CVE-2023-54020

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: sf-pdma: pdma_desc memory leak fix

Commit b2cc5c465c2c ("dmaengine: sf-pdma: Add multithread support for a

DMA channel") changed sf_pdma_prep_dma_memcpy() to unconditionally

allocate a new sf_pdma_desc each time it is called.

The driver previously recycled descs, by checking the in_use flag, only

allocating additional descs if the existing one was in use. This logic

was removed in commit b2cc5c465c2c ("dmaengine: sf-pdma: Add multithread

support for a DMA channel"), but sf_pdma_free_desc() was not changed to

handle the new behaviour.

As a result, each time sf_pdma_prep_dma_memcpy() is called, the previous

descriptor is leaked, over time leading to memory starvation:

unreferenced object 0xffffffe008447300 (size 192):

comm "irq/39-mchp_dsc", pid 343, jiffies 4294906910 (age 981.200s)

hex dump (first 32 bytes):

00 00 00 ff 00 00 00 00 b8 c1 00 00 00 00 00 00 ................

00 00 70 08 10 0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References