PANIC: IORequest::_CopyData(): invalid range: (208072704, 1838)

[axeld]

Happened during compilation of pe (DEBUG=1 jam -q pe). KDL session:

PANIC: IORequest::_CopyData(): invalid range: (208072704, 1838)
Welcome to Kernel Debugging Land...
Thread 23 "scsi scheduler" running on CPU 0
kdebug> sc
stack trace for thread 23 "scsi scheduler"
    kernel stack: 0x9f4ed000 to 0x9f4f1000
frame            caller     <image>:function + offset
 0 9f4f0ac8 (+  48) 80056b29   <kernel>:invoke_debugger_command + 0x00ed
 1 9f4f0af8 (+  64) 80056921   <kernel>:invoke_pipe_segment__FP21debugger_command_pipelPc + 0x0079
 2 9f4f0b38 (+  64) 80056c69   <kernel>:invoke_debugger_command_pipe + 0x009d
 3 9f4f0b78 (+  48) 80057b44   <kernel>:_ParseCommandPipe__16ExpressionParserRi + 0x0234
 4 9f4f0ba8 (+  48) 800574fa   <kernel>:EvaluateCommand__16ExpressionParserPCcRi + 0x01de
 5 9f4f0bd8 (+ 224) 80058f10   <kernel>:evaluate_debug_command + 0x0088
 6 9f4f0cb8 (+  64) 80054f9e   <kernel>:kernel_debugger_loop__Fv + 0x01ae
 7 9f4f0cf8 (+  48) 80055b37   <kernel>:kernel_debugger + 0x0117
 8 9f4f0d28 (+ 192) 80055a15   <kernel>:panic + 0x0029
 9 9f4f0de8 (+  64) 8006d9f3   <kernel>:_CopyData__9IORequestPvxUlb + 0x006b
10 9f4f0e28 (+  64) 8006d981   <kernel>:CopyData__9IORequestPCvxUl + 0x0029
11 9f4f0e68 (+ 112) 8006c3d2   <kernel>:Finish__11IOOperation + 0x0206
12 9f4f0ed8 (+  80) 8006738c   <kernel>:_Finisher__11IOScheduler + 0x012c
13 9f4f0f28 (+  96) 800679fb   <kernel>:_GetNextUnscheduledRequest__11IOScheduler + 0x0177
14 9f4f0f88 (+  48) 80067b3d   <kernel>:_Scheduler__11IOScheduler + 0x0015
15 9f4f0fb8 (+  32) 80067bea   <kernel>:_SchedulerThread__11IOSchedulerPv + 0x0012
16 9f4f0fd8 (+  32) 8004d1db   <kernel>:_create_kernel_thread_kentry__Fv + 0x001b
17 9f4f0ff8 (+1622208520) 8004d178   <kernel>:thread_kthread_exit__Fv + 0x0000
kdebug> call 11 -1
thread 23, scsi scheduler
9f4f0e68 8006c3d2   <kernel>:Finish__11IOOperation(0x90c94fa0)
kdebug> io_operation _arg1
io_operation at 0x90c94fa0
  parent:           0x90c8e660
  status:           No error
  dma buffer:       0x90c76660
  offset:           208072704 (original: 208072768)
  length:           29184    (original: 29120)
  transferred:      29120
  block size:       512
  saved vec index:  52428
  saved vec length: 52428
  r/w:              read
  phase:            do all
  partial begin:    yes
  partial end:      no
  bounce buffer:    yes
kdebug> io_request _parent
io_request at 0x90c8e660
  parent:            0x9248ebf8
  status:            No Error (1)
  mutex:             0x90c8e67c
  IOBuffer:          0x90d40a40
  offset:            208072768
  length:            131008
  transfer size:     131008
  relative offset:   0
  pending children:  6
  flags:             0x0
  team:              1063
  r/w:               read
  partial transfer:  no
  finished cvar:     0x90c8e6cc
  iteration:
    vec index:       1
    vec offset:      0
    remaining bytes: 0
  callbacks:
    finished 0x00000000, cookie 0x00000000
    iteration 0x00000000, cookie 0x00000000
  children:
    0x90c94fa0
    0x90c95000
    0x90c95050
    0x90c950a0
    0x90c950f0
    0x90c95140
kdebug> dma_buffer 0x90c76660
DMABuffer at 0x90c76660
  bounce buffer:      0x80946000 (physical 0xedf1000)
  bounce buffer size: 16384
  vecs:               16
    [0] 0x0edf1000, 1902
    [1] 0x1198b8d4, 1836
    [2] 0x0edf176e, 1838
    [3] 0x1198b8d4, 1836
    [4] 0x0edf1e9c, 1838
    [5] 0x1198b8d4, 1836
    [6] 0x0edf25ca, 1838
    [7] 0x1198b8d4, 1836
    [8] 0x0edf2cf8, 1838
    [9] 0x1198b8d4, 1836
    [10] 0x0edf3426, 1838
    [11] 0x1198b8d4, 1836
    [12] 0x0edf3b54, 1838
    [13] 0x1198b8d4, 1836
    [14] 0x0edf4282, 1838
    [15] 0x1198b8d4, 1564
kdebug> io_buffer _buffer
