⬢ DragonFlyBSD Kernel Audit
DF-3794 / mcallctrl.c
← back to finding ↓ download raw
/* Control for DF-3794: same ioctl with a VALID path -> copyinstr succeeds
 * -> args freed -> no leak. usage: mcallctrl [iters] */
#include <sys/types.h>
#include <sys/ioctl.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include "acpi.h"
#include <dev/acpica/acpiio.h>
#include <dev/acpica/acpiio_mcall.h>

int main(int argc, char **argv) {
    long iters = (argc > 1) ? atol(argv[1]) : 100000;
    int i, fd;
    struct acpi_mcall_ioctl_arg a;
    ACPI_OBJECT objs[2];
    ACPI_OBJECT_LIST ol;
    static char path[] = "\\_SB_";

    fd = open("/dev/acpi", O_RDWR);
    if (fd < 0) { perror("open"); return 1; }
    memset(&a, 0, sizeof(a));
    objs[0].Type = ACPI_TYPE_INTEGER; objs[0].Integer.Value = 1;
    objs[1].Type = ACPI_TYPE_INTEGER; objs[1].Integer.Value = 2;
    ol.Count = 2; ol.Pointer = objs;
    a.args = ol;
    a.path = path;
    for (i = 0; i < iters; i++)
        ioctl(fd, ACPIIO_DO_MCALL, &a);
    printf("control: %ld iterations with valid path done\n", iters);
    close(fd);
    return 0;
}