Bug report: find_vma() called before mmap_read_lock() issued in /usr/src/hailo_pci-4.23.0/linux/vdma/memory.c

Environment

Hardware: Raspberry Pi 5 with Hailo AI Kit module via NVMe Base Duo

Kernel: 6.12.75+rpt-rpi-2712

Driver: hailo_pci 4.23.0 (latest as of March 2026)

OS: Raspberry Pi OS (Debian Bookworm), systemd 257

The system journal was being flooded with repeated kernel WARN traces every time the Hailo inference app ran. Each flood looked like this:

kernel: ------------\[ cut here \]------------
kernel: Call trace:
kernel:  find_vma+0x6c/0x80
kernel:  hailo_vdma_buffer_map+0x8c/0x5e8 \[hailo_pci\]
kernel:  hailo_vdma_buffer_map_ioctl+0xdc/0x340 \[hailo_pci\]
...

This is a kernel WARN_ON triggered on every DMA buffer mapping call, not just verbose debug logging. Running at 10Hz meant writing 15+ lines to the journal at 10Hz, which caused significant system slowdowns even when running the system from an SSD (as opposed to an SD card).

Root Cause
In Linux kernel 6.x, find_vma() requires the mmap_read_lock() to be held before calling it. The hailo_vdma_buffer_map() function in /usr/src/hailo_pci-4.23.0/linux/vdma/memory.c calls find_vma() without acquiring this lock, triggering the warning on every inference call.

Fix

Edit the driver source and rebuild via DKMS.
1. Edit the source file

sudo nano /usr/src/hailo_pci-4.23.0/linux/vdma/memory.c

Around line 169, wrap the find_vma call and all subsequent vma usage with mmap_read_lock/ mmap_read_unlock. The three unlock calls cover the three exit paths from the block (NULL vma error, create_fd_from_vma failure, and normal exit).

Before:

if (HAILO_DMA_DMABUF_BUFFER != buffer_type) {
      vma = find_vma(current->mm, addr_or_fd);
      if (IS_ENABLED(HAILO_SUPPORT_MMIO_DMA_MAPPING)) {
          if (NULL == vma) {
               dev_err(dev, "no vma for virt_addr/size = 0x%08lx/0x%08zx\n", addr_or_fd, size);
               ret = -EFAULT;
               goto cleanup;
          }
      }

     if (is_dmabuf_vma(vma)) {
         dev_dbg(dev, "Given vma is backed by dmabuf - creating fd and mapping as dmabuf\n");
         buffer_type = HAILO_DMA_DMABUF_BUFFER;
         ret = create_fd_from_vma(dev, vma);
         if (ret < 0) {
              dev_err(dev, "Failed creating fd from vma in given dmabuf\n");
              goto cleanup;
         }
         dmabuf_from_pointer_addr = addr_or_fd;
         addr_or_fd = ret;
      }
}

After:

if (HAILO_DMA_DMABUF_BUFFER != buffer_type) {
    mmap_read_lock(current->mm);
    vma = find_vma(current->mm, addr_or_fd);
    if (IS_ENABLED(HAILO_SUPPORT_MMIO_DMA_MAPPING)) {
        if (NULL == vma) {
            mmap_read_unlock(current->mm);
            dev_err(dev, "no vma for virt_addr/size = 0x%08lx/0x%08zx\\n", addr_or_fd, size);
            ret = -EFAULT;
            goto cleanup;
        }
   }

  if (is_dmabuf_vma(vma)) {
       dev_dbg(dev, "Given vma is backed by dmabuf - creating fd and mapping as dmabuf\\n");
        buffer_type = HAILO_DMA_DMABUF_BUFFER;
        ret = create_fd_from_vma(dev, vma);
        if (ret < 0) {
            mmap_read_unlock(current->mm);
            dev_err(dev, "Failed creating fd from vma in given dmabuf\\n");
            goto cleanup;
        }
        dmabuf_from_pointer_addr = addr_or_fd;
        addr_or_fd = ret;
    }
    mmap_read_unlock(current->mm);
}

2. Rebuild and reinstall the module

sudo dkms build hailo_pci/4.23.0
sudo dkms install --force hailo_pci/4.23.0
sudo modprobe -r hailo_pci && sudo modprobe hailo_pci

This will be overwritten if and when hailo_pci is updated via apt upgrade unless the source library is updated in the repository.

1 Like

Thanks @user929 for raising this issue and the solution - we are truly appreciate it! We will investigate it internally.

Hi, any update regarding this bug please? I’m having the same issue in Trixie:

Linux gold 6.12.75+rpt-rpi-2712 #1 SMP PREEMPT Debian 1:6.12.75-1+rpt1 (2026-03-11) aarch64 GNU/Linux

1 Like

I also experienced this issue with a Compute Module 5 and the 6.12.75+rpt-rpi-2712 kernel. as was mentioned by @user929 the problem lies with the find_vma call not being surrounded by the mmap_read_lock/mmap_read_unlock calls. I have create a PR on the hailo8 branch on the hailort_drivers repo. Please could you review and merge so that the fix can find its way to Pi OS package mainters. Cheers

1 Like

Hi @user280, @Stepan_Riss,
We are still working on it.
I’ll keep update here ASAP.
Thanks,

Hi @user929, @user280, @Stepan_Riss;

We are planning to release soon a new version of HailoRT for Hailo-8 with a fix for this issue.

Thanks,