Re: 2.4 kernels - "attempt to access beyond end of device"

[Michal Jaegermann]

To add to my report about troubles with disk activity on a system with
PDC20265 IDE controller (this is on Asus AV7 mobo, BTW) I tried the
same experiments with 2.2.19pre14 patched with ide patches to get a
support for Promise.

I got similar results - i.e. problems after some 130-150 megabytes
was copied.  On different occasions I got things like that:

file_cluster badly computed!!! 0 <> 536870911
file_cluster badly computed!!! 1 <> 0

practically immediately and followed by a period of a lively disk
activity and a crash.

Whoops: end_buffer_io_async: b_count != 1 on async io.

after which 'cp' process hanged in a "D" state.

attempt to access beyond end of device
21:01: rw=0, want=537238629, limit=4506201
dev 21:01 blksize=512 blocknr=1074477258 sector=1074477258 size=512 count=1
...
(and more of these)  terminated with oops decoded below.

To take 'vfat' out of picture I also tried 'cp' from ext2 partitions
(I had to collect number of things as I do not have enough of data on
this system yet) to an ext2 partition while using 2.4.2-ac5.  This resulted
in:

EXT2-fs error (device ide3(34,9)): ext2_readdir: bad entry in
directory #16584: inode out of bounds - offset=0, inode=134234312,
rec_len=12, name_len=1
EXT2-fs error (device ide3(34,9)): ext2_readdir: bad entry in
directory #131542: inode out of bounds - offset=0, inode=134349270,
rec_len=12, name_len=1
EXT2-fs error (device ide3(34,9)): ext2_readdir: bad entry in
directory #82294: inode out of bounds - offset=0, inode=134300022,
rec_len=12, name_len=1
EXT2-fs error (device ide3(34,9)): ext2_readdir: bad entry in
directory #164456: inode out of bounds - offset=0, inode=134382184,
rec_len=12, name_len=1
EXT2-fs error (device ide3(34,9)): ext2_readdir: bad entry in
directory #98872: inode out of bounds - offset=0, inode=134316600,
rec_len=12, name_len=1
22:09: rw=0, want=537530884, limit=1574338
attempt to access beyond end of device
22:09: rw=0, want=537530884, limit=1574338
.....
punctuated by oops.

Here is a decoded oops from 2.2.19pre14

Unable to handle kernel paging request at virtual address 08000000
current->tss.cr3 = 1f052000, %cr3 = 1f052000
*pde = 1f67b067
Oops: 0000
CPU:    0
EIP:    0010:[<c01277a8>]
Using defaults from ksymoops -t elf32-i386 -a i386
EFLAGS: 00010206
eax: 08000000   ebx: 00000007   ecx: 00053d24   edx: 08000000
esi: 0000000d   edi: 00002202   ebp: 0004906a   esp: de955e7c
ds: 0018   es: 0018   ss: 0018
Process cp (pid: 573, process nr: 19, stackpage=de955000)
Stack: 0004906a 00002202 00053d24 c01277e8 00002202 0004906a 00000200 00000000 
       c0127b9a 00002202 0004906a 00000200 00000000 0004906a 00000000 ded6a200 
       ffffffff c0145398 00002202 0004906a 00000200 c014a0db ded6a200 0004906a 
Call Trace: [<c01277e8>] [<c0127b9a>] [<c0145398>] [<c014a0db>] [<c0145b6c>] [<c014a26f>] [<c014784e>] 
       [<c01262d9>] [<c01476d0>] [<c0109534>] 
Code: 8b 00 39 6a 04 75 15 8b 4c 24 20 39 4a 08 75 0c 66 39 7a 0c 

>>EIP; c01277a8 <find_buffer+68/90>   <=====
Trace; c01277e8 <get_hash_table+18/48>
Trace; c0127b9a <getblk+1e/144>
Trace; c0145398 <fat_getblk+3c/4c>
Trace; c014a0db <fat_add_cluster1+243/3cc>
Trace; c0145b6c <fat_get_cluster+58/98>
Trace; c014a26f <fat_add_cluster+b/2c>
Trace; c014784e <fat_file_write+17e/4ac>
Trace; c01262d9 <sys_write+e5/118>
Trace; c01476d0 <fat_file_write+0/4ac>
Trace; c0109534 <system_call+34/38>
Code;  c01277a8 <find_buffer+68/90>
00000000 <_EIP>:
Code;  c01277a8 <find_buffer+68/90>   <=====
   0:   8b 00                     mov    (%eax),%eax   <=====
Code;  c01277aa <find_buffer+6a/90>
   2:   39 6a 04                  cmp    %ebp,0x4(%edx)
Code;  c01277ad <find_buffer+6d/90>
   5:   75 15                     jne    1c <_EIP+0x1c> c01277c4 <find_buffer+84/90>
Code;  c01277af <find_buffer+6f/90>
   7:   8b 4c 24 20               mov    0x20(%esp,1),%ecx
Code;  c01277b3 <find_buffer+73/90>
   b:   39 4a 08                  cmp    %ecx,0x8(%edx)
Code;  c01277b6 <find_buffer+76/90>
   e:   75 0c                     jne    1c <_EIP+0x1c> c01277c4 <find_buffer+84/90>
Code;  c01277b8 <find_buffer+78/90>
  10:   66 39 7a 0c               cmp    %di,0xc(%edx)

