From: Johann Höpfner <hoepf@cit.tum.de>
Subject: Re: sys/dev/ic/lpt.c: race condition, kernel heap leaked to line printer
To: Vitaliy Makkoveev <mvs@openbsd.org>
Cc: tech@openbsd.org
Date: Fri, 7 Aug 2026 11:34:54 +0200

On 26-07-08 13:55:15, Vitaliy Makkoveev wrote:
> Well, this is the final diff to fix this context switch fallout.
> 
> Index: sys/dev/ic/lpt.c
> ===================================================================
> RCS file: /cvs/src/sys/dev/ic/lpt.c,v
> retrieving revision 1.17
> diff -u -p -r1.17 lpt.c
> --- sys/dev/ic/lpt.c	25 Jun 2025 20:28:09 -0000	1.17
> +++ sys/dev/ic/lpt.c	8 Jul 2026 10:45:32 -0000
> @@ -206,7 +206,7 @@ lptopen(dev_t dev, int flag, int mode, s
>  	sc->sc_control = control;
>  	bus_space_write_1(sc->sc_iot, sc->sc_ioh, lpt_control, control);
>  
> -	sc->sc_inbuf = malloc(LPT_BSIZE, M_DEVBUF, M_WAITOK);
> +	sc->sc_inbuf = malloc(LPT_BSIZE, M_DEVBUF, M_WAITOK | M_ZERO);
>  	sc->sc_count = 0;
>  	sc->sc_state = LPT_OPEN;
>  
> @@ -309,6 +309,8 @@ lptpushbytes(struct lpt_softc *sc)
>  						error = EIO;
>  					if (error != EWOULDBLOCK)
>  						return error;
> +					if (sc->sc_count == 0)
> +						return 0;
>  				}
>  				break;
>  			}
> @@ -360,10 +362,10 @@ lptwrite(dev_t dev, struct uio *uio, int
>  	int error = 0;
>  
>  	while ((n = ulmin(LPT_BSIZE, uio->uio_resid)) != 0) {
> -		sc->sc_cp = sc->sc_inbuf;
> -		error = uiomove(sc->sc_cp, n, uio);
> +		error = uiomove(sc->sc_inbuf, n, uio);
>  		if (error != 0)
>  			return error;
> +		sc->sc_cp = sc->sc_inbuf;
>  		sc->sc_count = n;
>  		error = lptpushbytes(sc);
>  		if (error) {
> 

Sorry to bug you about this patch again. I have verified again, that the
patch fixes the bug in every case that I was able to test. Is there any
further blocking issue with this fix to merge it? Additionally as the
bug persists in NetBSD is there any common process to porting bugfixes
in inherited code like the lpt driver?