---
id: CVE-2025-37837
title: 'iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent()

  Two WARNINGs are observed when SMMU driver rolls back upon failure:
   arm-smmu-v3.9.auto: Failed to regis…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 483e0bd8883a40fd3dd3193997a4014337698d72 <
    e5dd974d6e00704553308ef1a88659f8dcfb39d4
  - >-
    Linux >= 483e0bd8883a40fd3dd3193997a4014337698d72 <
    5584dbf393df509159813645a487b1ef76557722
  - >-
    Linux >= 483e0bd8883a40fd3dd3193997a4014337698d72 <
    e38ed6908080047d8fa1763d1da86b584f9eb55b
  - >-
    Linux >= 483e0bd8883a40fd3dd3193997a4014337698d72 <
    767e22001dfce64cc03b7def1562338591ab6031
  - Linux 6.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:41:52.529850Z'
published: '2025-05-09'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:52:04.562Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-37837'
references:
  - url: 'https://git.kernel.org/stable/c/e5dd974d6e00704553308ef1a88659f8dcfb39d4'
  - url: 'https://git.kernel.org/stable/c/5584dbf393df509159813645a487b1ef76557722'
  - url: 'https://git.kernel.org/stable/c/e38ed6908080047d8fa1763d1da86b584f9eb55b'
  - url: 'https://git.kernel.org/stable/c/767e22001dfce64cc03b7def1562338591ab6031'
tags:
  - cve.org
epss: 0.00281
epssPercentile: 0.20739
ingestedAt: '2026-11-05T22:38:31.882Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent()

Two WARNINGs are observed when SMMU driver rolls back upon failure:
 arm-smmu-v3.9.auto: Failed to register iommu
 arm-smmu-v3.9.auto: probe with driver arm-smmu-v3 failed with error -22
 ------------[ cut here ]------------
 WARNING: CPU: 5 PID: 1 at kernel/dma/mapping.c:74 dmam_free_coherent+0xc0/0xd8
 Call trace:
  dmam_free_coherent+0xc0/0xd8 (P)
  tegra241_vintf_free_lvcmdq+0x74/0x188
  tegra241_cmdqv_remove_vintf+0x60/0x148
  tegra241_cmdqv_remove+0x48/0xc8
  arm_smmu_impl_remove+0x28/0x60
  devm_action_release+0x1c/0x40
 ------------[ cut here ]------------
 128 pages are still in use!
 WARNING: CPU: 16 PID: 1 at mm/page_alloc.c:6902 free_contig_range+0x18c/0x1c8
 Call trace:
  free_contig_range+0x18c/0x1c8 (P)
  cma_release+0x154/0x2f0
  dma_free_contiguous+0x38/0xa0
  dma_direct_free+0x10c/0x248
  dma_free_attrs+0x100/0x290
  dmam_free_coherent+0x78/0xd8
  tegra241_vintf_free_lvcmdq+0x74/0x160
  tegra241_cmdqv_remove+0x98/0x198
  arm_smmu_impl_remove+0x28/0x60
  devm_action_release+0x1c/0x40

This is because the LVCMDQ queue memory are managed by devres, while that
dmam_free_coherent() is called in the context of devm_action_release().

Jason pointed out that "arm_smmu_impl_probe() has mis-ordered the devres
callbacks if ops->device_remove() is going to be manually freeing things
that probe allocated":
https://lore.kernel.org/linux-iommu/20250407174408.GB1722458@nvidia.com/

In fact, tegra241_cmdqv_init_structures() only allocates memory resources
which means any failure that it generates would be similar to -ENOMEM, so
there is no point in having that "falling back to standard SMMU" routine,
as the standard SMMU would likely fail to allocate memory too.

Remove the unwind part in tegra241_cmdqv_init_structures(), and return a
proper error code to ask SMMU driver to call tegra241_cmdqv_remove() via
impl_ops->device_remove(). Then, drop tegra241_vintf_free_lvcmdq() since
devres will take care of that.

## Affected

- `Linux >= 483e0bd8883a40fd3dd3193997a4014337698d72 < e5dd974d6e00704553308ef1a88659f8dcfb39d4`
- `Linux >= 483e0bd8883a40fd3dd3193997a4014337698d72 < 5584dbf393df509159813645a487b1ef76557722`
- `Linux >= 483e0bd8883a40fd3dd3193997a4014337698d72 < e38ed6908080047d8fa1763d1da86b584f9eb55b`
- `Linux >= 483e0bd8883a40fd3dd3193997a4014337698d72 < 767e22001dfce64cc03b7def1562338591ab6031`
- `Linux 6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.