4.12.0-rc6: kernel BUG at arch/x86/mm/init_64.c:128!

[YASUAKI ISHIMATSU]

The I hit the following kernel panic while hot-adding memory.

  ------------[ cut here ]------------
  kernel BUG at arch/x86/mm/init_64.c:128!
  invalid opcode: 0000 [#1] SMP
  <snip>
  CPU: 10 PID: 6 Comm: kworker/u1024:0 Not tainted 4.12.0-rc6+ #2
  <snip>
  Workqueue: kacpi_hotplug acpi_hotplug_work_fn
  task: ffff880189604380 task.stack: ffffc90000074000
  RIP: 0010:sync_global_pgds+0x157/0x180
  RSP: 0018:ffffc90000077ae0 EFLAGS: 00010206
  RAX: ffff880187d88000 RBX: ffffea103e5bf2c0 RCX: 00003ffffffff000
  RDX: ffff881050ee2000 RSI: 0000000187d88067 RDI: 0000000187d88067
  RBP: ffffc90000077b18 R08: 8000000000000163 R09: ffff880187d88000
  R10: 0000000000000000 R11: 0000000000000cc1 R12: ffff8c0f96fcb900
  R13: 0000000000000900 R14: ffffffff81c09900 R15: ffff8c0fb0f6c074
  FS:  0000000000000000(0000) GS:ffff88105c280000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 00007fe765890000 CR3: 0000000001c09000 CR4: 00000000003406e0
  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  Call Trace:
   kernel_physical_mapping_init+0x191/0x1b1
   init_memory_mapping+0x189/0x3a0
   add_memory+0x8e/0x110
   acpi_memory_device_add+0x14c/0x310
   acpi_bus_attach+0x10c/0x1d0
   acpi_bus_attach+0x93/0x1d0
   acpi_bus_scan+0x47/0xa0
   acpi_device_hotplug+0x199/0x490
   acpi_hotplug_work_fn+0x1e/0x30
   process_one_work+0x149/0x360
   worker_thread+0x4d/0x3c0
   kthread+0x109/0x140
   ? rescuer_thread+0x380/0x380
   ? kthread_park+0x60/0x60
   ret_from_fork+0x25/0x30
  <snip>
  RIP: sync_global_pgds+0x157/0x180 RSP: ffffc90000077ae0
  ---[ end trace 3dbbd50e90802680 ]---
  Kernel panic - not syncing: Fatal exception

The panic did not occur on 4.11 but has occurred since 4.12-rc1. So I think the following
commit caused the issue.

  commit f2a6a7050109e0a5c7a84c70aa6010f682b2f1ee
  Author: Kirill A. Shutemov <kirill.shutemov@xxxxxxxxxxxxxxx>
  Date:   Fri Mar 17 21:55:15 2017 +0300

    x86: Convert the rest of the code to support p4d_t

As additional information, the issue does not occur if I just do memory hot-add.
But if I hot add the memory after hot removing a memory, the issue occurs 100%.

Thanks,
Yasuaki Ishimatsu