System panic due to kernel heap corruption (Doc ID 2141450.1)

Last updated on MAY 25, 2016

Applies to:

Solaris SPARC Operating System - Version 10 1/13 U11 to 11.1 [Release 10.0 to 11.0]
Information in this document applies to any platform.

Symptoms

System panics with panic string and stack similar to:

CAT(vmcore.1/11V)> panic
panic on CPU 0
panic string: kernel heap corruption detected
...
unix:vpanic_common+0x78(0x12df748, 0x2a103cade28, 0xc8, 0x2a103cadbf8,
0x2a103cadbf8, 0x2000)
unix:panic+0x1c(0x12df748, 0xc4004796dc40, 0, 0x30000060b18, 0x12df400, 1)
genunix:kmem_error+0x4b8(1, 0x30000060ab0, 0xc4004796dc40)
genunix:kmem_cache_free_debug+0x12c(0x30000060ab0, 0xc4004796dc40, 0x1209b98)
genunix:kmem_cache_free+0x108(0x30000060ab0?, 0xc4004796dc40)
genunix:dblk_lastfree(, 0xc4004796dc40) - frame recycled
genunix:freemsg+0x80(0xc4004796bd20)
vnet:vgen_dringsend+0x4d4(0xc40026a96b80?, 0xc4004796bd20, 1)
vnet:vgen_tx+0xc4(0xc400259048f0, 0xc4002528e280, 1)
vnet:vnet_tx_ring_send+0x264(0xc400274a12f8)
mac:mac_tx_ring_drain+0x80(0xc4002762d440, 1, 0)
mac:mac_tx_ring+0x178(0xc4002762d440, 0xc4002528e280, 0, 0, 0)
mac:mac_tx_single+0x4fc(0xc40027600c40, 0xc4002528e280, 9, 0, 0,0xc40026540640)
mac:mac_tx+0x68(0xc40027600c40, 0xc4002528e280, 9, 0, 0)
dld:str_mdata_fastpath_put+0xb0(0xc40028e21ac0, 0xc4002528e280, 9, 0)
ip:ip_xmit+0x560(0xc4002528e280, , 0x2b80016061, , , 0, 0, 0xc40045e0d668)
ip:ire_send_wire_v4+0x32c(, 0xc4002528e280?)
ip:conn_ip_output(0xc4002528e280, 0xc40045e0d500, 0xc4004c6965b0,
0xc4004617cd80, 0xc4004c6965c4, 0x40180000) - frame recycled
ip:tcp_send+0xc0c(0xc4004617cd80, 0x5b4, 0x28, 0x14, 0, 0x2a103caecdc, , , ,0x7a0c)
ip:tcp_wput_data+0x5e4()
ip:tcp_output(0xc4004617ca80, 0xc4002c29cf20, 0xc40024d0fd40, 0, , 0x8c) -frame recycled
ip:squeue_enter+0xb8(, 0xc4002c29cf20, , 1, 0, 4, 7)
ip:tcp_sendmsg+0x1b0(0xc4004617ca80, 0xc4002c29cf20, , 0xc400417930d8)
sockfs:so_sendmsg+0x274(0xc40046380e90, 0x2a103caf0a0, 0x2a103caf248,0xc400417930d8)
sockfs:socket_sendmsg+0x48(0xc40046380e90, , 0x2a103caf248, 0xc400417930d8)
sockfs:socket_vop_write+0x38(0xc4004643b700, 0x2a103caf248, 0,0xc400417930d8, 0)
genunix:fop_write+0x84(0xc4004643b700, 0x2a103caf248, 0, 0xc400417930d8, 0)
genunix:write+0x298()
unix:_syscall_no_proc_exit32+0x78()

and

CAT(vmcore.1/10V)> panic kmem
kmem_panic_info @ 0x1a700e0
timestamp: 0x140f1ba6d1199e (0.255184260 seconds earlier)
error: REDZONE - redzone violation (write past end of buf)
buffer: 0x60034fb57c0
realbuf: 0x60034fb57c0
cache: 0x3001a216000 (streams_dblk_16) size 128
realcache: 0x3001a216000 (streams_dblk_16) size 128
slab: 0x30869370f78
bufctl: 0x30510579ba0

kmem_buftag @ 0x60034fb5840
redzone: 0xfeedface00008100 (size 131, INVALID)
bufctl: 0xe030510579ba0
bxstat: 0x305b147534d (UNKNOWN - 0xe0000a110c8ed)

skipping KMEM_REDZONE_BYTE check, size INVALID

kmem_bufctl_audit @ 0x30510579ba0
next: NULL
addr: 0x60034fb57c0
slab: 0x30869370f78
cache: 0x3001a216000 (streams_dblk_16) size 128
timestamp: 0x140f1ba4f52f7a (0.286373800 seconds earlier)
thread: 0x2a103f97c80
lastlog: 0x30010346900
contents: NULL
genunix:kmem_cache_alloc+0x150
genunix:allocb+0x94
mac_ether:mac_ether_header+0x34
dls:dls_header+0xc0
dld:proto_unitdata_req+0x148
unix:putnext+0x218
arp:ar_xmit+0x2d0
arp:ar_rput+0x704
unix:putnext+0x218
dld:dld_str_rx_unitdata+0xe4
dls:i_dls_link_rx_common+0x380
mac:mac_rx+0x8c
vnet:vnet_rx+0x70
vnet:vgen_rx+0x24
vnet:vgen_process_dringdata+0xf4

 

Cause

Sign In with your My Oracle Support account

Don't have a My Oracle Support account? Click to get started

My Oracle Support provides customers with access to over a
Million Knowledge Articles and hundreds of Community platforms