#!/bin/busybox sh
# XFS stats_clear teardown race: controlled window after free_percpu().
export PATH=/bin
/bin/busybox --install -s /bin 2>/dev/null

mount -t proc proc /proc
mount -t sysfs sysfs /sys
mkdir -p /dev/pts /tmp
mount -t devtmpfs devtmpfs /dev 2>/dev/null || true

STALL=${STALL:-800}
NWR=${NWR:-16}
DO_RMMOD=${DO_RMMOD:-1}
for arg in $(cat /proc/cmdline); do
	case "$arg" in
		nw=*) NWR=${arg#nw=} ;;
		rmmod=*) DO_RMMOD=${arg#rmmod=} ;;
	esac
done
log() { echo "XFSRACE-INIT: $*"; }

log "loading xfs.ko"
insmod /xfs.ko || { log "FATAL: insmod xfs failed"; dmesg | tail -20; poweroff -f; }
[ -e /proc/sys/fs/xfs/stats_clear ] || { log "FATAL: stats_clear missing"; poweroff -f; }

log "loading xfsrace.ko stall_ms=$STALL"
insmod /xfsrace.ko stall_ms=$STALL || { log "FATAL: insmod xfsrace failed"; dmesg | tail -20; poweroff -f; }
log "module list: $(grep -E "^(xfs|xfsrace) " /proc/modules | tr "\n" ";")"

log "starting $NWR writers"
i=0
while [ $i -lt $NWR ]; do
	( while true; do echo 1 > /proc/sys/fs/xfs/stats_clear 2>/dev/null; done ) &
	i=$((i+1))
done
sleep 2

if [ "$DO_RMMOD" = 1 ]; then
	log "rmmod xfs begins"
	rmmod xfs
	RC=$?
	log "rmmod status=$RC"
else
	log "rmmod skipped (control)"
	RC=na
fi
sleep 2

log "collecting"
dmesg | grep -E "XFSRACE|BUG: KASAN|BUG: KCSAN|Use-after-free|WARNING:|Oops|RIP:" | tail -200
HITS=$(dmesg | grep -c "UAF-WINDOW")
log "uaf_hits=$HITS"
log "PLAN-DONE"
sleep 1
poweroff -f
