#!/bin/sh
# DF-2245 run: executes the recursion-depth harness.
# The vulnerable variant (exact copy of sys/libkern/qsort.c) reaches O(n)
# depth on the median-of-3 killer input; the fixed variant (recurse on the
# smaller partition) stays at O(log n). This proves the algorithmic defect.
#
# NOTE: The kernel stack-overflow PANIC is NOT reproduced, because the only
# attacker-reachable kqsort caller (ext2_htree_split_dirblock) is behind a
# `#if 0` in ext2_lookup.c:920-941 (dead code on current master), and every
# other live caller (ng_ppp max 16, drm_blend = hw planes, vinum drives)
# sorts a small bounded array. So this finding is a LATENT hardening defect.
# The harness proves the primitive; fix.diff bounds recursion to O(log n).
set -e
# the harness recurses deeply on the killer input; raise the userspace stack
ulimit -s 262144
./kqsort_depth_harness