Executive brief
The Allwinner A31 DMA controller driver in the Linux kernel failed to properly reclaim memory used by active DMA transfer descriptors when terminating transfers. This caused permanent memory leaks where descriptor structures and their linked lists were not freed, potentially leading to memory exhaustion over time if DMA transfers were frequently started and stopped.
Technical details
The vulnerability is a resource leak in the sun6i-dma driver's DMA termination handler. When DMA transfers are terminated via dmaengine_terminate_all(), the code only properly handled cyclic descriptors while non-cyclic descriptors and their linked list items (LLI chains) were not reclaimed, leaking kernel memory. The fix uses vchan_terminate_vdesc() to handle both cyclic and non-cyclic descriptors by adding them to a desc_terminated queue for cleanup, and adds a pchan->desc != pchan->done check to prevent corruption from double-adding already-completed descriptors. The vulnerability affects all kernels with the sun6i DMA driver and is patched in stable kernel series.
Affected products
- Linux Linux kernel all versions with sun6i-dma driver
Timeline
- 2026-07-01: patched: Patch authored by Hongling Zeng
- 2026-09-04: disclosed