This was the interesting result of 'less -f /dev/kmem' on 2.6.0-test2-mm2:
<1>Unable to handle kernel NULL pointer dereference at virtual address 00000020
printing eip:
c01b9d4a
*pde = 00000000
Oops: 0000 [#3]
PREEMPT
CPU: 0
EIP: 0060:[<c01b9d4a>] Not tainted VLI
EFLAGS: 00010296
EIP is at __copy_user_intel+0x16/0xac
eax: 00000004 ebx: 00000000 ecx: 00002000 edx: 0806546c
esi: 00000000 edi: 0806346c ebp: 00000000 esp: c6401f18
ds: 007b es: 007b ss: 0068
Process less (pid: 7815, threadinfo=c6400000 task=c400b900)
Stack: 00000000 0806346c c01b9ef4 0806346c 00000000 00002000 0806346c 00002000
c01e48b6 0806346c 00000000 00002000 ce0fcbd4 0000000a 0000000a 0806042a
c01ebd1f 00000000 00002000 00000000 c8134480 c81344a0 00002000 c0150344
Call Trace:
[<c01b9ef4>] __copy_to_user_ll+0x68/0x6c
[<c01e48b6>] read_kmem+0x158/0x15f
[<c01ebd1f>] write_chan+0x0/0x255
[<c0150344>] vfs_read+0xb0/0x119
[<c01505eb>] sys_read+0x42/0x63
[<c0109167>] syscall_call+0x7/0xb
Code: 29 ca 01 d0 8b 7c 24 08 21 f0 8b 1c 24 8b 74 24 04 83 c4 0c c3 83 ec 08 89 34 24 89 7c 24 04 8b 4c 24 14 8b 7c 24
0c 8b 74 24 10 <8b> 46 20 83 f9 43 76 04 8b 46 40 90 8b 46 00 8b 56 04 89 47 00
I'm not worried, I was explicitly trying to find ways to oops my kernel :)
-Josh