Re: [Bug 198497] New: handle_mm_fault / xen_pmd_val / radix_tree_lookup_slot Null pointer

[Matthew Wilcox <willy@infradead.org>]

On Fri, Jan 19, 2018 at 04:14:42PM +1300, xen@randomwebstuff.com wrote:
> 
> On 19/01/18 4:04 PM, Matthew Wilcox wrote:
> > On Thu, Jan 18, 2018 at 02:18:20PM -0800, Laura Abbott wrote:
> > > On 01/18/2018 01:55 PM, Andrew Morton wrote:
> > > > > [   24.647744] BUG: unable to handle kernel NULL pointer dereference at
> > > > > 00000008
> > > > > [   24.647801] IP: __radix_tree_lookup+0x14/0xa0
> > > > > [   24.647811] *pdpt = 00000000253d6027 *pde = 0000000000000000
> > > > > [   24.647828] Oops: 0000 [#1] SMP
> > > > > [   24.647842] CPU: 5 PID: 3600 Comm: java Not tainted
> > > > > 4.14.13-rh10-20180115190010.xenU.i386 #1
> > > > > [   24.647855] task: e52518c0 task.stack: e4e7a000
> > > > > [   24.647866] EIP: __radix_tree_lookup+0x14/0xa0
> > > > > [   24.647876] EFLAGS: 00010286 CPU: 5
> > > > > [   24.647884] EAX: 00000004 EBX: 00000007 ECX: 00000000 EDX: 00000000

If my understanding is right, EDX contains the index we're looking up.
Which is zero.  So the swp_entry we got is one bit away from being NULL.
Hmm.  Have you run memtest86 or some other memory tester on the system
recently?

> PS: cannot recall seeing this issue on x86_64, just 32 bit.

Laura has 64-bit instances of this.

PPS: reminder
> this is on a Xen VM which per https://xenbits.xen.org/docs/unstable/man/xl.cfg.5.html#PVH-Guest-Specific-Options
> has "out of sync pagetables" if that is relevant (we do not set that option,
> I am unsure what default is used).

Laura also has non-Xen instances of this.  They may not all be the same
bug, of course.

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>