DragonFlyBSD Kernel Audit
DF-0835 / patched_disasm.txt
← back to finding ↓ download raw
=== PATCHED smbfs_advlock disassembly (fix applied) ===
=== smbfs.ko built from /usr/src/sys/vfs/smbfs/ with fix.diff applied ===

--- smbfs_advlock full disassembly ---
Dump of assembler code for function smbfs_advlock:
   0x000000000000c4d0 <+0>:	push   %rbp
   0x000000000000c4d1 <+1>:	mov    %rsp,%rbp
   0x000000000000c4d4 <+4>:	push   %r15
   0x000000000000c4d6 <+6>:	push   %r14
   0x000000000000c4d8 <+8>:	push   %r13
   0x000000000000c4da <+10>:	push   %r12
   0x000000000000c4dc <+12>:	push   %rbx
   0x000000000000c4dd <+13>:	sub    $0x28,%rsp
   0x000000000000c4e1 <+17>:	mov    0x20(%rdi),%rax
   0x000000000000c4e5 <+21>:	mov    0x38(%rdi),%r14
   0x000000000000c4e9 <+25>:	mov    %gs:0x0,%rdx
   0x000000000000c4f2 <+34>:	cmpl   $0x2,0xe8(%rax)
   0x000000000000c4f9 <+41>:	je     0xc5c4 <smbfs_advlock+244>
   0x000000000000c4ff <+47>:	cmpw   $0x1,0x16(%r14)
   0x000000000000c505 <+53>:	ja     0xc567 <smbfs_advlock+151>
   0x000000000000c507 <+55>:	mov    (%r14),%r13
   0x000000000000c50a <+58>:	test   %r13,%r13
   0x000000000000c50d <+61>:	js     0xc567 <smbfs_advlock+151>
   0x000000000000c50f <+63>:	mov    0x8(%r14),%rsi
   0x000000000000c513 <+67>:	test   %rsi,%rsi
   0x000000000000c516 <+70>:	je     0xc580 <smbfs_advlock+176>
   0x000000000000c518 <+72>:	lea    -0x1(%rsi,%r13,1),%r12
   0x000000000000c51d <+77>:	cmp    %r12,%r13
   0x000000000000c520 <+80>:	jg     0xc567 <smbfs_advlock+151>
   0x000000000000c522 <+82>:	mov    0x8(%rdx),%rsi
   0x000000000000c526 <+86>:	mov    0xa8(%rsi),%rdx
   0x000000000000c52d <+93>:	test   %rdx,%rdx
   0x000000000000c530 <+96>:	je     0xc536 <smbfs_advlock+102>
   0x000000000000c532 <+98>:	mov    0x10(%rdx),%rdx
   0x000000000000c536 <+102>:	mov    0x128(%rax),%r15
   0x000000000000c53d <+109>:	mov    %rdi,%rbx
   0x000000000000c540 <+112>:	lea    -0x40(%rbp),%rdi
   0x000000000000c544 <+116>:	mov    0x48(%r15),%rax
   0x000000000000c548 <+120>:	mov    %rax,-0x48(%rbp)
   0x000000000000c54c <+124>:	callq  0xc551 <smbfs_advlock+129>
   0x000000000000c551 <+129>:	mov    0x30(%rbx),%eax
   0x000000000000c554 <+132>:	cmp    $0x7,%eax
   0x000000000000c557 <+135>:	je     0xc653 <smbfs_advlock+387>
   0x000000000000c55d <+141>:	cmp    $0x8,%eax
   0x000000000000c560 <+144>:	je     0xc5d0 <smbfs_advlock+256>
   0x000000000000c562 <+146>:	cmp    $0x2,%eax
   0x000000000000c565 <+149>:	je     0xc590 <smbfs_advlock+192>
   0x000000000000c567 <+151>:	mov    $0x16,%r8d
   0x000000000000c56d <+157>:	add    $0x28,%rsp
   0x000000000000c571 <+161>:	mov    %r8d,%eax
   0x000000000000c574 <+164>:	pop    %rbx
   0x000000000000c575 <+165>:	pop    %r12
   0x000000000000c577 <+167>:	pop    %r13
   0x000000000000c579 <+169>:	pop    %r14
   0x000000000000c57b <+171>:	pop    %r15
   0x000000000000c57d <+173>:	pop    %rbp
   0x000000000000c57e <+174>:	retq   
   0x000000000000c57f <+175>:	nop
   0x000000000000c580 <+176>:	mov    $0xffffffffffffffff,%r12
   0x000000000000c587 <+183>:	jmp    0xc522 <smbfs_advlock+82>
   0x000000000000c589 <+185>:	nopl   0x0(%rax)
   0x000000000000c590 <+192>:	mov    -0x48(%rbp),%rdx
   0x000000000000c594 <+196>:	lea    0x90(%r15),%rsi
   0x000000000000c59b <+203>:	mov    %rbx,%rdi
   0x000000000000c59e <+206>:	callq  0xc5a3 <smbfs_advlock+211>
   0x000000000000c5a3 <+211>:	mov    %r12,%r8
   0x000000000000c5a6 <+214>:	lea    -0x40(%rbp),%r9
   0x000000000000c5aa <+218>:	mov    %r13,%rcx
   0x000000000000c5ad <+221>:	mov    $0x1,%edx
   0x000000000000c5b2 <+226>:	mov    $0x2,%esi
   0x000000000000c5b7 <+231>:	mov    %r15,%rdi
   0x000000000000c5ba <+234>:	callq  0xc5bf <smbfs_advlock+239>
   0x000000000000c5bf <+239>:	mov    %eax,%r8d
   0x000000000000c5c2 <+242>:	jmp    0xc56d <smbfs_advlock+157>
   0x000000000000c5c4 <+244>:	mov    $0x2d,%r8d
   0x000000000000c5ca <+250>:	jmp    0xc56d <smbfs_advlock+157>
   0x000000000000c5cc <+252>:	nopl   0x0(%rax)
   0x000000000000c5d0 <+256>:	movzwl 0x14(%r14),%eax
   0x000000000000c5d5 <+261>:	sub    $0x1,%eax
   0x000000000000c5d8 <+264>:	cmp    $0x2,%ax
   0x000000000000c5dc <+268>:	ja     0xc567 <smbfs_advlock+151>
   0x000000000000c5de <+270>:	movzwl %ax,%eax
   0x000000000000c5e1 <+273>:	lea    0x90(%r15),%r14
   0x000000000000c5e8 <+280>:	mov    -0x48(%rbp),%rdx
   0x000000000000c5ec <+284>:	mov    %rbx,%rdi
   0x000000000000c5ef <+287>:	mov    0x0(,%rax,4),%eax
   0x000000000000c5f6 <+294>:	mov    %r14,%rsi
   0x000000000000c5f9 <+297>:	mov    %eax,-0x4c(%rbp)
   0x000000000000c5fc <+300>:	callq  0xc601 <smbfs_advlock+305>
   0x000000000000c601 <+305>:	mov    %eax,%r8d
   0x000000000000c604 <+308>:	test   %eax,%eax
   0x000000000000c606 <+310>:	jne    0xc56d <smbfs_advlock+157>
   0x000000000000c60c <+316>:	mov    -0x4c(%rbp),%esi
   0x000000000000c60f <+319>:	mov    %r12,%r8
   0x000000000000c612 <+322>:	lea    -0x40(%rbp),%r9
   0x000000000000c616 <+326>:	mov    %r13,%rcx
   0x000000000000c619 <+329>:	mov    $0x1,%edx
   0x000000000000c61e <+334>:	mov    %r15,%rdi
   0x000000000000c621 <+337>:	callq  0xc626 <smbfs_advlock+342>
   0x000000000000c626 <+342>:	mov    %eax,%r8d
   0x000000000000c629 <+345>:	test   %eax,%eax
   0x000000000000c62b <+347>:	je     0xc56d <smbfs_advlock+157>
   0x000000000000c631 <+353>:	mov    -0x48(%rbp),%rdx
   0x000000000000c635 <+357>:	mov    %r14,%rsi
   0x000000000000c638 <+360>:	mov    %rbx,%rdi
   0x000000000000c63b <+363>:	mov    %eax,-0x4c(%rbp)
   0x000000000000c63e <+366>:	movl   $0x2,0x30(%rbx)
   0x000000000000c645 <+373>:	callq  0xc64a <smbfs_advlock+378>
   0x000000000000c64a <+378>:	mov    -0x4c(%rbp),%r8d
   0x000000000000c64e <+382>:	jmpq   0xc56d <smbfs_advlock+157>
   0x000000000000c653 <+387>:	mov    -0x48(%rbp),%rdx
   0x000000000000c657 <+391>:	lea    0x90(%r15),%rsi
   0x000000000000c65e <+398>:	mov    %rbx,%rdi
   0x000000000000c661 <+401>:	callq  0xc666 <smbfs_advlock+406>
   0x000000000000c666 <+406>:	mov    %eax,%r8d
   0x000000000000c669 <+409>:	jmpq   0xc56d <smbfs_advlock+157>
End of assembler dump.

