DF-4535 — lptwrite() ignores uiomove() failure: stale-kernel-heap transmission + unkillable livelock (system-wide DoS in polled mode)

File: sys/dev/misc/lpt/lpt.c lines 761-764 (pass 2)

while ((n = (unsigned)szmin(BUFSIZE, uio->uio_resid)) != 0) {
        sc->sc_cp = sc->sc_inbuf;
        uiomove(sc->sc_cp, (size_t)n, uio);      /* return value DROPPED */
        sc->sc_xfercnt = n;

uiomove() copies at most n bytes and returns EFAULT when the user buffer faults. lptwrite() ignores the error and sets sc_xfercnt = n regardless, so the driver:

1. transmits bytes beyond what was copied — the remainder of the 1024-byte kernel buffer sc_inbuf (stale content of the previous write; uninitialized slab memory on first use) is strobed out the parallel data port (kernel heap -> physical port info leak), and
2. never terminates when the fault persists: the next loop iteration calls uiomove() at the faulting address again, copies 0 bytes, uio_resid never shrinks, and the loop spins forever, each pass re-transmitting the full stale 1024-byte chunk.

In polled mode the inner sleep (lpt_pushbytes, lpt.c:657) has no PCATCH, and the whole d_write runs under the kernel mplock (lpt's dev_ops flags = 0, so dev_needmplock() is true, sys/kern/kern_device.c:119-122): the livelocked write sleeps holding Giant, starving every non-MPSAFE path in the kernel — on the test guest this killed the ability to establish new ssh sessions (system-wide denial of service).

Reproduce (as root on the guest, lpt0 attached)

Build:

cc -O -Wall -o lpt_uioleak lpt_uioleak.c

Run (IRQ-driven port — default when the parallel port has an IRQ):

./lpt_uioleak 10

Polled variant (unkillable + mplock starvation):

./polled_switch      # ioctl(LPT_IRQ, 0) on /dev/lpt0.ctl; next open is polled
./lpt_uioleak 10     # then: kill -9 does NOT work; new ssh logins fail

Expected / observed (baseline, unpatched lpt.ko)

• IRQ mode: write() never returns; process state R4 (kernel); kill -9 is required and works (PCATCH at lpt.c:796). Host-side port capture (QEMU -parallel chardev:file): after the 4096 valid 'B' bytes, 130+ extra 1024-byte blocks of stale buffer content (133,120 bytes, all 0x42) — see leak_sample_irq.bin (offsets 4117..141333 after the 21-byte smoke write; analysis in run.log).
• Polled mode: same, plus kill -9 cannot terminate the writer and the system stops accepting new ssh sessions ("Connection timed out during banner exchange"); 2,183,288 stale bytes captured before the guest was force-reset (leak_sample_polled_head64k.bin, bootlog-wedge-tail.txt).

Fix validation (fix.diff applied to guest /usr/src, lpt.ko rebuilt)

• ./lpt_uioleak 10 → phase-2 write() returns -1/EFAULT after ~1 s.
• Port capture delta = exactly 8192 bytes = 'A'4096 + 'B'4096 — zero stale bytes (fix_capture_patched.bin).
• Normal write still works ("NORMAL-WRITE-STILL-OK" captured).

Environment

DragonFly 6.5-DEVELOPMENT X86_64_GENERIC #0 Thu Jul 2 06:02:54 UTC 2026, QEMU/KVM x86_64, 6 vCPU, isa-parallel (0x378, irq 7) with -chardev file backend; kernel modules ppbus.ko/lpt.ko/ppc.ko built from the guest's /usr/src/sys (see env.txt).

DF-4535 — VERDICT

Status: reproduced (impact: dos; leak facet proven; severity Low — device node is 0600 root:wheel, so reaching lptwrite requires root or equivalent on the node).

Root cause (path:line)

sys/dev/misc/lpt/lpt.c:763 — the return value of uiomove() is discarded; sc->sc_xfercnt = n (lpt.c:764) is set unconditionally. On a faulting user buffer, uiomove copies 0 (or a partial prefix), and lptwrite:

• transmits the full n bytes from sc_inbuf — bytes beyond what was copied are stale heap content from the previous write (proven) or uninitialized slab memory (first use after open);
• loops forever because uio_resid never decreases once uiomove copies 0 bytes: n = szmin(BUFSIZE, uio->uio_resid) (lpt.c:761) stays non-zero.

