Kernel compromise via unlocked descriptor traversal

Race condition in the Linux kernel's mmp_pdma DMA driver allows local users to compromise the kernel through concurrent status queries. The mmp_pdma_residue() function traverses chain_running and reads descriptor contents without desc_lock while a tasklet can move and free the same descriptor. Exploitation requires concurrent transfers and status queries on the same affected DMA channel; the resulting use-after-free can crash the host or corrupt kernel memory.