=== JUMP TABLE at .rodata+0x300 (switch on fl->l_type) ===
On DragonFlyBSD: F_RDLCK=1, F_UNLCK=2, F_WRLCK=3
Compiler computes (l_type-1) as jump table index:
  index 0 (F_RDLCK=1): table[0] = SMB_LOCK_SHARED   (1) -- shared/read  CORRECT
  index 1 (F_UNLCK=2): table[1] = SMB_LOCK_RELEASE  (2) -- unlock       CORRECT
  index 2 (F_WRLCK=3): table[2] = SMB_LOCK_EXCL     (0) -- exclusive    CORRECT

 0300 01000000 02000000 00000000 00000000  ................
 0e20 02000000 03000000 02000400 03000400  ................
 0e30 02000001 03000001 02000401 03000401  ................
 0ea0 02000008 03000008 02000408 03000408  ................
 0eb0 02000009 03000009 02000409 03000409  ................

=== KEY EVIDENCE: F_SETLK path now uses jump-table result for op ===
  0xc5ef <+287>: mov 0x0(,%rax,4),%eax   # lookup lkop from switch table
  0xc5f9 <+297>: mov %eax,-0x4c(%rbp)    # save lkop to stack
  ... lf_advlock call ...
  0xc60c <+316>: mov -0x4c(%rbp),%esi    # load lkop into op arg (NOT xor esi,esi!)

=== CONTRAST with BASELINE (unpatched): ===
  0xce5e <+318>: xor %esi,%esi           # op = 0 = SMB_LOCK_EXCL ALWAYS (bug)