In the Linux kernel, the following vulnerability has been resolved:
iommu/tegra241-cmdqv: Fix warnings due to dmamfreecoherent()
Two WARNINGs are observed when SMMU driver rolls back upon failure: arm-smmu-v3.9.auto: Failed to register iommu arm-smmu-v3.9.auto: probe with driver arm-smmu-v3 failed with error -22 ------------[ cut here ]------------ WARNING: CPU: 5 PID: 1 at kernel/dma/mapping.c:74 dmamfreecoherent+0xc0/0xd8 Call trace: dmamfreecoherent+0xc0/0xd8 (P) tegra241vintffreelvcmdq+0x74/0x188 tegra241cmdqvremovevintf+0x60/0x148 tegra241cmdqvremove+0x48/0xc8 armsmmuimplremove+0x28/0x60 devmactionrelease+0x1c/0x40 ------------[ cut here ]------------ 128 pages are still in use! WARNING: CPU: 16 PID: 1 at mm/pagealloc.c:6902 freecontigrange+0x18c/0x1c8 Call trace: freecontigrange+0x18c/0x1c8 (P) cmarelease+0x154/0x2f0 dmafreecontiguous+0x38/0xa0 dmadirectfree+0x10c/0x248 dmafreeattrs+0x100/0x290 dmamfreecoherent+0x78/0xd8 tegra241vintffreelvcmdq+0x74/0x160 tegra241cmdqvremove+0x98/0x198 armsmmuimplremove+0x28/0x60 devmaction_release+0x1c/0x40
This is because the LVCMDQ queue memory are managed by devres, while that dmamfreecoherent() is called in the context of devmactionrelease().
Jason pointed out that "armsmmuimplprobe() has mis-ordered the devres callbacks if ops->deviceremove() is going to be manually freeing things that probe allocated": https://lore.kernel.org/linux-iommu/20250407174408.GB1722458@nvidia.com/
In fact, tegra241cmdqvinit_structures() only allocates memory resources which means any failure that it generates would be similar to -ENOMEM, so there is no point in having that "falling back to standard SMMU" routine, as the standard SMMU would likely fail to allocate memory too.
Remove the unwind part in tegra241cmdqvinitstructures(), and return a proper error code to ask SMMU driver to call tegra241cmdqvremove() via implops->deviceremove(). Then, drop tegra241vintffreelvcmdq() since devres will take care of that.
[ { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@767e22001dfce64cc03b7def1562338591ab6031", "deprecated": false, "digest": { "function_hash": "75899287611178222854893405295772706023", "length": 917.0 }, "target": { "file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c", "function": "tegra241_cmdqv_init_structures" }, "id": "CVE-2025-37837-0b0099fd", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5dd974d6e00704553308ef1a88659f8dcfb39d4", "deprecated": false, "digest": { "function_hash": "90147509291519093887929993528265267395", "length": 273.0 }, "target": { "file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c", "function": "tegra241_vintf_free_lvcmdq" }, "id": "CVE-2025-37837-297fda18", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e38ed6908080047d8fa1763d1da86b584f9eb55b", "deprecated": false, "digest": { "line_hashes": [ "301310079780356870417549727607100270691", "44780308696440911489783853052400261829", "271892292267214561410241968862467326590", "1603817957348539285978517255478494751", "28479559614562611633925027133144221657", "315845880451625387218879246771842853314", "115916829393449354791483670162442292347", "18774486872436126294220500727355053527", "39074304674260070432273118173119798753", "134572358150035614265312359056389958216", "317562140728245764570657833505696919158", "86955902620952189666725672884628138674", "305616087279154796651015780682360915550", "255180131790916853981697388268143018513", "109199176676222299383948355446156370552", "236778116177377851206354171065153074735", "328084475267586081496174708285927178520", "22281546717147536212898707143691393152", "89709476894096419522815745589193935473", "44618762917553168940131926852343813933", "273268627485556738062661636044617191057", "295574171384127867122188976247073928522", "110403241659077225142318871976948341280", "164952463958919930005502542044930255852", "267007973474785024757859551814083846373", "324354132981516357136816473844081885348", "249488959026231460822013495291090454231", "227055305872068377270117467518699591478", "7461242973827953281348999452933949864", "178937194454437957519321653599217522064", "89522475673928189888093838905171536262", "45221332418799389263998342445196273006", "230656473724975284855252848950760360961", "214244702993279354865242341710085531777", "329496383362357272704113202392774272977", "291833088976570687865810542537880183851", "217632768755479023271260838054527726201", "264675106925080951515805187374926829052", "295003779913657516481919729875184278244", "157593185799403545232714073825156039389", "316459286536724528490690025191068524884", "190625106057261600766164008032983374782" ], "threshold": 0.9 }, "target": { "file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c" }, "id": "CVE-2025-37837-2f68f23b", "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@767e22001dfce64cc03b7def1562338591ab6031", "deprecated": false, "digest": { "function_hash": "90147509291519093887929993528265267395", "length": 