--- a/sys/dev/misc/lpt/lpt.c +++ b/sys/dev/misc/lpt/lpt.c @@ -760,7 +760,13 @@ lptwrite(struct dev_write_args *ap) sc->sc_state &= ~INTERRUPTED; while ((n = (unsigned)szmin(BUFSIZE, uio->uio_resid)) != 0) { sc->sc_cp = sc->sc_inbuf; - uiomove(sc->sc_cp, (size_t)n, uio); + if ((err = uiomove(sc->sc_cp, (size_t)n, uio)) != 0) { + /* do not transmit the stale contents of sc_inbuf + * beyond what was actually copied, and do not + * loop forever on a persistently faulting buffer */ + sc->sc_xfercnt = 0; + return (err); + } sc->sc_xfercnt = n; if (sc->sc_irq & LP_ENABLE_EXT) {