Re: port-amd64/60920: 11.0 kernel for amd64 fails with null pointer deref in uvm_page_redim()

["Havard Eidnes via gnats" <gnats-admin%NetBSD.org@localhost>]

The following reply was made to PR port-amd64/60920; it has been noted by GNATS.

From: Havard Eidnes <he%NetBSD.org@localhost>
To: gnats-bugs%netbsd.org@localhost, gnats-admin%NetBSD.org@localhost
Cc: port-amd64-maintainer%netbsd.org@localhost, netbsd-bugs%netbsd.org@localhost
Subject: Re: port-amd64/60920: 11.0 kernel for amd64 fails with null
 pointer deref in uvm_page_redim()
Date: Sat, 24 Oct 2026 21:54:00 +0200 (CEST)

 >>  >So bucketcount = 2, at least in 10.0?
 >>
 >>  bucketcount = 2 is a problem if the code touches bucket 2
 >>  (only 0 + 1 exist).
 >
 > Well, there's a difference between "index" and "count"; one would
 > say that one has 2 buckets if they're indexed with 0 and 1, no?
 >
 > If uvm.bucketcount = newnbuckets = 2, (whatever % newnbuckets)
 > will be either 0 or 1, no?  So are we getting to the crash via
 > 
 >                       if (uvm_page_numa_region != NULL) {
 >                               nb = uvm_page_numa_lookup(pg);
 >
 > ?
 >
 > # crash
 > Crash version 10.0, image version 10.0.
 > Kernel compiled without options LOCKDEBUG.
 > Output from a running system is unreliable.
 > crash> x/x uvm_page_numa_region
 > uvm_page_numa_region:   da530c80
 > crash> 
 
 Some further indication this is the path we got there:
 
 static struct uvm_page_numa_region {
         struct uvm_page_numa_region     *next;
         paddr_t                         start;
         paddr_t                         size;
         u_int                           numa_id;
 } *uvm_page_numa_region;
 
 
 # crash
 Crash version 10.0, image version 10.0.
 Kernel compiled without options LOCKDEBUG.
 Output from a running system is unreliable.
 crash> x/x uvm_page_numa_region
 uvm_page_numa_region:   da530c80
 crash> 
 uvm_page_numa_region+0x4:       ffff82fa
 crash> x/x 0xffff82fada530c80
 ffff82fada530c80:       da530c60
 crash> x/x,4
 ffff82fada530c80:       da530c60    ffff82fa    20000000    c
 crash> 
 ffff82fada530c90:       0           4           3           0
 crash> x/x 0xffff82fada530c60
 ffff82fada530c60:       da530c40
 crash> x/x,4
 ffff82fada530c60:       da530c40    ffff82fa    20000000    8
 crash> 
 ffff82fada530c70:       0           4           2           0
 crash> x/x 0xffff82fada530c40
 ffff82fada530c40:       da530c20
 crash> x/x,4
 ffff82fada530c40:       da530c20    ffff82fa    20000000    4
 crash> 
 ffff82fada530c50:       0           4           1           0
 crash> x/x 0xffff82fada530c20
 ffff82fada530c20:       c708dec0
 crash> x/x,4
 ffff82fada530c20:       c708dec0    ffff8309    0           1
 crash> 
 ffff82fada530c30:       20000000    3           0           0
 crash> 
 
 So those show numa_id 0, 1, 2 and 3 (in reverse order)?
 
 But why doesn't 10.0 fail, but 11.0 does?