In the Linux kernel, the following vulnerability has been resolved:
iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent()
Two WARNINGs are observed when SMMU driver rolls back upon failure: arm-smmu-v3.9.auto: Failed to register iommu arm-smmu-v3.9.auto: probe with driver arm-smmu-v3 failed with error -22 ------------[ cut here ]------------ WARNING: CPU: 5 PID: 1 at kernel/dma/mapping.c:74 dmam_free_coherent+0xc0/0xd8 Call trace: dmam_free_coherent+0xc0/0xd8 (P) tegra241_vintf_free_lvcmdq+0x74/0x188 tegra241_cmdqv_remove_vintf+0x60/0x148 tegra241_cmdqv_remove+0x48/0xc8 arm_smmu_impl_remove+0x28/0x60 devm_action_release+0x1c/0x40 ------------[ cut here ]------------ 128 pages are still in use! WARNING: CPU: 16 PID: 1 at mm/page_alloc.c:6902 free_contig_range+0x18c/0x1c8 Call trace: free_contig_range+0x18c/0x1c8 (P) cma_release+0x154/0x2f0 dma_free_contiguous+0x38/0xa0 dma_direct_free+0x10c/0x248 dma_free_attrs+0x100/0x290 dmam_free_coherent+0x78/0xd8 tegra241_vintf_free_lvcmdq+0x74/0x160 tegra241_cmdqv_remove+0x98/0x198 arm_smmu_impl_remove+0x28/0x60 devm_action_release+0x1c/0x40
This is because the LVCMDQ queue memory are managed by devres, while that dmam_free_coherent() is called in the context of devm_action_release().
Jason pointed out that "arm_smmu_impl_probe() has mis-ordered the devres callbacks if ops->device_remove() is going to be manually freeing things that probe allocated": https://lore.kernel.org/linux-iommu/[email protected]/
In fact, tegra241_cmdqv_init_structures() only allocates memory resources which means any failure that it generates would be similar to -ENOMEM, so there is no point in having that "falling back to standard SMMU" routine, as the standard SMMU would likely fail to allocate memory too.
Remove the unwind part in tegra241_cmdqv_init_structures(), and return a proper error code to ask SMMU driver to call tegra241_cmdqv_remove() via impl_ops->device_remove(). Then, drop tegra241_vintf_free_lvcmdq() since devres will take care of that.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade bpftoolUpgrade kernel-libbpf-debuginfoUpgrade kernel-modules-extra-commonUpgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade python3-perf6.12-debuginfoUpgrade perf6.12Upgrade kernel-libbpf-staticUpgrade kernel-livepatch-6.12.25-32.101Upgrade kernel-libbpfUpgrade python3-perf6.12Upgrade kernel-libbpf-develUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-develUpgrade kernel6.12-debuginfoUpgrade kernel6.12Upgrade kernel-tools-develUpgrade kernel-headersUpgrade perf6.12-debuginfoUpgrade kernel6.12-modules-extraUpgrade kernel-tools-debuginfoUpgrade kernel6.12-debuginfo-common-aarch64 | Aug 5, 2025 | May 9, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 9, 2025 |
| Suse | — | Upgrade reiserfs-kmp-defaultUpgrade kernel-docsUpgrade kernel-azureUpgrade kernel-azure-vdsoUpgrade kernel-defaultUpgrade kernel-64kb-extraUpgrade kernel-source-vanillaUpgrade kernel-obs-buildUpgrade kernel-default-baseUpgrade kernel-obs-qaUpgrade kernel-develUpgrade kernel-azure-extraUpgrade kernel-azure-develUpgrade kernel-64kb-develUpgrade kernel-64kbUpgrade kernel-kvmsmallUpgrade kernel-sourceUpgrade kernel-default-develUpgrade kernel-source-azureUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-extraUpgrade kernel-docs-htmlUpgrade kernel-default-livepatchUpgrade kernel-macrosUpgrade kernel-zfcpdumpUpgrade kernel-kvmsmall-develUpgrade kernel-devel-azureUpgrade kernel-symsUpgrade kernel-default-vdsoUpgrade kernel-syms-azure | Dec 5, 2025 | Jul 8, 2025 |
| Ubuntu | — | Upgrade linux-image-azure-fdeUpgrade linux-image-6.14.0-1008-gcpUpgrade linux-image-6.14.0-1007-raspiUpgrade linux-image-6.14.0-1007-oracle-64kUpgrade linux-image-6.14.0-22-generic-64kUpgrade linux-image-azureUpgrade linux-image-gcpUpgrade linux-image-genericUpgrade linux-image-6.14.0-1007-awsUpgrade linux-image-generic-64kUpgrade linux-image-6.14.0-1007-aws-64kUpgrade linux-image-raspiUpgrade linux-image-aws-64kUpgrade linux-image-6.14.0-22-genericUpgrade linux-image-6.14.0-1004-realtimeUpgrade linux-image-6.14.0-1008-gcp-64kUpgrade linux-image-realtimeUpgrade linux-image-6.14.0-1007-azureUpgrade linux-image-oracleUpgrade linux-image-gcp-64kUpgrade linux-image-6.14.0-1007-oracleUpgrade linux-image-oracle-64kUpgrade linux-image-awsUpgrade linux-image-6.14.0-1007-azure-fde | Jun 26, 2025 | May 9, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub