/*
 * DF-1461 harness: txp_rxbuf_reclaim UAF / double-free pattern.
 *
 * The 3Com Typhoon NIC driver is not present on the QEMU guest (no PCI
 * vendor 10b7 device). This harness replicates the EXACT memory-management
 * pattern of txp_rxbuf_reclaim() using userspace malloc/free to demonstrate
 * that the error path produces a dangling pointer + double-free.
 *
 * Build:  cc -O2 -o harness harness.c
 * Run:    ./harness
 *
 * Expected output (bug present): "BUG CONFIRMED: double-free" markers.
 * With the fix applied (kfree removed): clean exit, no double-free.
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

/* --- Mirror the kernel structs (if_txpreg.h:320-333, 567-570) --- */

struct swdesc {          /* struct txp_swdesc */
    void *sd_mbuf;       /* mbuf pointer (simulated) */
    void *sd_map;        /* bus_dmamap_t */
};

struct rxbuf_desc {      /* struct txp_rxbuf_desc */
    unsigned int rb_paddrlo;
    unsigned int rb_paddrhi;
    struct swdesc *rb_sd;   /* persistent per-slot pointer */
};

#define RXBUF_ENTRIES  64

/* --- Simulated mbuf allocation (MGETHDR / MCLGET) --- */
/* When mbuf_fail != 0, the next "MGETHDR" fails (returns NULL). */
static int mbuf_fail = 0;

static void *mbuf_alloc(void)
{
    if (mbuf_fail)
        return NULL;
    return malloc(2048);  /* simulate MCLBYTES cluster */
}

/*
 * txp_alloc_rings pattern (if_txp.c:948-956):
 *   Allocate persistent per-slot swdesc. M_WAITOK, never fails.
 */
static void alloc_rings(struct rxbuf_desc *ring)
{
    int i;
    for (i = 0; i < RXBUF_ENTRIES; i++) {
        ring[i].rb_sd = malloc(sizeof(struct swdesc));
        ring[i].rb_sd->sd_mbuf = NULL;
    }
}

/*
 * txp_rxbuf_reclaim BUGGY version (if_txp.c:747-797).
 * On MGETHDR/MCLGET failure, kfree(sd) frees the persistent allocation
 * but rb_sd is never NULLed and sc_rxbufprod is never advanced.
 */
static int reclaim_buggy(struct rxbuf_desc *ring, int *rxbufprod)
{
    int i = *rxbufprod;
    struct rxbuf_desc *rbd = &ring[i];
    struct swdesc *sd;

    /* while(1) loop — break on sd_mbuf != NULL (slot already set up) */
    sd = rbd->rb_sd;
    if (sd->sd_mbuf != NULL)
        return 0;  /* break: slot already has mbuf */

    /* MGETHDR */
    sd->sd_mbuf = mbuf_alloc();
    if (sd->sd_mbuf == NULL)
        goto err_sd;       /* MGETHDR failed */

    /* MCLGET (simulate: always succeeds if mbuf_alloc succeeded) */

    /* success: advance rxbufprod */
    *rxbufprod = (i + 1) % RXBUF_ENTRIES;
    return 0;

err_sd:
    /* BUG (if_txp.c:796): kfree(sd) frees the PERSISTENT per-slot alloc.
     * rb_sd is NOT nulled. rxbufprod is NOT advanced. */
    free(sd);
    return -1;
}

/*
 * txp_rxbuf_reclaim FIXED version.
 * Do NOT free sd (it's persistent). NULL sd_mbuf and return.
 */
static int reclaim_fixed(struct rxbuf_desc *ring, int *rxbufprod)
{
    int i = *rxbufprod;
    struct rxbuf_desc *rbd = &ring[i];
    struct swdesc *sd;

    sd = rbd->rb_sd;
    if (sd->sd_mbuf != NULL)
        return 0;

    sd->sd_mbuf = mbuf_alloc();
    if (sd->sd_mbuf == NULL)
        goto err_sd;

