struct msg_msg {
    struct list_head m_list;
    long m_type;
    size_t m_ts;        /* message text size */
    struct msg_msgseg *next;
    void *security;
    /* the actual message follows immediately */
};

msgsnd()        // Userland
    do_msgsnd() // Kernel land
        load_msg()  
            alloc_msg()         // Allocate all the necessary chunks
            copy_from_user()    // Race here to replace `struct msg_msgseg *next` before its used to copy userdata. Maybe use userfaultfd ;)

cpu_set_t cpu_set;
CPU_ZERO(&cpu_set);
CPU_SET(0,&cpu_set);
ret=sched_setaffinity(0,sizeof(cpu_set),&cpu_set);