Linux Kernel Qcom GenI Serial Kfifo Underflow Vulnerability

A kfifo underflow vulnerability has been identified in the Linux kernel's Qcom GenI serial driver. This issue arises when the 'uart_flush_buffer()' function is called before the DMA completion interrupt is processed, creating a race condition. The problem occurs as follows: DMA transmission begins with 'tx_remaining' bytes, and the kfifo buffer holds the same number of bytes. Once the DMA completes in hardware, the interrupt is still pending. If 'uart_flush_buffer()' is executed at this point, it resets the kfifo length to zero while 'tx_remaining' remains unchanged. When the DMA interrupt finally arrives, it attempts to advance the transmission on an empty kfifo, leading to a situation where the kfifo length inaccurately reports available data. This miscalculation causes the next DMA transfer to include outdated buffer data, potentially disrupting the intended data transmission process.

Impact

This vulnerability can cause a kfifo underflow, where the output index wraps around, leading to incorrect buffer lengths and the transfer of stale data via DMA, which can disrupt serial communication.

Reproduction

The vulnerability can be reproduced by initiating a DMA transmission that fills the kfifo buffer. Before the DMA completion interrupt is delivered, call the 'uart_flush_buffer()' function. This will reset the kfifo length while leaving the 'tx_remaining' byte count intact. Once the buffer is flushed, the DMA interrupt can be processed, which will attempt to advance the transmission on the now-empty kfifo. This sequence of actions will create the underflow condition by misaligning the kfifo's output index, causing it to wrap around and incorrectly report the buffer's state.

Remediation

Users can apply the latest patches available in the Linux kernel stable tree to address this vulnerability.