CVE-2025-37837
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-37837
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-37837.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-37837
- Downstream
- Published
- 2025-05-09T06:41:48Z
- Modified
- 2025-10-18T00:41:22.383399Z
- Summary
- iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
iommu/tegra241-cmdqv: Fix warnings due to dmamfreecoherent()
Two WARNINGs are observed when SMMU driver rolls back upon failure: arm-smmu-v3.9.auto: Failed to register iommu arm-smmu-v3.9.auto: probe with driver arm-smmu-v3 failed with error -22 ------------[ cut here ]------------ WARNING: CPU: 5 PID: 1 at kernel/dma/mapping.c:74 dmamfreecoherent+0xc0/0xd8 Call trace: dmamfreecoherent+0xc0/0xd8 (P) tegra241vintffreelvcmdq+0x74/0x188 tegra241cmdqvremovevintf+0x60/0x148 tegra241cmdqvremove+0x48/0xc8 armsmmuimplremove+0x28/0x60 devmactionrelease+0x1c/0x40 ------------[ cut here ]------------ 128 pages are still in use! WARNING: CPU: 16 PID: 1 at mm/pagealloc.c:6902 freecontigrange+0x18c/0x1c8 Call trace: freecontigrange+0x18c/0x1c8 (P) cmarelease+0x154/0x2f0 dmafreecontiguous+0x38/0xa0 dmadirectfree+0x10c/0x248 dmafreeattrs+0x100/0x290 dmamfreecoherent+0x78/0xd8 tegra241vintffreelvcmdq+0x74/0x160 tegra241cmdqvremove+0x98/0x198 armsmmuimplremove+0x28/0x60 devmaction_release+0x1c/0x40
This is because the LVCMDQ queue memory are managed by devres, while that dmamfreecoherent() is called in the context of devmactionrelease().
Jason pointed out that "armsmmuimplprobe() has mis-ordered the devres callbacks if ops->deviceremove() is going to be manually freeing things that probe allocated": https://lore.kernel.org/linux-iommu/20250407174408.GB1722458@nvidia.com/
In fact, tegra241cmdqvinit_structures() only allocates memory resources which means any failure that it generates would be similar to -ENOMEM, so there is no point in having that "falling back to standard SMMU" routine, as the standard SMMU would likely fail to allocate memory too.
Remove the unwind part in tegra241cmdqvinitstructures(), and return a proper error code to ask SMMU driver to call tegra241cmdqvremove() via implops->deviceremove(). Then, drop tegra241vintffreelvcmdq() since devres will take care of that.
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/5584dbf393df509159813645a487b1ef76557722
- https://git.kernel.org/stable/c/767e22001dfce64cc03b7def1562338591ab6031
- https://git.kernel.org/stable/c/e38ed6908080047d8fa1763d1da86b584f9eb55b
- https://git.kernel.org/stable/c/e5dd974d6e00704553308ef1a88659f8dcfb39d4
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced483e0bd8883a40fd3dd3193997a4014337698d72Fixede5dd974d6e00704553308ef1a88659f8dcfb39d4
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced483e0bd8883a40fd3dd3193997a4014337698d72Fixed5584dbf393df509159813645a487b1ef76557722
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced483e0bd8883a40fd3dd3193997a4014337698d72Fixede38ed6908080047d8fa1763d1da86b584f9eb55b
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced483e0bd8883a40fd3dd3193997a4014337698d72Fixed767e22001dfce64cc03b7def1562338591ab6031
Affected versions
v6.*
v6.11
v6.11-rc4
v6.11-rc5
v6.11-rc6
v6.11-rc7
v6.12
v6.12-rc1
v6.12-rc2
v6.12-rc3
v6.12-rc4
v6.12-rc5
v6.12-rc6
v6.12-rc7
v6.12.1
v6.12.10
v6.12.11
v6.12.12
v6.12.13
v6.12.14
v6.12.15
v6.12.16
v6.12.17
v6.12.18
v6.12.19
v6.12.2
v6.12.20
v6.12.21
v6.12.22
v6.12.23
v6.12.3
v6.12.4
v6.12.5
v6.12.6
v6.12.7
v6.12.8
v6.12.9
v6.13
v6.13-rc1
v6.13-rc2
v6.13-rc3
v6.13-rc4
v6.13-rc5
v6.13-rc6
v6.13-rc7
v6.13.1
v6.13.10
v6.13.11
v6.13.2
v6.13.3
v6.13.4
v6.13.5
v6.13.6
v6.13.7
v6.13.8
v6.13.9
v6.14
v6.14-rc1
v6.14-rc2
v6.14-rc3
v6.14-rc4
v6.14-rc5
v6.14-rc6
v6.14-rc7
v6.14.1
v6.14.2
v6.15-rc1
Database specific
vanir_signatures
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@767e22001dfce64cc03b7def1562338591ab6031",
"deprecated": false,
"digest": {
"function_hash": "75899287611178222854893405295772706023",
"length": 917.0
},
"target": {
"file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c",
"function": "tegra241_cmdqv_init_structures"
