'perf stat' または 'perf test' コマンドを実行すると、(null) で NULL ポインターの逆参照が原因で _spin_lock_irqsave() でカーネルパニックが発生する

Issue

• "Intel(R) Xeon(R) CPU E7" (Westmere) プロセッサーを持つ VMware Virtual Platform で実行している RHEL6 で 'perf stat' または 'perf test' コマンドを実行すると、(null) の NULL ポインターの逆参照が原因で _spin_lock_irqsave() でカーネルパニックが発生します。

BUG: unable to handle kernel NULL pointer dereference at (null)
IP:[<ffffffff8152cd4f>] _spin_lock_irqsave+0x1f/0x40
PGD 0 
Oops:0002 [#1] SMP 
last sysfs file:/sys/kernel/mm/redhat_transparent_hugepage/khugepaged/defrag
CPU 10 
Modules linked in: autofs4 nfs lockd fscache auth_rpcgss nfs_acl sunrpc microcode ppdev vmware_balloon sg i2c_piix4 i2c_core shpchp parport_pc parport ext4 jbd2 mbcache sd_mod crc_t10dif sr_mod cdrom vmxnet3 vmw_pvscsi pata_acpi ata_generic ata_piix dm_mirror dm_region_hash dm_log dm_mod [last unloaded: speedstep_lib]

Pid:7468, comm: monoop.orig.tsk Not tainted 2.6.32-504.el6.x86_64 #1 VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform
RIP:0010:[<ffffffff8152cd4f>]  [<ffffffff8152cd4f>] _spin_lock_irqsave+0x1f/0x40
RSP:0018:ffff8810047955f8  EFLAGS:00010046
RAX:0000000000010000 RBX: ffff88006194cc40 RCX:0000000000000000
RDX:0000000000000046 RSI: ffff881025630c00 RDI:0000000000000000
RBP: ffff8810047955f8 R08:0000000000000002 R09:0000000000000001
R10:0000000000000004 R11:0000000000000008 R12: ffff881025630c00
R13:0000000000000000 R14:0000000000000000 R15: ffff881025630d38
FS:0000000000000000(0000) GS:ffff880061940000(0000) knlGS:0000000000000000
CS:0010 DS:0000 ES:0000 CR0:000000008005003b
CR2:0000000000000000 CR3:00000010028c6000 CR4:00000000000007e0
DR0:0000000000000000 DR1:0000000000000000 DR2:0000000000000000
DR3:0000000000000000 DR6:00000000ffff0ff0 DR7:0000000000000400
Process monoop.orig.tsk (pid:7468, threadinfo ffff881004794000, task ffff88102066aaa0)
Stack:
 ffff881004795658 ffffffff81024bd9 0000000200000004 0000000000000000
<d> 0000000000000000 0000000000000001 0000000000000003 ffff881025630c00
<d> 0000000000000000 ffff88006194cc40 0000000000000002 ffff881004795908
Call Trace:
 [<ffffffff81024bd9>] __intel_shared_reg_get_constraints+0x69/0x1e0
 [<ffffffff81024deb>] intel_get_event_constraints+0x9b/0x180
 [<ffffffff8101e815>] x86_schedule_events+0x75/0x1d0
 [<ffffffff810586dc>] ? check_preempt_curr+0x7c/0x90
 [<ffffffff810649fe>] ? try_to_wake_up+0x24e/0x3e0
 [<ffffffff81064ba2>] ? default_wake_function+0x12/0x20
 [<ffffffff8109eb16>] ? autoremove_wake_function+0x16/0x40
 [<ffffffff810577e9>] ?__wake_up_common+0x59/0x90
 [<ffffffff811a9517>] ?__d_lookup+0xa7/0x150
 [<ffffffff8119db5f>] ? do_lookup+0x9f/0x230
 [<ffffffff811a993a>] ? dput+0x9a/0x150
 [<ffffffff8119c8f5>] ? path_to_nameidata+0x25/0x60
 [<ffffffff8119e90a>] ?__link_path_walk+0x7da/0x1000
 [<ffffffff8101d8f9>] ? x86_pmu_add+0xb9/0x170
 [<ffffffff8101d7a7>] x86_pmu_commit_txn+0x67/0xc0
 [<ffffffff811b07b0>] ? mntput_no_expire+0x30/0x110
 [<ffffffff8119c731>] ? path_put+0x31/0x40
 [<ffffffff8107c297>] ? current_fs_time+0x27/0x30
 [<ffffffff8117d170>] ? mem_cgroup_get_reclaim_stat_from_page+0x20/0x70
 [<ffffffff8111b7aa>] group_sched_in+0x13a/0x170
 [<ffffffff81014a29>] ? sched_clock+0x9/0x10
 [<ffffffff8111bac8>] ctx_sched_in+0x2e8/0x330
 [<ffffffff8111bb7b>] perf_event_sched_in+0x6b/0xb0
 [<ffffffff8111bc36>] perf_event_context_sched_in+0x76/0xc0
 [<ffffffff8111eb3b>] perf_event_comm+0x1bb/0x2e0
 [<ffffffff81195ee9>] set_task_comm+0x69/0x80
 [<ffffffff81195fe1>] setup_new_exec+0xe1/0x2e0
 [<ffffffff811ea68e>] load_elf_binary+0x3ce/0x1ab0
 [<ffffffff8114ac12>] ? follow_page+0x412/0x500
 [<ffffffff8114fed0>] ?__get_user_pages+0x110/0x430
 [<ffffffff811e78be>] ? load_misc_binary+0x9e/0x3f0
 [<ffffffff81150289>] ? get_user_pages+0x49/0x50
 [<ffffffff81197287>] search_binary_handler+0x137/0x370
 [<ffffffff811977f7>] do_execve+0x217/0x2c0
 [<ffffffff810095ea>] sys_execve+0x4a/0x80
 [<ffffffff8100b4ca>] stub_execve+0x6a/0xc0
Code: c9 c3 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 0f 1f 44 00 00 9c 58 0f 1f 44 00 00 48 89 c2 fa 66 0f 1f 44 00 00 b8 00 00 01 00 <f0> 0f c1 07 0f b7 c8 c1 e8 10 39 c1 74 0e f3 90 0f 1f 44 00 00 
RIP  [<ffffffff8152cd4f>] _spin_lock_irqsave+0x1f/0x40
 RSP <ffff8810047955f8>
CR2:0000000000000000