DF-0835 / patched_disasm.txt
=== PATCHED smbfs_advlock disassembly (fix applied) === === smbfs.ko built from /usr/src/sys/vfs/smbfs/ with fix.diff applied === --- smbfs_advlock full disassembly --- Dump of assembler code for function smbfs_advlock: 0x000000000000c4d0 <+0>: push %rbp 0x000000000000c4d1 <+1>: mov %rsp,%rbp 0x000000000000c4d4 <+4>: push %r15 0x000000000000c4d6 <+6>: push %r14 0x000000000000c4d8 <+8>: push %r13 0x000000000000c4da <+10>: push %r12 0x000000000000c4dc <+12>: push %rbx 0x000000000000c4dd <+13>: sub $0x28,%rsp 0x000000000000c4e1 <+17>: mov 0x20(%rdi),%rax 0x000000000000c4e5 <+21>: mov 0x38(%rdi),%r14 0x000000000000c4e9 <+25>: mov %gs:0x0,%rdx 0x000000000000c4f2 <+34>: cmpl $0x2,0xe8(%rax) 0x000000000000c4f9 <+41>: je 0xc5c4 <smbfs_advlock+244> 0x000000000000c4ff <+47>: cmpw $0x1,0x16(%r14) 0x000000000000c505 <+53>: ja 0xc567 <smbfs_advlock+151> 0x000000000000c507 <+55>: mov (%r14),%r13 0x000000000000c50a <+58>: test %r13,%r13 0x000000000000c50d <+61>: js 0xc567 <smbfs_advlock+151> 0x000000000000c50f <+63>: mov 0x8(%r14),%rsi 0x000000000000c513 <+67>: test %rsi,%rsi 0x000000000000c516 <+70>: je 0xc580 <smbfs_advlock+176> 0x000000000000c518 <+72>: lea -0x1(%rsi,%r13,1),%r12 0x000000000000c51d <+77>: cmp %r12,%r13 0x000000000000c520 <+80>: jg 0xc567 <smbfs_advlock+151> 0x000000000000c522 <+82>: mov 0x8(%rdx),%rsi 0x000000000000c526 <+86>: mov 0xa8(%rsi),%rdx 0x000000000000c52d <+93>: test %rdx,%rdx 0x000000000000c530 <+96>: je 0xc536 <smbfs_advlock+102> 0x000000000000c532 <+98>: mov 0x10(%rdx),%rdx 0x000000000000c536 <+102>: mov 0x128(%rax),%r15 0x000000000000c53d <+109>: mov %rdi,%rbx 0x000000000000c540 <+112>: lea -0x40(%rbp),%rdi 0x000000000000c544 <+116>: mov 0x48(%r15),%rax 0x000000000000c548 <+120>: mov %rax,-0x48(%rbp) 0x000000000000c54c <+124>: callq 0xc551 <smbfs_advlock+129> 0x000000000000c551 <+129>: mov 0x30(%rbx),%eax 0x000000000000c554 <+132>: cmp $0x7,%eax 0x000000000000c557 <+135>: je 0xc653 <smbfs_advlock+387> 0x000000000000c55d <+141>: cmp $0x8,%eax 0x000000000000c560 <+144>: je 0xc5d0 <smbfs_advlock+256> 0x000000000000c562 <+146>: cmp $0x2,%eax 0x000000000000c565 <+149>: je 0xc590 <smbfs_advlock+192> 0x000000000000c567 <+151>: mov $0x16,%r8d 0x000000000000c56d <+157>: add $0x28,%rsp 0x000000000000c571 <+161>: mov %r8d,%eax 0x000000000000c574 <+164>: pop %rbx 0x000000000000c575 <+165>: pop %r12 0x000000000000c577 <+167>: pop %r13 0x000000000000c579 <+169>: pop %r14 0x000000000000c57b <+171>: pop %r15 0x000000000000c57d <+173>: pop %rbp 0x000000000000c57e <+174>: retq 0x000000000000c57f <+175>: nop 0x000000000000c580 <+176>: mov $0xffffffffffffffff,%r12 0x000000000000c587 <+183>: jmp 0xc522 <smbfs_advlock+82> 0x000000000000c589 <+185>: nopl 0x0(%rax) 0x000000000000c590 <+192>: mov -0x48(%rbp),%rdx 0x000000000000c594 <+196>: lea 0x90(%r15),%rsi 0x000000000000c59b <+203>: mov %rbx,%rdi 0x000000000000c59e <+206>: callq 0xc5a3 <smbfs_advlock+211> 0x000000000000c5a3 <+211>: mov %r12,%r8 0x000000000000c5a6 <+214>: lea -0x40(%rbp),%r9 0x000000000000c5aa <+218>: mov %r13,%rcx 0x000000000000c5ad <+221>: mov $0x1,%edx 0x000000000000c5b2 <+226>: mov $0x2,%esi 0x000000000000c5b7 <+231>: mov %r15,%rdi 0x000000000000c5ba <+234>: callq 