},
"id": "CVE-2025-37837-0b0099fd",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5dd974d6e00704553308ef1a88659f8dcfb39d4",
"deprecated": false,
"digest": {
"function_hash": "90147509291519093887929993528265267395",
"length": 273.0
},
"target": {
"file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c",
"function": "tegra241_vintf_free_lvcmdq"
},
"id": "CVE-2025-37837-297fda18",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e38ed6908080047d8fa1763d1da86b584f9eb55b",
"deprecated": false,
"digest": {
"line_hashes": [
"301310079780356870417549727607100270691",
"44780308696440911489783853052400261829",
"271892292267214561410241968862467326590",
"1603817957348539285978517255478494751",
"28479559614562611633925027133144221657",
"315845880451625387218879246771842853314",
"115916829393449354791483670162442292347",
"18774486872436126294220500727355053527",
"39074304674260070432273118173119798753",
"134572358150035614265312359056389958216",
"317562140728245764570657833505696919158",
"86955902620952189666725672884628138674",
"305616087279154796651015780682360915550",
"255180131790916853981697388268143018513",
"109199176676222299383948355446156370552",
"236778116177377851206354171065153074735",
"328084475267586081496174708285927178520",
"22281546717147536212898707143691393152",
"89709476894096419522815745589193935473",
"44618762917553168940131926852343813933",
"273268627485556738062661636044617191057",
"295574171384127867122188976247073928522",
"110403241659077225142318871976948341280",
"164952463958919930005502542044930255852",
"267007973474785024757859551814083846373",
"324354132981516357136816473844081885348",
"249488959026231460822013495291090454231",
"227055305872068377270117467518699591478",
"7461242973827953281348999452933949864",
"178937194454437957519321653599217522064",
"89522475673928189888093838905171536262",
"45221332418799389263998342445196273006",
"230656473724975284855252848950760360961",
"214244702993279354865242341710085531777",
"329496383362357272704113202392774272977",
"291833088976570687865810542537880183851",
"217632768755479023271260838054527726201",
"264675106925080951515805187374926829052",
"295003779913657516481919729875184278244",
"157593185799403545232714073825156039389",
"316459286536724528490690025191068524884",
"190625106057261600766164008032983374782"
],
"threshold": 0.9
},
"target": {
"file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c"
},
"id": "CVE-2025-37837-2f68f23b",
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@767e22001dfce64cc03b7def1562338591ab6031",
"deprecated": false,
"digest": {
"function_hash": "90147509291519093887929993528265267395",
"length": 273.0
},
"target": {
"file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c",
"function": "tegra241_vintf_free_lvcmdq"
},
"id": "CVE-2025-37837-36ffef08",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e38ed6908080047d8fa1763d1da86b584f9eb55b",
"deprecated": false,
"digest": {
"function_hash": "75899287611178222854893405295772706023",
"length": 917.0
},
"target": {
"file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c",
"function": "tegra241_cmdqv_init_structures"
},
"id": "CVE-2025-37837-3a88c54f",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5dd974d6e00704553308ef1a88659f8dcfb39d4",
"deprecated": false,
"digest": {
"line_hashes": [
"301310079780356870417549727607100270691",
"44780308696440911489783853052400261829",
"271892292267214561410241968862467326590",
"1603817957348539285978517255478494751",
"28479559614562611633925027133144221657",
"315845880451625387218879246771842853314",
"115916829393449354791483670162442292347",
"18774486872436126294220500727355053527",
"39074304674260070432273118173119798753",
"134572358150035614265312359056389958216",
"317562140728245764570657833505696919158",
"86955902620952189666725672884628138674",
"305616087279154796651015780682360915550",
"255180131790916853981697388268143018513",
"109199176676222299383948355446156370552",
"236778116177377851206354171065153074735",
"328084475267586081496174708285927178520",
"22281546717147536212898707143691393152",
