kern/72208: panic: bio_completed can't be greater than bio_length

[Jeremy C. Reed]

>Number:         72208
>Category:       kern
>Synopsis:       panic: bio_completed can't be greater than bio_length
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Sep 30 16:30:27 GMT 2004
>Closed-Date:
>Last-Modified:
>Originator:     Jeremy C. Reed
>Release:        -current as of a couple days ago
>Organization:
>Environment:
FreeBSD tahoma.reedmedia.net 6.0-CURRENT FreeBSD 6.0-CURRENT #0: Mon Sep 27 09:25:32 PDT 2004     reed at tahoma.reedmedia.net:/usr/obj/usr/src/sys/OLDCARD  i386

>Description:
      current system running OLDCARD has continuing messages like:
ad0: TIMEOUT - READ retrying (2 retries left) LBA=235520522

ad0: TIMEOUT - READ retrying (2 retries left) LBA=101139222
ad0: WARNING - WRITE no interrupt but good status

It ran fine with FreeBSD 4.x and 5.0 and 5.1. It is a Toshiba Tecra 740CDT.

It has panic'd and gone into kernel debugger a few times since I upgraded from FreeBSD 5.1 to current:
panic: bio_completed can't be greater than bio_length
cpuid = 0
KDB: enter: panic
[thread 100027]
Stopped at      kdb_enter+0x2b: nop
db>

So I typed "trace":
kdb_enter(c07f1b2f) at kdb_enter+0x2b
panic(c07ecf1d,c14e4e70,c0325c00) at panic+0x127
g_io_deliver(c1473840,0) at g_io_deliver+0x80
g_disk_done(c14e44e70) at g_disk_done+0x9b
biodone(c14e4e70,c14599db,c0325cb4,c14599d8) at biodone+0x57
ad_done(c14599db) at ad_done+0x2d
ata_completed(c14599d8,c8325cd4,0,c07ecd3a,1b5) at at_completed+0x3ee
g_io_schedule_up
g_up_procbody
fork_exit
fork_trampoline
(I didn't write it all down, ran out of time, the numbers change from each time it goes into debugger .. is there wa way to save this?)

dmesg follows:
WARNING: /tmp was not properly dismounted
WARNING: /usr was not properly dismounted
WARNING: /var was not properly dismounted
ed1 at port 0x300-0x31f irq 5 flags 0x80000 slot 1 on pccard1
ed1: [GIANT-LOCKED]
ed1: Ethernet address: 00:04:5a:08:78:e1
ed1: if_start running deferred for Giant
type Linksys (16 bit) 
miibus0: <MII bus> on ed1
ukphy0: <Generic IEEE 802.3u media interface> on miibus0
ukphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
ad0: TIMEOUT - READ retrying (2 retries left) LBA=236292110
panic: bio_completed can't be greater than bio_length
cpuid = 0
KDB: enter: panic
Uptime: 7m17s
Cannot dump. No dump device defined.
Automatic reboot in 15 seconds - press a key on the console to abort
Rebooting...
Copyright (c) 1992-2004 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
The Regents of the University of California. All rights reserved.
FreeBSD 6.0-CURRENT #0: Mon Sep 27 09:25:32 PDT 2004
    reed at tahoma.reedmedia.net:/usr/obj/usr/src/sys/OLDCARD
WARNING: WITNESS option enabled, expect reduced performance.
Timecounter "i8254" frequency 1193182 Hz quality 0
CPU: Pentium/P55C (166.19-MHz 586-class CPU)
  Origin = "GenuineIntel"  Id = 0x544  Stepping = 4
  Features=0x8001bf<FPU,VME,DE,PSE,TSC,MSR,MCE,CX8,MMX>
real memory  = 151126016 (144 MB)
avail memory = 138252288 (131 MB)
pnpbios: Bad PnP BIOS data checksum
Intel Pentium detected, installing workaround for F00F bug
npx0: [FAST]
npx0: <math processor> on motherboard
npx0: INT 16 interface
pcib0: <Host to PCI bridge> pcibus 0 on motherboard
pci0: <PCI bus> on pcib0
pci0: <display, VGA> at device 4.0 (no driver attached)
cpu0 on motherboard
isa0: <ISA bus> on motherboard
orm0: <ISA Option ROM> at iomem 0xe4000-0xeffff on isa0
pmtimer0 on isa0
ata0 at port 0x3f6,0x1f0-0x1f7 irq 14 on isa0
ata1 at port 0x376,0x170-0x177 irq 15 on isa0
atkbdc0: <Keyboard controller (i8042)> at port 0x64,0x60 on isa0
atkbd0: <AT Keyboard> irq 1 on atkbdc0
kbd0 at atkbd0
atkbd0: [GIANT-LOCKED]
psm0: <PS/2 Mouse> irq 12 on atkbdc0
psm0: [GIANT-LOCKED]
psm0: model Generic PS/2 mouse, device ID 0
fdc0: <NEC 765 or clone> at port 0x3f0-0x3f5 irq 6 drq 2 on isa0
fdc0: [FAST]
fd0: <1440-KB 3.5" drive> on fdc0 drive 0
pcic0: <Intel i82365SL-A/B> at port 0x3e0 iomem 0xd0000 on isa0
pcic0: Polling mode
pccard0: <PC Card 16-bit bus (classic)> on pcic0
pccard1: <PC Card 16-bit bus (classic)> on pcic0
ppc0: <Parallel port> at port 0x378-0x37f irq 7 on isa0
ppc0: Generic chipset (ECP/PS2/NIBBLE) in COMPATIBLE mode
ppc0: FIFO with 16/16/16 bytes threshold
ppbus0: <Parallel port bus> on ppc0
plip0: <PLIP network interface> on ppbus0
lpt0: <Printer> on ppbus0
lpt0: Interrupt-driven port
ppi0: <Parallel I/O> on ppbus0
sc0: <System console> at flags 0x100 on isa0
sc0: VGA <16 virtual consoles, flags=0x300>
sio0 at port 0x3f8-0x3ff irq 4 flags 0x10 on isa0
sio0: type 16550A
sio1 at port 0x2f8-0x2ff irq 3 on isa0
sio1: type 16550A
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
Timecounter "TSC" frequency 166194573 Hz quality 800
Timecounters tick every 10.000 msec
ad0: 2937MB <TOSHIBA MK3003MAN/D4.02 A> [5968/16/63] at ata0-master PIO4
pccard: card inserted, slot 1
ATAPI_RESET time = 20us
acd0: CDROM <TOSHIBA CD-ROM XM-1502B/2996> at ata1-master PIO3
WARNING: / was not properly dismounted
Mounted root from ufs:/dev/ad0s1a.
WARNING: /tmp was not properly dismounted
WARNING: /usr was not properly dismounted
/usr: mount pending error: blocks 232 files 0
/usr: superblock summary recomputed
WARNING: /var was not properly dismounted
ed1 at port 0x300-0x31f irq 5 flags 0x80000 slot 1 on pccard1
ed1: [GIANT-LOCKED]
ed1: Ethernet address: 00:04:5a:08:78:e1
ed1: if_start running deferred for Giant
type Linksys (16 bit) 
miibus0: <MII bus> on ed1
ukphy0: <Generic IEEE 802.3u media interface> on miibus0
ukphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto


>How-To-Repeat:
      In my case, turn on or reboot and wait a little while.
>Fix:
      Sorry unknown.
>Release-Note:
>Audit-Trail:
>Unformatted: