consistent crash with data=journal

[Phil White]

I've been running into a kernel panic pretty consistently when using 
data=journal.  This occurs during heavy IO, and is highly reproducible 
(only takes about 5 minutes of IO to cause it).  The applications being 
used are MySQL, Postfix, and a mail filtering application which operates 
on postfix queue files using mmaped IO.

Shortly before the crash, the following messages are logged:
Mar  2 14:15:30 test5 kernel: Unexpected dirty buffer encountered at 
do_get_write_access:618 (03:05 blocknr 3688784)
Mar  2 14:16:04 test5 kernel: Unexpected dirty buffer encountered at 
do_get_write_access:618 (03:05 blocknr 3616336)
Mar  2 14:18:38 test5 kernel: Unexpected dirty buffer encountered at 
do_get_write_access:618 (03:05 blocknr 3692808)

I've duplicated it in 2.4.22 and 2.4.25.  Here's the crash from 2.4.25:

Assertion failure in journal_commit_transaction() at commit.c:759: 
"!(((bh)->b_state & (1UL << BH_Dirty)) != 0)"
kernel BUG at commit.c:759!
invalid operand: 0000
CPU:    0
EIP:    0010:[<c0174064>]    Not tainted
Using defaults from ksymoops -t elf32-i386 -a i386
EFLAGS: 00010282
eax: 00000074   ebx: f7221f00   ecx: f7752000   edx: f7795f7c
esi: f71a9c00   edi: 00000001   ebp: 00000000   esp: f7753e74
ds: 0018   es: 0018   ss: 0018
Process kjournald (pid: 115, stackpage=f7753000)
Stack: c02a2180 c029ff8f c029ffaa 000002f7 c02a47c0 c1c3ecf4 00000000 
00000e74
       d77fb18c 00000000 f6dfb380 e89d3d20 00000cca d78fb100 da292700 
da292680
       da292600 da28b980 f65f1480 f65f1580 f65f1380 c3f9b800 ccdc6780 
da4cb800
Call Trace:    [<c0176b64>] [<c01769f0>] [<c01072ee>] [<c0176a10>]
Code: 0f 0b f7 02 aa ff 29 c0 e9 1b fe ff ff 89 1c 24 8b 4c 24 28

 >>EIP; c0174064 <journal_commit_transaction+924/11c0>   <=====
Trace; c0176b64 <kjournald+154/1e0>
Trace; c01769f0 <commit_timeout+0/10>
Trace; c01072ee <arch_kernel_thread+2e/40>
Trace; c0176a10 <kjournald+0/1e0>
Code;  c0174064 <journal_commit_transaction+924/11c0>
00000000 <_EIP>:
Code;  c0174064 <journal_commit_transaction+924/11c0>   <=====
   0:   0f 0b                     ud2a      <=====
Code;  c0174066 <journal_commit_transaction+926/11c0>
   2:   f7 02 aa ff 29 c0         testl  $0xc029ffaa,(%edx)
Code;  c017406c <journal_commit_transaction+92c/11c0>
   8:   e9 1b fe ff ff            jmp    fffffe28 <_EIP+0xfffffe28>
Code;  c0174071 <journal_commit_transaction+931/11c0>
   d:   89 1c 24                  mov    %ebx,(%esp,1)
Code;  c0174074 <journal_commit_transaction+934/11c0>
  10:   8b 4c 24 28               mov    0x28(%esp,1),%ecx


Any help would be greatly appreciated! Please let me know if any more 
info is needed.

Thanks in advance,
--Phil White