DF-0847 — Global dquot hash/free-list manipulated with no lock

Finding: sys/vfs/ufs/ufs_quota.c — ufs_dqhashtbl / ufs_dqfreelist / ufs_numdquot are global across all mounts and mutated (hash lookup, recycle, insert, remove, free-list insert) without any token/mutex/spinlock in ufs_dqget(), ufs_dqrele(), and ufs_dqflush(). Two concurrent quota operations could corrupt the lists / double-unlink / UAF.

Severity filed: Medium (CWE-362 race condition).

Verification outcome

NOT REPRODUCED on the default kernel; confirmed real-but-latent source bug.

The cited unlocked manipulation is dead code on the stock X86_64_GENERIC kernel:

1. ufs_quotactl() early-returns EOPNOTSUPP unless the kernel was built with options QUOTA (sys/vfs/ufs/ufs_vfsops.c:77-78). X86_64_GENERIC does not set options QUOTA (0 occurrences — only VKERNEL64 and LINT64 carry it).
2. Every in-kernel caller of ufs_getinoquota()/ufs_chkdq()/ufs_chkiq()/ ufs_dqrele() — the only paths that reach ufs_dqget() — is wrapped in #ifdef QUOTA (ffs_alloc.c:110/131/150/217/303, ffs_inode.c:176/195/448, ffs_balloc.c:490, ufs_vnops.c:290/545/568/589/1285/..., ufs_inode.c:78/113/150). On a non-QUOTA kernel these are compiled out.

So ufs_dqget()/ufs_dqrele()/ufs_dqflush() are present in the binary (ufs_quota.c is optional ffs, per sys/conf/files:1994, not optional quota) but have zero callers — unreachable.

Runtime proof

quota_unreachable calls quotactl(Q_QUOTAON) on a UFS mount and prints:

quotactl(Q_QUOTAON, "/mnt/q", uid=0, "/mnt/q/quota.user") -> rc=-1 errno=45 (Operation not supported)
PATH DEAD: EOPNOTSUPP => ufs_quotactl() #ifndef-QUOTA early-return at
           sys/vfs/ufs/ufs_vfsops.c:77-78. `options QUOTA` is absent from
           X86_64_GENERIC, so every caller of ufs_dqget() is compiled out.
           => DF-0847 unreachable on this (default) kernel.

The source-level bug is REAL (latent)

Even though unreachable on the default kernel, the concurrency defect is genuine. Reading ufs_quota.c:

• ufs_dqget() (ufs_quota.c:769-866): LIST_FOREACH hash walk, TAILQ_REMOVE free-list dequeue (hit path :779 and recycle path :804), LIST_REMOVE hash removal (:806), LIST_INSERT_HEAD publish (:813) — no lock.
• ufs_dqrele() (ufs_quota.c:890): TAILQ_INSERT_TAIL free-list enqueue — no lock.
• ufs_dqflush() (ufs_quota.c:956-966): full hash-table sweep with LIST_REMOVE per matching entry — no lock.

The only serialization the original code has is vn_lock(dqvp) (:812), which is per quota-file vnode (per-mount-per-type) and is taken after the list mutation — it does nothing to protect the global lists against two CPUs on different mounts (or two missers on the same mount).

dq_race.c is a root-driven characterization harness (calls Q_GETQUOTA with cycling uids from N threads) used to exercise the race on a custom options QUOTA kernel. Note: even on an options QUOTA kernel, an unprivileged user can only trigger a cache-miss for their own uid (a single dquot via file create/write), giving a negligible race window; driving the race needs the privileged Q_GETQUOTA-for-arbitrary-uid path. So even where the code is live, unprivileged exploitation is not realistic.

