Sthack 2026 Prechallenge - Toutdoux kernel Pwn

int init_toutdoux(void)
{
  ulong uVar1;

  major = __register_chrdev(0,0,0x100,"toutdoux",&toutdoux_fops);
  if (-1 < major) {
    toutdoux_class = (class *)__class_create(&__this_module,"toutdoux",&toutdoux_class);
    if (toutdoux_class < (class *)0xfffffffffffff001) {
      uVar1 = device_create(toutdoux_class,0,major << 0x14,0,"toutdoux");
      if (uVar1 < 0xfffffffffffff001) {
        return 0;
      }
      class_destroy(toutdoux_class);
    }
    __unregister_chrdev(major,0,0x100,"toutdoux");
  }
  return -1;
}

long toutdoux_ioctl(file *file,uint action,ulong args)
{
  long lVar1;
  int iVar2;
  uint uVar3;
  long lVar4;
  task *ptVar5;
  task *ptVar6;
  char *pcVar7;
  long in_GS_OFFSET;
  byte bVar8;
  user_task u_task;
  char name [32];
  char description [960];

                    /* Unresolved local var: long ret@[???] */
  bVar8 = 0;
  lVar1 = *(long *)(in_GS_OFFSET + 0x28);
  mutex_lock(&toutdoux_lock);
  u_task.id = 0;
  u_task._4_4_ = 0;
  u_task.name = (char *)0x0;
  u_task.description = (char *)0x0;
  lVar4 = _copy_from_user(&u_task,args,0x18);
  if (lVar4 != 0) {
    lVar4 = -0xe;
    mutex_unlock(&toutdoux_lock);
    goto LAB_001007ea;
  }
  name[0] = '\0';
  name[1] = '\0';
  name[2] = '\0';
  name[3] = '\0';
  name[4] = '\0';
  name[5] = '\0';
  name[6] = '\0';
  name[7] = '\0';
  pcVar7 = description + 8;
  for (lVar4 = 0x77; lVar4 != 0; lVar4 = lVar4 + -1) {
    pcVar7[0] = '\0';
    pcVar7[1] = '\0';
    pcVar7[2] = '\0';
    pcVar7[3] = '\0';
    pcVar7[4] = '\0';
    pcVar7[5] = '\0';
    pcVar7[6] = '\0';
    pcVar7[7] = '\0';
    pcVar7 = pcVar7 + (ulong)bVar8 * -0x10 + 8;
  }
  name[8] = '\0';
  name[9] = '\0';
  name[10] = '\0';
  name[0xb] = '\0';
  name[0xc] = '\0';
  name[0xd] = '\0';
  name[0xe] = '\0';
  name[0xf] = '\0';
  name[0x10] = '\0';
  name[0x11] = '\0';
  name[0x12] = '\0';
  name[0x13] = '\0';
  name[0x14] = '\0';
  name[0x15] = '\0';
  name[0x16] = '\0';
  name[0x17] = '\0';
  name[0x18] = '\0';
  name[0x19] = '\0';
  name[0x1a] = '\0';
  name[0x1b] = '\0';
  name[0x1c] = '\0';
  name[0x1d] = '\0';
  name[0x1e] = '\0';
  name[0x1f] = '\0';
  description[0] = '\0';
  description[1] = '\0';
  description[2] = '\0';
  description[3] = '\0';
  description[4] = '\0';
  description[5] = '\0';
  description[6] = '\0';
  description[7] = '\0';
  if (action == 4) {
    iVar2 = task_finish_update_desc(u_task.id,u_task.description);
    lVar4 = (long)iVar2;
  }
  else if (action < 5) {
    if (action == 2) {
      iVar2 = task_delete(u_task.id);
      lVar4 = (long)iVar2;
    }
    else if (action == 3) {
      iVar2 = task_complete(u_task.id);
      lVar4 = (long)iVar2;
    }
    else if (action == 0) {
      lVar4 = _copy_from_user(name,u_task.name,0x20);
      if (lVar4 == 0) {
        lVar4 = _copy_from_user(description,u_task.description,0x3c0);
        if (lVar4 == 0) {
          iVar2 = task_create(name,description);
          lVar4 = (long)iVar2;
          goto LAB_001007de;
        }
      }
      lVar4 = -0xe;
    }
    else {
      iVar2 = get_task_infos(u_task.id,u_task.name,u_task.description);
      lVar4 = (long)iVar2;
    }
  }
  else if (action == 6) {
                    /* Unresolved local var: uint idx@[???]
                       Unresolved local var: task * t@[???] */
    ptVar6 = todos;
                    /* Unresolved local var: int i@[???] */
    ptVar5 = todos;
    do {
      if (u_task.id == ptVar5->id) {
        uVar3 = 0;
        goto LAB_001008c2;
      }
      ptVar5 = ptVar5 + 1;
    } while (ptVar5 != (task *)&toutdoux_class);
LAB_00100969:
    lVar4 = -0x16;
  }
  else if (action == 7) {
    iVar2 = task_update_name(u_task.id,u_task.name);
    lVar4 = (long)iVar2;
  }
  else {
    if (action != 5) goto LAB_00100969;
    iVar2 = task_set_in_progress(u_task.id);
    lVar4 = (long)iVar2;
  }
LAB_001007de:
  mutex_unlock(&toutdoux_lock);
LAB_001007ea:
  if (lVar1 == *(long *)(in_GS_OFFSET + 0x28)) {
    return lVar4;
  }
                    /* WARNING: Subroutine does not return */
  __stack_chk_fail();
  while( true ) {
                    /* Unresolved local var: int i@[???] */
    uVar3 = uVar3 + 1;
    ptVar6 = ptVar6 + 1;
    if (uVar3 == 100) break;
LAB_001008c2:
    if (u_task.id == ptVar6->id) {
      iVar2 = (*todos[uVar3].render_fn)
                        (todos[uVar3].description,(char *)((long)(int)uVar3 * 0x36 + 0x101866),
                         todos[uVar3].completed,todos[uVar3].inProgress,u_task.description);
      lVar4 = (long)iVar2;
      goto LAB_001007de;
    }
  }
  goto LAB_00100969;
}

