Looks like you are hitting the empty section gap:

0xfa200000-0xfa300000 1048576 pmd_empty_section_gap+0x0/0x3c ioremap

pmd_empty_section_gap ends up with vm->phys_addr = 0x0 because it was
never set. This section isn't actually mapped so when searching for the
range in the static io map it finds this address and returns it but it
isn't actually a valid address to return. Perhaps ioremap should not
bother trying to re-use the static iomap if the address is zero and let
pmd_empty_section_gap use 0x0 as a dummy value?

diff --git a/arch/arm/mm/ioremap.c b/arch/arm/mm/ioremap.c
--- a/arch/arm/mm/ioremap.c
+++ b/arch/arm/mm/ioremap.c

@@ -228,7 +228,8 @@ void __iomem * __arm_ioremap_pfn_caller(unsigned

long pfn,
*/
read_lock(&vmlist_lock);
for (area = vmlist; area; area = area->next) {
- if (!size || (sizeof(phys_addr_t) == 4 && pfn >= 0x100000))
+ if (!size || !pfn || (sizeof(phys_addr_t) == 4 &&
+ pfn >= 0x100000))