/*
 * DF-2680 PoC step 2: plain process that catches SIGIO.  It never opens
 * /dev/devctl.  If the freed victim's struct proc chunk is recycled for
 * this process, the kernel's stale devsoftc.async_proc dereference
 * delivers SIGIO here -> GOT_SIGIO is written.
 */
#include <signal.h>
#include <stdio.h>
#include <unistd.h>

static void
handler(int sig)
{
	FILE *f = fopen("/tmp/df2680/got_sigio.txt", "a");
	if (f) {
		fprintf(f, "GOT_SIGIO pid=%d (never opened devctl)\n",
		    getpid());
		fclose(f);
	}
	_exit(0);
}

int
main(void)
{
	struct sigaction sa;

	sa.sa_handler = handler;
	sigemptyset(&sa.sa_mask);
	sa.sa_flags = 0;
	sigaction(SIGIO, &sa, NULL);
	printf("catcher: pid=%d waiting\n", getpid());
	fflush(stdout);
	pause();
	return (0);
}