kern/60760: lpt(4) concurrency issues

["campbell+netbsd%mumble.net@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60760
>Category:       kern
>Synopsis:       lpt(4) concurrency issues
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Sep 21 22:15:00 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, ...
>Organization:
Acme BSD Line Printers, Inc.
>Environment:
>Description:

	lpt(4) is a small but grody legacy driver that is not MP-safe.
	Not being MP-safe would be fine, but it's also buggy even in
	the giant-locked model of kernel computation:

	1. Access to variables like sc->sc_state and sc->sc_count is
	   done from both thread context, e.g. in
	   lptopen/lptclose/lptwrite, and in interrupt context, in
	   lptintr, which runs in various platforms at IPL_TTY.

	   But this access is not protected with spltty.  So the
	   interrupt handler might screw up the thread logic.

	2. Nothing prevents concurrent writes from being issued,
	   interleaving their results, and likely overrunning kernel
	   buffers.  Reported by Johann Höpfner on tech-kern:
	   https://mail-index.NetBSD.org/tech-kern/2026/09/16/msg031252.html

>How-To-Repeat:

	code inspection

>Fix:

	Ideally we would rewrite this driver to be MP-safe, but I have
	no idea how to test it seriously, so I'm inclined to apply
	minimal changes to (a) sprinkle spltty and (b) serialize
	lptwrite calls with tsleep and a lock flag.