"89709476894096419522815745589193935473",
"44618762917553168940131926852343813933",
"273268627485556738062661636044617191057",
"295574171384127867122188976247073928522",
"110403241659077225142318871976948341280",
"164952463958919930005502542044930255852",
"267007973474785024757859551814083846373",
"324354132981516357136816473844081885348",
"249488959026231460822013495291090454231",
"227055305872068377270117467518699591478",
"7461242973827953281348999452933949864",
"178937194454437957519321653599217522064",
"89522475673928189888093838905171536262",
"45221332418799389263998342445196273006",
"230656473724975284855252848950760360961",
"214244702993279354865242341710085531777",
"329496383362357272704113202392774272977",
"291833088976570687865810542537880183851",
"217632768755479023271260838054527726201",
"264675106925080951515805187374926829052",
"295003779913657516481919729875184278244",
"157593185799403545232714073825156039389",
"316459286536724528490690025191068524884",
"190625106057261600766164008032983374782"
],
"threshold": 0.9
},
"target": {
"file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c"
},
"id": "CVE-2025-37837-55b96d5a",
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@767e22001dfce64cc03b7def1562338591ab6031",
"deprecated": false,
"digest": {
"line_hashes": [
"301310079780356870417549727607100270691",
"44780308696440911489783853052400261829",
"271892292267214561410241968862467326590",
"1603817957348539285978517255478494751",
"28479559614562611633925027133144221657",
"315845880451625387218879246771842853314",
"115916829393449354791483670162442292347",
"18774486872436126294220500727355053527",
"39074304674260070432273118173119798753",
"134572358150035614265312359056389958216",
"317562140728245764570657833505696919158",
"86955902620952189666725672884628138674",
"305616087279154796651015780682360915550",
"255180131790916853981697388268143018513",
"109199176676222299383948355446156370552",
"236778116177377851206354171065153074735",
"328084475267586081496174708285927178520",
"22281546717147536212898707143691393152",
"89709476894096419522815745589193935473",
"44618762917553168940131926852343813933",
"273268627485556738062661636044617191057",
"295574171384127867122188976247073928522",
"110403241659077225142318871976948341280",
"164952463958919930005502542044930255852",
"267007973474785024757859551814083846373",
"324354132981516357136816473844081885348",
"249488959026231460822013495291090454231",
"227055305872068377270117467518699591478",
"7461242973827953281348999452933949864",
"178937194454437957519321653599217522064",
"89522475673928189888093838905171536262",
"45221332418799389263998342445196273006",
"230656473724975284855252848950760360961",
"214244702993279354865242341710085531777",
"329496383362357272704113202392774272977",
"291833088976570687865810542537880183851",
"217632768755479023271260838054527726201",
"264675106925080951515805187374926829052",
"295003779913657516481919729875184278244",
"157593185799403545232714073825156039389",
"316459286536724528490690025191068524884",
"190625106057261600766164008032983374782"
],
"threshold": 0.9
},
"target": {
"file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c"
},
"id": "CVE-2025-37837-5a3244d4",
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5dd974d6e00704553308ef1a88659f8dcfb39d4",
"deprecated": false,
"digest": {
"function_hash": "190920062589479234189241483884292541708",
"length": 276.0
},
"target": {
"file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c",
"function": "tegra241_vcmdq_free_smmu_cmdq"
},
"id": "CVE-2025-37837-6c61900b",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e38ed6908080047d8fa1763d1da86b584f9eb55b",
"deprecated": false,
"digest": {
"function_hash": "190920062589479234189241483884292541708",
"length": 276.0
},
"target": {
"file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c",
"function": "tegra241_vcmdq_free_smmu_cmdq"
},
"id": "CVE-2025-37837-7d1204c8",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5584dbf393df509159813645a487b1ef76557722",
"deprecated": false,
"digest": {
"function_hash": "75899287611178222854893405295772706023",