IOBuffer at 0x90d40a40
  origin:     user
  kind:       virtual
  length:     131008
  capacity:   1
  vecs:       1
    [0] 0x18c948d3, 131008
kdebug> io_request _parent
io_request at 0x9248ebf8
  parent:            0x00000000
  status:            No Error (1)
  mutex:             0x9248ec14
  IOBuffer:          0x90d40d40
  offset:            8256
  length:            131008
  transfer size:     131008
  relative offset:   0
  pending children:  1
  flags:             0x0
  team:              1063
  r/w:               read
  partial transfer:  no
  finished cvar:     0x9248ec64
  iteration:
    vec index:       1
    vec offset:      0
    remaining bytes: 0
  callbacks:
    finished 0x80095840, cookie 0x90d967d0
    iteration 0x800955c8, cookie 0x90d967d0
  children:
    0x90c8e660
kdebug> child1=0x90c94fa0
[...]
kdebug> io_operation child1
io_operation at 0x90c94fa0
  parent:           0x90c8e660
  status:           No error
  dma buffer:       0x90c76660
  offset:           208072704 (original: 208072768)
  length:           29184    (original: 29120)
  transferred:      29120
  block size:       512
  saved vec index:  52428
  saved vec length: 52428
  r/w:              read
  phase:            do all
  partial begin:    yes
  partial end:      no
  bounce buffer:    yes
kdebug> io_operation child2
io_operation at 0x90c95000
  parent:           0x90c8e660
  status:           No error
  dma buffer:       0x90c7672c
  offset:           208101888 (original: 208101888)
  length:           22016    (original: 22016)
  transferred:      22016
  block size:       512
  saved vec index:  1
  saved vec length: 512
  r/w:              read
  phase:            do all
  partial begin:    no
  partial end:      no
  bounce buffer:    yes
kdebug> io_operation child3
io_operation at 0x90c95050
  parent:           0x90c8e660
  status:           No error
  dma buffer:       0x90c767f8
  offset:           208123904 (original: 208123904)
  length:           31744    (original: 31744)
  transferred:      31744
  block size:       512
  saved vec index:  52428
  saved vec length: 52428
  r/w:              read
  phase:            do all
  partial begin:    no
  partial end:      no
  bounce buffer:    yes
kdebug> io_operation child4
io_operation at 0x90c950a0
  parent:           0x90c8e660
  status:           No error
  dma buffer:       0x90c768c4
  offset:           208155648 (original: 208155648)
  length:           13824    (original: 13824)
  transferred:      13824
  block size:       512
  saved vec index:  52428
  saved vec length: 52428
  r/w:              read
  phase:            do all
  partial begin:    no
  partial end:      no
  bounce buffer:    yes
kdebug> io_operation child5
io_operation at 0x90c950f0
  parent:           0x90c8e660
  status:           No error
  dma buffer:       0x90c76990
  offset:           208169472 (original: 208169472)
  length:           29696    (original: 29696)
  transferred:      29696
  block size:       512
  saved vec index:  52428
  saved vec length: 52428
  r/w:              read
  phase:            do all
  partial begin:    no
  partial end:      no
  bounce buffer:    yes
kdebug> io_operation child6
io_operation at 0x90c95140
  parent:           0x90c8e660
  status:           No error
  dma buffer:       0x90c76a5c
  offset:           208199168 (original: 208199168)
  length:           4608     (original: 4608)
  transferred:      4608
  block size:       512
  saved vec index:  52428
  saved vec length: 52428
  r/w:              read
  phase:            do all
  partial begin:    no
  partial end:      no
  bounce buffer:    yes

[axeld]

Happened with hrev26898, btw; also tried to cleanup the KDL session a bit.