And here is the one from ext2 to ext2 copy under 2.4.2-ac5

Unable to handle kernel paging request at virtual address ea096084
c0128edf
*pde = 00000000
Oops: 0000
CPU:    0
EIP:    0010:[<c0128edf>]
Using defaults from ksymoops -t elf32-i386 -a i386
EFLAGS: 00010003
eax: 0800001b   ebx: 0800001b   ecx: 00000282   edx: ca096000
esi: dffd7cdc   edi: 00000000   ebp: 00001000   esp: dec6de38
ds: 0018   es: 0018   ss: 0018
Process cp (pid: 543, stackpage=dec6d000)
Stack: 0000220a 0001220a 00000286 00000010 c17cb2e0 00000000 c0133314 dffd7cdc 
       00000003 c17cb2e0 00000000 c01333d2 00000001 0007ccfc 00000000 c0121be9 
       220a0000 c17cb2e0 c17cb2e0 0000220a 00000000 c0133687 c17cb2e0 00001000 
Call Trace: [<c0133314>] [<c01333d2>] [<c0121be9>] [<c0133687>] [<c01339ab>] [<c0123e8c>] [<c013423d>] 
       [<c014ffb0>] [<c0126886>] [<c014ffb0>] [<c0124a70>] [<c0131468>] [<c01090a3>] 
Code: 8b 44 82 18 0f af 5e 0c 89 42 14 03 5a 0c 40 75 05 8b 02 89 

>>EIP; c0128edf <kmem_cache_alloc+1f/60>   <=====
Trace; c0133314 <get_unused_buffer_head+34/90>
Trace; c01333d2 <create_buffers+22/1c0>
Trace; c0121be9 <vmtruncate+d9/1a0>
Trace; c0133687 <create_empty_buffers+17/70>
Trace; c01339ab <__block_prepare_write+4b/2b0>
Trace; c0123e8c <add_to_page_cache_unique+ac/c0>
Trace; c013423d <block_prepare_write+1d/40>
Trace; c014ffb0 <ext2_get_block+0/4c0>
Trace; c0126886 <generic_file_write+3b6/5d0>
Trace; c014ffb0 <ext2_get_block+0/4c0>
Trace; c0124a70 <file_read_actor+0/60>
Trace; c0131468 <sys_write+98/d0>
Trace; c01090a3 <system_call+33/40>
Code;  c0128edf <kmem_cache_alloc+1f/60>
00000000 <_EIP>:
Code;  c0128edf <kmem_cache_alloc+1f/60>   <=====
   0:   8b 44 82 18               mov    0x18(%edx,%eax,4),%eax   <=====
Code;  c0128ee3 <kmem_cache_alloc+23/60>
   4:   0f af 5e 0c               imul   0xc(%esi),%ebx
Code;  c0128ee7 <kmem_cache_alloc+27/60>
   8:   89 42 14                  mov    %eax,0x14(%edx)
Code;  c0128eea <kmem_cache_alloc+2a/60>
   b:   03 5a 0c                  add    0xc(%edx),%ebx
Code;  c0128eed <kmem_cache_alloc+2d/60>
   e:   40                        inc    %eax
Code;  c0128eee <kmem_cache_alloc+2e/60>
   f:   75 05                     jne    16 <_EIP+0x16> c0128ef5 <kmem_cache_alloc+35/60>
Code;  c0128ef0 <kmem_cache_alloc+30/60>
  11:   8b 02                     mov    (%edx),%eax
Code;  c0128ef2 <kmem_cache_alloc+32/60>
  13:   89 00                     mov    %eax,(%eax)

Does this rings a bell with anybody?  I cannot exclude here a faulty
hardware, but it is not overclocked in any way, or BIOS (Award ACPI BIOS
1005C - but this should not matter once I booted - right?).

   Michal