273.0 }, "target": { "file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c", "function": "tegra241_vintf_free_lvcmdq" }, "id": "CVE-2025-37837-36ffef08", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e38ed6908080047d8fa1763d1da86b584f9eb55b", "deprecated": false, "digest": { "function_hash": "75899287611178222854893405295772706023", "length": 917.0 }, "target": { "file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c", "function": "tegra241_cmdqv_init_structures" }, "id": "CVE-2025-37837-3a88c54f", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5dd974d6e00704553308ef1a88659f8dcfb39d4", "deprecated": false, "digest": { "line_hashes": [ "301310079780356870417549727607100270691", "44780308696440911489783853052400261829", "271892292267214561410241968862467326590", "1603817957348539285978517255478494751", "28479559614562611633925027133144221657", "315845880451625387218879246771842853314", "115916829393449354791483670162442292347", "18774486872436126294220500727355053527", "39074304674260070432273118173119798753", "134572358150035614265312359056389958216", "317562140728245764570657833505696919158", "86955902620952189666725672884628138674", "305616087279154796651015780682360915550", "255180131790916853981697388268143018513", "109199176676222299383948355446156370552", "236778116177377851206354171065153074735", "328084475267586081496174708285927178520", "22281546717147536212898707143691393152", "89709476894096419522815745589193935473", "44618762917553168940131926852343813933", "273268627485556738062661636044617191057", "295574171384127867122188976247073928522", "110403241659077225142318871976948341280", "164952463958919930005502542044930255852", "267007973474785024757859551814083846373", "324354132981516357136816473844081885348", "249488959026231460822013495291090454231", "227055305872068377270117467518699591478", "7461242973827953281348999452933949864", "178937194454437957519321653599217522064", "89522475673928189888093838905171536262", "45221332418799389263998342445196273006", "230656473724975284855252848950760360961", "214244702993279354865242341710085531777", "329496383362357272704113202392774272977", "291833088976570687865810542537880183851", "217632768755479023271260838054527726201", "264675106925080951515805187374926829052", "295003779913657516481919729875184278244", "157593185799403545232714073825156039389", "316459286536724528490690025191068524884", "190625106057261600766164008032983374782" ], "threshold": 0.9 }, "target": { "file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c" }, "id": "CVE-2025-37837-55b96d5a", "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@767e22001dfce64cc03b7def1562338591ab6031", "deprecated": false, "digest": { "line_hashes": [ "301310079780356870417549727607100270691", "44780308696440911489783853052400261829", "271892292267214561410241968862467326590", "1603817957348539285978517255478494751", "28479559614562611633925027133144221657", "315845880451625387218879246771842853314", "115916829393449354791483670162442292347", "18774486872436126294220500727355053527", "39074304674260070432273118173119798753", "134572358150035614265312359056389958216", "317562140728245764570657833505696919158", "86955902620952189666725672884628138674", "305616087279154796651015780682360915550", "255180131790916853981697388268143018513", "109199176676222299383948355446156370552", "236778116177377851206354171065153074735", "328084475267586081496174708285927178520", "22281546717147536212898707143691393152", "89709476894096419522815745589193935473", "44618762917553168940131926852343813933", "273268627485556738062661636044617191057", "295574171384127867122188976247073928522", "110403241659077225142318871976948341280", "164952463958919930005502542044930255852", "267007973474785024757859551814083846373", "324354132981516357136816473844081885348", "249488959026231460822013495291090454231", "227055305872068377270117467518699591478", "7461242973827953281348999452933949864", "178937194454437957519321653599217522064", "89522475673928189888093838905171536262", "45221332418799389263998342445196273006", "230656473724975284855252848950760360961", "214244702993279354865242341710085531777", "329496383362357272704113202392774272977", "291833088976570687865810542537880183851", "217632768755479023271260838054527726201", "264675106925080951515805187374926829052", "295003779913657516481919729875184278244", "157593185799403545232714073825156039389", "316459286536724528490690025191068524884", "190625106057261600766164008032983374782" ], "threshold": 0.9 }, "target": { "file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c" }, "id": "CVE-2025-37837-5a3244d4", "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5dd974d6e00704553308ef1a88659f8dcfb39d4", "deprecated": false, "digest": { "function_hash": "190920062589479234189241483884292541708", "length": 