In __map_buffer(), the call to dm_table_find_target() will never return a NULL pointer (provided every DM device table has a valid "targets" array, which should be the case). It may, however, return a pointer to a blank target record (since there are always a KEYS_PER_NODE-multiple of target records in the B-tree, but not all of these target records are necessarily used). This will occur when DM receives an I/O request past the end of a device. (You'd think this shouldn't happen, but it does - generic_make_request() will allow an I/O one sector past the end of a device with an even number of sectors.) Instead of checking for a NULL return from dm_table_find_target(), check for a valid "type" field in the returned target. --- linux-2.4.20a/drivers/md/dm.c 2003/03/18 21:05:24 +++ linux-2.4.20b/drivers/md/dm.c 2003/03/25 17:25:41 @@ -351,7 +351,7 @@ struct dm_target *ti; ti = dm_table_find_target(md->map, bh->b_rsector); - if (!ti) + if (!ti->type) return -EINVAL; /* hook the end io request fn */ p?