0xc5bf <smbfs_advlock+239> 0x000000000000c5bf <+239>: mov %eax,%r8d 0x000000000000c5c2 <+242>: jmp 0xc56d <smbfs_advlock+157> 0x000000000000c5c4 <+244>: mov $0x2d,%r8d 0x000000000000c5ca <+250>: jmp 0xc56d <smbfs_advlock+157> 0x000000000000c5cc <+252>: nopl 0x0(%rax) 0x000000000000c5d0 <+256>: movzwl 0x14(%r14),%eax 0x000000000000c5d5 <+261>: sub $0x1,%eax 0x000000000000c5d8 <+264>: cmp $0x2,%ax 0x000000000000c5dc <+268>: ja 0xc567 <smbfs_advlock+151> 0x000000000000c5de <+270>: movzwl %ax,%eax 0x000000000000c5e1 <+273>: lea 0x90(%r15),%r14 0x000000000000c5e8 <+280>: mov -0x48(%rbp),%rdx 0x000000000000c5ec <+284>: mov %rbx,%rdi 0x000000000000c5ef <+287>: mov 0x0(,%rax,4),%eax 0x000000000000c5f6 <+294>: mov %r14,%rsi 0x000000000000c5f9 <+297>: mov %eax,-0x4c(%rbp) 0x000000000000c5fc <+300>: callq 0xc601 <smbfs_advlock+305> 0x000000000000c601 <+305>: mov %eax,%r8d 0x000000000000c604 <+308>: test %eax,%eax 0x000000000000c606 <+310>: jne 0xc56d <smbfs_advlock+157> 0x000000000000c60c <+316>: mov -0x4c(%rbp),%esi 0x000000000000c60f <+319>: mov %r12,%r8 0x000000000000c612 <+322>: lea -0x40(%rbp),%r9 0x000000000000c616 <+326>: mov %r13,%rcx 0x000000000000c619 <+329>: mov $0x1,%edx 0x000000000000c61e <+334>: mov %r15,%rdi 0x000000000000c621 <+337>: callq 0xc626 <smbfs_advlock+342> 0x000000000000c626 <+342>: mov %eax,%r8d 0x000000000000c629 <+345>: test %eax,%eax 0x000000000000c62b <+347>: je 0xc56d <smbfs_advlock+157> 0x000000000000c631 <+353>: mov -0x48(%rbp),%rdx 0x000000000000c635 <+357>: mov %r14,%rsi 0x000000000000c638 <+360>: mov %rbx,%rdi 0x000000000000c63b <+363>: mov %eax,-0x4c(%rbp) 0x000000000000c63e <+366>: movl $0x2,0x30(%rbx) 0x000000000000c645 <+373>: callq 0xc64a <smbfs_advlock+378> 0x000000000000c64a <+378>: mov -0x4c(%rbp),%r8d 0x000000000000c64e <+382>: jmpq 0xc56d <smbfs_advlock+157> 0x000000000000c653 <+387>: mov -0x48(%rbp),%rdx 0x000000000000c657 <+391>: lea 0x90(%r15),%rsi 0x000000000000c65e <+398>: mov %rbx,%rdi 0x000000000000c661 <+401>: callq 0xc666 <smbfs_advlock+406> 0x000000000000c666 <+406>: mov %eax,%r8d 0x000000000000c669 <+409>: jmpq 0xc56d <smbfs_advlock+157> End of assembler dump. === JUMP TABLE at .rodata+0x300 (switch on fl->l_type) === On DragonFlyBSD: F_RDLCK=1, F_UNLCK=2, F_WRLCK=3 Compiler computes (l_type-1) as jump table index: index 0 (F_RDLCK=1): table[0] = SMB_LOCK_SHARED (1) -- shared/read CORRECT index 1 (F_UNLCK=2): table[1] = SMB_LOCK_RELEASE (2) -- unlock CORRECT index 2 (F_WRLCK=3): table[2] = SMB_LOCK_EXCL (0) -- exclusive CORRECT 0300 01000000 02000000 00000000 00000000 ................ 0e20 02000000 03000000 02000400 03000400 ................ 0e30 02000001 03000001 02000401 03000401 ................ 0ea0 02000008 03000008 02000408 03000408 ................ 0eb0 02000009 03000009 02000409 03000409 ................ === KEY EVIDENCE: F_SETLK path now uses jump-table result for op === 0xc5ef <+287>: mov 0x0(,%rax,4),%eax # lookup lkop from switch table 0xc5f9 <+297>: mov %eax,-0x4c(%rbp) # save lkop to stack ... lf_advlock call ... 0xc60c <+316>: mov -0x4c(%rbp),%esi # load lkop into op arg (NOT xor esi,esi!) === CONTRAST with BASELINE (unpatched): === 0xce5e <+318>: xor %esi,%esi # op = 0 = SMB_LOCK_EXCL ALWAYS (bug)