int task_create(char *name_buf,char *description_buf)
{
  uint _task_counter;
  task *_todos;
  char *description;
  long j;
  uint i;
  char *pcVar1;
  byte bVar2;

  bVar2 = 0;
  _todos = todos;
  i = 0;
  do {
    if (_todos->id == 0) {
                    /* Unresolved local var: uint index@[???] */
      description = (char *)kmem_cache_alloc_trace(_DAT_001030e0,0xdc0,960);
      if (description == (char *)0x0) {
        _task_counter = 0xfffffff4;
      }
      else {
        _todos = todos + (int)i;
        _todos->name[0] = '\0';
        _todos->name[1] = '\0';
        _todos->name[2] = '\0';
        _todos->name[3] = '\0';
        _todos->name[4] = '\0';
        _todos->name[5] = '\0';
        _todos->name[6] = '\0';
        _todos->name[7] = '\0';
        _todos = todos + (int)i;
        _todos->name[8] = '\0';
        _todos->name[9] = '\0';
        _todos->name[10] = '\0';
        _todos->name[0xb] = '\0';
        _todos->name[0xc] = '\0';
        _todos->name[0xd] = '\0';
        _todos->name[0xe] = '\0';
        _todos->name[0xf] = '\0';
        _todos = todos + (int)i;
        _todos->name[0x10] = '\0';
        _todos->name[0x11] = '\0';
        _todos->name[0x12] = '\0';
        _todos->name[0x13] = '\0';
        _todos->name[0x14] = '\0';
        _todos->name[0x15] = '\0';
        _todos->name[0x16] = '\0';
        _todos->name[0x17] = '\0';
        _todos = todos + (int)i;
        _todos->name[0x18] = '\0';
        _todos->name[0x19] = '\0';
        _todos->name[0x1a] = '\0';
        _todos->name[0x1b] = '\0';
        _todos->name[0x1c] = '\0';
        _todos->name[0x1d] = '\0';
        _todos->name[0x1e] = '\0';
        _todos->name[0x1f] = '\0';
        *(undefined8 *)todos[(int)i].name = *(undefined8 *)name_buf;
        *(undefined8 *)(todos[(int)i].name + 8) = *(undefined8 *)(name_buf + 8);
        *(undefined8 *)(todos[(int)i].name + 0x10) = *(undefined8 *)(name_buf + 0x10);
        *(undefined8 *)(todos[(int)i].name + 0x18) = *(undefined8 *)(name_buf + 0x18);
        pcVar1 = description;
        for (j = 120; j != 0; j = j + -1) {
          *(undefined8 *)pcVar1 = *(undefined8 *)description_buf;
          description_buf = description_buf + (ulong)bVar2 * -0x10 + 8;
          pcVar1 = pcVar1 + ((ulong)bVar2 * -2 + 1) * 8;
        }
        _task_counter = task_counter + 1;
        task_counter = _task_counter;
        todos[i].id = _task_counter;
        todos[i].inProgress = '\0';
        todos[i].completed = '\0';
        todos[i].description = description;
        todos[i].render_fn = default_render;
      }
      return _task_counter;
    }
    i = i + 1;
    _todos = _todos + 1;
  } while (i != 100);
  return -0x1c;
}

