I have an embedded Linux ARM 4.1.33 system that has been patched with the preempt real-time patch. This system contains some custom modified kernel code, and was sporadically experiencing a kernel oops. After some debugging it was discovered that one of the developers didn't understand the distinction between kernel and user space, and that they were dereferencing user space pointers without using the functions defined in uaccess.h.
I have since modified the problematic functions to use the functions defined in uaccess.h, to prevent further kernel oops from occurring. I am now attempting to verify that fix was successful. However, since the original kernel oops happened randomly, sometimes not occurring for days at a time, I'd like to identify some method to reliably recreate it in the original code, and then verify that it no longer occurs in the updated code.
Although the problematic function was using the pointer incorrectly, it did appear to correctly modify the user space value using the pointer (excluding when the kernel oops occurred). This would indicate to me that the pointer's address "meant the same thing" in both user and kernel space. Given this fact, the only reason that I'm aware of that this dereferencing could cause a kernel oops would be if the page containing the address was sent to swap, resulting in a page fault. However, our system has swap disabled due to the limited longevity of our flash storage, making this scenario seem unlikely.
What are the potential causes for a Linux kernel oops relating to dereferencing a user space pointer from within kernel space? How could I reliably cause such a kernel oops to occur, in order to verify that it no longer occurs after applying fixes?
NULLpointer from the user space?
copy_from_user()would probably anticipate such a need and provide destination space that is appropriately aligned (or bad code might provide it by accident, eg on the stack as a local variable).