=== PATCHED smbfs_advlock disassembly (fix applied) === === smbfs.ko built from /usr/src/sys/vfs/smbfs/ with fix.diff applied === --- smbfs_advlock full disassembly --- Dump of assembler code for function smbfs_advlock: 0x000000000000c4d0 <+0>: push %rbp 0x000000000000c4d1 <+1>: mov %rsp,%rbp 0x000000000000c4d4 <+4>: push %r15 0x000000000000c4d6 <+6>: push %r14 0x000000000000c4d8 <+8>: push %r13 0x000000000000c4da <+10>: push %r12 0x000000000000c4dc <+12>: push %rbx 0x000000000000c4dd <+13>: sub $0x28,%rsp 0x000000000000c4e1 <+17>: mov 0x20(%rdi),%rax 0x000000000000c4e5 <+21>: mov 0x38(%rdi),%r14 0x000000000000c4e9 <+25>: mov %gs:0x0,%rdx 0x000000000000c4f2 <+34>: cmpl $0x2,0xe8(%rax) 0x000000000000c4f9 <+41>: je 0xc5c4 0x000000000000c4ff <+47>: cmpw $0x1,0x16(%r14) 0x000000000000c505 <+53>: ja 0xc567 0x000000000000c507 <+55>: mov (%r14),%r13 0x000000000000c50a <+58>: test %r13,%r13 0x000000000000c50d <+61>: js 0xc567 0x000000000000c50f <+63>: mov 0x8(%r14),%rsi 0x000000000000c513 <+67>: test %rsi,%rsi 0x000000000000c516 <+70>: je 0xc580 0x000000000000c518 <+72>: lea -0x1(%rsi,%r13,1),%r12 0x000000000000c51d <+77>: cmp %r12,%r13 0x000000000000c520 <+80>: jg 0xc567 0x000000000000c522 <+82>: mov 0x8(%rdx),%rsi 0x000000000000c526 <+86>: mov 0xa8(%rsi),%rdx 0x000000000000c52d <+93>: test %rdx,%rdx 0x000000000000c530 <+96>: je 0xc536 0x000000000000c532 <+98>: mov 0x10(%rdx),%rdx 0x000000000000c536 <+102>: mov 0x128(%rax),%r15 0x000000000000c53d <+109>: mov %rdi,%rbx 0x000000000000c540 <+112>: lea -0x40(%rbp),%rdi 0x000000000000c544 <+116>: mov 0x48(%r15),%rax 0x000000000000c548 <+120>: mov %rax,-0x48(%rbp) 0x000000000000c54c <+124>: callq 0xc551 0x000000000000c551 <+129>: mov 0x30(%rbx),%eax 0x000000000000c554 <+132>: cmp $0x7,%eax 0x000000000000c557 <+135>: je 0xc653 0x000000000000c55d <+141>: cmp $0x8,%eax 0x000000000000c560 <+144>: je 0xc5d0 0x000000000000c562 <+146>: cmp $0x2,%eax 0x000000000000c565 <+149>: je 0xc590 0x000000000000c567 <+151>: mov $0x16,%r8d 0x000000000000c56d <+157>: add $0x28,%rsp 0x000000000000c571 <+161>: mov %r8d,%eax 0x000000000000c574 <+164>: pop %rbx 0x000000000000c575 <+165>: pop %r12 0x000000000000c577 <+167>: pop %r13 0x000000000000c579 <+169>: pop %r14 0x000000000000c57b <+171>: pop %r15 0x000000000000c57d <+173>: pop %rbp 0x000000000000c57e <+174>: retq 0x000000000000c57f <+175>: nop 0x000000000000c580 <+176>: mov $0xffffffffffffffff,%r12 0x000000000000c587 <+183>: jmp 0xc522 0x000000000000c589 <+185>: nopl 0x0(%rax) 0x000000000000c590 <+192>: mov -0x48(%rbp),%rdx 0x000000000000c594 <+196>: lea 0x90(%r15),%rsi 0x000000000000c59b <+203>: mov %rbx,%rdi 0x000000000000c59e <+206>: callq 0xc5a3 0x000000000000c5a3 <+211>: mov %r12,%r8 0x000000000000c5a6 <+214>: lea -0x40(%rbp),%r9 0x000000000000c5aa <+218>: mov %r13,%rcx 0x000000000000c5ad <+221>: mov $0x1,%edx 0x000000000000c5b2 <+226>: mov $0x2,%esi 0x000000000000c5b7 <+231>: mov %r15,%rdi 0x000000000000c5ba <+234>: callq 0xc5bf 