int task_delete(int id)
{
  char *pcVar1;
  uint uVar2;
  task *task_ptr;
  long lVar3;
  task *ptVar4;

                    /* Unresolved local var: uint idx@[???]
                       Unresolved local var: int i@[???] */
  ptVar4 = todos;
  task_ptr = todos;
  while (id != task_ptr->id) {
    task_ptr = task_ptr + 1;
    if (task_ptr == (task *)&toutdoux_class) {
      return -0x16;
    }
  }
  uVar2 = 0;
  do {
    if (id == ptVar4->id) {
      lVar3 = (long)(int)uVar2 * 0x36 + 6;
      goto LAB_0010054c;
    }
                    /* Unresolved local var: int i@[???] */
    uVar2 = uVar2 + 1;
    ptVar4 = ptVar4 + 1;
  } while (uVar2 != 100);
  lVar3 = 0x35ffffffd0;
  uVar2 = 0xffffffff;
LAB_0010054c:
  pcVar1 = todos[0].name + lVar3 + -6;
  pcVar1[0] = '\0';
  pcVar1[1] = '\0';
  pcVar1[2] = '\0';
  pcVar1[3] = '\0';
  pcVar1[4] = '\0';
  pcVar1[5] = '\0';
  pcVar1[6] = '\0';
  pcVar1[7] = '\0';
  pcVar1 = todos[0].name + lVar3 + 2;
  pcVar1[0] = '\0';
  pcVar1[1] = '\0';
  pcVar1[2] = '\0';
  pcVar1[3] = '\0';
  pcVar1[4] = '\0';
  pcVar1[5] = '\0';
  pcVar1[6] = '\0';
  pcVar1[7] = '\0';
  pcVar1 = todos[0].name + lVar3 + 10;
  pcVar1[0] = '\0';
  pcVar1[1] = '\0';
  pcVar1[2] = '\0';
  pcVar1[3] = '\0';
  pcVar1[4] = '\0';
  pcVar1[5] = '\0';
  pcVar1[6] = '\0';
  pcVar1[7] = '\0';
  pcVar1 = todos[0].name + lVar3 + 0x12;
  pcVar1[0] = '\0';
  pcVar1[1] = '\0';
  pcVar1[2] = '\0';
  pcVar1[3] = '\0';
  pcVar1[4] = '\0';
  pcVar1[5] = '\0';
  pcVar1[6] = '\0';
  pcVar1[7] = '\0';
  kfree(todos[uVar2].description);
  todos[uVar2].completed = '\0';
  todos[uVar2].description = (char *)0x0;
  todos[uVar2].id = 0;
  return 0;
}

int task_complete(int id)
{
  uint i;
  task *_todos_ptr_2;
  ulong idx;
  task *_todos_ptr_1;

  _todos_ptr_1 = todos;
  _todos_ptr_2 = todos;
  while (id != _todos_ptr_2->id) {
    _todos_ptr_2 = _todos_ptr_2 + 1;
    if (_todos_ptr_2 == (task *)&toutdoux_class) {
      return -0x16;
    }
  }
  idx = 0;
  do {
    if (id == _todos_ptr_1->id) goto do_complete;

    i = (int)idx + 1;
    idx = (ulong)i;
    _todos_ptr_1 = _todos_ptr_1 + 1;
  } while (i != 100);
  idx = 0xffffffff;
do_complete:
  todos[idx].completed = todos[idx].completed + '\x01';
  todos[idx].inProgress = '\0';
  return 0;
}

int task_set_in_progress(uint id)
{
  uint i;
  task *ptVar1;
  ulong idx;
  task *ptVar2;

  ptVar2 = todos;
  ptVar1 = todos;
  while (id != ptVar1->id) {
    ptVar1 = ptVar1 + 1;
    if (ptVar1 == (task *)&toutdoux_class) {
      return -0x16;
    }
  }
  idx = 0;
  do {
    if (id == ptVar2->id) goto LAB_00100610;
                    /* Unresolved local var: uint idx@[???]
                       Unresolved local var: int i@[???] */
    i = (int)idx + 1;
    idx = (ulong)i;
    ptVar2 = ptVar2 + 1;
  } while (i != 100);
  idx = 0xffffffff;
LAB_00100610:
  todos[idx].inProgress = '\x01';
  return 0;
}

int task_update_name(int id,char *name)
{
  code *pcVar1;
  int iVar2;
  long lVar3;
  task *ptVar4;
  ulong uVar5;
  task *ptVar6;

