On Wed, 12 Nov 2025 19:11:15 -0800
Guenter Roeck [off-list ref] wrote:

[  120.334908] BUG: kernel NULL pointer dereference, address: 0000000000000078
[  120.341901] #PF: supervisor read access in kernel mode
[  120.347055] #PF: error_code(0x0000) - not-present page
[  120.352208] PGD 0 P4D 0
[  120.354750] Oops: Oops: 0000 [#1] SMP NOPTI
[  120.358946] CPU: 36 UID: 0 PID: 14127 Comm: page_table_stre Tainted: G S         O        6.18.0-smp-DEV #2 NONE
[  120.369242] Tainted: [S]=CPU_OUT_OF_SPEC, [O]=OOT_MODULE
[  120.374568] Hardware name: Google LLC Indus/Indus_QC_03, BIOS 30.116.4 08/29/2025
[  120.382075] RIP: 0010:gup_fast_fallback+0x150/0xb60
[  120.386977] Code: d0 c9 8b 48 89 84 24 a0 00 00 00 48 8b 80 30 05 00 00 0f b6 0d 0d 6b 1a 01 49 89 f8 49 d3 e8 41 81 e0 ff 01 00 00 41 c1 e0
 03 <4c> 03 40 78 4c 8d 5b ff 44 89 c8 83 e0 01 48 8d 04 45 05 00 00 00
[  120.405809] RSP: 0018:ffffa32be5f9b7a0 EFLAGS: 00010006
[  120.411051] RAX: 0000000000000000 RBX: 00007f0f57dfd000 RCX: 0000000000000027
[  120.418210] RDX: 0000000000000046 RSI: 0000000000000001 RDI: 00007f0f57dfc000
[  120.425368] RBP: 0000000000000000 R08: 00000000000007f0 R09: 0000000000100002
[  120.432526] R10: ffffa32be5f9b8c8 R11: 0000000000000000 R12: 00007f0f57dfc6c0
[  120.439683] R13: ffff99b44dd7c800 R14: 00000000fffffff2 R15: 00000000000800c3
[  120.446842] FS:  0000000000000000(0000) GS:ffff9a127357b000(0000) knlGS:0000000000000000
[  120.454956] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  120.460721] CR2: 0000000000000078 CR3: 000000512d03e006 CR4: 00000000007706f0
[  120.467879] PKRU: 55555554
[  120.470592] Call Trace:
[  120.473045]  <TASK>
[  120.475152]  perf_prepare_sample+0x77b/0x910
[  120.479445]  perf_event_output+0x35/0x100
[  120.483467]  intel_pmu_drain_pebs_nhm+0x570/0x750
[  120.488198]  intel_pmu_pebs_sched_task+0x74/0x80
[  120.492839]  ? __put_partials+0xd6/0x130
[  120.496775]  ? __mt_destroy+0x3f/0x80
[  120.500451]  ? put_cpu_partial+0x9b/0xc0
[  120.504384]  ? __slab_free+0x249/0x320
[  120.508144]  ? refill_obj_stock+0x120/0x1a0
[  120.512341]  ? __mt_destroy+0x3f/0x80
[  120.516013]  ? kfree+0x2ca/0x390
[  120.519254]  ? update_load_avg+0x1c8/0x7d0
[  120.523364]  ? update_entity_lag+0xf6/0x110
[  120.527560]  intel_pmu_sched_task+0x1d/0x30
[  120.531755]  perf_pmu_sched_task+0xf2/0x1a0
[  120.535952]  __perf_event_task_sched_out+0x3f/0x1f0
[  120.540844]  ? pick_next_task_fair+0x3e/0x2a0
[  120.545214]  __schedule+0xad0/0xb40
[  120.548715]  do_task_dead+0x48/0xa0

Ah, this is called at do_task_dead()

I guess we need to also test for !current->mm because the flags set for an
exiting task is done when we can still do callchains. Thus, the only way to
know if it is safe to do a callchain when a task is exiting is via task->mm
and not task->flags :-/

-- Steve

[  120.552215]  do_exit+0x734/0x920
[  120.555463]  ? do_exit+0x9/0x920
[  120.558699]  do_group_exit+0x85/0x90
[  120.562284]  __x64_sys_exit_group+0x17/0x20
[  120.566478]  x64_sys_call+0x21f7/0x2200
[  120.570327]  do_syscall_64+0x6f/0x940
[  120.574001]  ? clear_bhb_loop+0x50/0xa0
[  120.577849]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[  120.582915] RIP: 0033:0x7f0f5a0d2c48
[  120.586501] Code: Unable to access opcode bytes at 0x7f0f5a0d2c1e.
[  120.592700] RSP: 002b:00007f0f57dfcec8 EFLAGS: 00000207 ORIG_RAX: 00000000000000e7
[  120.600294] RAX: ffffffffffffffda RBX: 00007f0f57dfd700 RCX: 00007f0f5a0d2c48
[  120.607452] RDX: 00007f0f57dfd660 RSI: 0000000000000000 RDI: 0000000000000000
[  120.614607] RBP: 00007f0f57dfcef0 R08: 00007f0f57dfd700 R09: 00007f0f57dfd700
[  120.621765] R10: 00007f0f5a17a6c0 R11: 0000000000000207 R12: 00007f0f57dfd9d0
[  120.628923] R13: 00007ffc64840aa6 R14: 00007f0f57dfdd1c R15: 00007f0f57dfcfc0
[  120.636081]  </TASK>
[  120.638272] Modules linked in: vfat fat i2c_mux_pca954x i2c_mux spidev cdc_acm xhci_pci xhci_hcd gq(O) sha3_generic
[  120.649976] gsmi: Log Shutdown Reason 0x03
[  120.654086] CR2: 0000000000000078
[  120.657409] ---[ end trace 0000000000000000 ]---