--- /dev/null
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * GPIO character device helper for UAF tests.
+ *
+ * Copyright 2026 Google LLC
+ */
+
+#include <errno.h>
+#include <fcntl.h>
+#include <linux/gpio.h>
+#include <poll.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/ioctl.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#define CONFIGFS_DIR "/sys/kernel/config/gpio-sim"
+#define PROCFS_DIR "/proc"
+
+static void print_usage(void)
+{
+ printf("usage:\n");
+ printf(" gpio-cdev-uaf [chip|handle|event|req] [poll|read|ioctl]\n");
+}
+
+static int _create_chip(const char *name, int create)
+{
+ char path[64];
+
+ snprintf(path, sizeof(path), CONFIGFS_DIR "/%s", name);
+
+ if (create)
+ return mkdir(path, 0755);
+ else
+ return rmdir(path);
+}
+
+static int create_chip(const char *name)
+{
+ return _create_chip(name, 1);
+}
+
+static void remove_chip(const char *name)
+{
+ _create_chip(name, 0);
+}
+
+static int _create_bank(const char *chip_name, const char *name, int create)
+{
+ char path[64];
+
+ snprintf(path, sizeof(path), CONFIGFS_DIR "/%s/%s", chip_name, name);
+
+ if (create)
+ return mkdir(path, 0755);
+ else
+ return rmdir(path);
+}
+
+static int create_bank(const char *chip_name, const char *name)
+{
+ return _create_bank(chip_name, name, 1);
+}
+
+static void remove_bank(const char *chip_name, const char *name)
+{
+ _create_bank(chip_name, name, 0);
+}
+
+static int _enable_chip(const char *name, int enable)
+{
+ char path[64];
+ int fd, ret;
+
+ snprintf(path, sizeof(path), CONFIGFS_DIR "/%s/live", name);
+
+ fd = open(path, O_WRONLY);
+ if (fd == -1)
+ return fd;
+
+ if (enable)
+ ret = write(fd, "1", 1);
+ else
+ ret = write(fd, "0", 1);
+
+ close(fd);
+ return ret == 1 ? 0 : -1;
+}
+
+static int enable_chip(const char *name)
+{
+ return _enable_chip(name, 1);
+}
+
+static void disable_chip(const char *name)
+{
+ _enable_chip(name, 0);
+}
+
+static int open_chip(const char *chip_name, const char *bank_name)
+{
+ char path[64], dev_name[32];
+ int ret, fd;
+
+ ret = create_chip(chip_name);
+ if (ret) {
+ fprintf(stderr, "failed to create chip\n");
+ return ret;
+ }
+
+ ret = create_bank(chip_name, bank_name);
+ if (ret) {
+ fprintf(stderr, "failed to create bank\n");
+ goto err_remove_chip;
+ }
+
+ ret = enable_chip(chip_name);
+ if (ret) {
+ fprintf(stderr, "failed to enable chip\n");
+ goto err_remove_bank;
+ }
+
+ snprintf(path, sizeof(path), CONFIGFS_DIR "/%s/%s/chip_name",
+ chip_name, bank_name);
+
+ fd = open(path, O_RDONLY);
+ if (fd == -1) {
+ ret = fd;
+ fprintf(stderr, "failed to open %s\n", path);
+ goto err_disable_chip;
+ }
+
+ ret = read(fd, dev_name, sizeof(dev_name) - 1);
+ close(fd);
+ if (ret == -1) {
+ fprintf(stderr, "failed to read %s\n", path);
+ goto err_disable_chip;
+ }
+ dev_name[ret] = '\0';
+ if (ret && dev_name[ret - 1] == '\n')
+ dev_name[ret - 1] = '\0';
+
+ snprintf(path, sizeof(path), "/dev/%s", dev_name);
+
+ fd = open(path, O_RDWR);
+ if (fd == -1) {
+ ret = fd;
+ fprintf(stderr, "failed to open %s\n", path);
+ goto err_disable_chip;
