CVE-2023-54020

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: sf-pdma: pdma_desc memory leak fix

Commit b2cc5c465c2c ("dmaengine: sf-pdma: Add multithread support for a DMA channel") changed sfpdmaprepdmamemcpy() to unconditionally allocate a new sfpdmadesc each time it is called.

The driver previously recycled descs, by checking the inuse flag, only allocating additional descs if the existing one was in use. This logic was removed in commit b2cc5c465c2c ("dmaengine: sf-pdma: Add multithread support for a DMA channel"), but sfpdmafreedesc() was not changed to handle the new behaviour.

As a result, each time sfpdmaprepdmamemcpy() is called, the previous descriptor is leaked, over time leading to memory starvation:

unreferenced object 0xffffffe008447300 (size 192): comm "irq/39-mchpdsc", pid 343, jiffies 4294906910 (age 981.200s) hex dump (first 32 bytes): 00 00 00 ff 00 00 00 00 b8 c1 00 00 00 00 00 00 ................ 00 00 70 08 10 00 00 00 00 00 00 c0 00 00 00 00 ..p............. backtrace: [<00000000064a04f4>] kmemleakalloc+0x1e/0x28 [<00000000018927a7>] kmemcachealloc+0x11e/0x178 [<000000002aea8d16>] sfpdmaprepdmamemcpy+0x40/0x112

Add the missing kfree() to sfpdmafreedesc(), and remove the redundant inuse flag.