0x000000000000c5bf <+239>: mov %eax,%r8d 0x000000000000c5c2 <+242>: jmp 0xc56d 0x000000000000c5c4 <+244>: mov $0x2d,%r8d 0x000000000000c5ca <+250>: jmp 0xc56d 0x000000000000c5cc <+252>: nopl 0x0(%rax) 0x000000000000c5d0 <+256>: movzwl 0x14(%r14),%eax 0x000000000000c5d5 <+261>: sub $0x1,%eax 0x000000000000c5d8 <+264>: cmp $0x2,%ax 0x000000000000c5dc <+268>: ja 0xc567 0x000000000000c5de <+270>: movzwl %ax,%eax 0x000000000000c5e1 <+273>: lea 0x90(%r15),%r14 0x000000000000c5e8 <+280>: mov -0x48(%rbp),%rdx 0x000000000000c5ec <+284>: mov %rbx,%rdi 0x000000000000c5ef <+287>: mov 0x0(,%rax,4),%eax 0x000000000000c5f6 <+294>: mov %r14,%rsi 0x000000000000c5f9 <+297>: mov %eax,-0x4c(%rbp) 0x000000000000c5fc <+300>: callq 0xc601 0x000000000000c601 <+305>: mov %eax,%r8d 0x000000000000c604 <+308>: test %eax,%eax 0x000000000000c606 <+310>: jne 0xc56d 0x000000000000c60c <+316>: mov -0x4c(%rbp),%esi 0x000000000000c60f <+319>: mov %r12,%r8 0x000000000000c612 <+322>: lea -0x40(%rbp),%r9 0x000000000000c616 <+326>: mov %r13,%rcx 0x000000000000c619 <+329>: mov $0x1,%edx 0x000000000000c61e <+334>: mov %r15,%rdi 0x000000000000c621 <+337>: callq 0xc626 0x000000000000c626 <+342>: mov %eax,%r8d 0x000000000000c629 <+345>: test %eax,%eax 0x000000000000c62b <+347>: je 0xc56d 0x000000000000c631 <+353>: mov -0x48(%rbp),%rdx 0x000000000000c635 <+357>: mov %r14,%rsi 0x000000000000c638 <+360>: mov %rbx,%rdi 0x000000000000c63b <+363>: mov %eax,-0x4c(%rbp) 0x000000000000c63e <+366>: movl $0x2,0x30(%rbx) 0x000000000000c645 <+373>: callq 0xc64a 0x000000000000c64a <+378>: mov -0x4c(%rbp),%r8d 0x000000000000c64e <+382>: jmpq 0xc56d 0x000000000000c653 <+387>: mov -0x48(%rbp),%rdx 0x000000000000c657 <+391>: lea 0x90(%r15),%rsi 0x000000000000c65e <+398>: mov %rbx,%rdi 0x000000000000c661 <+401>: callq 0xc666 0x000000000000c666 <+406>: mov %eax,%r8d 0x000000000000c669 <+409>: jmpq 0xc56d End of assembler dump. === JUMP TABLE at .rodata+0x300 (switch on fl->l_type) === On DragonFlyBSD: F_RDLCK=1, F_UNLCK=2, F_WRLCK=3 Compiler computes (l_type-1) as jump table index: index 0 (F_RDLCK=1): table[0] = SMB_LOCK_SHARED (1) -- shared/read CORRECT index 1 (F_UNLCK=2): table[1] = SMB_LOCK_RELEASE (2) -- unlock CORRECT index 2 (F_WRLCK=3): table[2] = SMB_LOCK_EXCL (0) -- exclusive CORRECT 0300 01000000 02000000 00000000 00000000 ................ 0e20 02000000 03000000 02000400 03000400 ................ 0e30 02000001 03000001 02000401 03000401 ................ 0ea0 02000008 03000008 02000408 03000408 ................ 0eb0 02000009 03000009 02000409 03000409 ................ === KEY EVIDENCE: F_SETLK path now uses jump-table result for op === 0xc5ef <+287>: mov 0x0(,%rax,4),%eax # lookup lkop from switch table 0xc5f9 <+297>: mov %eax,-0x4c(%rbp) # save lkop to stack ... lf_advlock call ... 0xc60c <+316>: mov -0x4c(%rbp),%esi # load lkop into op arg (NOT xor esi,esi!) === CONTRAST with BASELINE (unpatched): === 0xce5e <+318>: xor %esi,%esi # op = 0 = SMB_LOCK_EXCL ALWAYS (bug)