Re: port-amd64/60920: 11.0 kernel for amd64 fails with null pointer deref in uvm_page_redim()

["Havard Eidnes via gnats" <gnats-admin%NetBSD.org@localhost>]

The following reply was made to PR port-amd64/60920; it has been noted by GNATS.

From: Havard Eidnes <he%NetBSD.org@localhost>
To: gnats-bugs%netbsd.org@localhost, gnats-admin%NetBSD.org@localhost
Cc: port-amd64-maintainer%netbsd.org@localhost, netbsd-bugs%netbsd.org@localhost
Subject: Re: port-amd64/60920: 11.0 kernel for amd64 fails with null
 pointer deref in uvm_page_redim()
Date: Sat, 24 Oct 2026 21:37:53 +0200 (CEST)

 >  >So bucketcount = 2, at least in 10.0?
 >
 >  bucketcount = 2 is a problem if the code touches bucket 2
 >  (only 0 + 1 exist).
 
 Well, there's a difference between "index" and "count"; one would
 say that one has 2 buckets if they're indexed with 0 and 1, no?
 
 If uvm.bucketcount = newnbuckets = 2, (whatever % newnbuckets)
 will be either 0 or 1, no?  So are we getting to the crash via
 
                       if (uvm_page_numa_region != NULL) {
                               nb = uvm_page_numa_lookup(pg);
 
 ?
 
 # crash
 Crash version 10.0, image version 10.0.
 Kernel compiled without options LOCKDEBUG.
 Output from a running system is unreliable.
 crash> x/x uvm_page_numa_region
 uvm_page_numa_region:   da530c80
 crash> 
 
 I'll note that I don't quite understand why the last 4 cores are
 noted as "node 1" whereas the 4 first in the last package are
 "node 0", in
 
 : {33} cat /tmp/11-cpus  | egrep 'cpu.*node'
 [   1.0000000] cpu0: node 0, package 0, core 0, smt 0
 [   1.0000000] cpu1: node 0, package 0, core 1, smt 0
 [   1.0000000] cpu2: node 0, package 0, core 2, smt 0
 [   1.0000000] cpu3: node 0, package 0, core 3, smt 0
 [   1.0000000] cpu4: node 0, package 0, core 4, smt 0
 [   1.0000000] cpu5: node 0, package 0, core 5, smt 0
 [   1.0000000] cpu6: node 0, package 0, core 6, smt 0
 [   1.0000000] cpu7: node 0, package 0, core 7, smt 0
 [   1.0000000] cpu8: node 0, package 1, core 0, smt 0
 [   1.0000000] cpu9: node 0, package 1, core 1, smt 0
 [   1.0000000] cpu10: node 0, package 1, core 2, smt 0
 [   1.0000000] cpu11: node 0, package 1, core 3, smt 0
 [   1.0000000] cpu12: node 1, package 1, core 4, smt 0
 [   1.0000000] cpu13: node 1, package 1, core 5, smt 0
 [   1.0000000] cpu14: node 1, package 1, core 6, smt 0
 [   1.0000000] cpu15: node 1, package 1, core 7, smt 0
 : {34} 
 
 (That's the same with 10.0)
 
 Regards,
 
 - Havard