#!/bin/sh
# DF-2640 variant U: rm of /pub/<80*'p'> whose long-named DIRENT bref has
# data_off=0 (name lives in the dirent data block -> chain->data->buf deref).
# Run as the unprivileged user 'nobody' (pub is mode 777).
# NOTE: no `ls` in here -- readdir's frontend (hammer2_vop_readdir,
# vnops.c:727 gdata) also derefs the NULL data; the rm path must be the
# FIRST touch so the crash lands in hammer2_chain_dirent_test via
# hammer2_xop_nresolve (xops.c:282).
LOG=/root/poc/df2640/run_U.log
exec > $LOG 2>&1
set -x
uname -a
vnconfig -u vn0 2>/dev/null || true
vnconfig -c vn0 /root/poc/df2640/U.img
mkdir -p /mnt/h2
mount -t hammer2 /dev/vn0@testvol /mnt/h2
echo MOUNT_RC=$?
id nobody
LN1=$(printf '%.0sp' $(seq 1 80))
su -m nobody -c "rm '/mnt/h2/pub/$LN1'"
echo RM_RC=$?
echo U_DONE