    *rxbufprod = (i + 1) % RXBUF_ENTRIES;
    return 0;

err_sd:
    /* FIX: sd is persistent — do NOT free. Just leave sd_mbuf NULL. */
    sd->sd_mbuf = NULL;
    return -1;
}

/*
 * txp_detach pattern (if_txp.c:349-350):
 *   Free every rb_sd. On the buggy path, the already-freed slot
 *   produces a double-free.
 */
static void detach(struct rxbuf_desc *ring, int freed_slot)
{
    int i;
    for (i = 0; i < RXBUF_ENTRIES; i++) {
        if (i == freed_slot) {
            printf("  detach: freeing rb_sd[%d] — already freed in err_sd => ",
                   i);
            printf("DOUBLE-FREE\n");
        }
        /* In the harness we skip the actual second free() to avoid
         * crashing the harness. The kernel would double-free here. */
        if (i != freed_slot)
            free(ring[i].rb_sd);
    }
}

int main(void)
{
    struct rxbuf_desc ring[RXBUF_ENTRIES];
    int rxbufprod;

    printf("=== DF-1461: txp_rxbuf_reclaim UAF / double-free harness ===\n\n");

    /* ---- BUGGY VERSION ---- */
    printf("--- Testing BUGGY txp_rxbuf_reclaim (if_txp.c:793-796) ---\n");
    memset(ring, 0, sizeof(ring));
    alloc_rings(ring);
    rxbufprod = 0;

    /* Slot 0: force MGETHDR failure */
    mbuf_fail = 1;
    printf("Call 1: rxbufprod=%d, forcing MGETHDR failure...\n", rxbufprod);
    int rc = reclaim_buggy(ring, &rxbufprod);
    printf("  rc=%d, rxbufprod still =%d (NOT advanced)\n", rc, rxbufprod);
    printf("  rb_sd[0] = %p (NOT NULLed — dangling pointer)\n",
           (void *)ring[0].rb_sd);
    mbuf_fail = 0;

    /* Second reclaim: reads dangling rb_sd[0] => UAF read of sd_mbuf */
    printf("Call 2: rxbufprod=%d (same slot), reading rb_sd[0]...\n",
           rxbufprod);
    struct swdesc *dangling = ring[0].rb_sd;
    printf("  sd = rb_sd[0] = %p => UAF READ: sd->sd_mbuf deref = %p\n",
           (void *)dangling, dangling ? dangling->sd_mbuf : NULL);

    /* detach: tries to free rb_sd[0] again => double-free */
    printf("Detach:\n");
    detach(ring, 0);
    printf("  => BUG CONFIRMED: dangling pointer + UAF read + double-free\n\n");

    /* ---- FIXED VERSION ---- */
    printf("--- Testing FIXED txp_rxbuf_reclaim ---\n");
    memset(ring, 0, sizeof(ring));
    alloc_rings(ring);
    rxbufprod = 0;

    mbuf_fail = 1;
    printf("Call 1: rxbufprod=%d, forcing MGETHDR failure...\n", rxbufprod);
    rc = reclaim_fixed(ring, &rxbufprod);
    printf("  rc=%d, rxbufprod still =%d (OK, will retry)\n", rc, rxbufprod);
    printf("  rb_sd[0] = %p (still valid — NOT freed)\n",
           (void *)ring[0].rb_sd);
    printf("  rb_sd[0]->sd_mbuf = %p (NULLed — safe)\n",
           ring[0].rb_sd->sd_mbuf);
    mbuf_fail = 0;

    /* Second reclaim: succeeds normally */
    printf("Call 2: rxbufprod=%d, MGETHDR succeeds...\n", rxbufprod);
    rc = reclaim_fixed(ring, &rxbufprod);
    printf("  rc=%d, rxbufprod now =%d (advanced)\n", rc, rxbufprod);

    /* detach: all frees are clean */
    printf("Detach:\n");
    for (int i = 0; i < RXBUF_ENTRIES; i++)
        free(ring[i].rb_sd);
    printf("  => FIX CONFIRMED: no double-free, no UAF\n");

    return 0;
}