Char Devices and ioctl: An Attack Surface

/* An unprivileged user can often just open a device node ... */
int fd = open("/dev/babydev", O_RDWR);

/* ... and drive the driver through read/write/ioctl. */
ioctl(fd, CMD_SET_SIZE, 0x100);   /* reaches driver code directly */

• A character device exposes a file like /dev/something; its file_operations table wires open, read, write, ioctl to kernel functions.
• ioctl is a catch-all command channel: user passes a command number and an arbitrary argument buffer. Great flexibility — and a rich source of bugs.
• If the device permissions allow unprivileged open, that driver code runs at ring 0 on behalf of an untrusted user.
• Classic bug patterns: missing bounds checks, integer overflow in sizes, and lifetime bugs (double free / use-after-free).