I can reproduce this pretty easily with local disk.

Here's some details about my setup (attached is the
full kernel config):
- dell 2650 (dual xeon, hyperthreading disabled)
- 1 local SCSI disk (root volume)
- 2 local SCSI disks (data), each with 10 partitions
of 100MB each, 6 of them reiserfs filesystems, 3 of them
ext3, and 3 of them ext2 (total of 20 unique filesystems)
- one instance of test program running on each of the
20 filesystems

Sorry, but at this time I can't share the test program itself
(I'm working on that).  Let me try to describe it though.

The test is single threaded, and tests sequential writes and
reads (with data compare) of random blocksizes ("block"
meaning "chunk of data"), along with file truncate,
rename, and delete.  The test has a continuous
loop where it randomly picks one of these operations,
checks for success (e.g. it'll flag data corruption,
an operation failing, etc), and then loops around.
For the read or write operations, it'll first do an
"open()" followed by the operation, followed by a
"close()".  The test will create a lot of files with
unique names in a single directory.  It also will detect
when the  filesystem is getting full, and then start
deleting or overwriting files instead of creating more.







rachman login: Oops: 0000 [#1]
SMP
Modules linked in: ext3 jbd edd joydev sg st sr_mod ide_cd cdrom nvram autofs thermal processor fan button battery ac tg3 sworks_agp
agpgart evdev id
CPU:    0
EIP:    0060:[<c015a63d>]    Not tainted VLI
EFLAGS: 00010206   (2.6.9-rc2)
EIP is at sync_buffer+0xd/0x40
eax: 30c92553   ebx: 080af825   ecx: dd5f3be8   edx: 00000246
esi: dd5f3bdc   edi: c042a300   ebp: dd5f3c70   esp: dd5f3bb4
ds: 007b   es: 007b   ss: 0068
Process hammer (pid: 12363, threadinfo=dd5f2000 task=f71d4030)
Stack: c015a7b4 080af825 00000000 f71d4030 c015a5e0 dd5f3be8 dd5f3be8 f8b318ee
         00000018 080af825 00000000 f71d4030 c015a5e0 c042a304 c042a304 00003e9a
         00000000 00000001 00001000 f95fb008 f8b14132 00000001 dd5f3c28 dd63a018
Call Trace:
   [<c015a7b4>] __wait_on_buffer+0x84/0xa0
   [<c015a5e0>] bh_wake_function+0x0/0x50
   [<f8b318ee>] search_by_key+0x16e/0x11e0 [reiserfs]
   [<c015a5e0>] bh_wake_function+0x0/0x50
   [<f8b14132>] scan_bitmap_block+0x132/0x280 [reiserfs]
   [<f8b14542>] scan_bitmap+0x1f2/0x220 [reiserfs]
   [<f8b1580a>] reiserfs_allocate_blocknrs+0x27a/0x580 [reiserfs]
   [<f8b21ff9>] reiserfs_allocate_blocks_for_region+0x229/0x1440 [reiserfs]
   [<f8b32b31>] search_for_position_by_key+0x1d1/0x460 [reiserfs]
   [<f8b1c38c>] make_cpu_key+0x4c/0x60 [reiserfs]
   [<f8b24105>] reiserfs_prepare_file_region_for_write+0x665/0x9c0 [reiserfs]
   [<f8b24872>] reiserfs_file_write+0x412/0x6a0 [reiserfs]
   [<c01574bc>] do_truncate+0x5c/0xa0
   [<c0167e65>] may_open+0x245/0x2a0
   [<c015a152>] get_empty_filp+0x52/0xd0
   [<c015a46c>] file_move+0x1c/0x60
   [<c01586d8>] dentry_open+0xe8/0x200
   [<c01585e0>] filp_open+0x40/0x50
   [<c01595d0>] vfs_write+0xb0/0x120
   [<c01596f1>] sys_write+0x41/0x70
   [<c010721d>] sysenter_past_esp+0x52/0x71
Code: 8b 1c 24 8b 74 24 04 83 c4 08 e9 bf 35 fc ff eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 90 0f ae f0 8d 76 00 8b 40 20 85 c0 74
1b <8b> 40 04 8b
   <1>Unable to handle kernel paging request at virtual address 000055f8
   printing eip:
000055f8
*pde = 2141a001
Oops: 0000 [#2]
SMP
Modules linked in: ext3 jbd edd joydev sg st sr_mod ide_cd cdrom nvram autofs thermal processor fan button battery ac tg3 sworks_agp
agpgart evdev id
CPU:    0
EIP:    0060:[<000055f8>]    Not tainted VLI
EFLAGS: 00010006   (2.6.9-rc2)
EIP is at 0x55f8
eax: dd5f3bdc   ebx: dd5f3bdc   ecx: 00000000   edx: 00000003
esi: 000055f6   edi: 000055f9   ebp: c03b3df0   esp: c03b3dd0
ds: 007b   es: 007b   ss: 0068
Process swapper (pid: 0, threadinfo=c03b2000 task=c0333ae0)
Stack: c011c157 e3770d48 c042a304 00000001 00000003 c042a300 e3770d48 00000001
         c03b3e14 c011c1c8 00000000 e3770d48 00000092 00000003 c042a300 e3770d48
         c26fdfa0 00000000 c015a5d4 e3770d48 e3770d48 00000203 c015b11b f7fe2000
Call Trace:
   [<c011c157>] __wake_up_common+0x37/0x70
   [<c011c1c8>] __wake_up+0x38/0x50
   [<c015a5d4>] wake_up_buffer+0x44/0x50
   [<c015b11b>] end_buffer_async_write+0x3b/0xf0
   [<c013d351>] mempool_free+0x81/0xa0
   [<c015dbb0>] end_bio_bh_io_sync+0x0/0x40
   [<c015dbd3>] end_bio_bh_io_sync+0x23/0x40
   [<c015ef8e>] bio_endio+0x5e/0xa0
   [<c022139e>] elv_next_request+0x2e/0xf0
   [<c0225096>] __end_that_request_first+0xe6/0x240
   [<f884901d>] scsi_request_fn+0x4d/0x3e0 [scsi_mod]
   [<c022387b>] freed_request+0x7b/0xc0
   [<f8848519>] scsi_end_request+0x29/0xd0 [scsi_mod]
   [<f8848905>] scsi_io_completion+0x175/0x4d0 [scsi_mod]
   [<f8843c52>] scsi_finish_command+0x82/0xf0 [scsi_mod]
   [<f8843b77>] scsi_softirq+0xc7/0xe0 [scsi_mod]
   [<c0124792>] __do_softirq+0x62/0xe0
   [<c012483d>] do_softirq+0x2d/0x40
   [<c0109d96>] do_IRQ+0x126/0x160
   [<c0107bdc>] common_interrupt+0x18/0x20
   [<c0105280>] default_idle+0x0/0x40
   [<c01052a9>] default_idle+0x29/0x40
   [<c0105334>] cpu_idle+0x34/0x50
   [<c03b491a>] start_kernel+0x19a/0x210
   [<c03b4380>] unknown_bootoption+0x0/0x170
Code:  Bad EIP value.
   <0>Kernel panic - not syncing: Fatal exception in interrupt