How to reproduce (default-kernel reachability probe)

Root setup (once) — create a UFS mount with quota files:

ssh dfbsd                          # root
dd if=/dev/zero of=/root/q.img bs=1m count=64
vnconfig -c -s labels vn0 /root/q.img
newfs /dev/vn0s0
mkdir -p /mnt/q
mount -o userquota,groupquota /dev/vn0s0 /mnt/q
touch /mnt/q/quota.user /mnt/q/quota.group
chmod 1777 /mnt/q

Then as the unprivileged user:

ssh dfbsd-maxx                     # maxx (uid 1001)
cd poc/DF-0847 && ./build.sh && ./run.sh /mnt/q
# expect: errno=45 (EOPNOTSUPP)  => PATH DEAD

Fix

fix.diff adds a single lwkt_token ufs_dq_token (mirroring ext2_ihash_token in sys/vfs/ext2fs/ext2_ihash.c) and wraps every hash/free-list mutation in lwkt_gettoken/lwkt_reltoken. The token is held only across list manipulation and is released around sleeping calls (kmalloc(M_WAITOK), vn_lock, VOP_READ) so it cannot deadlock. This closes the race on any kernel that enables options QUOTA.

Files

DF-0847 — VERDICT

Status: NOT REPRODUCED on the default kernel. (Real-but-latent source-level concurrency defect; the cited code path is dead on X86_64_GENERIC.)

The claim

sys/vfs/ufs/ufs_quota.c: the global dquot hash table (ufs_dqhashtbl), free list (ufs_dqfreelist), and counter (ufs_numdquot) are mutated without any lock in ufs_dqget()/ufs_dqrele()/ufs_dqflush(). Concurrent quota operations could double-unlink / corrupt the lists → UAF / panic.

Why it does NOT reproduce on the default kernel

The unlocked manipulation is dead code on the stock X86_64_GENERIC kernel. Two compile-time gates close the path:

1. ufs_quotactl() early-returns EOPNOTSUPP unless options QUOTA is set (sys/vfs/ufs/ufs_vfsops.c:77-78): c ufs_quotactl(...) { #ifndef QUOTA return (EOPNOTSUPP); #else X86_64_GENERIC does not carry options QUOTA (0 occurrences — only VKERNEL64 and LINT64 do, per sys/config/). So quotaon always fails and ump->um_quotas[type] is never set.

2. Every in-kernel caller of ufs_dqget() is #ifdef QUOTA-gated, so the internal write()/creat()/chown() paths never reach it: - sys/vfs/ufs/ffs_alloc.c:110,131,150,217,303 (ufs_chkdq) - sys/vfs/ufs/ffs_inode.c:176,195,448 (ufs_chkdq/ufs_getinoquota) - sys/vfs/ufs/ffs_balloc.c:490 (ufs_chkdq) - sys/vfs/ufs/ufs_vnops.c:290,545,568,589,1285,1301,1319,1330,2027,... - sys/vfs/ufs/ufs_inode.c:78,113,150

Even a hypothetical direct caller would hit the guard inside ufs_dqget() itself (ufs_quota.c:762-765): dqvp = ump->um_quotas[type]; if (dqvp == NULLVP ...) return (EINVAL); — early-returns before any list mutation.

ufs_quota.c is compiled whenever FFS is (sys/conf/files:1994: vfs/ufs/ufs_quota.c optional ffs, not optional quota), so the functions exist in the binary (nm /boot/kernel/kernel shows ufs_dqget, ufs_dqrele, ufs_quotaon) — but with zero callers. Unreachable.

Runtime proof

quota_unreachable calls quotactl(Q_QUOTAON) on a UFS mount as the unprivileged maxx user:

quotactl(Q_QUOTAON, "/mnt/q", uid=0, "/mnt/q/quota.user") -> rc=-1 errno=45 (Operation not supported)
PATH DEAD: EOPNOTSUPP => ufs_quotactl() #ifndef-QUOTA early-return at
           sys/vfs/ufs/ufs_vfsops.c:77-78.

The source-level bug is REAL (latent)

Although unreachable on the default kernel, the concurrency defect is genuine and would be live on any kernel built with options QUOTA. Reading ufs_quota.c (master DEV, unpatched):

The only serialization is vn_lock(dqvp) (:812), which is per quota-file vnode and is acquired after the list mutation — it cannot protect the global lists against two CPUs on different mounts. This matches the ext2_ihash_token / msdosfs / nfs analogue in the tree, all of which use an lwkt_token to guard their global hash tables — ufs_quota.c is the odd one out with no token at all.

