#!/bin/sh
# run_poison.sh [poison|direct] -- GUEST-side DF-2368 demo B:
# consequence of the Nr=0 state that rijndael_set_key stores when
# keyBits is invalid and INVARIANTS is off (production kernels):
# the round loop in rijndaelEncrypt (r = Nr>>1 = 0; do-while --r)
# never terminates and walks rk forward 32 bytes per iteration past
# ek/dk -> OOB read until an unmapped page -> kernel page fault.
#
# The rig builds a REAL rijndael_ctx (valid 128-bit set_key) at the
# end of a mapped user page followed by an unmapped guard page,
# forces ctx->Nr = 0 (the exact stored state), and calls the real
# rijndael_encrypt (poison) or rijndaelEncrypt(ek,0,..) (direct).
#
# Expected on stock kernel: fatal trap 12 page fault in kernel mode,
# backtrace contains rijndaelEncrypt; ssh dies.  On the fixed kernel:
# op returns, "SURVIVED" logged, guest stays up.
set -e
/root/rijnh "${1:-poison}"
echo "EXIT=$?"