From: Johann Höpfner <hoepf@cit.tum.de>
Subject: Re: sys/dev/ic/lpt.c: race condition, kernel heap leaked to line printer
To: Vitaliy Makkoveev <mvs@openbsd.org>
Cc: tech@openbsd.org
Date: Tue, 7 Jul 2026 14:05:12 +0200

On 26-07-07 09:51:33, Vitaliy Makkoveev wrote:
> Hello Johann,
> 
> It seems we only need to check sc->sc_count against 0 after the sleep.
> Otherwise the following "sc->sc_count--" produces integer overflow.
> 
> Does the diff below help?
> 
> Index: sys/dev/ic/lpt.c
> ===================================================================
> RCS file: /cvs/src/sys/dev/ic/lpt.c,v
> diff -u -p -r1.17 lpt.c
> --- sys/dev/ic/lpt.c	25 Jun 2025 20:28:09 -0000	1.17
> +++ sys/dev/ic/lpt.c	7 Jul 2026 09:44:31 -0000
> @@ -309,6 +309,8 @@ lptpushbytes(struct lpt_softc *sc)
>  						error = EIO;
>  					if (error != EWOULDBLOCK)
>  						return error;
> +					if (sc->sc_count == 0)
> +						return 0;
>  				}
>  				break;
>  			}

Hello Vitaliy.

I think this is unrelated. The original info leak was unaffected by
your patch, when I tested it again.

The race condition, as I understand it, is caused by sc_count being 
effectively increased by one thread entering lptwrite while a second 
thread is already executing lptpushbytes, now reading a wrong count of
bytes left to be sent to the device (from sc->sc_count).