Characterization on an options QUOTA kernel (non-default config)

To prove the bug isn't theoretical, a kernel was built with options QUOTA added to X86_64_GENERIC. On it, quotaon succeeds and ufs_dqget() becomes reachable. dq_race.c (root-driven, N threads calling Q_GETQUOTA with cycling uids → repeated cache-miss recycle + free-list races) was used to exercise the unlocked lists.

Note on unprivileged reachability: even with options QUOTA, an unprivileged user can only trigger a dquot cache-miss for their own uid (via file create/write — a single dquot), giving a negligible race window. Driving the race requires the privileged Q_GETQUOTA-for-arbitrary-uid path (caps_priv_check RESTRICTEDROOT, ufs_vfsops.c:123). So the realistic unprivileged impact ceiling is negligible; the bug is a privileged-DoS / latent corruption on a non-default config.

This characterization is labelled non-default config per the audit's bright-line rule and does not affect the default-kernel verdict.

Exploit-chain / escalation assessment

No escalation chain was developed, because:

• On the default kernel the primitive is unreachable (dead code) — there is nothing to escalate. This is a valid hard blocker (the cited vulnerable code path is dead at runtime on the default kernel AND on the default config).
• On an options QUOTA kernel the primitive is a concurrent-list- corruption race whose unprivileged reachability is negligible (single own-uid cache entry). Realistically it is a privileged-DoS, not an unprivileged privesc. Spending 15–30 grooming attempts would not change the unprivileged-reachability verdict, which is the gating property.

Honest impact: none on the default kernel; latent concurrency defect (privileged-DoS ceiling) on a non-default options QUOTA kernel.

PoC changes

The finding shipped with no on-disk PoC folder (findings/poc/DF-0847/ did not exist). I authored the full evidence pack:

• quota_unreachable.c — default-kernel reachability probe (the PoC).
• dq_race.c — root-driven race characterization harness for the options QUOTA kernel.
• build.sh / run.sh — exact build/run.
• fix.diff — the lwkt_token fix.

Fix

fix.diff adds static struct lwkt_token ufs_dq_token (mirroring ext2_ihash_token in sys/vfs/ext2fs/ext2_ihash.c) and wraps every hash / free-list mutation in ufs_dqget/ufs_dqrele/ufs_dqflush in lwkt_gettoken/lwkt_reltoken. The token is held only across list manipulation and is explicitly released around sleeping calls (kmalloc(M_WAITOK), vn_lock, VOP_READ) so it cannot deadlock or serialize I/O. It compiles cleanly and git apply --check passes against the audit tree.

This supersedes the finding's one-line proposal ("lwkt_token around all hash/free-list mutations, I/O outside token") by implementing exactly that with correct token-scope boundaries around the two sleeping call sites in ufs_dqget.

Fix validation

fix_status: not_testable. The race-triggering PoC cannot run on the default guest because the path is latent (options QUOTA off). I validated that fix.diff (a) git apply --check passes against the read-only sys/ tree, (b) compiles into a kernel (built alongside the options QUOTA characterization kernel — no new warnings/errors), and (c) by source tracing closes every cited unlocked mutation site. On the default kernel the path is dead both before and after the fix, so there is no runtime before/after to observe.

Kernel references (confirmed during verification)

• sys/vfs/ufs/ufs_quota.c:731-732 — global free list + counter, no lock
• sys/vfs/ufs/ufs_quota.c:769-866 — ufs_dqget, all mutations unlocked
• sys/vfs/ufs/ufs_quota.c:890 — ufs_dqrele free-list enqueue unlocked
• sys/vfs/ufs/ufs_quota.c:956-966 — ufs_dqflush hash sweep unlocked
• sys/vfs/ufs/ufs_vfsops.c:77-78 — ufs_quotactl #ifndef QUOTA return EOPNOTSUPP
• sys/config/X86_64_GENERIC — no options QUOTA
• sys/conf/files:1994 — ufs_quota.c is optional ffs (compiled) not optional quota
• sys/vfs/ufs/ffs_alloc.c:110 (and siblings) — #ifdef QUOTA caller gate
• sys/vfs/ext2fs/ext2_ihash.c:67 — the lwkt_token analogue the fix mirrors