DF-0145 — vq_done stub leaks all quota RB-trees on unmount

Verdict: REPRODUCED (unbounded kernel memory leak, DoS)

The empty vq_done() stub is confirmed live: every ac_unode/ac_gnode kmalloc'd during accounting survives unmount, growing kernel memory without bound on repeated mount/populate/unmount cycles. Triggerable by an unprivileged user for the populate step (vquotactl "set limit uid" has no privilege check in sys_vquotactl); the mount/unmount requires privilege or vfs.usermount.

The bug (sys/kern/vfs_quota.c:142-146)

void
vq_done(struct mount *mp)
{
    /* TODO: remove the rb trees here */
}

On mount, VFS_ACINIT (sys/kern/vfs_vfsops.c:112) → vfs_stdac_init → vq_init initializes mp->mnt_acct.ac_uroot/ac_groot (RB trees) and enables accounting. Accounting population (vfs_stdaccount, cmd_set_limit_uid → unode_insert/gnode_insert at :89/:103) does kmalloc(sizeof(struct ac_unode|ac_gnode), M_MOUNT, ...). On unmount, VFS_ACDONE (vfs_vfsops.c:131) → vfs_stdac_done → vq_done is the empty stub, so none of those nodes are freed.

Evidence (live, as root on vfs.quota_enabled=1 guest)

mount-count BEFORE:        218
mounted tmpfs on /mnt/df0145 (vq_init ran)
populated 500/500 uid chunks (each -> unode_insert kmalloc M_MOUNT)
mount-count AFTER populate: 718      (+500 allocations)
unmounted (VFS_ACDONE -> vq_done stub ran)
mount-count AFTER unmount: 717      (only the tmpfs mount struct freed; 499 ac_unode LEAKED)

The leak is cumulative across cycles: baseline 218 → 1017 after a few mount/populate/unmount rounds. Each ac_unode is ~540 B (slab bucket 1024); hundreds of cycles exhaust kernel memory. The RB-tree nodes hold uid/gid accounting and are referenced only by the per-mount tree root, which vq_done was supposed to drain.

Exploit chain

none (memory-corruption-class chain N/A) — this is a resource-leak DoS, not a write/UAF primitive. An unprivileged user populates the trees (via vquotactl "set limit uid"/"set usage all", which lack any priv_check), and when the mount is torn down (by the owner/admin) the nodes leak permanently. Realistic impact ceiling: unbounded kernel memory growth → eventual kmem_slab_alloc exhaustion / OOM / panic (same failure mode DF-0144 hits).

Fix

fix.diff implements vq_done to drain and kfree both RB trees (guarded by vfs_quota_enabled, matching vq_init). git apply --check passes.

Fix validation

See Phase 8 below — the single-fix kernel (all three vfs_quota.c fixes applied) shows the mount-count dropping back to baseline after unmount (nodes freed).