HIGH
dmaengine Tegra ADMA UAF
CVE-2025-71162
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: dmaengine: tegra-adma: Fix use-after-free A use-after-free bug exists in the Tegra ADMA driver when audio streams are terminated, particularly during XRUN conditions. The issue occurs when the DMA buffer is freed by tegra_adma_terminate_all() before the vchan completion tasklet finishes accessing it. The race condition follows this sequence: 1. DMA transfer completes, triggering an interrupt that schedules the completion tasklet (tasklet has not executed yet) 2. Audio playback stops, calling tegra_adma_terminate_all() which frees the DMA buffer memory via kfree() 3. The scheduled tasklet finally executes, calling vchan_complete() which attempts to access the already-freed memory Since tasklets can execute at any time after being scheduled, there is no guarantee that the buffer will remain valid when vchan_complete() runs. Fix this by properly synchronizing the virtual channel completion: - Calling vchan_terminate_vdesc() in tegra_adma_stop() to mark the descriptors as terminated instead of freeing the descriptor. - Add the callback tegra_adma_synchronize() that calls vchan_synchronize() which kills any pending tasklets and frees any terminated descriptors. Crash logs: [ 337.427523] BUG: KASAN: use-after-free in vchan_complete+0x124/0x3b0 [ 337.427544] Read of size 8 at addr ffff000132055428 by task swapper/0/0 [ 337.427562] Call trace: [ 337.427564] dump_backtrace+0x0/0x320 [ 337.427571] show_stack+0x20/0x30 [ 337.427575] dump_stack_lvl+0x68/0x84 [ 337.427584] print_address_description.constprop.0+0x74/0x2b8 [ 337.427590] kasan_report+0x1f4/0x210 [ 337.427598] __asan_load8+0xa0/0xd0 [ 337.427603] vchan_complete+0x124/0x3b0 [ 337.427609] tasklet_action_common.constprop.0+0x190/0x1d0 [ 337.427617] tasklet_action+0x30/0x40 [ 337.427623] __do_softirq+0x1a0/0x5c4 [ 337.427628] irq_exit+0x110/0x140 [ 337.427633] handle_domain_irq+0xa4/0xe0 [ 337.427640] gic_handle_irq+0x64/0x160 [ 337.427644] call_on_irq_stack+0x20/0x4c [ 337.427649] do_interrupt_handler+0x7c/0x90 [ 337.427654] el1_interrupt+0x30/0x80 [ 337.427659] el1h_64_irq_handler+0x18/0x30 [ 337.427663] el1h_64_irq+0x7c/0x80 [ 337.427667] cpuidle_enter_state+0xe4/0x540 [ 337.427674] cpuidle_enter+0x54/0x80 [ 337.427679] do_idle+0x2e0/0x380 [ 337.427685] cpu_startup_entry+0x2c/0x70 [ 337.427690] rest_init+0x114/0x130 [ 337.427695] arch_call_rest_init+0x18/0x24 [ 337.427702] start_kernel+0x380/0x3b4 [ 337.427706] __primary_switched+0xc0/0xc8
02KernelScan AI Analysis
Risk summary
A use-after-free vulnerability in the Tegra210 Audio DMA driver can cause kernel crashes when audio streams are terminated. The race condition between interrupt handling and memory cleanup can lead to system instability during normal audio operations, particularly when audio underruns (XRUN) occur.
Vulnerability analysis
Root Cause: A race condition exists between DMA completion interrupt handling and channel termination. When audio playback stops, tegra_adma_terminate_all() calls tegra_adma_stop() which immediately frees the DMA descriptor via kfree(). However, a completion tasklet may have already been scheduled by the interrupt handler but not yet executed. When the tasklet finally runs, it calls vchan_complete() which attempts to access the already-freed descriptor memory.
Attack Surface: This vulnerability affects systems using Tegra210 ADMA hardware for audio DMA operations. It requires local access to trigger audio playback operations that can cause XRUN conditions or abrupt termination. The bug is triggered through normal audio subsystem operations and does not require special privileges beyond audio device access.
Fix Mechanism: The fix implements proper synchronization using the virtual channel framework: (1) In tegra_adma_stop(), instead of directly freeing the descriptor with kfree(), it calls vchan_terminate_vdesc() to mark the descriptor as terminated; (2) Adds a new tegra_adma_synchronize() callback that calls vchan_synchronize() to kill any pending tasklets and safely free terminated descriptors; (3) Registers this synchronize callback in the DMA device structure.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 5.10 | 5.10.249 | 5f8d1d66a952 |
| 5.15 | 5.15.199 | 76992310f807 |
| 6.1 | 6.1.162 | ae3eed72de68 |
| 6.12 | 6.12.67 | cb2c9c4bb132 |
| 6.18 | 6.18.7 | be655c3736b3 |
| 6.6 | 6.6.122 | 59cb421b0902 |
| mainline | 6.19 | 2efd07a7c369 |