"length": 917.0
},
"target": {
"file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c",
"function": "tegra241_cmdqv_init_structures"
},
"id": "CVE-2025-37837-7f272b59",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5584dbf393df509159813645a487b1ef76557722",
"deprecated": false,
"digest": {
"line_hashes": [
"301310079780356870417549727607100270691",
"44780308696440911489783853052400261829",
"271892292267214561410241968862467326590",
"1603817957348539285978517255478494751",
"28479559614562611633925027133144221657",
"315845880451625387218879246771842853314",
"115916829393449354791483670162442292347",
"18774486872436126294220500727355053527",
"39074304674260070432273118173119798753",
"134572358150035614265312359056389958216",
"317562140728245764570657833505696919158",
"86955902620952189666725672884628138674",
"305616087279154796651015780682360915550",
"255180131790916853981697388268143018513",
"109199176676222299383948355446156370552",
"236778116177377851206354171065153074735",
"328084475267586081496174708285927178520",
"22281546717147536212898707143691393152",
"89709476894096419522815745589193935473",
"44618762917553168940131926852343813933",
"273268627485556738062661636044617191057",
"295574171384127867122188976247073928522",
"110403241659077225142318871976948341280",
"164952463958919930005502542044930255852",
"267007973474785024757859551814083846373",
"324354132981516357136816473844081885348",
"249488959026231460822013495291090454231",
"227055305872068377270117467518699591478",
"7461242973827953281348999452933949864",
"178937194454437957519321653599217522064",
"89522475673928189888093838905171536262",
"45221332418799389263998342445196273006",
"230656473724975284855252848950760360961",
"214244702993279354865242341710085531777",
"329496383362357272704113202392774272977",
"291833088976570687865810542537880183851",
"217632768755479023271260838054527726201",
"264675106925080951515805187374926829052",
"295003779913657516481919729875184278244",
"157593185799403545232714073825156039389",
"316459286536724528490690025191068524884",
"190625106057261600766164008032983374782"
],
"threshold": 0.9
},
"target": {
"file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c"
},
"id": "CVE-2025-37837-a9e76cd1",
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e38ed6908080047d8fa1763d1da86b584f9eb55b",
"deprecated": false,
"digest": {
"function_hash": "90147509291519093887929993528265267395",
"length": 273.0
},
"target": {
"file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c",
"function": "tegra241_vintf_free_lvcmdq"
},
"id": "CVE-2025-37837-b015fb07",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5dd974d6e00704553308ef1a88659f8dcfb39d4",
"deprecated": false,
"digest": {
"function_hash": "75899287611178222854893405295772706023",
"length": 917.0
},
"target": {
"file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c",
"function": "tegra241_cmdqv_init_structures"
},
"id": "CVE-2025-37837-b4239caa",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5584dbf393df509159813645a487b1ef76557722",
"deprecated": false,
"digest": {
"function_hash": "190920062589479234189241483884292541708",
"length": 276.0
},
"target": {
"file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c",
"function": "tegra241_vcmdq_free_smmu_cmdq"
},
"id": "CVE-2025-37837-ce1b56de",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5584dbf393df509159813645a487b1ef76557722",
"deprecated": false,
"digest": {
"function_hash": "90147509291519093887929993528265267395",
"length": 273.0
},
"target": {
"file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c",
"function": "tegra241_vintf_free_lvcmdq"
},
"id": "CVE-2025-37837-e64b19ef",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@767e22001dfce64cc03b7def1562338591ab6031",
"deprecated": false,
"digest": {
"function_hash": "190920062589479234189241483884292541708",
"length": 276.0
},
"target": {
"file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c",
"function": "tegra241_vcmdq_free_smmu_cmdq"
},
"id": "CVE-2025-37837-f7fe1889",
"signature_type": "Function",
"signature_version": "v1"
}
]