title: What can cause a "Unable to handle kernel paging request" error when using kzalloc()?
body: <p>Im getting a "Unable to handle kernel paging request" kernel oops (see error message below) and I can't see why. As far as I know, this error message occurs, when I'm accessing memory that I shouldn't access.But in this case the error message seems to trigger in/directly after the allocation.</p>
  
  <p>So my question is: is there another reason for this oops to occur?</p>
  
  <p>Here's the error message:</p>
  
  <pre><code>[   68.229185] Unable to handle kernel paging request at virtual address 5761308c
  [   68.236398] pgd = c0004000
  [   68.239094] [5761308c] *pgd=00000000
  [   68.242670] Internal error: Oops: 5 [#1] SMP ARM
  [   68.247266] Modules linked in: riddler(O)
  [   68.251285] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G        W  O    4.1.0 #14
  [   68.258388] Hardware name: Altera SOCFPGA
  [   68.262380] task: c07cffa8 ti: c07ca000 task.ti: c07ca000
  [   68.267763] PC is at kmem_cache_alloc_trace+0x60/0x184
  [   68.272883] LR is at riddler_nf_queue_handler+0x164/0x6d4 [riddler]
  [   68.279122] pc : [&lt;c0118ea0&gt;]    lr : [&lt;bf000630&gt;]    psr: 200f0113
  [   68.279122] sp : c07cbb80  ip : c07cbbc0  fp : c07cbbbc
  [   68.290546] r10: 00000000  r9 : ed66d800  r8 : 0000000c
  [   68.295746] r7 : edc01f00  r6 : bf000630  r5 : 00008020  r4 : 5761308c
  [   68.302243] r3 : 00000000  r2 : c07cbb80  r1 : c07cbce0  r0 : 2da0f000
  [   68.308741] Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
  [   68.316015] Control: 10c5387d  Table: 2cd3004a  DAC: 00000015
  [   68.321734] Process swapper/0 (pid: 0, stack limit = 0xc07ca218)
  [   68.327713] Stack: (0xc07cbb80 to 0xc07cc000)
  [   68.332054] bb80: 000005dc c0448cdc c07cc404 00004058 2d66e000 ed5c99d0 bf001cfc ed5a8800
  [   68.340196] bba0: bf001cfc 000005c0 ed66d800 00000000 c07cbc14 c07cbbc0 bf000630 c0118e4c
  [   68.348338] bbc0: c07cbc9c 00000044 c07cbc14 c07cbbd8 00000000 00000000 00000001 00484c68
  [   68.356479] bbe0: 000005c0 0000001c 00000044 ed5a8800 c05b83f0 00000044 bf001984 edfebe40
  [   68.364621] bc00: bf001940 00000000 c07cbc64 c07cbc18 c0484e3c bf0004d8 c07cbc3c 00000000
  [   68.372762] bc20: 80000000 c04bbc02 ede3f000 00000000 00000000 c0489f30 c0483d08 c07cbc9c
  [   68.380903] bc40: edfebe40 c07cbc6c c07cdae8 00000003 ede3f000 c07cd524 c07cbc94 c07cbc68
  [   68.389045] bc60: c0483da8 c0484d00 edc817c0 bf001940 c07c9340 00000050 ecc91340 edfebe40
  [   68.397186] bc80: ede3f000 00000008 c07cbcd4 c07cbc98 c048a880 c0483d54 c07cbccc 00000000
  [   68.405327] bca0: 80000000 c04bbc02 ede3f000 00000000 00000000 c0489f30 edfebe40 c07ce898
  [   68.413468] bcc0: c048a4c4 ede3f000 c07cbd24 c07cbcd8 c0457b00 c048a4d0 00000000 ede3f000
  [   68.421610] bce0: edfebe40 ede3f580 00000020 edfebe40 00000000 ede3f05c c07cbd14 c07cd514
  [   68.429752] bd00: edfebe40 ede3f580 00000020 00000100 00000000 00000001 c07cbd3c c07cbd28
  [   68.437893] bd20: c045a34c c0457440 c07cd514 edfebe40 c07cbd6c c07cbd40 c045a400 c045a320
  [   68.446034] bd40: 2690390a 14562ba2 edfebe40 ede3f580 00000020 00000100 00000003 edfebe40
  [   68.454175] bd60: c07cbd8c c07cbd70 c045ada8 c045a3b4 ede3f580 edfebe40 000005ea 00000020
  [   68.462316] bd80: c07cbdec c07cbd90 c03a50c8 c045acec 00000000 e2d32d80 0000000f ee1d5400
  [   68.470456] bda0: 00000001 ede3f4c0 c07cbde4 c07cbdb8 c07d153c 00000100 00000040 00000002
  [   68.478597] bdc0: ffffffff ede3f580 00000001 00000040 0000012c ee1d8b80 c07cc100 c07cbe18
  [   68.486738] bde0: c07cbe54 c07cbdf0 c045be80 c03a4e04 ffffa577 c06b2a60 c07cd514 c07cd514
  [   68.494880] be00: c082ce31 ee1d8b80 c082f608 2da0f000 c07c9b80 ffffa579 c07cbe18 c07cbe18
  [   68.503021] be20: c07cbe20 c07cbe20 00000001 c07cc08c 00000003 00000000 00000100 c07ca000