                    /* Unresolved local var: uint idx@[???] */
  lVar3 = strnlen_user(name,0x3c0);
  if (lVar3 < 0x20) {
                    /* Unresolved local var: int i@[???] */
    ptVar6 = todos;
    ptVar4 = todos;
    while (id != ptVar4->id) {
      ptVar4 = ptVar4 + 1;
      if (ptVar4 == (task *)&toutdoux_class) {
        return -0x16;
      }
    }
    iVar2 = 0;
    do {
      if (id == ptVar6->id) {
        lVar3 = (long)iVar2 * 0x36 + 6;
        goto LAB_00100491;
      }
                    /* Unresolved local var: int i@[???] */
      iVar2 = iVar2 + 1;
      ptVar6 = ptVar6 + 1;
    } while (iVar2 != 100);
    lVar3 = 0x35ffffffd0;
LAB_00100491:
    uVar5 = strnlen_user(name,0x3c0);
                    /* Unresolved local var: int sz@[???]
                       Unresolved local var: int __ret_warn_on@[???] */
    if (0x7fffffff < uVar5) {
                    /* WARNING: Does not return */
      pcVar1 = (code *)invalidInstructionException();
      (*pcVar1)();
    }
                    /* Unresolved local var: int __flags@[???] */
    lVar3 = _copy_from_user(todos[0].name + lVar3 + -6,name,uVar5);
    iVar2 = 0;
    if (lVar3 != 0) {
      return -0xe;
    }
  }
  else {
    iVar2 = -1;
  }
  return iVar2;
}

int task_finish_update_desc(uint id,char *description_buf)
{
  uint uVar1;
  int iVar2;
  task *ptVar3;
  char *pcVar4;
  long lVar5;
  ulong uVar6;
  task *ptVar7;

  ptVar7 = todos;
  ptVar3 = todos;
  while (id != ptVar3->id) {
    ptVar3 = ptVar3 + 1;
    if (ptVar3 == (task *)&toutdoux_class) {
      return -0x16;
    }
  }
  uVar6 = 0;
  do {
    if (id == ptVar7->id) goto LAB_0010067b;
                    /* Unresolved local var: int i@[???] */
    uVar1 = (int)uVar6 + 1;
    uVar6 = (ulong)uVar1;
    ptVar7 = ptVar7 + 1;
  } while (uVar1 != 100);
  uVar6 = 0xffffffff;
LAB_0010067b:
  if (todos[uVar6].completed == '\0') {
                    /* Unresolved local var: uint index@[???] */
    pcVar4 = (char *)kmem_cache_alloc_trace(_DAT_001030e0,0xdc0,0x3c0);
    if (pcVar4 == (char *)0x0) {
      iVar2 = -0xc;
    }
    else {
      todos[uVar6].completed = '\x01';
      kfree(todos[uVar6].description);
      lVar5 = _copy_from_user(pcVar4,description_buf,0x3c0);
      if (lVar5 == 0) {
        todos[uVar6].description = pcVar4;
        iVar2 = 0;
      }
      else {
        kfree(pcVar4);
        iVar2 = -0xe;
      }
    }
  }
  else {
    iVar2 = -1;
  }
  return iVar2;
}

  else if (action == 6) {
    ptVar5 = todos;
    ptVar4 = todos;
    do {
      if (u_task.id == ptVar4->id) {
        i = 0;
        goto LAB_001008c2;
      }
      ptVar4 = ptVar4 + 1;
    } while (ptVar4 != (task *)&toutdoux_class);

// ...snip...

LAB_001008c2:
    if (u_task.id == ptVar5->id) {
      iVar2 = (*todos[i].render_fn)
                        (todos[i].description,(char *)((long)(int)i * 0x36 + 0x101866),
                         todos[i].completed,todos[i].inProgress,u_task.description);
      lVar3 = (long)iVar2;
      goto LAB_001007de;