Amplifier: lpt's dev_ops has flags 0 (lpt.c:191-198), so dev_needmplock() (sys/kern/kern_device.c:119) is true and all d_write/d_read/d_open/d_close run under the mplock (sys/kern/ kern_device.c:142-156). In polled mode lpt_pushbytes sleeps with Giant held (tsleep flags=0, lpt.c:657) — the livelocked syscall starves every non-MPSAFE kernel path.

How it was reproduced

Guest: DragonFly 6.5-DEVELOPMENT, X86_64_GENERIC kernel + module build of ppbus/ppc/lpt from the same tree (GENERIC does not compile lpt in). QEMU -chardev file,id=par0,... -parallel chardev:par0 gives a PC-style LPT at 0x378 irq 7 whose SW emulation (QEMU hw/char/parallel.c) asserts the "printer ready" status pattern after an INIT-low control write — lptopen succeeds and strobed data bytes land verbatim in the host-side file = a perfect wiretap of the port.

Run 1 (IRQ mode, baseline module):

$ ./lpt_uioleak 10
[*] opened /dev/lpt0 (irq mode)
[*] phase1: wrote 4096 'A' bytes (kernel buffer now 'A')
[*] phase2: write(fd, 8192) with PROT_NONE guard page at 4096
[*] expecting syscall to NEVER return; will be killed after 10s

Process observed in state R4 (kernel) after 8 s; SIGKILL required. Port capture (host /proc//fd/11): 21-byte smoke write, then 'A'4096, 'B'4096 (valid), then 133,120 bytes of stale content (130 x 1024-byte blocks, all 0x42) — the buffer content from the last successfully copied chunk, re-transmitted continuously until the kill. Analysis transcript in run.log; raw bytes in leak_sample_irq.bin.

Run 2 (polled mode via ioctl(LPT_IRQ, 0) + reopen, baseline module):

kernel: lpt0: switched to polled standard mode

After ~90 s the guest stopped accepting ssh connections ("Connection timed out during banner exchange" — TCP accepted, sshd child starved); the console showed no panic. 2,183,288 stale bytes were strobed out before the wedge completed. kill -9 had been sent 8 s in and was ignored (no PCATCH on the polled path). Guest had to be force-reset. Evidence: bootlog-wedge-tail.txt, first 64 KB of the polled capture in leak_sample_polled_head64k.bin.

Exploit chain

Not a corruption primitive. As shipped, the node is 0600 root:wheel, so this is a root-triggerable robustness/DoS/leak defect, not an unprivileged escalation. Impact if the node permissions are relaxed (printer spoolers, lp groups): unkillable process + kernel mplock starvation (system-wide DoS in polled mode) and an unbounded kernel heap -> physical-port leak channel.

Fix validation (mandatory-class: leak/DoS with reproduced behavior)

fix.diff (also applied to the guest's /usr/src copy — never to the audit tree): check uiomove and bail out with the error.

• Baseline re-produced before the fix (Run 1/Run 2 above).
• Patched lpt.ko: write() returns -1/EFAULT after ~1 s; port capture delta exactly 8192 bytes = 'A'4096 + 'B'4096, ZERO stale bytes (fix_capture_patched.bin); a normal printf > /dev/lpt0 write still works ("NORMAL-WRITE-STILL-OK" on the wire).
• fix_status: fixed.

Kernel references

• sys/dev/misc/lpt/lpt.c:761-764 (bug: uiomove ignored)
• sys/dev/misc/lpt/lpt.c:657 (polled sleep without PCATCH)
• sys/dev/misc/lpt/lpt.c:191-198 (dev_ops flags 0 -> mplock held)
• sys/kern/kern_device.c:119-156 (dev_needmplock / dev_dopen mplock wrap)
• sys/kern/sys_generic.c:530-675 (write syscall -> devfs -> d_write)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.