Cause of the bug:
The flags for the vmap_area is not set properly while initializing the vmlist, vmalloc_init() in mm/vmallo.c This leads, to freeing of statically mapped memory(before the mapping is removed), by ioremap because tmp->flags has VM_IOREMAP set.
This makes vmalloc/ioremap calls to fail, because it is allocating one of the freed virtual address ranges that aren't unmapped.
This is the scenario, that is reproduced in the bug's test case, where we get an address range, which is already static-mapped by the Iotable.
The fix is available in the latest kernel, as well as in the internal branch, which sets the flags correctly.
Fix in latest kernel: commit-msg: fix faulty initialization in vmalloc_init()
Cause of the bug:
The flags for the vmap_area is not set properly while initializing the vmlist, vmalloc_init() in mm/vmallo.c This leads, to freeing of statically mapped memory(before the mapping is removed), by ioremap because tmp->flags has VM_IOREMAP set.
This makes vmalloc/ioremap calls to fail, because it is allocating one of the freed virtual address ranges that aren't unmapped.
This is the scenario, that is reproduced in the bug's test case, where we get an address range, which is already static-mapped by the Iotable.
The fix is available in the latest kernel, as well as in the internal branch, which sets the flags correctly.
Fix in latest kernel: commit-msg: fix faulty initialization in vmalloc_init()
This fixed the bug.