BUG 797943 - kiobuf I/O and request queue merging panic system

[pv@xxxxxxxxxxxxx (lord@xxxxxxx)]

View Incident: 
http://co-op.engr.sgi.com/BugWorks/code/bwxquery.cgi?search=Search&wlong=1&view_type=Bug&wi=797943

Submitter : lord                      Submitter Domain : sgi.com            
Assigned Engineer : chait             Assigned Domain : engr                
Assigned Group : xfs-linux            Category : software                   
Customer Reported : F                 Priority : 1                          
Project : xfs-linux                   Status : open                         
Description :
Linux 2.4.0-test5 now has merge functions on the requests
queues by default. These merge functions presume that a request
has buffer heads on it and will crash the system when they encounter
a kiobuf based request.

For example, running doio with a 50 Mbyte file in XFS seems
to eventually tip over my system with this stack trace:
*pde = 00000000

Entering kdb (0xc12d0000) on processor 1 Panic: Oops
due to panic @ 0xc01baab0
eax = 0xc3c89000 ebx = 0xc13ea7c0 ecx = 0x00000040 edx = 0x00000000 
esi = 0xc13fd000 edi = 0xc129fd98 esp = 0xc12d1edc eip = 0xc01baab0 
ebp = 0xc12d1ee8  ss = 0x00000018  cs = 0x00000010 eflags = 0x00010006 
 ds = 0x00000018  es = 0x00000018 origeax = 0xffffffff &regs = 0xc12d1ea8
[1]kdb> bt
    EBP       EIP         Function(args)
0xc12d1ee8 0xc01baab0 scsi_front_merge_fn_c+0x2c (0xc129fd98, 0xc13ea7c0, 
0xc29f24a0, 0xfe)
                               kernel .text 0xc0100000 0xc01baa84 0xc01baaec
0xc12d1f3c 0xc016da75 __make_request+0x2d9 (0xc129fd98, 0x1, 0xc29f24a0)
                               kernel .text 0xc0100000 0xc016d79c 0xc016ddec
0xc12d1f68 0xc016debe generic_make_request+0xd2 (0xc129fd98, 0x1, 0xc29f24a0)
                               kernel .text 0xc0100000 0xc016ddec 0xc016ded0
0xc12d1fac 0xc016dfff ll_rw_block+0x12f (0x1, 0x1, 0xc12d1fd0, 0xc12d0000)
                               kernel .text 0xc0100000 0xc016ded0 0xc016e078
0xc12d1fd4 0xc01353d7 flush_dirty_buffers+0x97 (0x0, 0xf00)
                               kernel .text 0xc0100000 0xc0135340 0xc0135424
0xc12d1fec 0xc01356a9 bdflush+0x8d
                               kernel .text 0xc0100000 0xc013561c 0xc01356e4
           0xc0108c3b kernel_thread+0x23
                               kernel .text 0xc0100000 0xc0108c18 0xc0108c50

The reason being that the merge functions are not kiobuf aware
and attempt to dereference the buffer head fields in the
request. This request structure happens to contain this:
struct request at 0xc13ea7c0
  rq_dev 0x804 cmd 1 errors 0 sector 90856 nr_sectors 32
  hsect 70176 hnrsect 16 nrseg 4 nrhwseg 1 currnrsect 8
  kiobuf 0xc5ffbf40 bh 0x00000000 bhtail 0x00000000 req_q 0xc129fd98

Since there are no buffer heads, dereferencing them will
take the system out.