  [   68.511163] be40: 00000008 c082cf0c c07cbebc c07cbe58 c002a684 c045bc68 00000011 edd41180
  [   68.519304] be60: edd411e0 00200000 c07cc100 ffffa578 c05769b4 0000000a c08302c0 c07c52c8
  [   68.527445] be80: c07cc080 c07cbe58 0000000c 00000004 00000000 c07c7c2c 00000024 00000000
  [   68.535587] bea0: 00000000 edc10800 c07cc450 c05769a8 c07cbed4 c07cbec0 c002ab68 c002a5a0
  [   68.543728] bec0: c07c7c2c 00000024 c07cbefc c07cbed8 c006738c c002aaec fee0010c c07cce2c
  [   68.551870] bee0: c07cbf20 fee00100 c082d4c0 c07cc450 c07cbf1c c07cbf00 c0009470 c0067328
  [   68.560011] bf00: c0010648 600f0013 ffffffff c07cbf54 c07cbf74 c07cbf20 c0014680 c0009448
  [   68.568153] bf20: 00000000 00000000 000198a0 c0021be0 00000000 c07ca000 c07cc49c ffffffff
  [   68.576295] bf40: c082d4c0 c07cc450 c05769a8 c07cbf74 c07cbf78 c07cbf68 c0010644 c0010648
  [   68.584437] bf60: 600f0013 ffffffff c07cbf9c c07cbf78 c005db84 c001060c 00000000 c082cc99
  [   68.592578] bf80: c07c5304 c07cbf78 c0570680 ffffffff c07cbfac c07cbfa0 c056be78 c005d9f4
  [   68.600719] bfa0: c07cbff4 c07cbfb0 c0763cc0 c056bdfc ffffffff ffffffff c07636d8 00000000
  [   68.608861] bfc0: 00000000 c07a98c8 00000000 c082fc14 c07cc440 c07a98c4 c07d1218 0000406a
  [   68.617002] bfe0: 413fc090 00000000 00000000 c07cbff8 0000807c c0763978 00000000 00000000
  [   68.625154] [&lt;c0118ea0&gt;] (kmem_cache_alloc_trace) from [&lt;bf000630&gt;] (riddler_nf_queue_handler+0x164/0x6d4 [riddler])
  [   68.635638] [&lt;bf000630&gt;] (riddler_nf_queue_handler [riddler]) from [&lt;c0484e3c&gt;] (nf_queue+0x148/0x17c)
  [   68.644907] [&lt;c0484e3c&gt;] (nf_queue) from [&lt;c0483da8&gt;] (nf_hook_slow+0x60/0xfc)
  [   68.652104] [&lt;c0483da8&gt;] (nf_hook_slow) from [&lt;c048a880&gt;] (ip_rcv+0x3bc/0x4c4)
  [   68.659308] [&lt;c048a880&gt;] (ip_rcv) from [&lt;c0457b00&gt;] (__netif_receive_skb_core+0x6cc/0x874)
  [   68.667542] [&lt;c0457b00&gt;] (__netif_receive_skb_core) from [&lt;c045a34c&gt;] (__netif_receive_skb+0x38/0x94)
  [   68.676724] [&lt;c045a34c&gt;] (__netif_receive_skb) from [&lt;c045a400&gt;] (netif_receive_skb_internal+0x58/0xcc)
  [   68.686077] [&lt;c045a400&gt;] (netif_receive_skb_internal) from [&lt;c045ada8&gt;] (napi_gro_receive+0xc8/0xf4)
  [   68.695176] [&lt;c045ada8&gt;] (napi_gro_receive) from [&lt;c03a50c8&gt;] (stmmac_poll+0x2d0/0x644)
  [   68.703148] [&lt;c03a50c8&gt;] (stmmac_poll) from [&lt;c045be80&gt;] (net_rx_action+0x224/0x354)
  [   68.710864] [&lt;c045be80&gt;] (net_rx_action) from [&lt;c002a684&gt;] (__do_softirq+0xf0/0x304)
  [   68.718577] [&lt;c002a684&gt;] (__do_softirq) from [&lt;c002ab68&gt;] (irq_exit+0x88/0xc0)
  [   68.725774] [&lt;c002ab68&gt;] (irq_exit) from [&lt;c006738c&gt;] (__handle_domain_irq+0x70/0xc4)
  [   68.733575] [&lt;c006738c&gt;] (__handle_domain_irq) from [&lt;c0009470&gt;] (gic_handle_irq+0x34/0x6c)
  [   68.741893] [&lt;c0009470&gt;] (gic_handle_irq) from [&lt;c0014680&gt;] (__irq_svc+0x40/0x54)
  [   68.749340] Exception stack(0xc07cbf20 to 0xc07cbf68)
  [   68.754371] bf20: 00000000 00000000 000198a0 c0021be0 00000000 c07ca000 c07cc49c ffffffff
  [   68.762512] bf40: c082d4c0 c07cc450 c05769a8 c07cbf74 c07cbf78 c07cbf68 c0010644 c0010648
  [   68.770650] bf60: 600f0013 ffffffff
  [   68.774133] [&lt;c0014680&gt;] (__irq_svc) from [&lt;c0010648&gt;] (arch_cpu_idle+0x48/0x4c)
  [   68.781508] [&lt;c0010648&gt;] (arch_cpu_idle) from [&lt;c005db84&gt;] (cpu_startup_entry+0x19c/0x264)
  [   68.789743] [&lt;c005db84&gt;] (cpu_startup_entry) from [&lt;c056be78&gt;] (rest_init+0x88/0x8c)
  [   68.797465] [&lt;c056be78&gt;] (rest_init) from [&lt;c0763cc0&gt;] (start_kernel+0x354/0x360)
  [   68.804917] Code: e7914000 e3540000 0a000038 e5973014 (e7949003)
  [   68.811024] ---[ end trace 11b433a852b633dc ]---
  </code></pre>
  
