gpio-cdev-uaf.c

// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * GPIO character device helper for UAF tests.
 *
 * Copyright 2026 Google LLC
 */

#include <errno.h>
#include <fcntl.h>
#include <linux/gpio.h>
#include <poll.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>

#define CONFIGFS_DIR "/sys/kernel/config/gpio-sim"
#define PROCFS_DIR "/proc"

static void print_usage(void)
{
	printf("usage:\n");
	printf("  gpio-cdev-uaf [chip|handle|event|req] [poll|read|ioctl]\n");
}

static int _create_chip(const char *name, int create)
{
	char path[64];

	snprintf(path, sizeof(path), CONFIGFS_DIR "/%s", name);

	if (create)
		return mkdir(path, 0755);
	else
		return rmdir(path);
}

static int create_chip(const char *name)
{
	return _create_chip(name, 1);
}

static void remove_chip(const char *name)
{
	_create_chip(name, 0);
}

static int _create_bank(const char *chip_name, const char *name, int create)
{
	char path[64];

	snprintf(path, sizeof(path), CONFIGFS_DIR "/%s/%s", chip_name, name);

	if (create)
		return mkdir(path, 0755);
	else
		return rmdir(path);
}

static int create_bank(const char *chip_name, const char *name)
{
	return _create_bank(chip_name, name, 1);
}

static void remove_bank(const char *chip_name, const char *name)
{
	_create_bank(chip_name, name, 0);
}

static int _enable_chip(const char *name, int enable)
{
	char path[64];
	int fd, ret;

	snprintf(path, sizeof(path), CONFIGFS_DIR "/%s/live", name);

	fd = open(path, O_WRONLY);
	if (fd == -1)
		return fd;

	if (enable)
		ret = write(fd, "1", 1);
	else
		ret = write(fd, "0", 1);

	close(fd);
	return ret == 1 ? 0 : -1;
}

static int enable_chip(const char *name)
{
	return _enable_chip(name, 1);
}

static void disable_chip(const char *name)
{
	_enable_chip(name, 0);
}

static int open_chip(const char *chip_name, const char *bank_name)
{
	char path[64], dev_name[32];
	int ret, fd;

	ret = create_chip(chip_name);
	if (ret) {
		fprintf(stderr, "failed to create chip\n");
		return ret;
	}

	ret = create_bank(chip_name, bank_name);
	if (ret) {
		fprintf(stderr, "failed to create bank\n");
		goto err_remove_chip;
	}

	ret = enable_chip(chip_name);
	if (ret) {
		fprintf(stderr, "failed to enable chip\n");
		goto err_remove_bank;
	}

	snprintf(path, sizeof(path), CONFIGFS_DIR "/%s/%s/chip_name",
		 chip_name, bank_name);

	fd = open(path, O_RDONLY);
	if (fd == -1) {
		ret = fd;
		fprintf(stderr, "failed to open %s\n", path);
		goto err_disable_chip;
	}

	ret = read(fd, dev_name, sizeof(dev_name) - 1);
	close(fd);
	if (ret == -1) {
		fprintf(stderr, "failed to read %s\n", path);
		goto err_disable_chip;
	}
	dev_name[ret] = '\0';
	if (ret && dev_name[ret - 1] == '\n')
		dev_name[ret - 1] = '\0';

	snprintf(path, sizeof(path), "/dev/%s", dev_name);

	fd = open(path, O_RDWR);
	if (fd == -1) {
		ret = fd;
		fprintf(stderr, "failed to open %s\n", path);
		goto err_disable_chip;
	}

	return fd;
err_disable_chip:
	disable_chip(chip_name);
err_remove_bank:
	remove_bank(chip_name, bank_name);
err_remove_chip:
	remove_chip(chip_name);
	return ret;
}

static void close_chip(const char *chip_name, const char *bank_name)
{
	disable_chip(chip_name);
	remove_bank(chip_name, bank_name);
	remove_chip(chip_name);
}

static int test_poll(int fd)
{
	struct pollfd pfds;

	pfds.fd = fd;
	pfds.events = POLLIN;
	pfds.revents = 0;

	if (poll(&pfds, 1, 0) == -1)
		return -1;

	return (pfds.revents & ~(POLLHUP | POLLERR)) ? -1 : 0;
}

static int test_read(int fd)
{
	char data;

	if (read(fd, &data, 1) == -1 && errno == ENODEV)
		return 0;
	return -1;
}

static int test_ioctl(int fd)
{
	if (ioctl(fd, 0, NULL) == -1 && errno == ENODEV)
		return 0;
	return -1;
}

int main(int argc, char **argv)
{
	int cfd, fd, ret;
	int (*test_func)(int);

	if (argc != 3) {
		print_usage();
		return EXIT_FAILURE;
	}

	if (strcmp(argv[1], "chip") == 0 ||
	    strcmp(argv[1], "event") == 0 ||
	    strcmp(argv[1], "req") == 0) {
		if (strcmp(argv[2], "poll") &&
		    strcmp(argv[2], "read") &&
		    strcmp(argv[2], "ioctl")) {
			fprintf(stderr, "unknown command: %s\n", argv[2]);
			return EXIT_FAILURE;
		}
	} else if (strcmp(argv[1], "handle") == 0) {
		if (strcmp(argv[2], "ioctl")) {
			fprintf(stderr, "unknown command: %s\n", argv[2]);
			return EXIT_FAILURE;
		}
	} else {
		fprintf(stderr, "unknown command: %s\n", argv[1]);
		return EXIT_FAILURE;
	}

	if (strcmp(argv[2], "poll") == 0)
		test_func = test_poll;
	else if (strcmp(argv[2], "read") == 0)
		test_func = test_read;
	else	/* strcmp(argv[2], "ioctl") == 0 */
		test_func = test_ioctl;

	cfd = open_chip("chip", "bank");
	if (cfd == -1) {
		fprintf(stderr, "failed to open chip\n");
		return EXIT_FAILURE;
	}

	/* Step 1: Hold a FD to the test target. */
	if (strcmp(argv[1], "chip") == 0) {
		fd = cfd;
	} else if (strcmp(argv[1], "handle") == 0) {
		struct gpiohandle_request req = {0};

		req.lines = 1;
		if (ioctl(cfd, GPIO_GET_LINEHANDLE_IOCTL, &req) == -1) {
			fprintf(stderr, "failed to get handle FD\n");
			goto err_close_chip;
		}

		close(cfd);
		fd = req.fd;
	} else if (strcmp(argv[1], "event") == 0) {
		struct gpioevent_request req = {0};

		if (ioctl(cfd, GPIO_GET_LINEEVENT_IOCTL, &req) == -1) {
			fprintf(stderr, "failed to get event FD\n");
			goto err_close_chip;
		}

		close(cfd);
		fd = req.fd;
	} else {	/* strcmp(argv[1], "req") == 0 */
		struct gpio_v2_line_request req = {0};

		req.num_lines = 1;
		if (ioctl(cfd, GPIO_V2_GET_LINE_IOCTL, &req) == -1) {
			fprintf(stderr, "failed to get req FD\n");
			goto err_close_chip;
		}

		close(cfd);
		fd = req.fd;
	}

	/* Step 2: Free the chip. */
	close_chip("chip", "bank");

	/* Step 3: Access the dangling FD to trigger UAF. */
	ret = test_func(fd);
	close(fd);
	return ret ? EXIT_FAILURE : EXIT_SUCCESS;
err_close_chip:
	close(cfd);
	close_chip("chip", "bank");
	return EXIT_FAILURE;
}