bof.c

#include <linux/module.h>
#include <linux/version.h>
#include <linux/kernel.h>
#include <linux/types.h>
#include <linux/kdev_t.h>
#include <linux/fs.h>
#include <linux/device.h>
#include <linux/cdev.h>
#include <linux/uaccess.h>

MODULE_LICENSE("GPL");

#define SUCCESS 		0
#define IOCTL_VULN 		1337
#define DEVICE_NAME 		"bof_ctf"
#define MAJOR_NUM		123

static long device_ioctl(struct file *file, unsigned int cmd, unsigned long arg);

dev_t dev = 0;
static struct cdev cdev;
static struct class *bof_class;

// our device file support ioctls
static struct file_operations fops =
{
        .unlocked_ioctl = device_ioctl
};

// load module - function creates device file
int init_module(void)
{
	int ret = 0;

    ret = alloc_chrdev_region(&dev, 0, 1, DEVICE_NAME);
    if (ret) {
        printk(KERN_INFO "failed alloc: %d\n", ret);
        return ret;
    }

    memset(&cdev, 0, sizeof(struct cdev));
    
    cdev_init(&cdev, &fops);
    cdev.owner = THIS_MODULE;
    cdev.ops = &fops;

    ret = cdev_add(&cdev, dev, 1);
    if (ret) {
        printk(KERN_INFO "cdev_add fail\n");
        return ret;
    }

    bof_class = class_create(THIS_MODULE, DEVICE_NAME);
    if (IS_ERR(bof_class)) {
        printk(KERN_INFO "class create failed!\n");
        return ret;
    }

    dev = device_create(bof_class, NULL, dev, NULL, DEVICE_NAME);
    if (IS_ERR(&cdev)) {
        ret = PTR_ERR(&cdev);
        printk(KERN_INFO "device create failed\n"); 

        class_destroy(bof_class);
        cdev_del(&cdev);
        unregister_chrdev_region(&dev, 1);

        return ret;
    }

    printk(KERN_INFO "bof module loaded successfully\n"); 

    return 0;
}


// unload module and remove the device file
void cleanup_module(void)
{
    cdev_del(&cdev);
    class_destroy(bof_class);
    unregister_chrdev_region(&dev, 1);
	printk(KERN_INFO "Goodbye bof\n");
}

// ioctl handler function
static long device_ioctl(struct file *file, unsigned int ioctl_num, unsigned long arg)
{
    char kernel_buff[20] = {0};

    // searchs the specified ioctl number
    switch (ioctl_num) 
    {
    case IOCTL_VULN:    // vulnerable ioctl
        // copy buffer from user to kernel
        __copy_from_user(kernel_buff, (char*)arg, strlen((char*)arg));
        printk(KERN_INFO "vulnerable ioctl recieved:    %s\n", kernel_buff);
        break;

    default:
        printk(KERN_INFO "ioctl number not found\n");
        break;
    }

    return SUCCESS;
}