  <p>And here's the code segment that's causing it (I think, I used gdb "list *(riddler_nf_queue_handler)+0x164" to find it):</p>
  
  <pre><code>  new = (struct fpga_kfifo_entry *) kzalloc(sizeof(struct fpga_kfifo_entry), GFP_ATOMIC);
  
    new-&gt;entry = entry;
    new-&gt;dma_buffer = dma_buffer; //+0x164 is here
    new-&gt;dma_buffer_size = data_length_pad;
  
    if(!(kfifo_put(&amp;irq_fifo, new))) {
      // FIFO was full
  #ifdef DEBUG
      pr_info("IRQ Fifo is full, couldn't add new entry!\n");
  #endif
  
      kfree(dma_buffer);
      kfree(new);
      nf_reinject(entry, NF_DROP);
      return 0;
    }
  </code></pre>
  
  <p>dma_buffer is allocated in the same function, but earlier:</p>
  
  <pre><code>data_length_pad = round_to_word_size(data_length + 1);
  
  dma_buffer = (unsigned char *) kzalloc(data_length_pad, GFP_ATOMIC);
  
  if (!dma_buffer) {
    kfree(dma_buffer);
    nf_reinject(entry, NF_DROP);
    return 0;
  } else {
    // Only continue when allocation was successful
    dma_buffer[data_length_pad - 1] = (unsigned char) data_length_pad - data_length;
  }
  </code></pre>
  
  <p>Thanks in advance!</p>