2000-12-07 16:27:41

by Jan Niehusmann

[permalink] [raw]
Subject: attempt to access beyond end of device

ll_rw_blk.c: generic_make_request() contains the following code:

if (maxsector < count || maxsector - count < sector) {
bh->b_state &= (1 << BH_Lock) | (1 << BH_Mapped);
if (blk_size[major][MINOR(bh->b_rdev)]) {

/* This may well happen - the kernel calls bread()
without checking the size of the device, e.g.,
when mounting a device. */
printk(KERN_INFO
"attempt to access beyond end of device\n");
printk(KERN_INFO "%s: rw=%d, want=%d, limit=%d\n",
kdevname(bh->b_rdev), rw,
(sector + count)>>1,
blk_size[major][MINOR(bh->b_rdev)]);
}
bh->b_end_io(bh, 0);
return;
}


That means that if blk_size[major][MINOR(bh->b_rdev)] == 0, the request
is canceled but no message is printed. Shouldn't there be a warning message?

Jan






2000-12-07 17:05:15

by Andries Brouwer

[permalink] [raw]
Subject: Re: attempt to access beyond end of device

On Thu, Dec 07, 2000 at 04:56:59PM +0100, Jan Niehusmann wrote:
> ll_rw_blk.c: generic_make_request() contains the following code:
>
> if (maxsector < count || maxsector - count < sector) {
> bh->b_state &= (1 << BH_Lock) | (1 << BH_Mapped);
> if (blk_size[major][MINOR(bh->b_rdev)]) {
>
> /* This may well happen - the kernel calls bread()
> without checking the size of the device, e.g.,
> when mounting a device. */
> printk(KERN_INFO
> "attempt to access beyond end of device\n");
> printk(KERN_INFO "%s: rw=%d, want=%d, limit=%d\n",
> kdevname(bh->b_rdev), rw,
> (sector + count)>>1,
> blk_size[major][MINOR(bh->b_rdev)]);
> }
> bh->b_end_io(bh, 0);
> return;
> }
>
>
> That means that if blk_size[major][MINOR(bh->b_rdev)] == 0, the request
> is canceled but no message is printed. Shouldn't there be a warning message?

Maybe that code fragment is mine. If so, then at some point
in time I decided that the answer to your question is no.

Andries

2000-12-07 17:41:28

by John Kennedy

[permalink] [raw]
Subject: Re: attempt to access beyond end of device

On Thu, Dec 07, 2000 at 05:34:28PM +0100, Andries Brouwer wrote:
> On Thu, Dec 07, 2000 at 04:56:59PM +0100, Jan Niehusmann wrote:
> > That means that if blk_size[major][MINOR(bh->b_rdev)] == 0, the request
> > is canceled but no message is printed. Shouldn't there be a warning message?
>
> Maybe that code fragment is mine. If so, then at some point
> in time I decided that the answer to your question is no.

As a potential real-world case (but possibly unrelated), I had an
interesting situation crop-up while I was playing with the loopback
filesystems.

If you just use the program-tools, you end up with a situation like:

losetup <blah> [close all] dd <blah> [close all] losetup -d [blah]

In my case, I was making a standalone program that did it all in one
program and I messed up in the ordering of the close() and the LOOP_CLR_FD.

I'm pretty sure that (with my small 10K test dataset) the I/O between
the loopback device and the looped file was never hitting the disk.
If I LOOP_CLR_FD before I closed, I ended up with bad data in the looped
file and kernel errors syslogged:

kernel: attempt to access beyond end of device
kernel: 07:00: rw=1, want=1, limit=0
kernel: dev 07:00 blksize=0 blocknr=0 sector=0 size=1024 count=1

I tended to get 10 of those, one for each of the 10 1K blocks in
my test dataset.

Doing the close() then the LOOP_CLR_FD got rid of the errors.