CVE-2025-37837

In the Linux kernel, the following vulnerability has been resolved:

iommu/tegra241-cmdqv: Fix warnings due to dmamfreecoherent()

Two WARNINGs are observed when SMMU driver rolls back upon failure: arm-smmu-v3.9.auto: Failed to register iommu arm-smmu-v3.9.auto: probe with driver arm-smmu-v3 failed with error -22 ------------[ cut here ]------------ WARNING: CPU: 5 PID: 1 at kernel/dma/mapping.c:74 dmamfreecoherent+0xc0/0xd8 Call trace: dmamfreecoherent+0xc0/0xd8 (P) tegra241vintffreelvcmdq+0x74/0x188 tegra241cmdqvremovevintf+0x60/0x148 tegra241cmdqvremove+0x48/0xc8 armsmmuimplremove+0x28/0x60 devmactionrelease+0x1c/0x40 ------------[ cut here ]------------ 128 pages are still in use! WARNING: CPU: 16 PID: 1 at mm/pagealloc.c:6902 freecontigrange+0x18c/0x1c8 Call trace: freecontigrange+0x18c/0x1c8 (P) cmarelease+0x154/0x2f0 dmafreecontiguous+0x38/0xa0 dmadirectfree+0x10c/0x248 dmafreeattrs+0x100/0x290 dmamfreecoherent+0x78/0xd8 tegra241vintffreelvcmdq+0x74/0x160 tegra241cmdqvremove+0x98/0x198 armsmmuimplremove+0x28/0x60 devmaction_release+0x1c/0x40

This is because the LVCMDQ queue memory are managed by devres, while that dmamfreecoherent() is called in the context of devmactionrelease().

Jason pointed out that "armsmmuimplprobe() has mis-ordered the devres callbacks if ops->deviceremove() is going to be manually freeing things that probe allocated": https://lore.kernel.org/linux-iommu/20250407174408.GB1722458@nvidia.com/

In fact, tegra241cmdqvinit_structures() only allocates memory resources which means any failure that it generates would be similar to -ENOMEM, so there is no point in having that "falling back to standard SMMU" routine, as the standard SMMU would likely fail to allocate memory too.

Remove the unwind part in tegra241cmdqvinitstructures(), and return a proper error code to ask SMMU driver to call tegra241cmdqvremove() via implops->deviceremove(). Then, drop tegra241vintffreelvcmdq() since devres will take care of that.