DF-4807 — ppiwrite() ignores the uiomove() return value: stale ppi_buffer bytes are handed to byte_peripheral_write() and a fully-faulting write never terminates (DF-4535 lpt twin, 1284-peripheral side)

File: sys/dev/misc/ppi/ppi.c line 478 (pass 2)

    /* negotiation done, write bytes to master host */
    while ((len = (int)szmin(uio->uio_resid, BUFSIZE)) != 0) {
        uiomove(ppi->ppi_buffer, (size_t)len, uio);     /* rc DROPPED */
        if ((error = byte_peripheral_write(ppbus,
                        ppi->ppi_buffer, len, &sent)))
            goto error;
    }

This is the exact DF-4535 shape (lpt.c:763, runtime-verified): a faulting user buffer leaves the tail of the 512-byte kernel ppi_buffer stale (previous write's data; probe-time zeros on first use), and byte_peripheral_write transmits the full len bytes to the IEEE1284 master host. A fully-faulting uiomove (0 bytes copied) leaves uio_resid unchanged, so the loop re-sends the stale chunk forever — though unlike lpt's polled mode, this loop's exits are the wire handshake timeouts in byte_peripheral_write (ppb_poll_bus PPB_FOREVER waits on the remote master, PCATCH-interruptible) rather than an unkillable Giant-held livelock.

Reproduce boundary (honest status: not_reproduced for the leak facet)

The transmit loop (ppi.c:477) is only reachable after the local host enters IEEE1284 peripheral mode — PPB_PERIPHERAL_IDLE — which requires a remote master host to complete the 1284 negotiation handshake (ppi.c:450-471). The QEMU guest's parallel port is an SPP-style emulation with no 1284 master peer, so on this guest:

• write() demonstrably enters the path and blocks in the negotiation wait: process state S3, wchan ppiwrite (tsleep ppi.c:459, PCATCH), SIGKILL terminates it (run.log).
• The stale-byte transmission itself needs physical peer hardware.

What IS proven beyond the source line:

• the module binary drops the check — objdump -dr (ppiwrite.dis): callq uiomove at 0x58e/0x59e, return in %eax never tested, the very next call is byte_peripheral_write at 0x5a0 whose return IS tested (test %eax,%eax; jne at 0x5a8);
• the identical code shape was runtime-verified for lpt (DF-4535: 133,120 stale bytes strobed out the port in IRQ mode on this same guest).

Build / run (root, ppi.ko with PERIPH_1284 loaded)

cc -O -Wall -o ppiwrite_uio ppiwrite_uio.c
./ppiwrite_uio &      # blocks in the 1284 negotiation wait
ps ax -o pid,stat,wchan,comm | grep ppiw
kill -9 <pid>         # PCATCH: terminated

Impact

Low: device node 0600 root:wheel + options PERIPH_1284 (LINT64-only) + a physical 1284 master peer. Stale kernel-buffer bytes (not kernel heap at large — ppi_buffer is only ever filled by uiomove/ppb_1284_read) leave the machine over the parallel cable; a faulting write spins the retransmit loop (bounded by wire timeouts, killable). Defense-in-depth: check uiomove and bail.

DF-4807 — VERDICT

Status: not_reproduced (the stale-byte transmission facet is hardware-gated on this guest: it requires an IEEE1284 master peer to complete the peripheral-side negotiation before ppiwrite's data loop is reachable). reproduced=0, impact=none as demonstrable on this guest; the code defect is certain, and its runtime consequence is proven by the line-identical, runtime-verified twin DF-4535 (lpt).

Root cause (path:line)

sys/dev/misc/ppi/ppi.c:478 — uiomove(ppi->ppi_buffer, len, uio); return value discarded; byte_peripheral_write(ppbus, ppi->ppi_buffer, len, &sent) (ppi.c:479-480) transmits len bytes regardless of how many uiomove actually copied. On EFAULT: stale ppi_buffer content (prior write's bytes) is transmitted to the 1284 master; if uiomove copies 0 bytes, uio_resid never shrinks and the loop re-sends the stale chunk indefinitely (bounded only by the wire handshake timeouts / PCATCH). Same defect class as DF-4535 (sys/dev/misc/lpt/lpt.c:763, reproduced live: 133,120 stale bytes out the port).

What was verified live (ppi.ko built with PERIPH_1284, pristine

sources, guest 6.5-DEVELOPMENT X86_64_GENERIC, ppc0 0x378 irq7)

1. Path entry + block: write(fd, faulting_buf, 8192) blocks in the kernel at ppi.c:459 — ps: S3 wchan=ppiwrite; SIGKILL terminates (PCATCH sleep, unlike lpt's polled-mode unkillable loop). The data loop at ppi.c:477 requires PPB_PERIPHERAL_IDLE, which requires a remote 1284 master host — absent on QEMU (SPP emulation only).
2. Binary proof of the dropped check (ppiwrite.dis, objdump -dr of the loaded module): 58e: callq ... R_X86_64_PLT32 uiomove-0x4 593: mov %r15,%rsi <- no test of %eax (uiomove rc) ... 5a0: callq ... R_X86_64_PLT32 byte_peripheral_write-0x4 5a5: mov %eax,%r15d 5a8: test %eax,%eax <- THIS rc is checked
3. Sibling verification cross-reference: DF-4535 evidence pack (same guest, same port) demonstrates the identical dropped-uiomove shape transmitting stale kernel bytes out the parallel port in lpt.

Exploit chain

None. Privileged-only (0600 root:wheel), PERIPH_1284-gated, peer-hardware-gated; impact ceiling is stale-buffer disclosure over the parallel cable plus a killable retransmit spin. Fix is defensive.

Fix (not hardware-validated on this guest — trivial check-and-bail)

    while ((len = (int)szmin(uio->uio_resid, BUFSIZE)) != 0) {
-       uiomove(ppi->ppi_buffer, (size_t)len, uio);
+       if ((error = uiomove(ppi->ppi_buffer, (size_t)len, uio)))
+           goto error;
        if ((error = byte_peripheral_write(ppbus,
                        ppi->ppi_buffer, len, &sent)))
            goto error;

(Validating this end-to-end requires a 1284 master peer; the fix is the same check-and-bail validated for DF-4535.)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)