276.0 }, "target": { "file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c", "function": "tegra241_vcmdq_free_smmu_cmdq" }, "id": "CVE-2025-37837-6c61900b", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e38ed6908080047d8fa1763d1da86b584f9eb55b", "deprecated": false, "digest": { "function_hash": "190920062589479234189241483884292541708", "length": 276.0 }, "target": { "file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c", "function": "tegra241_vcmdq_free_smmu_cmdq" }, "id": "CVE-2025-37837-7d1204c8", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5584dbf393df509159813645a487b1ef76557722", "deprecated": false, "digest": { "function_hash": "75899287611178222854893405295772706023", "length": 917.0 }, "target": { "file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c", "function": "tegra241_cmdqv_init_structures" }, "id": "CVE-2025-37837-7f272b59", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5584dbf393df509159813645a487b1ef76557722", "deprecated": false, "digest": { "line_hashes": [ "301310079780356870417549727607100270691", "44780308696440911489783853052400261829", "271892292267214561410241968862467326590", "1603817957348539285978517255478494751", "28479559614562611633925027133144221657", "315845880451625387218879246771842853314", "115916829393449354791483670162442292347", "18774486872436126294220500727355053527", "39074304674260070432273118173119798753", "134572358150035614265312359056389958216", "317562140728245764570657833505696919158", "86955902620952189666725672884628138674", "305616087279154796651015780682360915550", "255180131790916853981697388268143018513", "109199176676222299383948355446156370552", "236778116177377851206354171065153074735", "328084475267586081496174708285927178520", "22281546717147536212898707143691393152", "89709476894096419522815745589193935473", "44618762917553168940131926852343813933", "273268627485556738062661636044617191057", "295574171384127867122188976247073928522", "110403241659077225142318871976948341280", "164952463958919930005502542044930255852", "267007973474785024757859551814083846373", "324354132981516357136816473844081885348", "249488959026231460822013495291090454231", "227055305872068377270117467518699591478", "7461242973827953281348999452933949864", "178937194454437957519321653599217522064", "89522475673928189888093838905171536262", "45221332418799389263998342445196273006", "230656473724975284855252848950760360961", "214244702993279354865242341710085531777", "329496383362357272704113202392774272977", "291833088976570687865810542537880183851", "217632768755479023271260838054527726201", "264675106925080951515805187374926829052", "295003779913657516481919729875184278244", "157593185799403545232714073825156039389", "316459286536724528490690025191068524884", "190625106057261600766164008032983374782" ], "threshold": 0.9 }, "target": { "file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c" }, "id": "CVE-2025-37837-a9e76cd1", "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e38ed6908080047d8fa1763d1da86b584f9eb55b", "deprecated": false, "digest": { "function_hash": "90147509291519093887929993528265267395", "length": 273.0 }, "target": { "file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c", "function": "tegra241_vintf_free_lvcmdq" }, "id": "CVE-2025-37837-b015fb07", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5dd974d6e00704553308ef1a88659f8dcfb39d4", "deprecated": false, "digest": { "function_hash": "75899287611178222854893405295772706023", "length": 917.0 }, "target": { "file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c", "function": "tegra241_cmdqv_init_structures" }, "id": "CVE-2025-37837-b4239caa", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5584dbf393df509159813645a487b1ef76557722", "deprecated": false, "digest": { "function_hash": "190920062589479234189241483884292541708", "length": 276.0 }, "target": { "file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c", "function": "tegra241_vcmdq_free_smmu_cmdq" }, "id": "CVE-2025-37837-ce1b56de", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5584dbf393df509159813645a487b1ef76557722", "deprecated": false, "digest": { "function_hash": "90147509291519093887929993528265267395", "length": 273.0 }, "target": { "file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c", "function": "tegra241_vintf_free_lvcmdq" }, "id": "CVE-2025-37837-e64b19ef", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@767e22001dfce64cc03b7def1562338591ab6031", "deprecated": false, "digest": { "function_hash": "190920062589479234189241483884292541708", "length": 276.0 }, "target": { "file": "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c", "function": "tegra241_vcmdq_free_smmu_cmdq" }, "id": "CVE-2025-37837-f7fe1889", "signature_type": "Function", "signature_version": "v1" } ]