#!/bin/sh
# DF-1162 runtime test — NOT EXECUTABLE ON THIS GUEST (no LSI-Logic MPT FC HBA).
# The bug requires mpt(4) attached to an FC HBA in target mode, with
# MaxPostedCmdBuffers > MPT_MAX_REQUESTS/2 (so tgt_cmd_ptrs is smaller than
# the bound the ABTS path checks against), plus an adjacent FC peer sending
# ABTS with RX_ID in [tgt_cmds_allocated, mpt_max_tgtcmds). Not present.
set -e
echo "DF-1162: mpt_fc_els_reply_handler ABTS tgt_cmd_ptrs[] bound mismatch"
echo "----------------------------------------------------------------------"
echo "PREREQ: MPT FC HBA with MaxPostedCmdBuffers > MPT_MAX_REQUESTS/2"
echo "        + adjacent FC peer sending crafted ABTS RX_ID."
echo
pciconf -lv 2>/dev/null | grep -i 'mpt\|fusion\|lsi.*fc' || true
if ! pciconf -lv 2>/dev/null | grep -q -i 'mpt\|fusion'; then
    echo "no MPT FC HBA present — cannot trigger"
    exit 0
fi
echo "On a vulnerable kernel with FC target mode active + an IOC whose"
echo "MaxPostedCmdBuffers > MPT_MAX_REQUESTS/2, an adjacent peer sending"
echo "ABTS with RX_ID in [tgt_cmds_allocated, mpt_max_tgtcmds) would read"
echo "an OOB pointer from tgt_cmd_ptrs[] and likely panic."