+ }
+
+ return fd;
+err_disable_chip:
+ disable_chip(chip_name);
+err_remove_bank:
+ remove_bank(chip_name, bank_name);
+err_remove_chip:
+ remove_chip(chip_name);
+ return ret;
+}
+
+static void close_chip(const char *chip_name, const char *bank_name)
+{
+ disable_chip(chip_name);
+ remove_bank(chip_name, bank_name);
+ remove_chip(chip_name);
+}
+
+static int test_poll(int fd)
+{
+ struct pollfd pfds;
+
+ pfds.fd = fd;
+ pfds.events = POLLIN;
+ pfds.revents = 0;
+
+ if (poll(&pfds, 1, 0) == -1)
+ return -1;
+
+ return (pfds.revents & ~(POLLHUP | POLLERR)) ? -1 : 0;
+}
+
+static int test_read(int fd)
+{
+ char data;
+
+ if (read(fd, &data, 1) == -1 && errno == ENODEV)
+ return 0;
+ return -1;
+}
+
+static int test_ioctl(int fd)
+{
+ if (ioctl(fd, 0, NULL) == -1 && errno == ENODEV)
+ return 0;
+ return -1;
+}
+
+int main(int argc, char **argv)
+{
+ int cfd, fd, ret;
+ int (*test_func)(int);
+
+ if (argc != 3) {
+ print_usage();
+ return EXIT_FAILURE;
+ }
+
+ if (strcmp(argv[1], "chip") == 0 ||
+ strcmp(argv[1], "event") == 0 ||
+ strcmp(argv[1], "req") == 0) {
+ if (strcmp(argv[2], "poll") &&
+ strcmp(argv[2], "read") &&
+ strcmp(argv[2], "ioctl")) {
+ fprintf(stderr, "unknown command: %s\n", argv[2]);
+ return EXIT_FAILURE;
+ }
+ } else if (strcmp(argv[1], "handle") == 0) {
+ if (strcmp(argv[2], "ioctl")) {
+ fprintf(stderr, "unknown command: %s\n", argv[2]);
+ return EXIT_FAILURE;
+ }
+ } else {
+ fprintf(stderr, "unknown command: %s\n", argv[1]);
+ return EXIT_FAILURE;
+ }
+
+ if (strcmp(argv[2], "poll") == 0)
+ test_func = test_poll;
+ else if (strcmp(argv[2], "read") == 0)
+ test_func = test_read;
+ else /* strcmp(argv[2], "ioctl") == 0 */
+ test_func = test_ioctl;
+
+ cfd = open_chip("chip", "bank");
+ if (cfd == -1) {
+ fprintf(stderr, "failed to open chip\n");
+ return EXIT_FAILURE;
+ }
+
+ /* Step 1: Hold a FD to the test target. */
+ if (strcmp(argv[1], "chip") == 0) {
+ fd = cfd;
+ } else if (strcmp(argv[1], "handle") == 0) {
+ struct gpiohandle_request req = {0};
+
+ req.lines = 1;
+ if (ioctl(cfd, GPIO_GET_LINEHANDLE_IOCTL, &req) == -1) {
+ fprintf(stderr, "failed to get handle FD\n");
+ goto err_close_chip;
+ }
+
+ close(cfd);
+ fd = req.fd;
+ } else if (strcmp(argv[1], "event") == 0) {
+ struct gpioevent_request req = {0};
+
+ if (ioctl(cfd, GPIO_GET_LINEEVENT_IOCTL, &req) == -1) {
+ fprintf(stderr, "failed to get event FD\n");
+ goto err_close_chip;
+ }
+
+ close(cfd);
+ fd = req.fd;
+ } else { /* strcmp(argv[1], "req") == 0 */
+ struct gpio_v2_line_request req = {0};
+
+ req.num_lines = 1;
+ if (ioctl(cfd, GPIO_V2_GET_LINE_IOCTL, &req) == -1) {
+ fprintf(stderr, "failed to get req FD\n");
+ goto err_close_chip;
+ }
+
+ close(cfd);
+ fd = req.fd;
+ }
+
+ /* Step 2: Free the chip. */
+ close_chip("chip", "bank");
+
+ /* Step 3: Access the dangling FD to trigger UAF. */
+ ret = test_func(fd);
+ close(fd);
+ return ret ? EXIT_FAILURE : EXIT_SUCCESS;
+err_close_chip:
+ close(cfd);
+ close_chip("chip", "bank");
+ return EXIT_FAILURE;
+}
projects / thirdparty / kernel / linux.git / commitdiff
