# Attachments index

Files in this directory support reproducing
`linux-2026-002-dm-setup-md-queue-uaf`.

## Pipeline (validated)

Kernel build runs **inside the container at `docker run` time**, not during
`docker build`. Result is cached as `artifacts/bzImage`.

```bash
docker build -t dm-setup-md-queue-uaf -f Dockerfile .
mkdir -p artifacts
docker run --rm --privileged --device=/dev/kvm --network=host \
  -v "$PWD/artifacts:/artifacts" \
  -e OUTPUT_DIR=/artifacts \
  dm-setup-md-queue-uaf
```

Optional: mount a prebuilt `bzImage` with `-e KERNEL_IMAGE=/kernel/bzImage` to
skip `build-kernel.sh`.

| File | Description |
|------|-------------|
| `Dockerfile` | Ubuntu 24.04 repro host (QEMU, mmdebstrap, kernel *build deps*) |
| `repro.sh` | End-to-end: build-kernel → guest image → `run.sh` |
| `build-kernel.sh` | Download + build KASAN Linux 6.6.144 → `artifacts/bzImage` |
| `create-image-userns.sh` | Build Debian guest disk + SSH keys (no loop/`mknod`) |
| `run.sh` | Boot QEMU KASAN guest and run `poc.c` over SSH |
| `poc.c` | Minimized C reproducer |
| `stacktrace.txt` | Full KASAN stack from reproduction |

`--privileged` is required for `mmdebstrap --mode=root`. KVM (`--device=/dev/kvm`)
is strongly recommended. Artifacts (kernel, image, keys, logs) land in
`artifacts/` (gitignored).

Note: `run.sh` omits `panic_on_warn` — a related `bd_*_disk_holder` WARNING
often fires before the KASAN UAF and would abort the guest early.
