/*
 * DF-1283 harness: OOB heap write via unsigned underflow / missing bounds
 * check in the slot arithmetic of _mapping_add_new_device and
 * _mapping_add_new_pcie_device (mpr_mapping.c).
 *
 * Object-level proof. The mpr driver cannot attach on the audit QEMU guest
 * (no LSI/Avago SAS HBA), so the path is not runtime-reachable here. This
 * harness replays the exact unguarded arithmetic with attacker/firmware-
 * controlled slot/start_slot values.
 *
 * Cited path: sys/dev/raid/mpr/mpr_mapping.c:1637-1639 (SAS) and :1894-1896
 *   (PCIe). map_idx (u32) = start_index + slot - start_slot, with NO check
 *   that slot >= start_slot and NO check that map_idx < max_devices.
 *
 * Build: cc -O2 -o harness harness.c
 * Run:   ./harness
 */
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <string.h>

/* Mirror of sys/dev/raid/mpr/mprvar.h:113 dev_mapping_table (32 bytes) */
struct dev_mapping_table {
	uint64_t physical_id;
	uint32_t device_info;
	uint32_t phy_bits;
	uint16_t dpm_entry_num;
	uint16_t dev_handle;
	uint16_t reserved1;
	uint16_t id;
	uint8_t  missing_count;
	uint8_t  init_complete;
	uint8_t  TLR_bits;
	uint8_t  reserved2;
};

#define MAX_DEVICES   264u
#define GUARD_N       64u

static struct dev_mapping_table *g_table;

/* Replicate the unguarded write at mpr_mapping.c:1639-1646.
 * Returns 1 if it corrupted the guard (OOB), 0 otherwise, 2 = wild ptr. */
static int do_add_device(uint32_t start_index, uint16_t slot, uint16_t start_slot)
{
	/* exact kernel arithmetic, :1637 */
	uint32_t map_idx = start_index + slot - start_slot;
	struct dev_mapping_table *mt_entry;

	printf("[DF-1283] start_index=%u slot=%u start_slot=%u -> map_idx=%u (0x%x)\n",
	       start_index, slot, start_slot, map_idx, map_idx);

	if (map_idx >= MAX_DEVICES) {
		printf("[DF-1283]   BUG: map_idx=%u >= max_devices=%u -> write at "
		       "mapping_table[%u]",
		       map_idx, MAX_DEVICES, map_idx);
		if (map_idx >= MAX_DEVICES + GUARD_N)
			printf(" -- WILD POINTER (in-kernel: out-of-slab write / "
			       "panic; in userspace: SIGSEGV)");
		printf("\n");
	}

	/* Only dereference within the simulated slab+guard. A truly wild map_idx
	 * (the underflow case) would, in-kernel, write to a random kernel
	 * address (panic/escalation). We do NOT dereference it here -- the
	 * computed index itself is the proof. */
	if (map_idx >= MAX_DEVICES + GUARD_N)
		return 2;

	/* :1639-1646 (unguarded) */
	mt_entry = &g_table[map_idx];
	mt_entry->physical_id   = 0x4141414141414141ULL;
	mt_entry->id            = map_idx;
	mt_entry->dev_handle    = 0x4242;
	mt_entry->device_info   = 0x43434343;

	/* did it land in the guard (adjacent slab)? */
	if (map_idx >= MAX_DEVICES && map_idx < MAX_DEVICES + GUARD_N)
		return 1;
	return 0;
}

int main(void)
{
	g_table = calloc(MAX_DEVICES + GUARD_N, sizeof(*g_table));
	if (!g_table) { perror("calloc"); return 1; }
	for (unsigned g = MAX_DEVICES; g < MAX_DEVICES + GUARD_N; g++)
		memset(&g_table[g], 0xAA, sizeof(g_table[g]));

	printf("[DF-1283] mapping_table max_devices=%u, sizeof(entry)=%zu\n",
	       MAX_DEVICES, sizeof(*g_table));

	int any = 0;

	puts("\n--- Case A: slot too large (firmware u16, no upper bound) ---");
	/* start_index=10, slot=300 (from SAS Device Page 0), start_slot=0.
	 * No check that map_idx < max_devices -> OOB. */
	any |= do_add_device(10, 300, 0);

	puts("\n--- Case B: unsigned underflow (slot < start_slot) ---");
	/* start_index=0, slot=0, start_slot=5 (firmware u16).
	 * (start_index + slot) - start_slot = -5 -> u32 0xFFFFFFFB -> wild ptr.
	 * In-kernel this is an out-of-slab write -> panic/escalation. */
	any |= do_add_device(0, 0, 5);

	puts("");
	printf("[DF-1283] RESULT: %s\n",
	       any ? "OOB write into adjacent slab region DEMONSTRATED"
	           : "no guard corruption");

	puts("\n--- Fix demonstration ---");
	/* The fix checks slot >= start_slot AND map_idx < max_devices: */
	uint32_t start_index = 10; uint16_t slot = 300, start_slot = 0;
	if (slot < start_slot) {
		printf("[DF-1283] FIX: slot(%u) < start_slot(%u) -> skip (would "
		       "underflow)\n", slot, start_slot);
	} else {
		uint32_t mi = start_index + slot - start_slot;
		if (mi >= MAX_DEVICES)
			printf("[DF-1283] FIX: map_idx=%u >= max_devices=%u -> "
			       "SKIP write (no corruption)\n", mi, MAX_DEVICES);
	}

	free(g_table);
	return any ? 0 : 2;
}