Re: port-amd64/60920: 11.0 kernel for amd64 fails with null pointer deref in uvm_page_redim()

["Michael van Elst via gnats" <gnats-admin%NetBSD.org@localhost>]

The following reply was made to PR port-amd64/60920; it has been noted by GNATS.

From: mlelstv%serpens.de@localhost (Michael van Elst)
To: gnats-bugs%netbsd.org@localhost
Cc: 
Subject: Re: port-amd64/60920: 11.0 kernel for amd64 fails with null pointer deref in uvm_page_redim()
Date: Sat, 24 Oct 2026 12:30:28 -0000 (UTC)

 gnats-admin%NetBSD.org@localhost ("he%NetBSD.org@localhost via gnats") writes:
 
 >[   1.1450179] uvm_fault(0xffffffff81976e60, 0x0, 2) -: e
 >[   1.1450179] fatal page fault in supervisor mode
 >[   1.1450179] trap type 6 code 0x2 rip 0xffffffff80cc0282 cs 0x8 rflags 0x10206 cr2 0 ilevel 0x8 rsp 0xffffffff81d56dd0
 >[   1.1450179] curlwp 0xffffffff8188bdc0 pid 0.0 lowest kstack 0xffffffff81d512c0
 >kernel: page fault trap, code=0
 >Stopped in pid 0.0 (system) at  netbsd:uvm_page_redim+0x2f9:    addq    $0x1,0(%
 
 
 
 This is uvm_page.c:820
 
     811                                         if (uvm_page_numa_region != NULL
 ) {
     812                                                 nb = uvm_page_numa_looku
 p(pg);
     813                                         } else {
     814                                                 nb = atop(VM_PAGE_TO_PHY
 S(pg))
     815                                                     / uvmexp.ncolors / 8
     816                                                     % newnbuckets;
     817                                         }
     818                                         uvm_page_set_bucket(pg, nb);
     819                                         npgb = npgfl.pgfl_buckets[nb];
     820                                         npgb->pgb_nfree++;
 
 npgfl.pgfl_buckets is initialized for newnbuckets (== uvm.bucketcount).
 
 nb is in register %rax:
 
 >rax         2
 
 In the else part, nb is computed modulo newnbuckets and cannot exceed
 newnbuckets.
 
 But in the then part, nb can be the id of a NUMA node and it's unclear
 if that exceeds newnbuckets.
 
 Can you dump uvm.bucketcount in DDB ?