-8794e6860b23
panic message: BAD TRAP: type=e (#pf Page fault) rp=fffffe003c817970 addr=90de3 occurred in module "genunix" due to an illegal access to a user address
dump content: kernel pages only
> ::stack
kmem_slab_free+0x71(fffffe2ca840d008, fffffe2291c17000)
kmem_magazine_destroy+0xa7(fffffe2ca840d008, fffffe2dcbe6d080, 1f)
kmem_depot_ws_reap+0x65(fffffe2ca840d008)
taskq_thread+0x2cd(fffffe2ca6d75c68)
thread_start+0xb()
>

One more similar panic today:

> ::status
debugging crash dump vmcore.14 (64-bit) from server
operating system: 5.11 illumos-fcfad32eae (i86pc)
build version: heads/master-0-gfcfad32eae-dirty

image uuid: 4ada2d21-d00b-6bd0-d238-f8268c94ae8f
panic message: BAD TRAP: type=d (#gp General protection) rp=fffffe003c817870 addr=fffffe2d555e02b0
dump content: kernel pages only
> ::stack
vmem_hash_delete+0x58(fffffe2c9ea5c000, fffffe236f480000, 1000)
vmem_xfree+0x4b(fffffe2c9ea5c000, fffffe236f480000, 1000)
vmem_free+0x1a(fffffe2c9ea5c000, fffffe236f480000, 1000)
kmem_slab_destroy+0x87(fffffe2ca83f0008, fffffe2d555e02b0)
kmem_slab_free+0x2d7(fffffe2ca83f0008, fffffe236f480000)
kmem_magazine_destroy+0xa7(fffffe2ca83f0008, fffffe2d13e23000, 1f)
kmem_depot_ws_reap+0x65(fffffe2ca83f0008)
taskq_thread+0x2cd(fffffe2ca6d87c68)
thread_start+0xb()
>

I suspect #15431 could be related.