DF-4536 — lptopen() sc_state check-then-set TOCTOU (latent: blocked by the mplock in the current configuration)

File: sys/dev/misc/lpt/lpt.c:458-462 (pass 2)

if (sc->sc_state) {
        return(EBUSY);
} else
        sc->sc_state |= LPTINIT;

No lock, no atomic: two concurrent lptopen() calls that both read sc_state == 0 both proceed — double kmalloc(BUFSIZE) + kmalloc(BUFSTATSIZE) (the first pair leaks), and the two later closes kfree() the same (second) buffer pair twice → heap double-free in the private M_LPT zone.

Runtime status on this tree: BLOCKED (why the PoC cannot hit)

lpt's dev_ops head flags are 0 (lpt.c:191-198), so dev_needmplock() (sys/kern/kern_device.c:119-122) is true and dev_dopen() wraps d_open in get_mplock()/rel_mplock() (sys/kern/kern_device.c:142-156): all lpt cdev operations execute under Giant, fully serializing the check-then-set. (On top of that, same-vnode opens also pass through devfs's exclusive vnode section, sys/vfs/devfs/devfs_vnops.c devfs_spec_open.)

PoC lpt_openrace raced:

• /dev/lpt0 vs /dev/lpt0 — 300 rounds (full open path, fds held 300 ms so sequential double-success is impossible): 0 hits;
• /dev/lpt0 vs /dev/lpt0.ctl (different cdevs/vnodes, shared softc): 300 rounds, 0 hits;
• /dev/lpt0.ctl vs /mnt/df2/lpt0.ctl (two devfs mounts → two vnodes, no shared vnode lock): ~3,600 effective rounds, 0 hits — the mplock is the remaining serializer, and it is airtight for same-driver d_open entries.

(An early ".ctl vs .ctl same vnode" run printed many double-successes; those were sequential pairs — sibling's open after the holder's close — not races; the fd-hold fix in the PoC removes that false signal, after which all variants score 0.)

Why it is still filed (Info)

The driver-level TOCTOU is real source code; the serialization is incidental (a global side effect of not being D_MPSAFE). Any future conversion of lpt to D_MPSAFE (the direction DFly pushes all drivers) makes the window live with a double-free consequence. fix.diff adds the missing per-unit serialization now.

Reproduce (attempts)

cc -O -Wall -o lpt_openrace lpt_openrace.c
mount -t devfs devfs /mnt/df2
./lpt_openrace /dev/lpt0 /dev/lpt0 300 350          # full path
./lpt_openrace /dev/lpt0 /dev/lpt0.ctl 300 450      # mixed
./lpt_openrace /dev/lpt0.ctl /mnt/df2/lpt0.ctl 30000 3 25000

Expected on a hypothetical MPSAFE build: [+] HIT ... BOTH opens returned 0 followed (full path) by the double-free on the two closes and eventual heap corruption in the M_LPT zone. On this tree: zero hits everywhere (mplock).

DF-4536 — VERDICT

Status: not_reproduced — the driver-level TOCTOU exists (sys/dev/misc/lpt/lpt.c:458-462, unsynchronized check-then-set), but on this tree it cannot manifest: every lpt cdev operation runs under the kernel mplock because lpt's dev_ops head flags are 0 (lpt.c:191-198) → dev_needmplock() true (sys/kern/kern_device.c:119) → dev_dopen() wraps d_open in Giant (sys/kern/kern_device.c:142). Two concurrent lptopen() entries are impossible as configured, so the double-kmalloc/double-kfree consequence is unreachable today. Filed at Info as a latent defect: converting lpt to D_MPSAFE without first adding per-unit serialization re-opens the window with a heap double-free payoff.

Attempts (guest, root, fd-hold detection so sequential pairs cannot false-positive)

The last configuration removes both the shared vnode lock and any same-cdev devfs serialization; only the mplock remains — proving the mplock is the operative serializer.

Note on methodology: an early run without the fd-hold printed many "both opens returned 0" — these were sequential (sibling opened after the first closed, state already cleared), not races. The released PoC holds each fd 300 ms (configurable), making sequential double-success impossible; with that fix all configurations score 0.

Fix

fix.diff: per-unit spinlock sc_openlk in struct lpt_data; serialize the open state transition and the close-time buffer frees (+ NULL-ing). git-apply-clean against the tree. Runtime fix validation not applicable (nothing to observe on a non-manifesting bug).

Kernel references

• sys/dev/misc/lpt/lpt.c:458-462 (unsynchronized check-then-set)
• sys/dev/misc/lpt/lpt.c:538-541 (second open's kmallocs overwrite sc_inbuf)
• sys/dev/misc/lpt/lpt.c:598-599 (both closes kfree the same pointer)
• sys/dev/misc/lpt/lpt.c:191-198 (dev_ops flags 0)
• sys/kern/kern_device.c:119-122 (dev_needmplock)
• sys/kern/kern_device.c:142-156 (dev_dopen mplock wrap)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.