Re: port-amd64/60920: 11.0 kernel for amd64 fails with null pointer deref in uvm_page_redim()

[Havard Eidnes <he%NetBSD.org@localhost>]

>>  >So bucketcount = 2, at least in 10.0?
>>
>>  bucketcount = 2 is a problem if the code touches bucket 2
>>  (only 0 + 1 exist).
>
> Well, there's a difference between "index" and "count"; one would
> say that one has 2 buckets if they're indexed with 0 and 1, no?
>
> If uvm.bucketcount = newnbuckets = 2, (whatever % newnbuckets)
> will be either 0 or 1, no?  So are we getting to the crash via
> 
>                       if (uvm_page_numa_region != NULL) {
>                               nb = uvm_page_numa_lookup(pg);
>
> ?
>
> # crash
> Crash version 10.0, image version 10.0.
> Kernel compiled without options LOCKDEBUG.
> Output from a running system is unreliable.
> crash> x/x uvm_page_numa_region
> uvm_page_numa_region:   da530c80
> crash> 

Some further indication this is the path we got there:

static struct uvm_page_numa_region {
        struct uvm_page_numa_region     *next;
        paddr_t                         start;
        paddr_t                         size;
        u_int                           numa_id;
} *uvm_page_numa_region;


# crash
Crash version 10.0, image version 10.0.
Kernel compiled without options LOCKDEBUG.
Output from a running system is unreliable.
crash> x/x uvm_page_numa_region
uvm_page_numa_region:   da530c80
crash> 
uvm_page_numa_region+0x4:       ffff82fa
crash> x/x 0xffff82fada530c80
ffff82fada530c80:       da530c60
crash> x/x,4
ffff82fada530c80:       da530c60    ffff82fa    20000000    c
crash> 
ffff82fada530c90:       0           4           3           0
crash> x/x 0xffff82fada530c60
ffff82fada530c60:       da530c40
crash> x/x,4
ffff82fada530c60:       da530c40    ffff82fa    20000000    8
crash> 
ffff82fada530c70:       0           4           2           0
crash> x/x 0xffff82fada530c40
ffff82fada530c40:       da530c20
crash> x/x,4
ffff82fada530c40:       da530c20    ffff82fa    20000000    4
crash> 
ffff82fada530c50:       0           4           1           0
crash> x/x 0xffff82fada530c20
ffff82fada530c20:       c708dec0
crash> x/x,4
ffff82fada530c20:       c708dec0    ffff8309    0           1
crash> 
ffff82fada530c30:       20000000    3           0           0
crash> 

So those show numa_id 0, 1, 2 and 3 (in reverse order)?

But why doesn't 10.0 fail, but 11.0 does?