DF-0835 / baseline_disasm.txt
=== BASELINE (UNPATCHED #0 kernel): smbfs_advlock disassembly === === smbfs.ko from /boot/kernel/ (shipping, bug present) === --- smbfs_advlock full disassembly --- Dump of assembler code for function smbfs_advlock: 0x000000000000cd20 <+0>: push %rbp 0x000000000000cd21 <+1>: mov %rsp,%rbp 0x000000000000cd24 <+4>: push %r15 0x000000000000cd26 <+6>: push %r14 0x000000000000cd28 <+8>: push %r13 0x000000000000cd2a <+10>: push %r12 0x000000000000cd2c <+12>: push %rbx 0x000000000000cd2d <+13>: sub $0x28,%rsp 0x000000000000cd31 <+17>: mov 0x20(%rdi),%rax 0x000000000000cd35 <+21>: mov 0x38(%rdi),%r12 0x000000000000cd39 <+25>: mov %gs:0x0,%rdx 0x000000000000cd42 <+34>: cmpl $0x2,0xe8(%rax) 0x000000000000cd49 <+41>: je 0xce13 <smbfs_advlock+243> 0x000000000000cd4f <+47>: cmpw $0x1,0x16(%r12) 0x000000000000cd56 <+54>: ja 0xcdba <smbfs_advlock+154> 0x000000000000cd58 <+56>: mov (%r12),%r14 0x000000000000cd5c <+60>: test %r14,%r14 0x000000000000cd5f <+63>: js 0xcdba <smbfs_advlock+154> 0x000000000000cd61 <+65>: mov 0x8(%r12),%rcx 0x000000000000cd66 <+70>: test %rcx,%rcx 0x000000000000cd69 <+73>: je 0xcdd0 <smbfs_advlock+176> 0x000000000000cd6b <+75>: lea -0x1(%rcx,%r14,1),%r13 0x000000000000cd70 <+80>: cmp %r13,%r14 0x000000000000cd73 <+83>: jg 0xcdba <smbfs_advlock+154> 0x000000000000cd75 <+85>: mov 0x8(%rdx),%rsi 0x000000000000cd79 <+89>: mov 0xa8(%rsi),%rdx 0x000000000000cd80 <+96>: test %rdx,%rdx 0x000000000000cd83 <+99>: je 0xcd89 <smbfs_advlock+105> 0x000000000000cd85 <+101>: mov 0x10(%rdx),%rdx 0x000000000000cd89 <+105>: mov 0x128(%rax),%r15 0x000000000000cd90 <+112>: mov %rdi,%rbx 0x000000000000cd93 <+115>: lea -0x40(%rbp),%rdi 0x000000000000cd97 <+119>: mov 0x48(%r15),%rax 0x000000000000cd9b <+123>: mov %rax,-0x48(%rbp) 0x000000000000cd9f <+127>: callq 0xcda4 <smbfs_advlock+132> 0x000000000000cda4 <+132>: mov 0x30(%rbx),%eax 0x000000000000cda7 <+135>: cmp $0x7,%eax 0x000000000000cdaa <+138>: je 0xce93 <smbfs_advlock+371> 0x000000000000cdb0 <+144>: cmp $0x8,%eax 0x000000000000cdb3 <+147>: je 0xce20 <smbfs_advlock+256> 0x000000000000cdb5 <+149>: cmp $0x2,%eax 0x000000000000cdb8 <+152>: je 0xcde0 <smbfs_advlock+192> 0x000000000000cdba <+154>: mov $0x16,%ecx 0x000000000000cdbf <+159>: add $0x28,%rsp 0x000000000000cdc3 <+163>: mov %ecx,%eax 0x000000000000cdc5 <+165>: pop %rbx 0x000000000000cdc6 <+166>: pop %r12 0x000000000000cdc8 <+168>: pop %r13 0x000000000000cdca <+170>: pop %r14 0x000000000000cdcc <+172>: pop %r15 0x000000000000cdce <+174>: pop %rbp 0x000000000000cdcf <+175>: retq 0x000000000000cdd0 <+176>: mov $0xffffffffffffffff,%r13 0x000000000000cdd7 <+183>: jmp 0xcd75 <smbfs_advlock+85> 0x000000000000cdd9 <+185>: nopl 0x0(%rax) 0x000000000000cde0 <+192>: mov -0x48(%rbp),%rdx 0x000000000000cde4 <+196>: lea 0x90(%r15),%rsi 0x000000000000cdeb <+203>: mov %rbx,%rdi 0x000000000000cdee <+206>: callq 0xcdf3 <smbfs_advlock+211> 0x000000000000cdf3 <+211>: mov %r14,%rcx 0x000000000000cdf6 <+214>: lea -0x40(%rbp),%r9 0x000000000000cdfa <+218>: mov %r13,%r8 0x000000000000cdfd <+221>: mov $0x1,%edx 0x000000000000ce02 <+226>: mov $0x2,%esi 0x000000000000ce07 <+231>: mov %r15,%rdi 0x000000000000ce0a <+234>: callq 0xce0f <smbfs_advlock+239> 0x000000000000ce0f <+239>: mov %eax,%ecx 0x000000000000ce11 <+241>: jmp 0xcdbf <smbfs_advlock+159> 0x000000000000ce13 <+243>: mov $0x2d,%ecx 0x000000000000ce18 <+248>: jmp 0xcdbf <smbfs_advlock+159> 0x000000000000ce1a <+250>: nopw 0x0(%rax,%rax,1) 0x000000000000ce20 <+256>: movzwl 0x14(%r12),%eax 0x000000000000ce26 <+262>: sub $0x1,%eax 0x000000000000ce29 <+265>: cmp $0x2,%ax 0x000000000000ce2d <+269>: ja 0xcdba <smbfs_advlock+154> 0x000000000000ce2f <+271>: lea 0x90(%r15),%r12 0x000000000000ce36 <+278>: mov -0x48(%rbp),%rdx 0x000000000000ce3a <+282>: mov %rbx,%rdi 0x000000000000ce3d <+285>: mov %r12,%rsi 0x000000000000ce40 <+288>: callq 0xce45 <smbfs_advlock+293> 0x000000000000ce45 <+293>: mov %eax,%ecx 0x000000000000ce47 <+295>: test %eax,%eax 0x000000000000ce49 <+297>: jne 0xcdbf <smbfs_advlock+159> 0x000000000000ce4f <+303>: mov %r14,%rcx 0x000000000000ce52 <+306>: lea -0x40(%rbp),%r9 0x000000000000ce56 <+310>: mov %r13,%r8 0x000000000000ce59 <+313>: mov $0x1,%edx 0x000000000000ce5e <+318>: xor %esi,%esi 0x000000000000ce60 <+320>: mov %r15,%rdi 0x000000000000ce63 <+323>: callq 0xce68 <smbfs_advlock+328> 0x000000000000ce68 <+328>: mov %eax,%ecx 0x000000000000ce6a <+330>: test %eax,%eax 0x000000000000ce6c <+332>: je 0xcdbf <smbfs_advlock+159> 0x000000000000ce72 <+338>: mov -0x48(%rbp),%rdx 0x000000000000ce76 <+342>: mov %r12,%rsi 0x000000000000ce79 <+345>: mov %rbx,%rdi 0x000000000000ce7c <+348>: mov %eax,-0x4c(%rbp) 0x000000000000ce7f <+351>: movl $0x2,0x30(%rbx) 0x000000000000ce86 <+358>: callq 0xce8b <smbfs_advlock+363> 0x000000000000ce8b <+363>: mov -0x4c(%rbp),%ecx 0x000000000000ce8e <+366>: jmpq 0xcdbf <smbfs_advlock+159> 0x000000000000ce93 <+371>: mov -0x48(%rbp),%rdx 0x000000000000ce97 <+375>: lea 0x90(%r15),%rsi 0x000000000000ce9e <+382>: mov %rbx,%rdi 0x000000000000cea1 <+385>: callq 0xcea6 <smbfs_advlock+390> 0x000000000000cea6 <+390>: mov %eax,%ecx 0x000000000000cea8 <+392>: jmpq 0xcdbf <smbfs_advlock+159> End of assembler dump. --- KEY EVIDENCE: F_SETLK path calls smbfs_smb_lock with op=0 (xor esi,esi = SMB_LOCK_EXCL) --- --- Contrast: F_UNLCK path uses op=2 (mov /bin/shx2,%esi = SMB_LOCK_RELEASE) --- --- smbfs_smb_lock symbol (the callee) --- 000000000000eb50 T smbfs_smb_lock 000000000000e8f0 t smbfs_smb_lockandx