DF-0143 — nlookupdata leaked on nlookup failure (missing nlookup_done)

Verdict: REPRODUCED (unbounded kernel memory leak, DoS)

The missing nlookup_done() on the nlookup() failure path is confirmed live: each failed vquotactl on a nonexistent path leaks one MAXPATHLEN M_NAMEI buffer (and a namecache reference). 20000 calls leaked ~19.5 MB. An unprivileged user controls the path and can repeat indefinitely.

The bug (sys/kern/vfs_quota.c:351-359)

error = nlookup_init(&nd, path, UIO_USERSPACE, 0);   /* 351: kmalloc nl_path */
if (error)
    return (error);
error = nlookup(&nd);                                /* 354 */
if (error)
    return (error);                                  /* 355-356: BUG — no nlookup_done */
nch = nd.nl_nch;
cache_zero(&nd.nl_nch);
nlookup_done(&nd);                                   /* 359: only on SUCCESS */

nlookup_init (vfs_nlookup.c:131) allocates nd->nl_path from the namei_oc objcache (backed by M_NAMEI, MAXPATHLEN=1024, vfs_init.c:207) and takes a namecache reference (cache_copy, :150/160/171). nlookup_done releases both. On the nlookup() failure path the function returns at line 355 without nlookup_done, leaking nl_path + the namecache ref.

Evidence (live, unprivileged maxx, vfs.quota_enabled=1)

vquotactl('/tmp/df0143_does_not_exist_<pid>') x 20000  -> errno ENOENT each
BEFORE: nameibufs   17   (0M)        vfs.cache.numcache 865
AFTER : nameibufs   19.5K (19.5M)    vfs.cache.numcache 886

Per-call leak ≈ 1 nameibuf (1024 B). 20000 × 1024 ≈ 19.5 MB of M_NAMEI slab permanently leaked. The returned errno=ENOENT confirms the call reaches the nlookup() failure path (line 354) — exactly the buggy return.

Exploit chain

none (resource-leak DoS, no memory-corruption primitive) — the leaked objects are namei path buffers + namecache refs; they are not attacker-shapeable into a write/UAF. The realistic impact ceiling is unbounded kernel memory growth → exhaustion / OOM, triggerable by an unprivileged user (no privilege check in sys_vquotactl).

Fix

fix.diff adds nlookup_done(&nd) before the error return at line 355. git apply --check passes.

Fix validation

See Phase 8 — the single-fix kernel shows nameibufs staying flat across the same 20000-call workload (no leak).