Kernel crash after calling dma_alloc_coherent()

[Binh_Hoang]

Hi Community, 

I'm working on my custom board based on i.mx6sabresd. My driver crashed after executing dma_alloc_coherent() function. Is there a safe way to use dma_alloc_coherent()?

This is the code snippet 

    cam->dummy_frame.vaddress = dma_alloc_coherent(0,

                   SZ_8M, &cam->dummy_frame.paddress,

                   GFP_DMA | GFP_KERNEL | __GFP_NOFAIL);

    if (cam->dummy_frame.vaddress == 0)

        pr_err("ERROR: v4l2 capture: Allocate dummy frame "

               "failed.\n");

    cam->dummy_frame.buffer.length = SZ_8M;

This is the kernel panic log

[ 1053.552974] 8<--- cut here ---
[ 1053.556114] Unable to handle kernel NULL pointer dereference at virtual address 00000168
[ 1053.565347] pgd = 7461b0d8
[ 1053.568128] [00000168] *pgd=00000000
[ 1053.571781] Internal error: Oops: 5 [#1] PREEMPT SMP ARM
[ 1053.577190] Modules linked in: mxc_v4l2_capture(+) ov5647_camera_int ipu_still ipu_csi_enc ipu_fg_overlay_sdc ipu_bg_overlay_sdc ipu_prp_enc v4l2_int_device caam_jr caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine authenc libdes option usb_wwan usbserial imx_vdoa caam secvio error [last unloaded: mxc_v4l2_capture]
[ 1053.606342] CPU: 1 PID: 626 Comm: insmod Not tainted 5.15.71+g95448dd0dc9b #1
[ 1053.613605] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
[ 1053.620245] PC is at dma_alloc_attrs+0xc/0x118
[ 1053.624785] LR is at mxc_v4l2_probe+0x508/0x80c [mxc_v4l2_capture]
[ 1053.631146] pc : [<801984e8>] lr : [<7f0e1540>] psr: 60000013
[ 1053.637524] sp : 835ddd58 ip : 00000000 fp : 83758940
[ 1053.642841] r10: 000001e0 r9 : 820e9010 r8 : 812232e8
[ 1053.648159] r7 : 820e9000 r6 : 00000000 r5 : 00008cc1 r4 : 83758000
[ 1053.654800] r3 : 81404f88 r2 : 83758538 r1 : 00800000 r0 : 00000000
[ 1053.661440] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
[ 1053.668703] Control: 10c5387d Table: 1371404a DAC: 00000051
[ 1053.674548] Register r0 information: NULL pointer
[ 1053.679342] Register r1 information: non-paged memory
[ 1053.684487] Register r2 information: slab kmalloc-8k start 83758000 pointer offset 1336 size 8192
[ 1053.693534] Register r3 information: non-slab/vmalloc memory
[ 1053.699298] Register r4 information: slab kmalloc-8k start 83758000 pointer offset 0 size 8192
[ 1053.708073] Register r5 information: non-paged memory
[ 1053.713215] Register r6 information: NULL pointer
[ 1053.718006] Register r7 information: slab kmalloc-1k start 820e9000 pointer offset 0 size 1024
[ 1053.730226] Register r8 information: non-slab/vmalloc memory
[ 1053.739434] Register r9 information: slab kmalloc-1k start 820e9000 pointer offset 16 size 1024
[ 1053.751756] Register r10 information: non-paged memory
[ 1053.760420] Register r11 information: slab kmalloc-8k start 83758000 pointer offset 2368 size 8192
[ 1053.772940] Register r12 information: NULL pointer
[ 1053.781283] Process insmod (pid: 626, stack limit = 0x6f739801)
[ 1053.790762] Stack: (0x835ddd58 to 0x835de000)
[ 1053.798665] dd40: 83758000 7f0e83e0
[ 1053.810452] dd60: 00000000 820e9000 812232e8 7f0e1540 00000000 0000001e 835dc000 83758874
[ 1053.822319] dd80: 83758000 7f0df6e4 00000000 00000000 00000000 00000000 00000001 5e19c38a
[ 1053.834191] dda0: 00000000 00000000 820e9010 7f0e831c 81553cd0 0000001e 835dc000 0000017b
[ 1053.846133] ddc0: 00465744 806b946c 820e9010 00000000 7f0e831c 806b6b18 00000000 806c56f8
[ 1053.858089] dde0: 820e9010 820e9010 81553cd0 7f0e831c 820e9010 806b6f64 00000000 ab656a94
[ 1053.870070] de00: 815c8abc 815c8ac0 7f0e831c 0000001e 835dc000 0000017b 00465744 806b7100
[ 1053.882135] de20: 820e9054 820e9010 7f0e831c 814fe8c8 82032838 806b7864 00000000 7f0e831c
[ 1053.894211] de40: 806b77b4 814fe8c8 82032838 806b4868 835dde70 82031558 821f9634 5e19c38a
[ 1053.906317] de60: 7f0e831c 82032800 00000000 806b5ce4 7f0e69d4 00000000 7f0e831c 00000000
[ 1053.918417] de80: ffffe000 00000000 801002c4 806b81a4 8156d000 7f06c000 ffffe000 7f06c03c
[ 1053.930533] dea0: 8156d000 801017dc 00000000 835dc000 00000000 00000000 815b9d60 00000cc0
[ 1053.942720] dec0: 801ba46c 814051b8 00465744 80250ae4 00000000 00000000 82001180 80251830
[ 1053.954881] dee0: 00000000 00000000 00000000 7f0e8f40 00000003 5e19c38a 0000017b 7f0e8f40
[ 1053.967077] df00: 831c0dc0 00454030 0000017b 801ba48c 0000017b 801002c4 00000000 00000003
[ 1053.979253] df20: 00454030 801bd60c 835ddf3c 7fffffff 00000000 00000002 7ef88b88 c0d55000
[ 1053.991411] df40: c0d5cacd c0d5f100 c0d55000 0006cea0 c0dc1540 c0dc1300 c0da60b4 0000b000
[ 1054.003620] df60: 0000cd50 0000656c 0000e510 7f0e83e0 00000077 00000000 0000655c 00000039
[ 1054.015849] df80: 0000003a 00000024 0000001e 0000001b 00000000 5e19c38a 00000000 016db190
[ 1054.028000] dfa0: 00000000 80100060 00000000 016db190 00000003 00454030 00000000 00000000
[ 1054.040047] dfc0: 00000000 016db190 00000000 0000017b 00451fe0 00000000 00000002 00465744
[ 1054.051994] dfe0: 7ef88bc0 7ef88bb0 0044d27b 76e2af12 40000030 00000003 00000000 00000000
[ 1054.063909] [<801984e8>] (dma_alloc_attrs) from [<83758874>] (0x83758874)
[ 1054.074464] Code: e12fff1e e92d41f0 e1a05003 e59f3104 (e5906168)
[ 1054.098743] ---[ end trace 522bb96afef1758d ]---

Thank you in advanced

[Zhiming_Liu]

Did you print this value? Is it stack address of paddress or the stored value in paddress?

&cam->dummy_frame.paddress